Privacy Policy.

I. FIELDS OF APPLICATION

The purpose of this privacy policy (hereinafter " the Policy ") is to explain how the company UNLATCH UK LTD, a private limited company with a capital of £1000, registered on the Registrar of Companies for England and Wales under number 13282676, whose Headquarters are located at 23 Copenhagen Street, London, England, N1 0JB (hereinafter referred to as "UNLATCH"), collects and processes the personal data of users of its services as data controller.        

The Policy applies to the Data processing that we carry out as data controller via our website “getunlatch.com” and our associated software (hereinafter the “Platforms”). The persons concerned by the Policy are the natural persons who visit our Platforms and, where applicable, use the services we offer there (hereinafter the “Users” or “You”).        

However, the Policy does not cover: 

• the Data processing that we carry out as a subcontractor: 

This is the case when we process Data entrusted by our customers as part of the performance of our service missions. For example, our customers (or their employees) are required to post on our Platforms documents, messages and information relating to their activity, which may contain Data. We then host this Data and the customer remains the data controller. We have no control over the methods and purposes of collecting this Data as well as over the practices of our clients in terms of confidentiality and security. 

• Data processing of our candidates for a position, our employees, our shareholders or representatives of our suppliers and customers.

We recommend that you read this Policy in its entirety so that you are fully informed.

We only collect your Data in the following cases: 

• You are one of our natural person clients; 
• You are the legal representative of one of our legal person clients; 
• You are an employee of one of our clients and have a Purchaser Portal account on one of our Platforms; 
• You have visited / used our Platforms; 
• You have contacted us directly.

II. PURPOSES OF COLLECTION AND USE OF YOUR DATA

• Managing your access to your Purchaser Platform account 

When you have a Purchaser Platform account on one of our Platforms, we want to be able to identify you before allowing you to access it. This identification is one of the measures that we implement in order to guarantee that you are the only one able to access your Purchaser Platform account. 

For this purpose, we collect and store the following main Data: name, first name, email address, business telephone, login, password, IP address. 

If you refuse that we collect this data, you will not be able to access your Purchaser Platform account.

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH and explained above. 

• Carrying out identity checks online

We offer the customers of our Platform the possibility of proceeding to the electronic AML check of their purchaser’s identity. The purchaser remains responsible for the content uploaded during the online identity check. The customer remains responsible for the use of the identity check. 

The online identity verification process involves processing the Data of purchasers in order to identify them, ensure the validity of electronic transactions and keep proof of due diligence in the AML procedure. The Data collected from purchasers are in particular the name, first name, email address, postal address, telephone number and the identity card or passport of these persons. We subcontract the entire online identity verification process as well as the corresponding Data processing to our service provider, ONFIDO. 

In addition, the use of ONFIDO may also involve other processing of Data for which ONFIDO is responsible for processing. On this point, we invite you to consult its privacy policy. 

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH and explained above.

• Carrying out online payments

We offer the customers of our Platform the possibility of letting their purchasers pay their fees online. The customer remains responsible for the use of the online payment system. 

The online payment system involves processing the Data of purchasers in order to receive payment from them. We subcontract the entire online payment system as well as the corresponding Data processing to our service provider, STRIPE. 

In addition, the use of STRIPE may also involve other processing of Data for which STRIPE is responsible for processing. On this point, we invite you to consult its privacy policy. 

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH and explained above. 

• Carrying out an electronic signature operation

We offer the customers of our Platform the possibility of proceeding to the electronic signature of documents. The customer remains responsible for the content of the e-signed document and its use. 

The electronic signature process involves processing the Data of signatories and parties to the signature process in order to identify them, ensure the validity of electronic transactions and keep proof of electronic transactions. The Data collected are in particular your name, first name, email address, telephone number and, if applicable, the identity card or passport of these persons. We subcontract the entire electronic signature process as well as the corresponding Data processing to our service provider, DOCUSIGN. 

In addition, the use of DOCUSIGN may also involve other processing of Data for which DOCUSIGN is responsible for processing. On this point, we invite you to consult its privacy policy. 

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH and explained above. 

• Technical assistance

Users of our Platforms benefit from technical assistance by phone and email. 

In this context, we collect and record the date and nature of the incidents in question as well as your identification data (name, first name, email address, telephone, position, company). The processing of this data is necessary in order to resolve the problems encountered, and more generally in order to maintain the effectiveness and security of our services.

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH and explained above. 

• Optimising your browsing experience

When you use our Platforms, we automatically collect (i) certain Data relating to your browsing, such as web log data, URLs of pages viewed, time spent on pages viewed, date and time of connection, error logs; as well as (ii) certain data relating to your devices such as the IP address, the identification number of your device, the type of browser, the Internet service provider, the operating system. This Data is used to improve the performance of our services, as well as to evaluate and personalize your browsing experience.  

To do this, we use "cookies", which are text files containing small amounts of information (possibly including Data) and which are stored on your device. These cookies allow us in particular to save your preferences for using our services. For example, we use Google Analytics, a web analytics service that uses cookies to help us analyse how our websites are used, including the number of visitors, which websites visitors have navigated to our websites, and the pages on our websites that visitors navigate to.   

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH and explained above as well as on your consent. 

• Sending marketing communications

If you are an employee of one of our clients who uses our services or if you contact us directly, we will use some of your Data (last name, first name and email address, telephone number) in order to send you marketing information, product recommendations and other non-transactional communications relating to our services. This processing is necessary for our own business development. We may have to entrust the sending of these notifications to one of our subcontractors "MailChimp" or "ActivCampaign".     

