FACTUM GROUP
PERSONAL DATA PROTECTION POLICY

Olinn

SCOPE OF APPLICATION

The personal data protection policy (the “Policy”) is implemented by FACTUM GROUP, a simplified joint-stock company with capital of €16,870,000.00, with registered office at 43 rue de Médreville – 54000 Paris, France, and registered in the Nancy Trade and Companies Register under number 499 747 277 (“FACTUM GROUP”). The Policy is also applied by the following companies as subsidiaries of FACTUM GROUP (the “Subsidiaries”):

FACTUM FINANCE, a simplified joint-stock company with capital of €6,116,600.00, with registered office at 43 rue de Médreville – 54000 Nancy, and registered in the Nancy Trade and Companies Register under number 483 140 935;

FACTUM MOTORS, a simplified joint-stock company with capital of €50,000.00, with registered office at 43 rue de Médreville – 54000 Nancy, and registered in the Nancy Trade and Companies Register under number 753 349 489;

FACTUM BELGIQUE, a private company with limited liability under Belgian law with capital of €418,600.00, with registered office at Avenue Louise 149 – 1050 Brussels, and Company Number 0832.533.677;

FACTUM LUXEMBOURG, a company with limited liability under Luxembourg law with capital of €12,500.00, with registered office at 26 boulevard Grande Duchesse Charlotte, and registered in the Trade and Companies Register under number B171176;

FACTUM DEUTSCHLAND, a company with limited liability under German law (Gesellschaft mit beschränkter Haftung), with registered office at Schillerstraβe 4 – 60313 Frankfurt am Main, and registered in the Frankfurt am Main Trade and Companies Register under number HRB 111997;

FACTUM (SWITZERLAND), a company with limited liability under Swiss law with registered capital of CHF 595,000.00, with registered office at Rue Pierre-Fatio 12 – 1204 Geneva, and with unique identification number CHE-106.102.332.

In the scope of their business, FACTUM GROUP and its Subsidiaries (hereafter referred to as the “Group”) collect and process Personal Data relating to their clients, suppliers concerned by leasing contracts, and their contacts at financial partners. Such data will be collected and processed in accordance with current regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on general data protection (hereafter “GDPR”), as well as any national laws and regulations in this respect.

DEFINITIONS

In the Policy, which applies both to FACTUM GROUP and its Subsidiaries, the following words and expressions, if starting with a capital letter, shall mean:

“Personal Data”: any information pertaining to an identified or identifiable natural person, whether directly or indirectly;

“Data Controller”: the person in charge of determining the purpose and means of any Data Processing;

“Subcontractor”: for Data Processing, a person who processes Personal Data on behalf of the Data Controller, and under the latter’s instructions;

“Data Processing”: refers to the processing of Personal Data, i.e. any operation or set of operations (automated or not) that is performed on Personal Data or sets of Personal Data. The terms defined here can be used synonymously in the singular or plural, depending on the meaning or context.

PURPOSES OF PERSONAL DATA PROCESSING

Data Processing is performed by FACTUM GROUP and its Subsidiaries for the following purposes:

Client relationship management;

Partner and supplier relationship management;

Business prospecting;

Handling of disputes.

CATEGORIES OF PERSONAL DATA COLLECTED AND PROCESSED FACTUM GROUP and its Subsidiaries shall adhere to the data minimisation principle, in other words they shall only process Personal Data as needed for the purposes indicated above, i.e.:

For client relationship management, this pertains to any Personal Data needed to conclude and execute a contract, such as the client’s identification data (surname, first name) and contact details (postal address, telephone numbers and email address), as well as the client’s tax and bank details; For partner and supplier relationship management, this pertains to the Personal Data of contacts at FACTUM GROUP and its Subsidiaries for such partners, i.e. their identification data (surname, first name) and contact details (postal address, telephone numbers and email address);

For prospecting purposes, the contact details provided by the client shall be used in accordance with the applicable regulations in force; For disputes, Personal Data shall be processed as needed for the management of the dispute in question, such as identification data, contact details and any information that is related to the dispute.

RECIPIENTS OF PERSONAL DATA

Any Personal Data collected may be communicated to the Group's entities, financial partners and suppliers concerned by the lease contract.

Personal Data shall also be communicated and processed by subcontractors of FACTUM GROUP and its Subsidiaries as far as it is necessary for the purposes described above. Personal Data may also be transferred to any authorised third parties to meet the legal and regulatory obligations of FACTUM GROUP and its Subsidiaries, and to meet the legal and regulatory obligations of recipients of such Personal Data, as mentioned above.

SECURITY OF PERSONAL DATA

FACTUM GROUP and its Subsidiaries shall guarantee the availability, integrity and privacy of any Personal Data that are collected and processed. All technical and organisational measures employed by FACTUM GROUP and its Subsidiaries shall be used to secure data and ensure that none of it is altered, damaged or shared with a third party without permission.

Data shall be hosted on the servers of FACTUM GROUP and its Subsidiaries, which are all located in France.

DURATION FOR WHICH PERSONAL DATA MAY BE KEPT

Personal Data shall be kept by FACTUM GROUP and its Subsidiaries for as long as needed for processing purposes.

Personal Data may, in certain cases, be kept for a longer period of time, in accordance with the statutory periods of limitation, depending on the category of Personal Data and the applicable national legislation.

RIGHTS OF PERSONS CONCERNED

Data Processing performed by FACTUM GROUP and its Subsidiaries opens the following rights to the natural persons concerned:

Right to access, rectify or delete Personal Data under the conditions stipulated in the regulations (Articles 15 and 17 of the GDPR);

Right to limit the processing of Personal Data under the conditions stipulated in the regulation (Article 18 of the GDPR);

Right to withdraw consent at any time, if the Data Processing is based on consent, under the conditions stipulated in the regulation (Article 13-2(c) of the GDPR);

Right to the portability of Personal Data under the conditions stipulated in the regulation (Article 20 of the GDPR);

Right to oppose Data Processing under the conditions stipulated in the regulation (Article 21 of the GDPR);

Right to define guidelines for access to data in the case of death. To exercise any of the aforementioned rights, the natural person concerned must send a letter by post to FACTUM GROUP – To the attention of the Référent Données Personnelles [Personal Data Contact] – 43, rue de Médreville – BP90362 – 54007 Nancy, or by email to factum@factum-group.eu. In both cases, the natural person must indicate:

The purpose of the request (right in question),

proof of the person’s identity, or the identity of their representative if applicable. In addition to the aforementioned rights, the person concerned has the right to complain to the competent national authority for Personal Data protection.

The Policy may undergo future amendments due to statutory and regulatory changes.