BLUE SYSTEMS PRIVACY POLICY

Last Updated: August 6, 2021

Our mission is to improve people’s lives by providing cities with powerful Smart Mobility Platforms to better manage their mobility ecosystems. To that end, we need to collect, use and share some of your personal information. This Privacy Policy is intended to help you understand how we (Blue Systems USA, Inc., a New York corporation, BlueSystems SAS, a French simplified stock company, and our corporate affiliates within the Bollore SE group of companies – collectively “we,” “us,” or “our”) do that and how to exercise the choices and rights you have in your information.

1. SCOPE OF THIS POLICY

This Privacy Policy applies when you visit our website bluesystems.io (the Website) or use our Smart Mobility or Smart Parking Platform (“Blue Systems Platforms”), contact us, interact with us on social media platforms (i.e., LinkedIn) receive our communications or attend our events (collectively, the “Services”).

This Policy does not apply to city mobility data, i.e., information cities require their mobility and parking providers to share into Blue Systems Platforms by virtue of their respective municipal rules and regulations. If you would like to learn more about how we use, protect and safeguard city mobility data, contact us below and we will send you our Data Security Policy.

2. LEGAL BASES FOR PROCESSING PERSONAL INFORMATION

The processing of your personal data has the following legal bases:

* The acceptance of the Terms of Service for the use of the Website that constitutes a contract;

* Entering into a contract with the organization you represent;

* Your consent when required by the regulations in force, particularly in terms of commercial prospecting and cookies;

* Our legitimate interest in ensuring and improving the quality and security of our Services, the Website and Blue Systems Platforms;

* Our legitimate interest in carrying out optional satisfaction surveys regarding our Services in order to improve them; and

* Our compliance with legal and regulatory obligations to the relevant authorities.

3. INFORMATION WE COLLECT

A. Information you provide to us

Personal information you provide to us within the Services may include:

* Contact information, such as your first and last name, email address, phone number, professional title and the name of your organization;

* Account information, such as your username and password;

* Feedback or correspondence, such as information you provide when you contact us with questions, feedback, or otherwise correspond with us; and

* Usage information, such as information about how you use our Platforms and Services.

B. Information we obtain from social media platforms

When you visit or interact with our pages on social media platforms, such as LinkedIn, the platform provider’s privacy policy will apply to your interactions and their collection, use, and processing of your personal information. However, we will apply this Policy if we collect any of your personal information from those platforms.

C. Information we obtain from other publicly available sources

We currently receive personal information about you from publicly available websites such as information about your professional role and how to contact you.

D. Information we receive from other sources

We work closely with third parties (including, for example, business partners, other companies within our Group, our customers, subcontractors, analytics providers and other service providers) and may receive information about you from them.

E. Cookies and other automated means of obtaining information

A cookie is a small file placed on your computer’s hard drive. We use cookies to improve the user experience on the Website or with our Services, for example, by saving a user’s language preference or geographic region. Some information about you may be automatically collected by virtue of you visiting our Website, such as your computer or mobile device operating system type and version number, manufacturer and model; device identifier; browser type; screen resolution; IP address; general location information, and information about your use of and actions on the Services, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access.

We use the following cookies:

Cookies                                  Retention period                              Activate / deactivate

Google analytics                    6 months if allowed                           allow / refuse

These cookies collect standard internet log information and details of visitor behavior patterns to enable us to maintain our Services. The data gathered is anonymous and does not identify individual users.

YouTube                                6 months if allowed                           allow / refuse

This cookie allows user to play videos on the website. If this cookie is not allowed, the videos will not play.

By default, we assume your refusal to allow these cookies and they are not deposited unless an affirmative consent is given.

4. HOW WE USE YOUR INFORMATION

We never sell your personal information to any third parties. Instead, we use it for the following business purposes and as otherwise described in this Privacy Policy or at the time of collection:

A. To provide our Services, namely to:

• provide, operate, and improve Blue Systems Platforms and the Website;
• establish and maintain your user account on Blue Systems Platforms;
• communicate with you about our Services, including by sending you announcements, updates, security alerts, and other messages;
• provide support and maintenance for the Services; and
• respond to your requests, questions and feedback.

B. For research and development 

We analyze your use of the Services to improve the Services and to develop new products and services.

