This privacy policy (hereinafter „Policy“) defines and informs users of the WALLIX website (hereinafter the „User(s)“) of the conditions of collection, use and protection by WALLIX of personal data (hereinafter the „Personal Data“), from the WALLIX website wallix.com (hereinafter the „Website“), as well as their rights related to the use of such Personal Data.

This Policy may be modified or supplemented at any time by WALLIX, in particular in order to comply with any new law, new regulation, or technological evolution. In such a case, the date of its update will be clearly mentioned at the top of this Policy. These modifications bind any User of the Website as soon as they are published on the Website. The User should therefore regularly consult this Policy in order to be aware of any changes.

PERSONAL DATA

WALLIX undertakes to ensure that the collection and processing of User’s Personal Data comply with the General Data Protection Regulation adopted by the European Parliament on 14 April 2016, and the Data Protection Act of 6 January 1978 as amended. WALLIX informs Users of the following terms:

1. Identity of the Data Controller

The Data Controller is WALLIX, having its registered office at:

250bis, rue du Faubourg Saint-Honoré,75008 PARIS – France.

Tel.: +33 (0)1 53 42 12 90

Email: privacy@wallix.com

2. Personal Data collected

Purpose of processing	Categories of Personal Data	Legal basis (GDPR)	Purpose of processing
Browsing the Website and ensuring its proper operation	Technical information, IP address, browser information and connection logs	Legitimate interests	Ensuring the security, availability and proper functioning of the Website
Responding to contact requests and requests for information	Identity and contact details	Performance of pre-contractual measures requested by the User	Responding to contact requests and requests for information
Providing product demonstrations, free trials and commercial follow-up	Identity, contact details, company information	Performance of pre-contractual measures and WALLIX’s legitimate interests	Providing product demonstrations, Partner Portal access, free trials and commercial follow-up
Training registration	Identity, contact details, company information	Pre-contractual or contractual obligation	Providing registration for training cession
Prospect relationship management	Identity, contact details and pre-contractual information	Legitimate Interest or consent when applicable	Prospect relationship management
Sending newsletters and marketing communications	Identity and contact details	Consent where required, or legitimate interests for communications with existing business contacts,	Sending newsletters and marketing communications
Website audience measurement and performance analytics	Technical data, cookies and browsing information	Consent for non-essential cookies	Website audience measurement and performance analytics
Website security, fraud prevention and system administration	Technical data, IP addresses and connection logs	Legitimate interests	Website security, fraud prevention and system administration
Recruitment management	Identity, contact details, CV and application documents	Performance of pre-contractual measures at the candidate’s request	Recruitment management

3. Recipients of Personal Data

Only authorized WALLIX employees are recipients of User’s Personal Data, which is used by WALLIX employees for the sole purpose of the processing for which it is intended.

Personal Data may also be transmitted to third parties in the following cases:

(a) the User has given his prior consent for the sharing of his Personal Data with third parties;

(b) the sharing of the User’s Personal Data with such third party is necessary for the provision of the products or services requested by the User;

(c) a competent judicial or administrative authority requires WALLIX to communicate such Personal Data;

(d) transfer to subcontractors used by WALLIX for the provision of its services, operation of its Website and management of its business activities.

4. Service providers

WALLIX relies on selected service providers that may process Personal Data on behalf of WALLIX as processor.

Where these providers process Personal Data on behalf of WALLIX, they act as subcontractors within the meaning of applicable data protection regulations and are contractually required to:

• process Personal Data only in accordance with WALLIX’s instructions;
• implement appropriate technical and organizational measures to ensure the protection of Personal Data;
• maintain confidentiality of Personal Data;
• comply with applicable data protection regulations.

Depending on the services used by the User, Personal Data may be processed by the following categories of service providers:

Service provider	Purpose	Applicable data transfer mechanism
Datacampus	Main Hosting Infrastructure	EU
Amazon  Web Services (AWS)	Hosting infrastructure (Salesforce)	EU
Salesforce	Customer relationship management and related services	Standard Contractual Clauses and Binding Corporate Rule
Salesforce Marketing Cloud	Marketing communications and campaigns	Standard Contractual Clauses and Binding Corporate Rule
Upland LeadLander	Website visitor analytics	EU
Clari	Sales intelligence and customer relationship analysis	EU
Consensus	Product demonstrations	EU
Fluid Topics (Antidot)	Product documentation platform	EU
Softy	Recruitment platform and management of job applications	EU
Amalia	Recruitment services, where applicable	EU

WALLIX ensures that its subcontractors contractually undertake to implement a level of protection equivalent to the protection implemented by WALLIX and, in any event, compliant with applicable regulations.

