Privacy and Data Protection Policy

Preamble

The Flex To Pay website (hereinafter “the Site”) is owned by WEEDEV (hereinafter “We” or the “Data Controller”), a French simplified joint-stock company (société par actions simplifiée) specialising in digital marketing, with a share capital of €237,585.30, whose registered office is at 114, rue Gallieni – 92100 Boulogne-Billancourt, France, registered with the Nanterre Trade and Companies Register (RCS) under number 820 561 538 and with the French register of insurance intermediaries (ORIAS) under number 19005582.

We attach the utmost importance to the protection of privacy and personal data, and to compliance with applicable law. By personal data, We mean any information relating to an identified or identifiable natural person (hereinafter the “Data”).

The purpose of this privacy policy (hereinafter the “Policy”) is to give You clear information about the processing We carry out on Your Data, in accordance in particular with Regulation (EU) 2016/679 of 27 April 2016 (hereinafter the “GDPR” or the “Applicable Regulations”), available here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

Where artificial intelligence tools are used, Regulation (EU) 2024/1689 of 13 June 2024 on artificial intelligence (hereinafter the “AI Act”) also applies.

We process Your Data lawfully, fairly and transparently, respecting the rights of the data subjects (hereinafter “You”, “Your” or the “Data Subject”).

1. How does our Site work?

The purpose of the Site is to put You in contact with one or two of our partners, in order to offer You a point-of-sale (POS) system.

To this end, Data about You is collected via an online form and then securely transmitted to our partners (listed in Article 5) so that You can be contacted and benefit from this offer.

Our partners may then inform Us of the follow-up given to Your request, so that We can monitor the quality of our service (see Article 4).

Some stages of the process may use artificial intelligence tools, in particular: a conversational assistant via WhatsApp or Messenger; automated analysis of Your answers to pre-select the most suitable offer. When You interact with an automated tool, You are informed of this at the start of the exchange and may at any time ask it to schedule a telephone appointment with an advisor.

Connection Data is also collected via cookies, in order to monitor and secure activity on the Site. This Data is not transmitted to our partners. For more information, please see our Cookie Policy: https://flextopay.com/uk/pos/cookies.

2. Who is the Data Controller?

WEEDEV determines the means and purposes of the following processing operations:

• the collection of Your Data via forms or exchanges with our assistant;
• the analysis of Your Data, including by means of artificial intelligence tools, in order to identify the most relevant offer;
• the transfer of Data to the partners mentioned in Article 5;
• the retention of Data for the periods specified in Article 8;
• the follow-up of requests transmitted to our partners, based on the information they provide to Us about the follow-up given to Your request.

For these purposes, WEEDEV is the Data Controller within the meaning of the GDPR and the “deployer” of the artificial intelligence systems used within the meaning of the AI Act.

WEEDEV is an entity belonging to Hipto Groupe. As such, Your Data may be transmitted to other Hipto Groupe companies, to the extent necessary for the purposes described in this Policy.

Once Your Data has been transmitted to our partners, they become controllers of their own processing, in accordance with their privacy policy.

3. What Data do we collect and how?

The collection of Data via our forms is necessary to put You in contact with our partners offering solutions suited to Your business needs. This Data is relevant and necessary, and is only transmitted with Your consent. You may stop the process at any time by leaving the page.

We collect the following Data:

• Identification data: surname, first name, telephone number, email address, postcode.
• Data relating to Your business: company name, business sector, payment volume.
• Data relating to Your needs: type of solution sought.
• Data relating to Your consent: this allows Us to keep and provide You, on first request, with proof of Your consent to telephone marketing.
• Data from exchanges: content of Your messages with the conversational assistant.
• Data relating to the follow-up of Your request: processing status of Your request by the partner(s) to which it was transmitted (for example: request processed, person unreachable, incorrect contact details, offer subscribed or not). This Data is not collected from You but is provided to Us by these partners.

We ask You not to share any bank details, passwords or sensitive data with the assistant. The Data collected is strictly limited to what is necessary to establish a relevant connection.

4. Purposes and legal bases

The Data collected is transmitted to one or two of our partners so that You can be put in contact with them by telephone. You consent to this by ticking the first box on the form. By ticking the second box, You consent to receiving commercial offers from WEEDEV by email, SMS, WhatsApp or Messenger.

4a. Your consent to telephone marketing

By ticking the first box on the form, You freely, specifically, knowingly and unambiguously consent to being called by telephone by the professional(s) (two at most) indicated when Your consent is collected.

