Platform Privacy Policy

Required information

Last modified on March 21, 2025

This privacy policy (the "Privacy Policy") is intended to inform Users and KOLs of the processing of their personal data (hereinafter: “Personal Data”) that Kolsquare carries out when they use the Platform as well as the rules that Kolsquare applies when it processes this Personal Data as a controller.

The Privacy Policy supplements the Platform's TOS. Capitalized terms not defined in the Privacy Policy have the meaning given to them in the TOS.

By using the Platform, the Users and KOL are bound by the Privacy Policy, which can be modified or updated at any time. Any modification will be posted on the Platform. Kolsquare invites the Users and KOL to regularly consult the Privacy Policy. If the modifications or updates concern elements for which the consent of the Users and KOLs was required, Kolsquare will inform the Users in order to obtain their consent again.

1. Who is the data controller?

The party responsible for collecting and processing your Personal Data is Kolsquare, a simplified joint stock company (SAS) with capital of 19,116 euros, whose registered office is located at 124 rue Réaumur - 75002 Paris, registered with the Paris Trade and Companies Registry under number 529 297 483, represented by its President, Mr. Quentin Bordage, which offers the Services (hereinafter referred to together as “We”).

2. What personal data processing activities are implemented by Kolsquare ?

When Kolsquare collects and processes the Personal Data of Users and KOLs, it undertakes to treat them in accordance with the Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms, known as "Informatique et Libertés" as well as Regulation (EU) No. 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (together, the "Applicable Regulation").

Kolsquare undertakes to collect and process Personal Data in a fair and lawful manner, for the following precise and legitimate purposes and by respecting the rights of the Users and KOLs.

Kolsquare uses the Personal Data of the Users and KOLs for:

• the creation of an Account on the Platform (KOLs or Users). The treatment is based on the CGU which bind the KOLs and Users to Kolsquare;

• the constitution of the database of the KOLs (including the KOLs not registered on the Platform whose profile is public on social networks). Kolsquare treats, in this case, the Personal Data of the KOLs on the basis of its legitimate interest which consists of enriching its data base with public information;

• to allow the KOLs to manage their profile on Community and, in particular, to measure their influence on their various social networks, to receive offers of partnerships of the Customers, and to enter into exchanges with the Users (legal basis: CGU which bind the KOL and Kolsquare);
• to allow the Users of the same Client to communicate and manage their Campaigns and to exchange information with the KOLs as well as to synchronize their Gmail account with the Platform (legal basis: CGU which bind the Client and the Users to Kolsquare);

• to allow the User to constitute research of the KOLs, to constitute address books of KOLs, and to measure the performances of the Platform Campaigns (legal basis: CGU which bind the Customer and the Users to Kolsquare);

• the management of the invoicing of the Platform Customers (legal basis: GTC and contract which binds the Customer to Kolsquare);

• the improvement of the Platform according to the feedbacks of the Users and KOLs and to reduce problems of dysfunction of the Platform (legal basis: legitimate interest of Kolsquare, which consists in improving its products and services to answer the needs and/or requests of the Users and/or KOLs);

• measure and analyze the audience of the Platform as well as the contents consulted, its performance, detect navigation problems, and propose personalized contents (legal basis: legitimate interest of Kolsquare, which consists of allowing the good functioning of the Platform);

• to manage the commercial relationship with the Customers and KOLs and, if necessary, the prelitigation or litigation (legal basis: execution of the contract with the Customers and legitimate interest of Kolsquare in case of litigation);

• organize the payment of KOL missions through our payment partner (which may itself act as Merchant of Record where necessary by integrating one or more payment providers into its tool) and manage and supervise the financial flows involved;

• the anonymization of the Accounts, if necessary, or of the Personal Data of the KOLs in order to carry out analyses of the sector and market or of demographic profiling (legal basis: legitimate interest of Kolsquare, which consists of offering market studies);

• respond to requests from KOLs or Users reporting inappropriate or illegal content (legal basis: legal obligation of Kolsquare);

• the withdrawal or removal from the database of KOLs who have not complied with all or part of the GTC or no longer wish to be part of the database of Kolsquare (legal basis: GTC that bind Kolsquare to KOLs).

