PERSONAL DATA PRIVACY POLICY — IPTV One

ARTICLE 1. PURPOSE

Runway is a simplified joint-stock company (société par actions simplifiée) registered under SIREN 989 869 276, with its registered office at 2 Place de la Grande Hermine, 35400 SAINT-MALO.

This data use policy is intended to explain clearly and transparently how Runway, as data controller, collects, records, retains and communicates the personal data of Users (hereinafter referred to as "Data Subjects" or a "Data Subject") of the IPTV One Application.

Runway places privacy and respect for personal data at the heart of its concerns.

Runway undertakes to ensure that this policy, and its practical application, comply with the personal data protection framework (hereinafter "Applicable Regulations"), in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data (hereinafter the "GDPR");
• French Data Protection Act no. 78-17 of 6 January 1978, as amended by Act no. 2018-493 of 20 June 2018;
• Decree no. 2019-536 of 29 May 2019 implementing Act no. 78-17 of 6 January 1978 relating to information technology, data files and civil liberties.

This policy may be updated in line with changes in the legal and regulatory context and the doctrine of the French data protection authority (Commission nationale de l'informatique et des libertés, hereinafter "CNIL").

ARTICLE 2. DEFINITIONS

Capitalised terms used in this policy have the meanings given below:

"Application": refers to the IPTV One application;

"Runway": refers to Runway, as data controller.

"Users": refers to any natural person using the IPTV One Application;

"Data Subject": refers to Users whose personal data are collected via the Application;

"Data Controller": refers to Runway, which determines the purposes and means of the processing operations described in this policy.

ARTICLE 3. CONTACTING THE DATA CONTROLLER

Data Subjects may contact the data controller with any questions regarding the processing of their personal data or the exercise of their rights (see Article 8) by writing to: [email protected]h

ARTICLE 4. COLLECTION OF PERSONAL DATA

The term "personal data" (hereinafter "data") refers to any information relating to a natural person that allows them to be identified, either directly or indirectly.

Runway collects the following User data:

• Identity: email address, IP address.

Runway collects and processes this personal data for a specified, explicit and legitimate purpose.

Runway takes care, however, to limit the collection of such data to what is strictly necessary for the purpose pursued.

Personal data may be collected by Runway, as applicable:

• Via collection forms completed by the User when subscribing to a subscription on the Application.

It is noted that certain data must be provided; without it, Runway will not be able to process the User's request.

Failure to provide information not marked with an asterisk does not prevent Runway from processing the User's request.

Finally, in any event and in accordance with Applicable Regulations, each processing operation carried out by Runway is based on one or more of the following legal grounds (see Article 6 of the GDPR):

• The consent of the Data Subject;
• The performance of a contract or pre-contractual measures taken at the request of the Data Subject;
• Compliance with a legal obligation requiring the processing of data;
• Runway's legitimate interests, in particular with regard to the improvement of its services.

ARTICLE 5. RECIPIENTS OF PERSONAL DATA

Data collected by Runway is processed:

• Internally by Runway;

• By trusted service providers chosen by Runway, which process such data specifically on behalf of and for the account of Runway. Runway ensures that all service providers it uses provide sufficient guarantees in terms of data protection, particularly as regards confidentiality and security.

By way of example, Runway may use IT service providers (email services, audience analytics solutions, hosting) or payment service providers (Stripe).

Runway may also be required to communicate Data Subjects' data to professional institutions such as:

• Courts and tribunals;
• Legal professionals (bailiffs, notaries and solicitors);
• The CNIL;
• Mediation centres.

Data Subjects' personal data is hosted within the European Union (EU) and is not transferred outside the EU.

Such transfers are, however, justified, as applicable, by:

• The explicit consent of the Data Subject, who has been informed of the risks to their data in the absence of an adequacy decision and appropriate safeguards;
• The performance of a contract between the Data Subject and Runway;
• The establishment, exercise or defence of legal claims.

ARTICLE 6. RETENTION PERIOD

Runway retains Data Subjects' data only for as long as is necessary to fulfil the purpose pursued at the time of collection and in compliance with Applicable Regulations.

ARTICLE 7. DETAILS OF PROCESSING OPERATIONS

ARTICLE 8. SECURITY OF PERSONAL DATA

Runway implements organisational and technical measures to ensure the security of Users' data, protecting it against loss, alteration, disclosure and unauthorised access.

In the event of an incident affecting personal data, Runway will, in accordance with the regulatory framework, notify the CNIL as soon as possible after becoming aware of it, and will inform Data Subjects as necessary.

ARTICLE 9. RIGHTS OF DATA SUBJECTS

In accordance with Applicable Regulations, Data Subjects have the following rights over their data:

• The right to know whether personal data concerning them is being processed by Runway and, where applicable, the right to access such data and any related information;
• The right to request the rectification of any inaccurate personal data;
• Where processing is based on consent, the right to withdraw that consent at any time; otherwise, the right to object, under the conditions of Article 21 of the GDPR, to processing that they have not authorised;
• The right to request the erasure of data processed under the conditions set out in Article 17 of the GDPR (in particular where the Data Subject objects to processing);
• The right to restriction of processing under the conditions of Article 18 of the GDPR;
• The right to issue instructions specifying how their rights over their personal data should be exercised after their death;
• Where processing is based on a contract or on consent, the right to receive the personal data they have provided to Runway in a structured, commonly used and machine-readable format, in particular so that it can be transmitted to another controller, or even the right for Runway to transmit their data directly to the new controller;
• The right to lodge a complaint with the CNIL (www.cnil.fr/fr/plaintes), as well as the right to seek judicial redress.

Data Subjects may exercise their rights by email at: [email protected] or by post to: Runway, 2 Place de la Grande Hermine, 35400 SAINT-MALO.

When submitting a request to exercise their rights, the Data Subject must provide proof of their identity to Runway.

Accordingly, if there is reasonable doubt as to the Data Subject's identity and it cannot be verified by other means, Runway may ask the Data Subject to provide a copy of an identity document.

For further information on their rights, Data Subjects may consult the CNIL website: www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles.

ARTICLE 10. COOKIES

When the Application is used, a website publisher such as Runway may, subject to the Data Subject's choices, place a text file on their device (computer, smartphone, tablet) via their browser.

This text file is a cookie. For the duration of its validity or storage, it enables the Data Subject's device to be identified on subsequent visits.

Runway places cookies on the Data Subject's device.

On the Data Subject's first visit to the Runway Application, they are informed of the use of cookies via a banner. This banner includes the options "OK, accept all", "Reject all" or "Customise".

The Data Subject may independently consent to or refuse each purpose of cookies by clicking "Customise" on the banner.

Accepting cookies results in Google Analytics audience measurement cookies being placed in the browser.

These cookies do not allow Runway to identify the Data Subject; they serve primarily statistical purposes that help improve the quality and performance of the service.

Data collected in this context is retained for one year from the end of the Data Subject's first visit to the Application.