Data Protection Policy for the "Pilla" Internet and Mobile Application 

1. Preamble

The trademark "Pilla" is owned by Crédit Agricole next bank (Suisse) SA (hereinafter "CAnb", the "Bank" or "we"), which operates the Internet and mobile application "Pilla" (hereinafter the "Application").

The purpose of this Data Protection Policy (hereinafter the "Policy" or this "Document") is to provide users (hereinafter referred to as "you") with clear and detailed information about the way in which we process and store your personal data and your rights in relation to such processing.

2. Data Controller

In accordance with the data protection regulations in force, Crédit Agricole next bank (Suisse) SA is the "Data Controller". We define the nature of the data to be collected, the purposes for which it is to be used and how long it is to be kept, except in cases where it is expressly stated on the data collection medium that the Data Controller is a third party.

Within the scope of the "Pilla" Application, CAnb collaborates with the selected partners mentioned below (the "Partners"). When you subscribe to offers and services from one of our Partners (e.g. Liberty), this Partner acts as an independent Data Controller and will inform you of the characteristics of the processing operations it carries out under its sole responsibility.

3. Who is this Data Protection Policy intended for?

This Data Protection Policy concerns you for one or more of the following reasons:

- You have registered and have a user account for the Pilla Application: Your personal data is processed when you use the Application and create your "Pilla" account;

- You used a previous version of the Application: You have given us your consent to migrate your information to "Pilla".

4. What data do we collect about you and for what purpose?

Personal data is any information about a natural person that can be used to identify that person. It therefore does not concern data that does not relate to an identified or identifiable person (anonymous data).

4.1. Registering and using the Application

When you install the Application, we may collect, use, store, access and transfer the following categories of personal data about you:

- Identity data such as first name, maiden name, family name, identification number or any other similar identifier, marital status, title, date of birth, sex, etc.;

- Contact information such as home address, email address and telephone numbers, etc.;

- Information on products and services purchased from Partners;

- Technical data such as cookies, trackers, type of device, Application version, IP address, country of connection, day and time of connection, etc.

Processing this personal data is necessary to provide you with the services available in the Application.

In principle, we do not collect any information belonging to particular categories of sensitive personal data about you (race, ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, genetic and biometric data, information about any criminal convictions or offences, etc.).

4.2 Marketing

We may contact you to inform you of our activities if you have created an account in the Application, subscribed to one of our Partners' offers and have not objected to your data being used for this purpose. You may object to the use of your data for this purpose at any time by contacting us (see the contact information in section 9). This processing activity is based on our legitimate interest in issuing certain offers and activities related to our previous interactions with you.

We may carry out targeting and profiling operations on the basis of your data, particularly data relating to cookies and trackers. In accordance with your interests and your rights, the purpose of this processing is also to manage our marketing activities, develop new offers, and provide you with advice and personalised offers in order to provide you with the highest quality of service.

4.3 Offers and services from Partners

When you subscribe to Partner offers and services, the data collected and the provisions relating to personal data are indicated by the Partner under its sole responsibility.

5. How long do we keep your personal data?

We keep and process your personal data as long as needed to achieve the intended purpose. Data will be deleted as soon as it is no longer required to provide the service:

- The data collected when you register in the Application will be deleted no later than one (1) month after the date on which your account is created in the Application if you do not subscribe.

- If you have subscribed to at least one offer from one of our Partners, the data collected at the time of registration in the Application will be deleted no later than one (1) year after the closing date of the last contract.

- The storage period for the data you provide to Partners when subscribing to their offer will be specified by these Partners under their sole responsibility.

Please note that personal data may be kept in an archive (i.e. with restricted access), taking into account our legal obligations, for a maximum period corresponding to the duration of the contractual or business relationship plus the statutory periods for limitation and exhaustion of legal remedies.

6. To whom do we disclose your personal data?

In the course of Application usage, we may communicate your personal data to the following categories of recipients:

- selected Partners when you subscribe to their offers and services, for example in the area of pension funds;

- our sub-contractors, who process your personal data on our behalf and in accordance with our instructions and who may not use this data for any purpose other than performing the sub-contracted operations.

- authorities: we may disclose personal data to government authorities, courts and other regulatory authorities or agencies in Switzerland or abroad if we are legally required or permitted to, or if it is deemed necessary to protect our interests.

7. How do we handle your personal data if it is transferred outside of Switzerland?

We take great care to ensure that your personal data is processed and stored in Switzerland or in a country whose data protection legislation is recognised as "adequate" by the Swiss Federal Data Protection and Information Commissioner.

Within the scope of the "Pilla" Application, data may be transferred outside of Switzerland. This is particularly the case when we use service providers for the following services:

- Hosting of the Application data, taken care of by cloud service providers in Switzerland.

Some of these service providers are headquartered in the United States and are Swiss-US Data Privacy Framework certified (new data protection framework guaranteeing the security of personal data exchanges between Switzerland and certified US companies).

8. What are your rights, and how can you exercise them?

You may do the following at any time in accordance with the conditions laid down in the Federal Data Protection Act:

- access your personal data: you can obtain information about the processing and disclosure of your personal data;

- have it rectified: you can request the rectification of your personal data if it is inaccurate or incomplete;

- object to its processing on grounds relating to your particular situation, where the legal basis for the processing is the legitimate interest of the Bank or third parties (unless the Bank can prove the existence of legitimate and compelling grounds for such processing which take precedence over your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims) – at any time and without justification, to its processing for purposes of commercial prospecting;

- request its deletion: you can request the deletion of your personal data, particularly when it is no longer necessary for the purposes for which it was collected, with the notable exception of processing required for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;

- request the restriction of its processing: you can request the suspension or restriction of the processing of your data;

- request its portability: when the processing is automated and is based on consent or the performance of the contract or pre-contractual measures, you may request the return of the personal data that you have provided to us and/or its transfer to a third party;

- Lastly, you can, when the legal basis for the processing is consent, withdraw your consent for the future and thus put an end to the processing of your data, it being specified that the withdrawal of consent does not call into question the lawfulness of the processing carried out until then.

Please note that exercising some of these rights may prevent the Bank from providing certain products or services.

If you wish to exercise any of your rights, you may write to the address mentioned in the section "Your contact points", indicating the right(s) you wish to exercise as well as all elements enabling your identification (identity document, contract number, etc.).

9. Your contact points

If you have any questions or complaints, or if you wish to exercise the rights mentioned above, you can contact:

- By post: Crédit Agricole next bank (Suisse) SA – Service Marketing Relation Client – Esplanade de Pont Rouge 4-6 – CP 1250, 1211 Geneva 26

The Bank has appointed a Data Protection Officer (DPO), whom you can contact at the following addresses: Crédit Agricole next bank (Suisse) SA – Data Protection Officer – Esplanade de Pont Rouge 4-6 - CP 1250, 1211 Geneva 26 or by email: dpo@ca-nextbank.ch.

A representative of the Bank has been appointed for data protection within the EU and can be contacted as follows: CADS (CAnb Representative) – 1 220 avenue Costa de Beauregard – 73 290 La Motte Servolex or by email: representantcanb@ca-des-savoie.fr

In the event of a dispute, you may file a complaint with the competent data protection authority.