Privacy Policy

1. Data controller

Homaio Carbon Holdings SA
A French société anonyme with share capital of €37,000, RCS Paris 978 819 720
35 rue de Courcelles, 75008 Paris, France

HCH determines the purposes and means of the processing described below and acts as data controller.

2. Contact

For any question about this policy or to exercise your rights:

privacy+comply@homaio.com

By post: Homaio Carbon Holdings SA — 35 rue de Courcelles, 75008 Paris, France.

No data protection officer has been appointed to date, such an appointment not being mandatory given our processing activities.

3. Data we process

Depending on the context, we may process:

• Professional identification and contact data: first name, last name, job title, company, business email address, business telephone number, professional online profile (e.g. LinkedIn)
• Interaction data: content of messages and requests, call and meeting notes, history of commercial exchanges
• Data about the company represented: sector, installations covered by the EU ETS, stated volumes and requirements
• Contractual and billing data: information needed to enter into and perform contracts
• Regulatory data: documents and information required under customer identification and anti-money-laundering / counter-terrorist-financing obligations, where applicable
• Technical browsing data: IP address, browser type and version, pages viewed, connection date and time, data from cookies and trackers

Mandatory form fields are identified as such. If they are not completed, we will not be able to handle your request.

4. Purposes, legal bases and retention periods

Regarding commercial prospecting: we have carried out a balancing test between our interest in developing our business and your rights and freedoms. We only contact people whose professional role relates directly to the subject of the message, at their business address, and every message includes a simple and free way to object.

5. Source of the data and indirect collection

Some of the data we process is not provided to us directly by the individual concerned. We also collect professional data from:

• official EU ETS registers and publications, in particular the European Union Transaction Log (EUTL) and national registries, which identify the operators of the installations concerned
• company websites and search engines, to complete the information relating to those companies
• the professional social network LinkedIn, to identify the relevant contacts within those companies

The first two sources tell us about legal entities. Personal data as such comes mainly from the third.

The categories of data concerned are limited to professional data: first name, last name, job title, company, business email address, business telephone number, professional online profile.

We do not purchase prospecting lists from data brokers.

In accordance with Article 14 GDPR, where we contact a person whose data was collected indirectly, information about the processing is provided to them at the latest at the time of that first communication, by reference to this policy.

6. Recipients and processors

Your data is accessible to HCH staff who need it to carry out their duties, and to service providers acting on our behalf, on our instructions and under a data processing agreement.

Categories of recipients:

We may also disclose data to administrative or judicial authorities where required by law.

We do not sell your data and do not pass it on to third parties for their own marketing purposes.

7. Transfers outside the European Union

Some of our providers may be established outside the European Union or host data there. In that case, the transfer is covered by the safeguards provided for by the GDPR: an adequacy decision of the European Commission, standard contractual clauses, or another appropriate mechanism.

As at today, the following transfers apply:

• HubSpot Inc. (United States), onward processor for HubSpot Ireland Ltd for the newsletter and marketing automation.
• Google LLC (United States), for loading the website's typefaces and, subject to your consent, for audience measurement and advertising.
• Intercom Inc. (United States), for customer support.
• Meta Platforms Inc. (United States), for advertising, subject to your consent.
• LinkedIn Corporation (United States), for B2B advertising, subject to your consent.

Each of these transfers is covered by a data processing agreement and the European Commission's standard contractual clauses (or an adequacy decision, where applicable).

A copy of the safeguards in place can be requested at the address given in section 2.

8. Security

We implement appropriate technical and organisational measures to protect data against unauthorised destruction, loss, alteration, disclosure or access: need-to-know access control, strong authentication, encryption in transit, logging, selection and contractual oversight of processors, and staff awareness.

As no system offers absolute security, these measures aim to reduce risk rather than eliminate it entirely.

9. Your rights

Under the conditions set out in the GDPR, you have the following rights:

• Access: obtain confirmation that your data is being processed and receive a copy of it
• Rectification: have inaccurate or incomplete data corrected
• Erasure: request deletion of your data, in the cases provided for by law
• Restriction: request that processing be temporarily suspended
• Portability: receive, in a structured format, the data you provided to us, for processing based on consent or on a contract
• Objection: object to processing based on our legitimate interest. Objecting to commercial prospecting is an absolute right: it is applied without any need to give reasons, and each of our prospecting emails contains an unsubscribe link
• Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand
• Post-mortem instructions: determine what happens to your data after your death

To exercise these rights, write to the address given in section 2. We may ask you for something enabling us to verify your identity. We respond within one month, extendable by two months for complex requests.

If you consider that your rights have not been respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

10. Cookies and trackers

The use of cookies and trackers on this website, the purposes pursued, their lifespan and how to withdraw consent are set out in our Cookie Policy.

11. Automated decision-making

We do not take decisions producing legal effects concerning you based solely on automated processing, and we do not carry out profiling for that purpose.

12. Changes to this policy

We may update this policy, in particular to reflect changes in our processing activities or in the applicable law. The applicable version is the one published on this page, with the effective date shown at the top of the document. In the event of a substantial change, we will inform the individuals concerned by appropriate means.