Confidentiality policy

This privacy policy (hereinafter the “Policy”) describes how Vertimac SA and its subsidiary Altitop France SARL (hereinafter together “Altitop”, “we”) collect, use, store and protect the personal data of users of the site www.altitop.com (hereinafter the “Site”), as well as the rights that these users have.

It falls within the framework of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (“RGPD”), the Belgian law of 30 July 2018 relating to the protection of natural persons with regard to the processing of personal data, as well as French law no. 78-17 of 6 January 1978 amended (known as “Informatique et Libertés”).

By browsing the Site, you acknowledge that you have read this Policy. We invite you to consult it regularly, any substantial changes being reported on the Site.

1. Responsible for the treatment

The person responsible for processing data collected via the Site is:

Vertimac SAIndustrielaan 30 — 8790 Waregem (Belgium) Company number/VAT: BE 0835.103.781E-mail: info@altitop.comTelephone: +32 (0) 56 61 00 00

When the processing concerns activities carried out on French territory, it is carried out jointly with Altitop France SARL (SIREN 834 473 951, 17 rue de la Fontaine Chaude — 78660 Ablis).

For any questions or requests relating to your personal data, you can contact us at info@altitop.com.

2. Personal data collected

We limit the collection of data to only the information necessary for the purposes pursued. Depending on your use of the Site, we may collect:

2.1 Data that you provide to us directly

• Identification data : name, first name, function, company name, VAT number or SIRET;
• Coordinates : postal address, email address, telephone number;
• Data relating to your request : content of your message, type of equipment sought, rental dates, site concerned, possible attachments;
• Account data (if creating a customer area): username, encrypted password, communication preferences;
• Contract and billing data : references of quotations and orders, rental history, bank details or IBAN transmitted as part of a commercial relationship.

2.2 Data collected automatically

• Technical data : IP address, browser type and version, operating system, device type, language;
• Navigation data : pages viewed, date and time of visit, duration of consultation, referring site, interactions with forms;
• Cookies and trackers : see section 9 and our Cookies policy.

We do not collect any so-called “sensitive” data within the meaning of article 9 of the GDPR (health, political opinions, biometric data, etc.).

3. Purposes and legal bases of processing

Your data is processed for the following purposes, on the legal bases specified:

You can withdraw your consent at any time, without this calling into question the legality of the treatments carried out previously.

4. Data recipients

Your data is processed by Altitop's authorized teams (commercial, administrative, technical and legal), within the limits of their respective responsibilities.

They can also be sent, when necessary, to:

• Our affiliated companies within the group (in particular Vertimac SA and Altitop France SARL);
• Our technical service providers and partners acting on our behalf: hosting provider, providers of CRM solutions, e-mailing, mailing, payment, payment, logistics, telephony, computer maintenance, document management, accounting firms, legal advice;
• The competent administrations and authorities when required by law (tax authorities, judicial authorities, law enforcement agencies);
• A possible Buyer in the event of a sale, merger or restructuring transaction affecting Altitop.

Each of these recipients only accesses the data strictly necessary for its mission and is bound by a contractual obligation of confidentiality and security in accordance with the RGPD.

5. Data transfers outside the European Union

The Site is hosted by Webflow, Inc., a company based in the United States (398 11th Street, 2nd Floor, San Francisco, CA 94103). As such, some technical and navigation data may be transferred or stored outside the European Union.

These transfers are subject to appropriate guarantees within the meaning of articles 44 and following of the RGPD, in particular:

• Webflow's membership in Data Privacy Framework (DPF) between the European Union and the United States, or
• The conclusion of standard contract terms adopted by the European Commission,

supplemented, where appropriate, by additional technical and organizational measures (encryption, access control, etc.).

Other service providers that we use may also process data outside the EU; the same level of legal framework is applied to them. You can obtain a copy of these guarantees by contacting us at info@altitop.com.

