AIRWELL RESIDENTIAL, a Société par Actions Simplifiée (SAS – simplified joint stock company) with a share capital of EUR 2,500,000, registered in Versailles (France) under number 752 800 862, whose head office is located 10 rue du Fort de Saint-Cyr, 78180 Montigny le Bretonneux, represented by its President (hereinafter, “Airwell, “We” or “Us”), is a company specialized in the distribution of residential air-conditioning and heating solutions.

In the framework of its business activities, Airwell may collect and process specific personal data, as defined by Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on data protection and privacy (General Data Protection Regulation – hereinafter, the “GDPR”) and French Law No 78-17 of 6 January 1978 (Loi Informatique & Libertés – hereinafter, the “Data Protection Act”) in the version currently in force, concerning its private and professional customers.

Thus, this privacy policy (hereinafter, the “Policy”) has been drawn up to enable Airwell’s private and professional customers (hereinafter, “You” or “Your”) to understand what data is collected, for what purpose and what data subjects’ rights are in this regard.

This Policy may be amended from time to time. Any such amendment will be implemented after informing You thereof by any means available to Airwell. Any new version of the Policy will become applicable only after the date of “Last update” indicated above.

1. Who is the data controller in charge of processing the personal data?

Under the Data Protection Act and the GDPR, Airwell, who defines and implements the processing of its private and professional customers’ personal data, either directly or by a processor, as indicated hereinafter, is the data controller and, to that extent, assumes the legal and regulatory obligations that bind controllers in charge of personal data processing.

2. In what circumstances does Airwell collect and process personal data?

In the framework of its business activities, Airwell may collect and process personal data, within the meaning of the GDPR and the Data Protection Act, in various circumstances:

• when a customer account is created: Airwell requires specific information to enable You to create a customer account on the airwell-pro.fr or www.airwell-pro.com websites (for professionals only);

• when a product if ordered from Airwell: Airwell requires specific information to issue an invoice and process the order;

• when a request is sent to the after-sales service: Airwell must collect specific information concerning the breakdown, for example, which is included in the customer information sheet;

• for communication purposes between Airwell and its customers: the customers (both private and professional) can request to subscribe to Airwell’s newsletter by indicating their email address on one of Airwell’s websites. In addition, the communications between Airwell and its customers can contain personal data that is collected and processed by Airwell;

• when an Airwell website is browsed, such as airwell.com and www.airwell-pro.com.

3. What personal data does Airwell collect and process?

Airwell collects and processes the following data:

• identity data: for private customers, this generally concerns the name and first name, contact details, including a telephone number, email address and postal address; for professional customers, this also concerns the telephone number, postal address and email address, the type of customer (installer or distributor) and the contact details of the contacts in the sales department and accounts department, and perhaps the marketing department and the logistics department;

• data concerning an order: for all customers, Airwell stores their order history to facilitate the follow-up of each order and the supply of after-sales services, if necessary; for professional customers, Airwell also collects specific information concerning ongoing orders and the turnover generated;

• data concerning after-sales services;

• other data: all types of data provided to Us by our customers at their own initiative.

4. On what legal basis is the personal data collected and processed?

All the personal data collected and processed by Airwell is done so on a duly identified legal basis, in accordance with Article 6 of the GDPR:

• contract: Airwell collects personal data in the scope of an order, for the purpose of performing the sales contract for the product, including with regard to after-sales services;

• consent: customers can decide to provide Airwell with specific personal data concerning them;

• Airwell’s legitimate interests: some of the data, e.g., concerning traffic on our Websites, is collected for our legitimate business purposes, it being specified that this collection and processing of data does not in any way infringe Your interests or fundamental rights.

5. For what purposes is personal data collected and processed?

Airwell uses the personal data collected from its customers, in the cases described above, solely for the following purposes:

• to enable Airwell to process orders: the customers’ personal data is collected for the purpose of processing the order and, in particular, editing the invoice or dispatching the equipment ordered;

• to enable Airwell to provide after-sales services;

• to enable Airwell to communicate with You: the data can be processed for communication purposes between Airwell and You, such as sending newsletters if You provide an email address for that purpose, or for sales operations;

• to enable Airwell to improve the Websites, including through the analysis of statistics concerning browsing and traffic on the Websites.