‍C. To send you marketing and promotional communications  

We occasionally send marketing communications as permitted by law. You can opt out of our marketing and promotional communications at any time.

‍D. For compliance, fraud prevention, and safety  

We may use your personal information to comply with applicable laws and legal process, such as to respond to subpoenas or requests from national authorities. In very limited circumstances we may also disclose your personal information to law enforcement and government authorities, i.e, if there is a legal basis for requesting and providing the data and if the applicable regulations sufficiently protect the rights of natural persons in their personal data, and also, in case of non-EEA transfers for European residents.

‍E. To create anonymous data  

We create aggregated and other anonymous data from your personal information and information of other individuals whose personal information we collect. We do it by removing all information that makes it personal and allows for identification of any person. We then use this anonymous and aggregated data to analyze and improve the Services, develop new products and services, and promote our business.

5. HOW WE SHARE YOUR PERSONNFORMATIONAL I

We never share your personal information with any third parties without your consent, except in the following circumstances or as otherwise described in this Privacy Policy (such as for legal purposes):

‍* Professional advisors. We may disclose your personal information to professional advisors, such as lawyers, auditors, or insurers, where necessary in the course of the professional services that they provide to us.

* Third-party service providers. We may share your information with third parties that perform services for us or on our behalf, such as hosting services, email delivery, data analytics and marketing assistance.

* ‍For compliance, fraud prevention and safety. We may share your personal information for the compliance, fraud prevention and safety purposes described above.

‍* Internal reorganization or restructuring.

We may sell, transfer, or otherwise share some or all of our business or assets, including your personal information, in connection with a corporate restructuring or reorganization, such as a merger, consolidation, acquisition, reorganization or sale of assets. The terms of this Policy will apply to the successor company in any such transaction.

6. DATA RETENTION PERIOD

We will retain personal information that we receive and collect about you for period which is reasonably required for us to use it in accordance with the periods indicated in this Article or in accordance with the applicable law.

Except for litigation or judicial requisition and before archiving for compliance with our legal and regulatory obligations, most of the personal data collected are kept on an operational basis for five years or two years after the agreement with your organization has concluded, whichever is longer. Data relating to potential prospects are kept for one year from the last contact, without subsequent archiving.

Personal data related to financial records are kept for five years from the date when financial record was generated.

7. YOUR GDPR AND CCPA RIGHTS

You have several rights in your personal information provided by law – under the European General Data Protection Regulation (“GDPR”) or California Consumer Privacy Act (“CCPA”) – depending on where you live. You will find some details about these rights below. You can exercise these rights by sending us an email at hello@bluesystems.ai. Please indicate your full name, email address, your city and state or country and the nature of the GDPR or CCPA right you wish to exercise, and we will get back to you as soon as possible. Please note, we will need to be able to verify your identify to properly respond to your inquiry.

A. GDPR rights

For the purposes of GDPR, we are the Data Controller.

To the extent the GDPR is applicable to you, we process your personal data under the following legal bases:

* Performance of a contract: processing of your data is necessary for the performance of an agreement with an organization you are part of;

* Legal obligations: processing your data is necessary for compliance with our legal obligation;

* Public interests: processing your data is related to a task that is carried out in the public interest or in the exercise of official authority vested in us;

* Legitimate interests: processing your data is necessary for the purposes of the legitimate interests we pursue.

* Consent: you have given your consent for processing your data for one or more specific purposes;

In any event, we will gladly help clarify the specific legal basis that applies to the processing of personal data in every situation, and in particular, whether the processing is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Your Rights under the GDPR

To the extent the GDPR is applicable to you, you have the following rights under this Privacy Policy and by operation of the law:

* Right of access (article 15 of GDPR). You have the right to request a copy of the personal data we have about you, in an easily understandable format, as well as a copy of this policy on a durable medium.

* Right of rectification (article 16 of GDPR). You have the right to ask us to correct, complete or update information we have about you, if it is inaccurate, incomplete or out of date. In this case, please let us know the updated or corrected information in the same email.

* Right to object to processing of your personal data (article 21 of GDPR). This right exists when we rely on a legitimate interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to our processing of your personal data on this ground. You also have the right to object when we are processing your personal data for direct marketing purposes.

* To request erasure of your personal data (article 17 of GDPR). You have the right to ask us to delete or remove your personal data when there is no good reason for us to continue processing it.