5. Retention period

The User’s Personal Data is retained by WALLIX only for a period necessary for processing and adapted to the purpose of collection.

The retention periods may vary depending on the purpose for which the Personal Data is processed and applicable legal obligations.

In the context of a contractual relationship, Personal Data may be retained for up to 10 years after the end of the contract, in particular due to accounting and tax obligations incumbent on WALLIX.

Regarding prospects, Personal Data may be retained for up to 3 years after the last contact from the prospect.

Personal Data transmitted as part of an application may be retained for a period of 2 years from their submission or the last contact of the candidate.

As part of the control of WALLIX’s information system, a User’s Personal Data, in particular technical information such as IP addresses, connection logs and pages visited, are retained for 6 months from their collection.

At the end of the applicable retention period, Personal Data is deleted, anonymized or archived in accordance with applicable regulations.

6. Security measures

WALLIX makes every effort to ensure the security of the Personal Data collected, in accordance with the state of the art and the security policy of WALLIX’s information systems.

WALLIX implements appropriate technical and organizational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or unauthorized access.

These measures include, depending on the nature of the processing:

• access control and authorization management;
• confidentiality obligations applicable to authorized personnel and service providers;
• security measures relating to WALLIX’s information systems;
• backup and recovery procedures;
• measures to ensure the confidentiality, integrity and availability of Personal Data.

7. Rights of data subjects

The User has the following rights concerning his Personal Data, which he can exercise:

• by email to privacy@wallix.com; or
• by post to WALLIX – 250 bis rue du Faubourg Saint-Honoré – 75008 Paris, France.

Before processing a request, WALLIX may request additional information to verify the User’s identity.

Right of access and communication of Personal Data

The User has the right to access the Personal Data concerning him and request that this Personal Data and the information relating to the processing carried out on this Personal Data be communicated to him.

Right to rectification of data

The User may request the rectification, updating or completion of Personal Data concerning him which may prove to be inaccurate, erroneous, incomplete or obsolete.

Right to erasure

The User may also request the erasure of Personal Data where the conditions provided for by applicable regulations are met.

Right to restriction of processing

The User may request the restriction of the processing of his Personal Data in the cases provided for by applicable regulations.

Right to portability

The User may request the transfer of Personal Data collected with his consent or as part of the performance of a contract to another data controller where technically possible.

The right to portability must not infringe the rights and freedoms of third parties.

Right to object

The exercise of this right is only possible in one of the following two situations:

1. Where the exercise of this right is based on legitimate grounds; or
2. When the exercise of this right aims to prevent the Personal Data collected from being used for commercial prospecting purposes.

The User may object at any time to the processing of his Personal Data for direct marketing purposes.

Right to withdraw consent

Where the processing of Personal Data is based on the User’s consent, the User may withdraw his consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

8. Response times

WALLIX undertakes to respond, after verification of the User’s identity, to his request for access, rectification or opposition or any other request relating to his Personal Data within a reasonable period of time which may not exceed one (1) month from receipt of his request.

This period may be extended by an additional two (2) months where necessary, taking into account the complexity and number of requests. WALLIX will inform the User of such extension within one (1) month from receipt of the request.

9. Complaint to the competent authority

If the User considers that WALLIX does not comply with its obligations regarding his Personal Data, he may send a claim to the competent supervisory authority.

In France, the competent supervisory authority is the Commission Nationale de l’Informatique et des Libertés (CNIL).

The User may contact the CNIL via the following website:

https://www.cnil.fr

COOKIE POLICY

When connecting to WALLIX’s Website for the first time, the User is warned by a banner at the bottom of his screen that information relating to his browsing may be recorded in files called „cookies“.

WALLIX’s cookie policy allows the User to better understand the provisions implemented regarding navigation on the Website. It informs the User in particular about the cookies used on the Website, their purposes and gives the User the procedure to follow to configure them.

1. General information on cookies on WALLIX Websites

WALLIX, as publisher of the Website, may install cookies on the User’s terminal (computer, tablet, mobile device, etc.) in order to ensure optimal navigation on the Website.

„Cookies“ are small text files of limited size that allow WALLIX to recognize the User’s device in order to personalize the services offered and improve the Website experience.

The information collected through cookies does not identify the User by name. They are used exclusively for WALLIX’s own purposes, in particular to improve the interactivity and performance of the Website, analyze its use and provide content adapted to Users‘ interests.

None of this information is communicated to third parties except where WALLIX has obtained the User’s prior consent, where such communication is necessary for the provision of services requested by the User, or where disclosure is required by law, by order of a court or by any administrative or judicial authority empowered to request it.