6. Retention periods

We keep your data for as long as is strictly necessary for the purposes for which it was collected, then archive or delete it according to the following rules:

• Unanswered contact requests and quotations : 3 years from the last exchange;
• Customers : for the duration of the commercial relationship, then 5 years for evidentiary purposes (10 years for accounting and tax records, in accordance with applicable legislation);
• Inactive user accounts : deletion or anonymization after 3 years of inactivity, after relaunch;
• Newsletter and commercial prospecting : until the withdrawal of your consent or after 3 years from the last contact from the recipient;
• Cookies and trackers : 13 months maximum, in accordance with the recommendations of the CNIL and the Belgian Data Protection Authority;
• Technical logs and security logs : 6 to 12 months.

Beyond these periods, the data is deleted or anonymized irreversibly.

7. Data security

We implement appropriate technical and organizational measures to maintain the confidentiality, integrity and availability of your data: encryption of exchanges (HTTPS/TLS), access control, authentication of authorized users, regular backups, regular backups, protection against intrusions and malicious software, and awareness-raising among our teams.

Despite the care taken, no transmission of information over the Internet can be guaranteed to be risk-free. In the event of a data breach that may cause a risk to your rights and freedoms, we will notify the incident to the competent supervisory authority and, where appropriate, to the persons concerned, under the conditions provided for by the GDPR.

8. Your rights

In accordance with the RGPD and applicable national laws, you have the following rights over your personal data:

• Right of access : obtain confirmation that your data is being processed and receive a copy;
• Right to rectification : to have inaccurate or incomplete data corrected;
• Right to erasure (“right to be forgotten”): request the deletion of your data in the cases provided for by the regulations;
• Right to limitation processing in certain situations (contesting accuracy, unlawful processing, etc.);
• Right to object processing, in particular any form of commercial prospecting;
• Right to portability : receive your data in a structured and machine-readable format, or request their transmission to another data controller;
• Right to withdraw your consent at any time when the treatment is based on this basis;
• Right to define guidelines relating to the fate of your data after your death (applicable in France).

How to exercise your rights?

You can exercise your rights:

• by email to info@altitop.com ;
• by post to: Vertimac SA — Personal Data Department, Industrielaan 30, 8790 Waregem, Belgium.

To ensure the confidentiality of your data, we may ask you for proof of identity in case of reasonable doubt about the identity of the applicant. We are committed to responding within a maximum period ofOne (1) month upon receipt of your request, which may be extended by two months in the event of a complex request.

Complaints

If you consider, after contacting us, that your rights have not been respected, you have the option of filing a complaint with the competent supervisory authority:

• Data Protection Authority (APD/GBA) — Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be
• National Commission for Information Technology and Freedoms (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr

9. Cookies and trackers

The Site uses cookies that are strictly necessary for its operation, as well as, subject to your consent, audience measurement cookies and, where applicable, functional or advertising cookies.

During your first visit, a banner allows you to accept, refuse or configure these cookies. You can change your choices at any time via the cookie management link at the bottom of the page.

For more information on the nature of the cookies used, their purpose, their lifespan and their issuers, we invite you to consult our Cookies policy.

10. Minors

The Site is intended for a professional audience (BtoB) and is not intended for minors. We do not knowingly collect data from minors. If you believe that a minor has provided us with personal data, please let us know at info@altitop.com so that we can remove them.

11. Changes to this Policy

We reserve the right to change this Policy at any time, in particular to reflect legislative, regulatory, jurisprudential or technical developments. The date of the last update indicated at the top of the page makes it possible to identify the current version.

In the event of a substantial change, we will inform you by an appropriate means (banner on the Site, notification by e-mail, etc.) before the entry into force of the new provisions.

12. Contact

For any questions or requests relating to this Policy or to the processing of your personal data:

Vertimac SA — Personal Data ServiceIndustrielaan 30 — 8790 Waregem (Belgium) E-mail: info@altitop.comTelephone: +32 (0) 56 61 00 00

‍