GPT XP Lispro

Data Privacy Notice

Purpose of Notice

The purpose of this Data Privacy Notice (the "Notice") is to explain how GPT XP Lispro ("GPT XP Lispro" or "We" or "Us") will process, as data controller, your personal data you provide Us when you visit the website altrix-edge.mytestdoain.com (the "Website"), or that We receive from third parties, in order to put you in contact with professionals you might be interested in.

What categories of personal data will be processed?

We collect and process the following categories of personal data about you:

Category of personal data	Definition
Identification Data	Full name and contact information (telephone number and email address).
Browsing Information	IP address, time of access, date of access, web and mobile page(s) visited, language used, software crash reports and type of browser used, information regarding the device you used, your online actions collected automatically, such as cookies, web servers, pixels and web beacons..

How is your data collected?

We will collect your personal data:

• Directly from you, when you provide your Identification Data on our Website; and/or
• Indirectly:
  • when we receive Identification Data about you from third parties (including from investment education firms, partners / affiliates / marketers / digital agencies); and/or
  • when we collect data related to your browsing of our Website through the use of cookies or similar technologies (as defined in the Cookies Policy).

You are not obligated to provide Us with your personal data. However, not providing your personal data will prevent Us from putting you in contact with professionals you might be interested in.

What are the purposes and legal basis of Our processing?

We process your personal data for the following purposes:

Purpose	Legal basis	Categories of personal data processed
Sharing your personal data with professionals who offer services you might be interested in	Your consent	Identification Data
Responding to and complying with requests and legal demands from regulators or other authorities in or outside of your home country.	Complying with applicable legal and regulatory requirements.	Identification Data Browsing Information
Enforcing and defending our rights	Our legitimate interest to defend Ourselves vis-à-vis our users (including you), judicial, administrative and/or law enforcement authorities.	Identification Data Browsing Information
Ensuring the operation of Our Website and its security	Our legitimate interest in ensuring a well-functioning and secure Website.	Browsing Information

Who will my personal data be shared with?

We will share your personal data:

• Within Our group;
• With Our partners, for their own processing purposes, including to provide you with information on their services and/product in which you might be interested in, provided you gave your prior consent for such sharing. Such partners include investment education firms, data brokers and intermediaries;
• With third parties that provide Us services such as storage and hosting providers analytical, technical, and diagnostic services;
• With Our counsels, notably for compliance with Our statutory obligations, in particular in terms of accounting, auditing and internal control;
• As part of the sale of all or part of Our company and its assets to a third party or as part of a business reorganization or restructuring (including dissolution or liquidation); and
• Where required or permitted by applicable law, to governmental authorities, courts, external advisors, and similar third parties.

Cross-border data transfers

We transfer your personal data outside of the European Economic Area (“EEA”). Some recipients are located in countries for which the European Commission has issued adequacy decisions, namely to Israel. The transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective (Art. 45 GDPR).

Some recipients of your personal data could be located in another country for which the European Commission has not issued a decision that this country ensures an adequate level of data protection.

By way of entering into appropriate data transfer agreements based on standard contractual clauses (2021/914/EU) as referred to in Art. 46 (2) (c) GDPR or other adequate means, which are accessible via the contact details below we have established that all other recipients located outside the EEA will provide an adequate level of data protection for the personal data and that appropriate technical and organizational security measures are in place to protect personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including our affiliates outside the EEA) is subject to appropriate onward transfer requirements as required by applicable law.

Retention

We will only store collected personal data for as long as strictly necessary to achieve the purposes of processing referred to in this Notice and in accordance with applicable data privacy law. When We no longer needs to use your personal data, it will be deleted and/or anonymized so that individuals can no longer be identified from it (save to the extent retention is required to comply with legal or regulatory obligations or for taking or defending legal claims).

Your rights

Under applicable data privacy law, you have the following rights:

1. Right of access: You have the right to obtain from Us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.

   You have the right to obtain a copy of the personal data undergoing processing. For additional copies requested by you, we may charge a reasonable fee based on administrative costs.

2. Right to rectification: You have the right to obtain from Us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Right to erasure (right to be forgotten): You have the right to ask Us to erase your personal data.

4. Right to restriction of processing: You have the right to request the restriction of processing your personal data. In this case, the respective data will be marked and may only be processed by Us for certain purposes.

5. Right to data portability: You have the right to receive the personal data concerning you which you have provided to Us in a structured, commonly used and machine-readable format and you have the right to transmit those Personal Data to another entity without hindrance from us.

6. Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by us and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. Exercising this right will not incur any costs. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

7. Right to withdraw your consent: Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Such a right to withdraw your consent does not affect the lawfulness of the processing based on your consent you have previously given us, prior to the withdrawal.

8. Right to your data after your death: You have the right to give instructions related to the retention, erasure and communication of the personal data concerning you after your death.

Please note that these rights might be limited under the applicable local data privacy law.

If you wish to exercise any of these rights, please contact us as stated in the Contact us section below.

You also have the right to lodge a complaint with the French competent data privacy supervisory authority, which is the CNIL.

Contact us

Individuals who have any questions about this Notice should contact

Changes of the Privacy Notice

This Privacy Notice is subject to change. You will be notified adequately of any such changes.

Last updated: 07.05.2025