ALMA – Personal Data Protection Policy

Data Controller: Chaumet International SA (hereinafter, "CHAUMET"),
a public limited company (société anonyme) with its registered office at
12 place Vendôme, 75001 Paris (France), registered with the Paris Trade and
Companies Register under number B 342 966 942. DPO Contact: privacy@chaumet.com

This information notice explains how CHAUMET
collects and uses personal data in connection with the use of its e-learning
application ALMA (hereinafter, the "Application") for the
delivery and administration of training, progress tracking, and assessments.

We may process the following categories of
personal data:

Identification and employment data

• First
  and last name, employee ID, professional contact details
• Job
  title, department/service, workplace, manager/line manager

Training and assessment data

• Assigned
  training, training paths, attendance/participation
• Completion
  status, certifications (if applicable)
• Assessment
  results (e.g., test scores) and assessment data related to the training

Technical logs and usage data

• Account
  IDs, login/logout events, timestamps
• IP address,
  device/browser information, application version
• Security
  and audit logs, error logs, basic usage events necessary for support and
  security

• From
  you when you use the Application (e.g., completing modules, taking
  assessments)
• From
  employee files in order to provision access and assign training (e.g.,
  identity, role, reporting line)
• Automatically
  via the Application (technical logs and security/audit trails)

We process personal data in order to:

• Provide
  and administer the Application (access management, account management,
  training assignment)
• Organize
  and manage training programs (including mandatory training if applicable)
• Assess
  knowledge and training completion (tests, completion tracking)
• Produce
  training-related reports for HR and authorized management
• Ensure
  the security and proper functioning of the Application (fraud prevention,
  access control, incident investigation, troubleshooting and maintenance)

We rely on the following legal bases under the
GDPR, depending on the context:

• Legitimate
  interest: Organization of training sessions and assessment of knowledge
  and training. Administration and
  securing of the Application.
• Performance
  of a contract: Management of training requests and training periods
  completed.

Internal recipients (authorized persons only):

• Human
  Resources (HR) and training teams
• Managers/line
  managers (to the extent necessary for training management)
• IT
  and security teams (support, security, incident management)

External recipients (processors):

• Service
  providers involved in the development, hosting, maintenance, and support
  of the Application

All recipients are subject to appropriate
confidentiality and data protection obligations.

Certain recipients may be located in, or access
data from, foreign countries, particularly outside the EU. When international
transfers take place, they are framed by appropriate safeguards in accordance
with applicable law.

We retain personal data:

• For
  the duration of the employment relationship, then
• Archived for 5
  years.

We implement appropriate technical and
organizational measures to protect personal data, notably access controls,
role-based authorizations, authentication, logging/supervision, secure hosting,
and encryption in transit.

Subject to their admissibility, you have the
following rights:

• Right of access;
• Right to
  rectification;
• Right to
  erasure;
• Right
  to restriction of processing;
• Right to object.

In case of questions regarding the processing
of your personal data, you can contact our Data Protection Officer at the
following address: privacy@chaumet.com. You also have the right to lodge a
complaint with the competent supervisory authority (e.g., in France, the CNIL).

The Application may use cookies or similar
technologies strictly necessary for authentication, session management, and
security.

We may update this information notice. The most
recent version will be available within the Application.