Protection of personal data

WHO PROCESSES YOUR DATA?

Carrefour Hypermarchés, SAS, with share capital of €6,922,200 - 1 rue Jean Mermoz - ZAE Saint Guénault - 91002 Evry - 451 321 335 number FR 90 451 321 33, processes the data collected about you, and is responsible for the processing of personal data for marketing and commercial prospecting processing.

FOR WHICH PURPOSES DO WE COLLECT AND PROCESS YOUR DATA?

Carrefour Spectacles collects and processes data about you in order to carry out operations relating to commercial prospecting, or studies designed to improve customer knowledge and the services that Carrefour Spectacles can offer to its customers. Your data may thus be used, in compliance with any required authorisations you have granted us:

• to send you personalised or non-personalised commercial offers electronically, including on products and services of the Carrefour group companies.

• to analyse your use of the services (including your online browsing and your reactions to emails), so that we can get to know you better, appreciate the value of the Services offered and the messages we send you and offer you offers, contents and services adapted to your profile; these analyses will be carried out in compliance with any authorisations you may have granted us, in particular in the case of the use of cookies or other tracers.

WHY DO THE PROCESSING OF YOUR PERSONAL DATA TAKE PLACE?

Your data may be processed for one or more of the following reasons:

• within the framework of any agreement you may have formulated, for example to allow us to communicate to you about our offers and products or those of third-party advertisers;

• In respect of the interests, freedoms and fundamental rights of those registered for Carrefour Spectacles services, because this is necessary to enable us or our partners to pursue our legitimate interests such as customer loyalty, optimally managing our relationship with our customers, get to know them better and promote our products and services to them.

WHAT DATA DO WE COLLECT?

The data processed within the framework of Carrefour Spectacles come from:

• your registration: data appearing on the subscription form such as your last name, first name, date of birth, contact details, and number (s) of Carrefour loyalty card (s) (if the latter information is requested);

• the use of Carrefour Spectacles services such as your purchases, whether made directly from Carrefour Spectacles or not: data relating to purchases, places and times of order and purchase.

• Third parties may possibly send us data concerning you, such as your postal or electronic address, data relating to your profile, which will integrate our databases. These third parties have fairly collected your data and obtained any required consent before any transmission to Carrefour Spectacles.

• We may possibly possess data from Open Data.

With the exception of data from open data, other data is not accessible to the public.

The data may be collected directly from you or through the use of Carrefour Spectacles services, or from other entities of the Carrefour Group or possibly from our partners or third parties.

The data collected is essential to enable Carrefour Spectacles, their service providers and / or partners to provide the services of Carrefour Spectacles or offered via Carrefour Spectacles, to enable us to get to know you better and interact with you, to offer a facilitated relationship with the ecosystem of the Carrefour group, or to send you, us or our partners, content tailored to your profile and your areas of interest.

WHO WILL BE LIKELY TO ACCESS YOUR DATA?

To achieve the purposes described above and to the extent necessary for the pursuit of these purposes, your data may be transmitted to all or some of the following recipients:

• authorised persons of the departments concerned within Carrefour Group companies (e.g.: services in charge of marketing, studies and analyses, consumer panels, customer service, litigation, accounting and tax matters or information technology and information system security);

• the Carrefour advertising agency and the Carrefour media agency (Digital Media Shopper);

• the legal entity of the Carrefour Group which centrally manages the customer base;

• the loyalty program,

• providers and subcontractors of Carrefour Group companies (e.g., IT providers, providers involved in the advertising sector);

• the advertisers or brand partners: they do not have access either directly or indirectly to the data concerning you they only access data related to your profile without it being possible to identify you directly or indirectly;

• companies managing shopping centers in which Carrefour stores are present;

• administrative or judicial authorities, where appropriate, in the context of compliance with our legal obligations, or to enable us to defend our rights and interests.

LIMITATION OF THE RETENTION PERIOD OF YOUR DATA

The data collected concerning you will be kept for the period necessary for the accomplishment of the above purposes, increased by the statutory limitation period.

Thus, your account data (registration) will be retained for the duration of your membership. They can then be kept and processed for 3 years following the last contact from you, to allow us to send you commercial requests.

HOW SECURE IS YOUR DATA?

The companies of the Carrefour Group take into account the nature of personal data and the risks presented by the processing, to put in place the appropriate technical, physical and organizational measures to preserve the security and confidentiality of personal data and prevent them from being distorted, damaged or accessed by unauthorized third parties. Carrefour Group companies choose subcontractors or service providers who offer guarantees in terms of quality, safety, reliability and resources to ensure the implementation of technical and organizational measures, including in terms of processing security. Subcontractors and service providers undertake to respect levels of confidentiality at least identical to those of companies of Carrefour Group.

IS YOUR DATA PROCESSED OUTSIDE THE EUROPEAN UNION?

The different categories of data collected and processed as part of the services may be transmitted to service providers located in countries outside the European Union such as Morocco, or in the context of computer services or the use of data in connection with social networks.

To secure transfers outside the European Union, either our subcontractors sign with Carrefour, for example, standard clauses defined by the European Commission in order to regulate flows, or they are subject to binding internal rules by the authorities that control protection of personal data, or are located in a country with legislation providing adequate protection.

WHAT ARE YOUR RIGHTS?

In accordance with the regulations on the protection of personal data, you have a right to information, access, modification, and erasure (unless they are necessary for the performance of our contract, or are necessary for us to comply with our legal obligations or to observe or exercise our rights) regarding your personal data as well as the right to define guidelines regarding the fate of your data after your death. It is hereby stipulated that, under the right of access, Carrefour may request the payment of a reasonable fee based on administrative costs for any additional copy of the data provided to you.

You also have a right to obtain the limitation of a processing and a right to the portability of the data you have provided, which will apply in certain cases. In addition, you may request to exercise your right of objection for reasons relating to your particular situation, processing of personal data concerning you where the processing is based on the legitimate interest of the controller, including profiling. In the event of the exercise of such a right of opposition, Carrefour shall cease processing except where there are legitimate and compelling reasons for processing which prevail over the interests and rights and freedoms of the data subject or for the establishment, the exercise or defence of a right in a court of law. You may also object to any processing related to prospecting (including profiling related to such prospecting), or withdraw your consent at any time, in the event that it has been requested from you (The withdrawal of your consent will not affect the lawfulness of the processing carried out before the withdrawal of consent)

Carrefour wishes to inform you that failure to provide information or modification of your data may have consequences in the processing of certain requests in the course of performing the services and that your requests for the exercise of rights will be kept for tracking purposes.

The communication of specific post-mortem directives and the exercise of your rights are carried out by e-mail to the address droitsdespersonnes@serviceclients-carrefour.com or by post to Carrefour Services clients / Droits sur les Données personnelles, 35 rue Pierre and Dominique Ponchardier - Espace Fauriel, CS 60337 - 42015 Saint-Etienne Cedex 2 specifying the information to establish your identity. A reply will then be sent to you as soon as possible.

We also inform you of the existence of the « Bloctel » opposition list, managed by Opposetel, on which you can register, free of charge here: https://conso.bloctel.fr/ .

In the event that we are unable to respond to your requests in a way that satisfies you, you can also lodge a complaint with a supervisory authority (in France the CNIL 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07. Tel: 01 53 73 22 22).

DPO : Within the Carrefour group, data controllers have appointed a Data Protection Officer who you can contact for any questions relating to the processing of your personal data: Carrefour Délégué à la Protection des Données peronnelles- 93 avenue de Paris - CS 15015 - 91 342 Massy Cedex.