3. What data is processed by Kolsquare?

Within the framework of the Platform, Kolsquare collects the following Personal Data:

• for KOLs:

• Identification data*: name, first name, date of birth, nickname/alias, age, nationality, contact information, photographs, videos, sound and physical description if applicable;
• Personal life data*: social networks and/or sites used, publications posted on social networks, lifestyle habits;
• Data relating to professional life*(in particular with the assistance of our payment service provider partner): CV, types of services, URSSAF or SIRET number, APE code, profession; if applicable, the VAT number, the identity of the company's legal representative and information on the mission carried out for customers;
• Economic and Financial Information: Remuneration and/or KOL estimate for partnerships;
• Connection data*: navigation data (cookies) and IP address;
• if KOLs log into their Account from another social network's account (such as Instagram, TikTok or Twitter), the social network may disclose to Kolsquare the KOL's profile information as well as any information the KOL has authorized to be disclosed;

• for Users:

• Identification data*: name, first name, identifier and, if applicable, photograph;
• Work-related data: work email address, work phone number, position and employer (Client);
• Connection data*: navigation data (cookies) and IP address;
• Any other information that the User transmits on the Platform.

Kolsquare collects Personal Data either directly from Users and / or KOLs (during exchanges, including telephone, or via the forms of the Site) or indirectly through third parties (Customer, websites, social networks, third party cookies, etc.).

The Personal Data identified by an asterisk are mandatory for the use of the Platform.

The Users and KOLs are required to provide Kolsquare with their data in a sincere, accurate, and true manner and to update them as soon as necessary.

4. What are the legal bases for the processing carried out?

According to the processing identified above, it is reminded that Kolsquare's legal bases for processing Personal Data are systematically the following:

- Performance of the contract between us (general terms of use or general terms of subscription);

- Legal obligation;

- Legitimate interest;

- Consent (if applicable for cookies).

5. How long does Kolsquare keep the Personal Data?

Kolsquare keeps the Personal Data of the Users and KOLs during all the time of their use of the Platform.

Kolsquare then keeps the Personal Data on an intermediate basis, with restricted access, for a period of five (5) years, or, in case of litigation, for the duration of the litigation.

6. What are the transfers of Personal Data made by Kolsquare?

Within the framework of the management of the Platform, Kolsquare can transmit the Personal Data of the Users and KOLs to several recipients, in particular its service providers and partners.

The recipients of the Personal Data of the Users and KOLs are the following:

• Users may receive Personal Data from KOLs while KOLs may receive Personal Data from Users when the latter wish to contact them;

• Google Cloud Platform, which is the host of the Platform and whose servers are located in Belgium;

• HubSpot and Salesforce, which are the customer relationship management tools used by Kolsquare and whose servers are located in the United States. Kolsquare has concluded with these providers the standard contractual clauses of the European Commission to protect the transfer of Personal Data to the United States;

• Novity, which is Kolsquare’s service provider to constitute the database of KOLs and whose servers are located in Madagascar. Kolsquare and Novity have agreed to the European

Commission's standard contractual clauses for the protection of Personal Data;

Google, when syncing the Gmail account to Kolsquare. In this case, Kolsquare's use and transfer to any other application of information received from Google APIs will comply with the Google API Services User Data Policy, including the limited use requirements ;

• Any payment service provider likely to open a payment account enabling the KOL to receive payment for missions carried out on the Platform (as of the date hereof, the service provider selected is Gigapay, which implements data processing in accordance with its own privacy policy accessible via the following link: https://www.gigapay.co/legal/privacy-policy);

• If Kolsquare is the object of a merger-acquisition or merger-absorption by a third company, the Personal Data will be transmitted to it. In this case, Kolsquare will inform the Users and the KOLs.

Kolsquare has ensured the compliance with the RGPD of the treatments carried out by its subcontractors. Kolsquare has put in place the necessary measures with regard to the sensitivity of the data processed to ensure their security and avoid, in particular, their disclosure to unauthorized third parties.

If applicable within the framework of the tools we use, your data may be transferred outside the European Union. The transfer of your data in this context is secured using the following tools:

- either the data is transferred to a country that has been the subject of an adequacy decision by the European Commission, in accordance with Article 45 of the RGPD: in this case, this country ensures a level of protection deemed sufficient and adequate to the provisions of the RGPD.

- or the data is transferred to a country whose level of data protection has not been recognized as adequate to the RGPD: in this case such transfers are based on appropriate safeguards indicated in Article 46 of the RGPD, tailored to each provider, including but not limited to the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules or under an approved certification mechanism.

- or the data is transferred on the basis of one of the appropriate guarantees described in Chapter V of the RGPD.