Withdrawal. You may withdraw Your consent at any time, free of charge and without giving reasons, in a way that is no more complex than the way it was given. In particular, You may:

• state it orally during any call, in which case the call is ended immediately;
• write to [email protected].

Your request will be processed as soon as possible and no later than 30 working days.

For the collection of consent to telephone marketing, WEEDEV acts as a third party on behalf of the recipient professionals, within the meaning of Article R. 223-1 of the French Consumer Code. As such, it implements the retention and archiving system provided for in Article R. 223-2 and provides proof of consent to consumers who request it.

Access to proof of Your consent. We keep in digital format the information provided to You when Your consent was collected, together with its date and time. On simple request to [email protected], this proof is provided to You free of charge, on a durable medium, individually and within a reasonable time, for three (3) years from the date of collection.

5. Who are the recipients of Your Data?

Partners. Once Your consent has been obtained, We transmit Your Data to the partner(s), two at most, mentioned on the “reveal” page.

List of our partners (click on their name to view their privacy policy):

• SumUp Systems Limited

These partners may also provide Us with information on the follow-up given to Your request, under the conditions described in Article 4.

Messaging platforms. If You use our services through our Flex To Pay brand on Messenger or WhatsApp, Your Data is shared with the entities operating these platforms, in accordance with their privacy policy: Messenger; WhatsApp.

Processors. WEEDEV uses service providers acting solely on its instructions and implementing appropriate technical and organisational measures, in particular for:

• data and website hosting;
• online form and conversational software;
• sending emails and SMS (Salesforce Marketing Cloud, SMS Mode, Infobip, Brevo);
• the provision of artificial intelligence services: OpenAI (language processing: conversational assistant, request analysis).

Data transmitted to OpenAI via its API is not used to train its models.

Authorities. Data may be transmitted to duly authorised competent authorities, or to any officer of the court in the context of investigating offences committed on the Internet.

Internal recipients. WEEDEV staff only access Your Data to the extent strictly necessary to provide the service.

6. Is Your Data transferred outside the European Union?

Our partners process Your Data within the European Union. Some of our processors, in particular OpenAI, may access the Data from countries outside the European Union. In this case, either the recipient country benefits from an adequacy decision, or appropriate safeguards have been put in place.

You can obtain a copy of the safeguards in place by writing to [email protected].

7. Automated decisions and artificial intelligence

Artificial intelligence tools help Us analyse Your request and pre-select offers. No decision producing legal effects concerning You or similarly significantly affecting You is taken without human intervention.

8. Data retention period

We keep Your Data only for as long as necessary for the purpose of the processing. At the end of these periods, it is permanently deleted or anonymised.

9. Security measures

WEEDEV implements technical and organisational measures designed to protect the Data against any destruction, loss, alteration, disclosure or unauthorised access, taking into account the state of the art, the nature of the Data and the risks. Our security policies are regularly reviewed and updated. Artificial intelligence tools undergo a prior assessment (security, data location, contractual terms) before being deployed.

10. Your rights

The GDPR grants You the following rights:

• Right of access: to obtain access to the Data concerning You, in particular by means of a copy.
• Right to rectification: to have inaccurate or incomplete Data corrected or completed.
• Right to erasure: to obtain, under certain conditions, the deletion of Your Data, including Data processed by our artificial intelligence tools.
• Right to object: to object, on grounds relating to Your particular situation, to processing based on legitimate interest, in particular the use of Your exchanges to improve our tools or the follow-up of Your request based on information provided by our partners.
• Right to withdraw Your consent at any time, in a simple way.
• Right to restriction of processing.
• Right to data portability.
• Right not to be subject to a decision based solely on automated processing which produces legal effects concerning You or similarly significantly affects You, and to obtain human intervention (see Article 7).
• Right to set out instructions regarding the fate of Your Data after Your death.

To exercise Your rights, please contact our Data Protection Officer:

[email protected]

or by post:

DPO – Hipto
114 rue Gallieni
92100 Boulogne-Billancourt
France

You will receive a reply within one month, which may be extended by two months for complex requests.

Please specify the right being exercised and the processing concerned. In case of reasonable doubt, proof of identity may be requested.

You may also lodge a complaint with the French data protection authority (CNIL):

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 place de Fontenoy – TSA 80715
75334 Paris Cedex 07
France
www.cnil.fr

11. Updates to the Policy

This Policy may be updated, in particular in the event of changes to the tools used or to the Applicable Regulations.