Privacy Policy

Date: 25 March 2024

Dialog, a French company (société par actions simplifiée), registered under number 922 195 300 at the Commercial and Companies Registry of Paris, with a capital of 1,000 euros, whose registered office is located 3 Boulevard de Sébastopol, 75001 Paris ("Dialog"), is the editor of its application available on Shopify's App Store (the "Application").

The aim of the Application is to provide a sales assistant tool on merchants' websites to help their end-users and/or own customers (together the "End-Users") to find the right products they are looking for.

As a consequence, Dialog may collect and process information that directly or indirectly allows for the identification of these End-Users ("Personal Data"), such as the page views on the merchants' website by the End-Users and the history of conversations of the End-Users with the sales assistant tool. These Personal Data are collected and processed on behalf of Dialog's client ("Client") and according to their instructions, in order to provide the Clients with the Application and Dialog's services. This privacy policy ("Privacy Policy") does not apply to the processing of End-Users' Personal Data performed on behalf of the Clients: a data processing agreement is concluded between Dialog and the Clients to govern this processing in compliance with Data Protection Regulations.

This Privacy Policy only applies to processing of Personal Data of users of the Application ("Users") performed by Dialog as a controller.

Contact details for data protection matters: contact@askdialog.com

Who are the data subjects?

Data subjects to which the Privacy Policy applies are the Users, who have downloaded the Application on the Shopify App Store and who may be employees of Dialog's client ("Client").

Dialog processes Users' personal data as controller. In this context, Dialog determines the purposes and means of the processing of Users' personal data and undertakes to bring Users' personal data processing activities into compliance with Law no. 78-17 of 6 January 1978 on computer technology, computer files and civil liberties, known as the "Informatique et Libertés" Act, as well as with Regulation (EU) No 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (together, "Data Protection Regulation").

What Data does Dialog process?

Dialog collects, directly from Client and/or Users, and processes the following data to provide the Application:

• Users' email address, name and job title;

• Catalog information (product, product variant, collections);

• Blog pages;

• Online store pages.

The possible consequences of not providing Users' personal data may include Dialog's inability to provide the Client and Users with the Application.

Why does Dialog process Users' personal data and on which basis?

Dialog processes Users' personal data in order to:

• deliver the Application and its services to Users, and continue to maintain and develop the Application (legal basis: agreement between Clients and Dialog);

• invoicing (legal basis: agreement between Clients and Dialog and then legal obligation for invoice storage);

• analyse Users' actions on the Application, detect malfunctioning and perform research and development on the Application (legal basis: legitimate interest of Dialog to improve its services);

• send communication for marketing purposes or explaining new functionalities of the Application and/or its services (legal basis: legitimate interest of Dialog to communicate with Users);

• manage disputes with the Client and Users and where processing is necessary for the establishment, exercise or defense of a legal claim (legal basis: Dialog's legitimate interest to manage a claim).

Dialog does not subject the Users to decisions based exclusively on automated processing that produces legal effects concerning them or that affect them in a similarly significant way.

Who has access to Users' Personal Data and where are they stored?

The following recipients may receive or have access to some of Users' personal data (only if necessary for the performance of their tasks):

• the members of Dialog's staff tasked with commercial and administrative follow-up have access to the personal identification data, professional identification data and contact data;

• Dialog's legal advisors and lawyers may have access to certain personal data of Users in the context of the restructuring of Dialog's activities or litigation.

Dialog entrusts the processing of some of Users' personal data to third party processors only to the extent necessary to carry out their tasks and in accordance with the written instructions of Dialog and Data Protection Regulation. Dialog's providers are:

• Amazon Web Services, the host of the Platform, and which servers are located in Ireland.

In the case of a restructuring of Dialog's activities (e.g. a financing operation), Dialog may transfer certain personal data concerning a limited number of Users to a third party involved in the operation (e.g. a bank) in accordance with Data Protection Regulation.

Dialog takes appropriate measures to ensure that these third party processors process Users' personal data in accordance with Data Protection Regulation.

Personal Data are processed and stored within the European Union.

What are the applicable retention periods?

Dialog ensures that Users' personal data are only kept for as long as necessary for the purposes for which they are processed.

Dialog keeps invoices and other accounting documents (which may include some of the Users' personal data) for a period of ten (10) years from the end date of the accounting year when they were issued in accordance with accounting laws. These accounting documents may, where applicable, contain certain personal identification data, professional identification data and contact data.

Dialog retains information pertaining to Users and their use of the Application for up to 5 years after the termination of the Agreement with the Client.

What are Users' rights?

Subject to Data Protection Regulation, Users have the right to access their Personal Data, to request the erasure of their Personal Data, and the right to obtain communication thereof in a structured and readable form (save legitimate impediment). Users also have the right to object to (including profiling) or limit the processing of their Personal Data.

Users have the right to bring a claim before the competent Supervisory authority (in France, the Commission Nationale de l'Informatique et des Libertés "CNIL") and define guidance relating to their digital will.

Where Users have given their consent to Dialog, they may withdraw such at any time, being specified that any previous processing of their Personal Data will remain lawful.

For any issues relating to the protection of Personal Data, or to exercise their rights, Users may send an e-mail to the attention of our data protection officer at the following address contact@askdialog.com or write to the following postal address: Dialog, 3 Boulevard de Sébastopol, 75001 Paris.

In accordance with the Data Protection Regulations, Dialog will have one month to respond to any request, subject to a possible extension of two additional months, and reserves the right to object to any requests considered unreasonable due to the repetitive nature thereof.

Finally, Users are informed that Dialog may, in the event of doubt as to Users' identity, ask Users for proof of identity in order to prevent any unauthorized access to their personal data.

What level of security does Dialog ensure?

Dialog takes appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated with the processing of their personal data.

Dialog follows industry best practices to ensure that personal data are not accidentally or unlawfully destroyed, lost, altered, disclosed or accessed in an unauthorized manner.

Anything else?

Dialog reserves the right to update the Privacy Policy from time to time. Dialog will inform the Users of any changes it may make to the Privacy Policy. If amendments to the Privacy Policy involve matters for which the User consent was previously required, Dialog will notify the User in order to obtain its renewed consent.

In the event of a conflict or inconsistency between a provision of the Privacy Policy and a provision of another policy or document relating to the processing of personal data, the latest provision of the Privacy Policy prevails.