7. Data security

Kolsquare implements the appropriate administrative, physical, technical, and organizational measures to protect the Personal Data in order to guarantee their confidentiality and a level of security appropriate to the risks of accidental, unauthorized, or illegal access, disclosure, alteration, loss, or destruction of Personal Data.

In the event that Kolsquare becomes aware of an illegal access or a violation of the Personal Data stored on our servers or those of our providers, or of an unauthorized access resulting in the realization of high risks for the rights and fundamental freedoms of the Users and KOLs, Kolsquare will take the necessary measures to limit the damage that may result, will notify the National Commission of Computing and Freedoms, and will inform the Users and KOLs.

8. Your rights

The Users and KOLs have various rights on their Personal Data. They can exercise all or part of the following rights with Kolsquare:

• right of access, which allows Users and KOLs to know which information Kolsquare holds about them and the reasons why Kolsquare uses it;
• right to rectify or have rectified their Personal Data which would be inaccurate or incomplete;

• right to the erasure of their Personal Data. This right allows you to obtain the erasure of data held by Kolsquare, except for data that Kolsquare must retain to meet a legal obligation or to defend its rights in court;

• right to data portability, which allows Users and KOLs to receive their Personal Data in a structured, commonly used, and readable format, or to ask Kolsquare to transmit it to another company;

• right to limit the processing of data. In this case, Kolsquare will no longer use the data of the Users and KOLs but will be able to keep them in order to meet its legal obligations or for the defense of its legal rights;

• right to oppose the processing of data when Kolsquare uses the data of Users and KOLs for its legitimate interests. The Users and KOLs can also object to the processing of their Personal Data for commercial prospecting purposes, in particular by clicking on the link provided for this purpose in the emails from Kolsquare;

• the right to provide a digital will, i. e. instructions on the use of the data of Users and KOLs after their death.

When Kolsquare uses the Personal Data of Users and KOLs with their consent, Users and KOLs have the right to withdraw such consent at any time, but this will not affect the lawfulness of the processing carried out prior to the withdrawal of such consent.

Users can exercise their rights by writing to:

• Kolsquare - data protection department - 124 rue Réamur - 75002 Paris -

France; or ✦ privacy@kolsquare.com.

Finally, Users and KOLs have the right to file a complaint with the National Commission de l'Informatique et des Libertés (CNIL).

9. Cookies

9.1. What is a cookie?

A cookie is a file that can be saved on the hard disk of your terminal when the User consults the Site. These small files may contain, for example, the language of the browser and the User's preferences.

Kolsquare may place cookies on the terminals of Users to enable them to navigate in optimal conditions on the Site and restore their preferences when they are connected via their usual terminal as well as to create statistics.

9.2. Cookies used by Kolsquare via the website

Kolsquare uses cookies:

• of navigation, which are cookies necessary for the proper technical functioning of the Site as they allow for the optimization of the display of the content from each terminal and for the application of security parameters ("_cfuid" cookies), which expire when the User closes his browser;

• functional cookies, which are not essential to the proper functioning of the Site but optimize the experience on the Site by allowing it to be adapted to the User's terminal and by saving the User's choice regarding the deposit of cookies. These cookies expire after one year;

• analytics and audience measurement, which allow to follow the navigation of the Users for the purpose of optimization. Kolsquare uses:

• Google Analytics, a web analytics service provided by Google to improve the operation of the Site. Google Analytics uses the data collected, including the number of visitors, the origin and the details of the pages that were visited, to track and study the use of the Site, to prepare reports on activities. Google's privacy policy is available under this link. The main cookies used are the following:

• HubSpot, whose privacy policy is available at this link:

Users can accept or refuse the deposit of cookies on their terminal using the banner provided for this purpose when they connect to the Site.

Users may also, at any time, delete cookies from their computer software and configure them to oppose their registration.

Kolsquare invites Users to refer to the help file of the navigation software to establish the appropriate configuration. Browsing of the Site without accepting cookies may be degraded.

9.3. Traffic data

Traffic data is generated when the User's terminal is connected to the Internet and the Site.

These data may be used for statistical purposes in order to analyze traffic on the Site and to improve it by adapting it to the needs of Users. The traffic data are never used by Kolsquare by name.

10. Gmail Synchronization

Kolsquare’s use and transfer to any other app of information received from Google APIs will adhere

11. Modifications

We may modify this policy at any time, in particular in order to comply with any regulatory, legal, editorial or technical developments. These modifications will apply as of the effective date of the modified version. You are therefore invited to consult the latest version of this policy on a regular basis. Nevertheless, we will keep you informed of any significant changes to this privacy policy.