* Request the portability of your personal data (article 20 of GDPR). We will provide to you, or to a third-party you have chosen, all your personal data we hold on you in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you or an organization you represent.

* Withdraw your consent (article 13(2)(c) of GDPR). You have the right to withdraw your consent about processing your personal data by us. If you withdraw your consent, we may not be able to provide you with access to certain specific functionalities of the Services.

* Right to limit the processing of data (article 18 of GDPR). You have the right to restrict processing of your personal data under these four circumstances: (1) you contest the accuracy of your personal data; (2) the processing is unlawful but you would prefer a restriction rather than erasure of your data; (3) we no longer need to process your data but are required to keep them to enable you to establish, exercise or defend against legal claims; and (4) you have objected to processing pursuant to article 21 (1) of the GDPR pending the verification whether our legitimate grounds override yours.

Finally, you have the right to complain to a Data Protection Authority about our collection and use of your personal data. Of course, we hope for an opportunity to be able to resolve the matter. But if you wish to do so, you have the right to refer the matter to the competent authority for data

protection in France, namely the Commission Nationale de l’Informatique et des Libertés (CNIL), via its website cnil.fr or by mail at the following address CNIL – 3, place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07. This right may be exercised at any time and it’s free.

B. CCPA Rights

To the extend the CCPA is applicable to you under this Privacy Policy and by law if you are a resident of California, you have the following rights:

* The right to notice. You have the right to be informed about the categories of personal data that are being collected and the purposes for which your personal data is being used;

* The right to access / the right to request. You have the right to request and obtain information regarding the disclosure of your personal data that we have collected in the past 12 months and disclosed to a third party for its direct marketing purposes; (Note, we never share your information with any third parties for their marketing purpose!)

* The right to say no to the sale of personal data. You also have the right to ask us not to sell your personal data to third parties; (Note, we never sell your personal data to any third parties);

* The right to know about your personal data. You are entitled to request and obtain information about the categories of your personal data collected, the sources from which the data was collected, the business or commercial purpose for collecting or selling the data, categories of third parties with whom we share personal data and specific sets of personal data we collected about you;

* The right to delete personal data. You can request the deletion of your personal data that we have collected in the past 12 months.

* The right not to be discriminated against. You have the right not to be discriminated against for exercising any of your CCPA rights, including by denying goods or services to you or charging different prices or rates for goods or services.

8. INTERNATIONAL DATA TRANSFERS

Information we collect from you may be transferred to and processed in countries other than your country of residence, including the United States, in accordance with applicable law. By providing us with your information, you acknowledge any such transfer and processing.

If you live in the European Economic Area (EEA) or the United Kingdom, please note that, if we transfer your information outside the EEA or UK for processing, we will take appropriate measures to ensure that such processing complies with this Privacy Policy and your information is otherwise adequately protected. The measures we undertake include signing Standard Contractual Clauses in accordance with the GDPR and other data protection laws to govern the transfers of such data.

9. DATA SECURITY

Securing and safeguarding your data is our utmost priority. We assume full responsibility for keeping your data safe and secure. We employ a set of mechanisms designed to protect all data we collect, process and store. However, while our data handling practices are fully compliant with the most stringent cyber security, data privacy and data protection regulations, security risk is inherent in what we do and thus we cannot guarantee complete security of your information. To learn more about our data security practices, contact us below and we will send you our Data Security Policy.

10. CHILDREN

Our Services are not directed to, and we do not knowingly collect personal information from, anyone under the age of 16. If we learn that we have collected personal information of a child without the consent of the child’s parent or guardian, we will delete it. Please contact us below if you believe we have inadvertently collected your child’s personal information so we can delete it.

11. EXTERNAL WEBSITES

The Website and Blue Systems Platforms, from time to time, may contain links to external websites. If you follow a link to any external websites, please note that these websites have their own privacy policies and website terms and we do not accept any responsibility or liability for those policies. Please check those policies before you submit any information to any external websites.

12. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy at any time by posting the amended version on our Website and indicating the effective date of the amended version. We will announce any material changes to this Privacy Policy via email if we have your email address.

13. HOW TO CONTACT US

Your privacy is important to us. If you have any questions about this Policy or our privacy practices or would like to exercise your rights granted by this Policy or by operation of the law, contact us below or email us at hello@bluesystems.ai and we will get back to you as soon as we can.