6. With whom do We share the data collected?

The personal data You provide to Us is mainly intended for Airwell. In addition, certain data can be shared with duly identified third parties:

• our service providers or processors: Airwell may hire third-party service providers, such as transport companies; Airwell uses Google’s services (i.e., Google Analytics) for audience ratings on the Websites. For more information, please refer to Airwell’s Cookie Policy;

• the authorities: Airwell will, where necessary, cooperate with the State, administrative or judicial authorities, as well as the supervisory authorities in charge of enforcing the GDPR and the Data Protection Act. Consequently, We reserve the right to disclose any information collected in the scope of our business to the relevant authorities if Airwell is ordered to do so.

In no event will Airwell share Your personal data with third parties for business development or other purposes.

7. For how long does Airwell store personal data?

Airwell only stores personal data concerning its customers in an identifiable form for the time strictly necessary to fulfil the purpose of the processing concerned. Thus, broadly speaking:

• data concerning Our customers’ identity is stored for the term of the contract between You and Us, then archived for five (5) years after the end of the contract;

• some data is stored for the statutory period, particularly if Airwell is bound to do so by law. This is the case for data concerning invoices;

• data concerning disputes and claims management is stored for the time necessary to manage the dispute or the claim (taking into account the time limits for appeals) and until the statute of limitation for court action;

• data concerning prospective customers is stored for a maximum period of three (3) years;

• cookies are stored for the periods indicated in the Cookie Policy.

8. What rights do data subjects have in respect of their personal data?

Airwell complies with the rights granted to natural persons by the GDPR and the Data Protection Act.

Thus, data subjects have the right to request access to the personal data stored by Airwell concerning them and the correction, erasure and restricted processing thereof, as well as the right to refuse the processing thereof.

However, in the event of any restriction or refusal of processing, Airwell may no longer be able to process all or part of the order. Nevertheless, some information may be stored by Airwell in compliance with its legal obligations.

Natural persons are entitled to give instructions concerning the storage, erasure and disclosure of their personal data after their lifetime. In the absence of any such instructions, their personal data will be stored as indicated above, unless their heirs request their earlier erasure.

To exercise these rights, data subjects can send an email to the following address: privacy@airwell-res.com.

Furthermore, data subjects have the right to lodge a complaint at any time with the relevant data protection supervisory authority. For this purpose, they can contact the relevant data protection supervisory authority in the region where they live or, in any event, the CNIL in France at the following address: www.cnil.fr.

Lastly, data subjects are informed that they can object to cold calling by registering on the website www.bloctel.fr.

9. How does Airwell protect personal data?

Airwell undertakes to implement and maintain, at its cost, appropriate technical and organisational measures for the processing and security of personal data, in accordance with Articles 32 to 34 of the GDPR and Article 121 of the Data Protection Act.

Airwell ensures that those technical and organisational measures are always reasonable and adapted to the specific risks inherent to its processing operations, considering the nature of the information collected and processed, especially to protect the personal data against any accidental or unlawful destruction, loss or alteration and any unauthorized disclosure.

Thus, regarding the technical measures taken by Airwell, they include the following:

• the Websites and their data are hosted on a virtualised server in France. Each domain name has a certificate. A firewall implemented upstream blocks a large number of hacking attempts on the Websites;

• the data hosted by SalesForce and/or Moovapps is protected by the security measures taken by those service providers, particularly by means of partitioning the instances in docker containers under Linux;

• the user accounts are protected by two-factor authentication, as is the VPN. Sensitive computers are encrypted, passwords must be robust and, for RDP connections, the IP address is blocked.

Regarding the organisational measures, only the persons who need to know of the data to perform their duties within the company have access thereto. Additionally, the users are not the administrators of the computer terminals.

Furthermore, Airwell undertakes to maintain, update and store a complete and accurate record of the personal data processed by it. The record contains details of its processing operations.

10. Is any data transferred abroad?

Airwell’s websites are hosted in France, as are all the storage solutions used by it.

As an exception, specific data concerning audience ratings may be transferred abroad. If You wish to refuse this transfer, please inform Google of Your refusal by clicking on the following link: https://tools.google.com/dlpage/gaoptout?hl=fr.

11. Data Protection Officer

Airwell has appointed a Data Protection Officer who can be contacted at the following address: privacy@airwell-res.com.

12. Further information

For further information concerning how Airwell collects and processes the personal data provided to it, please send an email to our Data Protection Officer at the following address: privacy@airwell-res.com.