For better information of the User regarding the data collected through cookies, the list below mentions the different types of cookies that may be used on the Website, their purpose and, where applicable, their retention period.

2. Cookie Preferences Your Cookie Preferences

When you first visit the Website, a cookie banner allows you to:

• Accept all cookies;
• Reject non-essential cookies;
• Customize your preferences.

Your choices may be changed at any time through the Cookie Settings available on the Website.

Strictly Necessary Cookies

Strictly necessary cookies are essential for the operation, security and accessibility of the Website.

These cookies do not require your consent because they are necessary to provide the services requested by the User or to ensure secure electronic communications.

Examples include:

• Session cookies;
• Authentication cookies;
• Security cookies;
• Load balancing cookies;
• User interface preference cookies.

These cookies cannot be disabled through the cookie preference center.

Analytics Cookies

Subject to your consent, analytics cookies help WALLIX understand how visitors use the Website, measure its performance and improve the user experience.

Depending on the services enabled, these cookies may collect information such as:

• pages visited;
• navigation paths;
• browser and device information;
• approximate location;
• visit duration;
• referring websites.

The following analytics tools may be used on the Website:

Provider	Purpose	Privacy policy / Cookie management
Google Analytics	Generation of statistics relating to the use of the Website.	Google Analytics opt-out add-on: https://tools.google.com/dlpage/gaoptout?hl=fr
Salesforce Marketing Cloud	Analysis of interactions with marketing communications and campaign performance measurement.	https://help.salesforce.com/s/articleView?id=xcloud.data_protection_and_privacy.htm&type=5
Upland LeadLander	Analysis of Website visitor interactions and visitor behavior.	https://uplandsoftware.com/privacy/
Salesforce	Customer relationship management and related analysis purposes.	https://help.salesforce.com/s/articleView?id=xcloud.data_protection_and_privacy.htm&type=5
Clari	Sales intelligence and sales-related analysis purposes.	https://www.clari.com/privacy/ ; https://www.clari.com/cookies/
Amalia	Recruitment-related functionalities on the WALLIX Website.	https://trust.amalia.io/

Marketing Cookies

Subject to your consent, marketing cookies help WALLIX measure the effectiveness of its campaigns, understand interactions with its content and improve communications with visitors and prospects.

These cookies may be issued by WALLIX or by trusted third-party providers acting according to their own Privacy and Cookie Policies.

The following services may involve marketing cookies:

Provider	Purpose	Privacy policy / Cookie policy
Consensus	Providing interactive product demonstrations and related functionalities.	https://goconsensus.com/privacy-policy/
Gartner	Redirecting Users to Gartner content or services.	https://www.gartner.com/en/about/policies/privacy/cookie-policy

Social Media Cookies

Subject to your consent, social media cookies enable features such as:

• sharing Website content;
• displaying embedded videos;
• interacting with social media content.

Depending on the pages visited, these cookies may be placed by providers such as:

• LinkedIn;
• Facebook;
• YouTube;
• X (formerly Twitter).

These providers act as independent controllers for the cookies they place.

Provider	Purpose	Cookie policy
Facebook	Sharing Website content and interaction with Facebook content.	https://fr-fr.facebook.com/policies/cookies/
LinkedIn	Sharing Website content and interaction with LinkedIn content.	https://www.linkedin.com/legal/cookie-policy?_l=fr_FR
X (formerly Twitter)	Social media functionalities and cookie management.	https://support.twitter.com/articles/20170518
YouTube	Displaying embedded videos and interaction with YouTube content.	https://www.google.fr/intl/fr/policies/technologies/cookies/

Information relating to deletion of YouTube cookies from Google Chrome is available here:

https://support.google.com/youtube/answer/32050?hl=fr

Third-Party Cookies

Some cookies used on the Website are placed by trusted third-party providers.

These providers act as independent controllers for the cookies they place and process data according to their own Privacy and Cookie Policies.

WALLIX encourages Users to consult the relevant third-party policies available in the sections above for further information about their data processing practices.

Managing Cookies

You may change your preferences at any time through the Cookie Settings available on the Website.

Most web browsers also allow you to:

• view cookies;
• delete cookies;
• block cookies;
• receive notifications before cookies are stored.

Disabling certain cookies may impact the functionality of the Website and the User experience.

Cookie management instructions are available from your browser provider.

Supported browsers include:

• Google Chrome;
• Mozilla Firefox;
• Microsoft Edge;
• Safari;
• Opera.

Additional information is available from the CNIL website:

https://www.cnil.fr/professionnel

Contact

If you have any questions regarding this Cookie Policy, please contact us at:

privacy@wallix.com