Data Privacy ProtocolEnterprise Compliance Framework

This Privacy Policy describes how PAYET FABRICE, as publisher of the RefCampaign platform, collects, uses, stores and protects your personal data. We attach great importance to protecting your personal data and are committed to processing it in accordance with the General Data Protection Regulation (GDPR) and French Data Protection Act. The data controller is: **PAYET FABRICE** SIREN: 798 679 296 Email: contact@refcampaign.com Address: 20 ALLEE DES FLAMBOYANTS, 97429 PETITE-ILE, France

We collect the following personal data: **Identification data:** • First and last name • Email address • Phone number (optional) • Postal address (for Merchants) **Account data:** • Login credentials • Password (encrypted) • Profile information **Payment data:** • Billing information • Payment history • Banking information (processed by Stripe, our payment provider) **Usage data:** • IP address • Browser type and operating system • Pages visited and visit duration • Actions performed on the Platform • Affiliate tracking data (clicks, conversions) **Cookies and similar technologies:** • Session cookies • Analytics cookies • Affiliate tracking cookies

Your personal data is collected and processed for the following purposes: **Service provision:** • Account creation and management • Access to Platform features • Payment processing and billing • Customer support and technical assistance **Affiliate program management:** • Click and conversion tracking • Commission calculation and payment • Reporting and statistics **Service improvement:** • Platform usage analysis • Fraud detection and prevention • Testing and development of new features **Communication:** • Sending transactional emails (confirmations, notifications) • Sending marketing emails (with your consent) • Information about service updates **Legal obligations:** • Compliance with accounting and tax obligations • Response to requests from competent authorities

Processing of your personal data is based on the following legal bases: • **Contract execution**: for provision of RefCampaign service • **Legitimate interest**: for service improvement, fraud prevention and security • **Consent**: for sending marketing emails and use of certain cookies • **Legal obligation**: for compliance with accounting, tax and legal obligations

Your personal data may be transmitted to the following recipients: **Authorized personnel:** Our employees and collaborators who need access to data to ensure Platform operation. **Service providers:** • **Stripe**: payment processing and billing • **Vercel**: Platform hosting • **Resend**: transactional email sending from notifications.refcampaign.com • **PostHog**: analytics and usage tracking (optional) **Competent authorities:** In case of legal obligation, we may need to communicate your data to judicial, administrative or tax authorities. Our providers are subject to strict contractual obligations regarding data protection and can only use your data for defined purposes.

Some of our providers may be located outside the European Union. In this case, we ensure that: • The country benefits from an adequacy decision from the European Commission • Appropriate safeguards are in place (standard contractual clauses, Privacy Shield) • Your explicit consent has been obtained User data is primarily hosted in data centers located in Europe.

Your personal data is retained for the period necessary for the purposes for which it was collected: • **Account data**: throughout service usage, then 3 years after last activity • **Billing data**: 10 years in accordance with accounting obligations • **Tracking data**: according to subscription plan (30, 90 days or unlimited) • **Cookies**: 13 months maximum Beyond these periods, your data is deleted or anonymized.

In accordance with GDPR, you have the following rights regarding your personal data: • **Right of access**: obtain a copy of your personal data • **Right of rectification**: correct inaccurate or incomplete data • **Right to erasure**: request deletion of your data • **Right to restriction**: limit processing of your data in certain cases • **Right to portability**: receive your data in a structured, readable format • **Right to object**: object to processing of your data for legitimate reasons • **Right to withdraw consent**: for consent-based processing • **Right to define post-mortem directives**: on fate of your data after death To exercise these rights, you can contact us at: contact@refcampaign.com You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

We implement appropriate technical and organizational measures to protect your personal data against destruction, loss, alteration, unauthorized disclosure or unauthorized access: • Encryption of sensitive data (SSL/TLS) • Password encryption • Restricted access to personal data • Intrusion monitoring and detection • Regular backups • Staff training on data protection However, no method of transmission over the Internet or electronic storage is completely secure. We therefore cannot guarantee absolute security.

The Platform uses cookies and similar technologies to improve your user experience. **Types of cookies used:** • **Strictly necessary cookies**: essential for Platform operation (authentication, security) • **Performance cookies**: analysis of Platform usage for improvement • **Affiliate tracking cookies**: attribution of conversions to affiliates (duration: 30 days by default) • **Marketing cookies**: content and advertising personalization (with your consent) You can configure your cookie preferences through your browser settings or our cookie management banner. Refusal of strictly necessary cookies may prevent use of certain Platform features.

The Platform is not intended for persons under 18 years of age. We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at contact@refcampaign.com so we can delete this data.

We reserve the right to modify this Privacy Policy at any time. Any significant modification will be notified to you by email or Platform notification. The last update date is indicated at the top of this document. We encourage you to regularly consult this page to be aware of any modifications.

For any questions regarding this Privacy Policy or to exercise your rights, you can contact us: **By email:** contact@refcampaign.com **By mail:** PAYET FABRICE 20 ALLEE DES FLAMBOYANTS 97429 PETITE-ILE France We are committed to responding to your requests within a maximum of one month.