You have the option at any time to no longer appear on our mailing lists by clicking on the button provided for this purpose in the notifications you receive.

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH or to the extent that you have provided your prior consent. 

• Collecting information on our prospects

When you visit our websites, you can contact us by filling out the form provided for this purpose. The information in this form arrives on a company email address and is then processed by the sales team. We then collect and save these emails and the Data they contain. This processing is used to identify customer opportunities.

Legal basis: this processing is based on the legitimate interests pursued by UNLATCH. 

III. RECIPIENTS OF YOUR DATA

We only communicate your Data to the categories of people defined below: 

• Our employees: Your Data is only accessible to our employees whose functions require it (in particular those of the sales and technical departments) who have received instructions and who are in any event subject to an obligation of confidentiality;
• Our subcontractors: Your Data may be communicated to our service providers for the sole purpose of carrying out the processing for which they were initially collected. UNLATCH only subcontracts data processing to subcontractors who provide sufficient guarantees as to the implementation of appropriate technical and organizational measures. Our main subcontractors are Amazon Web Service and OVH for the hosting of Data;   
• Authorities: Your Data may be communicated to any authority legally entitled to know it (public bodies, judicial administration, etc.).  

IV. INTERNATIONAL TRANSFERS

We make our best efforts to minimize the scenarios in which your Data would be transferred internationally. Therefore, we have your Data hosted by our subcontractors within the European Economic Area. Thus, we do not directly proceed with international transfers of your Data.

However, some of our subcontractors who have access to the Data are based in the United States, which constitutes an international transfer within the meaning of the GDPR. In this case, we ensure that these transfers are covered by appropriate safeguards in accordance with the GDPR, including the existence of standard contractual clauses.

Also, Unlatch may use service providers (invisible service providers) whose use involves the transfer of personal data outside the European Union. In this case, Unlatch implements the necessary measures to ensure that the transferred data receive the appropriate guarantees as required by the applicable regulation. In particular, Unlatch establishes standard contractual clauses of the European Commission with these providers.

You expressly acknowledge and accept the existence of these transfers.

V. DURATION OF DATA RETENTION

We keep your Data only as long as necessary for the purposes for which it is processed and as provided for by the laws in force. At the end of this period, we delete or anonymise the Data. In the event that technical limits prevent deletion or anonymisation, we protect the Data and limit active use thereof. For any request for clarification concerning the retention period of the Data, we invite you to contact our data protection officer at the following address: alexandre.larzat@getunlatch.com. 

VI. YOUR RIGHTS WITH REGARD TO YOUR DATA

You have the rights listed below, in accordance with the GDPR.

To exercise your rights, you can contact us directly by email at the following address: support@getunlatch.com. 

We will respond to your requests within one month, which may be extended to two months given the complexity and number of requests. In the event that your requests are manifestly unfounded or excessive, we may refuse to follow up or charge for its response. 

• Withdrawal of consent: You can withdraw your consent to the processing of all or part of your Data at any time. Withdrawing consent may prevent certain services from being performed. 
• Access to data: You can ask us for details on the Data to which we have access as well as the processing operations that we carry out. You can also ask us to obtain a copy of the Data being processed. Any additional copies will be invoiced. 
• Rectification of data: You can ask us to rectify as soon as possible the Data concerning you which are inaccurate. 
• Erasure of data: You can at any time, under the conditions of the GDPR, request that some or all of your Data be deleted as soon as possible. Where applicable, we will inform the recipients of this Data of your request. This action may prevent some services from running. 
• Limitation of processing: In the hypotheses below, you can ask us to stop any action on your Data, with the exception of their retention: (i) You dispute the accuracy of the Data concerning you, (ii) You believe that the processing is unlawful, (iii) At the end of the processing, you do not want your Data to be completely deleted. In this case, we will communicate this request as far as possible to any recipient of your Data and will contact you to find out the causes of this request and try to remedy it if necessary.  
• Data portability: You can ask us to receive communication of all the Data concerning you in our possession, in a structured, commonly used and machine-readable format or if this is technically possible, that this data be transferred to another data controller. . 

VII. DATA SECURITY

We strive to take all necessary security measures to protect your Data, and in particular the following measures: 

• User access control: secure password for connection to the customer area  
• Software Safeguards: Using Linux, Updates, and Security Patches 
• Data backup: back up every hour with 10 years retention at OVH 
• Data encryption: site accessible in https 
• Control of subcontractors: verification of the privacy policy of each subcontractor;  
• Other measures: secure premises  
• Computers of our employees accessible with password and protected by antivirus and firewalls updated regularly; 
• Implementation of this privacy policy
• Employee awareness; 
• Disciplinary actions foreseen against employees who access processed data without authorisation.

We will notify you, as soon as possible, of this violation on the condition that it is likely to generate a high risk for your rights and freedoms under the conditions of the GDPR.

VIII. NEWS AND MODIFICATION OF THE POLICY

The date of the last revision of the Policy is January 8, 2021.

Due to the constant development of our Platforms and our services, and on the basis of legal requirements, it may be necessary to modify this Policy. Data subjects will be informed of any revisions to the Policy and their consent will be required if necessary.

IX. DATA PROTECTION OFFICER

We have appointed a data protection officer to help us bring our services into compliance with the GDPR.

They are: Mr. Alexandre Larzat, alexandre.larzat@getunlatch.com 

We invite you to contact him for any questions relating to the processing of your data.

In London, May 13, 2024.