Privacy policy • MYM for ambassadors

DATA PROTECTION AND PRIVACY POLICY Version dated 19/01/2022 This Privacy Policy is intended for users of the MYM.FANS platform accessible at the following address: https://mym.fans/ (hereinafter “ the Platform”) for the purpose of informing them on the way in which their personal data may be collected and processed. Respect for privacy and personal data is a priority for AIR MEDIAS (MYM), which is why we undertake to process your data in strict compliance with the French Data Protection Act of 6 January 1978 (hereinafter referred to as the "IEL Act"), as amended, and the General Data Protection Regulation (EU) of 27 April 2016 (hereinafter referred to as the "GDPR"). 1. General information and details of the Data Controller AIR MEDIAS, a simplified joint stock company with a share capital of 502 000 euros, registered in the Lyon Trade and Companies Register under number 809 565 906 and with headquarters located at 16, rue Cuvier 69006 Lyon. AIR MEDIAS (MYM) is the Data Controller for processing related to:

managing and tracking accounts and contracts
providing and managing services
managing payments
managing requests for information from the customer relations service
the sending of emails
managing requests related to rights
the correct functioning and ongoing improvements of the Platform

Legal reminder: Under the IEL Act and the GDPR, the Data Controller is the person who decides the methods and purposes of the processing. In cases where two or more Data Controllers jointly decide the methods and purposes of the processing, they are Joint Data Controllers (or Joint Controllers). The Data Processor is a person processing of personal data on behalf of the Data Controller, acting under the authority and on the instructions of the Data Controller. 2. Definitions

“Data”: means the personal data subject to the Processing within the framework of this Privacy Policy.
“Personal Data”: means personal data as defined in article 4 (1) of the GDPR.
“General Data Protection Regulation” or the “GDPR”: means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“User”: means any person browsing on the Platform https://mym.fans/, whether a Fan, Creator, Ambassador or simple internet user.
“Processing/Process”: means any of the operations specified in article 4 (2) of the GDPR, carried out on the Personal Data within the context of the performance of this Privacy Policy.
“Data Processor”: means the natural or legal person, public authority, department or other body that processes Personal Data on behalf of and on the instructions of AIR MEDIAS (MYM) in accordance with article 4 (8) of the GDPR.

3. Purpose of the treatment and legal bases AIR MEDIAS (MYM) solely collects the Data necessary for the explicit purposes specified below:

Main purpose	Detail	Legal basis
Managing and tracking accounts and contracts	Signing up Fans; Signing up Creators; Signing up Ambassadors; Certifying the accounts of Creators, Ambassadors and Fans.	User consent
Providing and managing services	Connecting Fans to Creators Connecting Ambassadors to Creators	Performance of a contract or performance of pre-contractual measures
Managing payments	Payment Tracking invoices Keeping accounting records and legal documents	Legal obligation: article L. 102 B et seq. of the Tax Procedure Code
Managing requests for information from the customer relations service	Tracking and responding to requests for information from the customer relations service	Performance of a contract or performance of pre-contractual measures
Sending mailshots by email	Sending emails and other alerts to Users who have requested such information	User consent
Managing requests related to rights under the GDPR and the IEL Act	This processing covers all operations necessary for following up requests for rights addressed to AIR MEDIAS (MYM) (classifying the request, investigations, performance of specific technical operations, etc.). It only concerns cases in which AIR MEDIAS (MYM) acts as Data Controller.	Our legal obligation under articles 15 et seq. of the GDPR and articles 48 et seq. of the IEL Act
The correct functioning and ongoing improvements of the Platform and its functions	Ensuring the correct functioning and ongoing improvements of the Platform and its functions	Our legitimate interest to guarantee the optimal functioning and quality of the Platform, largely due to audience statistics. User consent, when this is required.

4. Collected data The compulsory or optional nature of the personal data collected and the possible consequences of a failure to respond are explained during the various contacts with the data subjects. Below, you can find details about the personal data that we are likely to have about you. NB: the detail of the information provided below is not intended to be exhaustive and aims above all to inform Users about the categories of data that AIR MEDIAS (MYM) is likely to process.

Purpose	Data processed
For managing and tracking accounts and contracts	Data regarding User identity: last name, first name(s), address, telephone number, email addresses, username, date of birth, data provided in the biography, photos, copy of passport/ID card
For providing and managing services
For managing payments	IBAN Bank card number (only the last 4 numbers are recorded) PayPal email address Information required for issuing invoices
For managing requests for information from the customer relations service	Email address Order number
To send mailshots by email	Contact information of the User (last name, first name, email address)
For managing requests related to rights	Email address Order number
For the correct functioning and ongoing improvements of the Platform	Logs and connection data of Users and the identification data of the IT equipment; Data collected by cookies and other traces present on our Platform; for further details, please see our Cookie Charte.

5. Personal data collected automatically When you browse on the https://mym.fans/Platform, AIR MEDIAS (MYM) automatically records information about your browsing. When you use our services, connection data may be automatically recorded in our server logs, such as your IP address, your unique identifier, your operating system and its location, the type of browser you are using and the pages you have visited. 6. Data recipients Only the authorised persons specified below can access User data.

The other Platform Users;

The authorised personnel of AIR MEDIAS (MYM);
Service providers responsible for managing and hosting the Platform and IT system of AIR MEDIAS (MYM);
Service providers responsible for managing customer relations and moderating content;
Service providers responsible for managing payments;
Email service providers;
If applicable, the authorised personnel of our Data Processors;
Where appropriate, the relevant courts, mediators, accountants, statutory auditors, lawyers, bailiffs, debt collection agencies or police authorities in the case of theft or judicial requisition;
Third parties that may place cookies on your terminals when you provide your consent

Your data will not be communicated, exchanged, sold or hired to any other person than those mentioned above. 7. Data retention periods AIR MEDIAS (MYM) undertakes that the data collected will be kept in a form that allows your identification for no longer than is necessary for the purposes for which the data is collected and processed.

Purpose	Retention periods
Managing and tracking accounts and contracts	Data is kept throughout the period of contractual relations and then archived. It is then stored for a period of five (5) years for evidentiary purposes, in accordance with the legal and regulatory obligations to which AIR MEDIAS (MYM) is subject. In addition, accounting records are kept for a period of 10 years.
Providing and managing services
For managing payments	For payments by bank card, in accordance with Article L.133-24 of the French Monetary and Financial Code, this data may be kept for the purpose of proof in the event of a dispute over the transaction or claim, in intermediate archives, for a period of thirteen (13) months following the date of debit (this period is extended to fifteen (15) months for deferred debit payment cards). In all cases, In the event of a single payment, bank data is kept in an active database until full payment has been received; In the event of a subscription with tacit renewal, bank data is kept for the period of the subscription; In the event of a subscription without tacit renewal, bank data is kept in an active database until the final payment instalment. Data relating to the PAN and cryptogram is not stored and data relating to the expiry date is deleted once the expiry date is reached. Invoices and accounting data is kept for ten (10) years as from the date of issue.
For managing requests for information from the customer relations service	Data is kept for the time necessary for processing the request and then for a period of three (3) years as from the last contact with AIR MEDIAS (MYM).
To send mailshots by email	Data is kept until the User unsubscribes using the link provided for this purpose.
For managing requests related to rights	Data relating to managing rights requests is kept for the period necessary for processing the request. It is then archived for the duration of the criminal statute of limitations applicable to intermediate storage
For the correct functioning and ongoing improvements of the Platform	Cookies and other commercial tracers may be placed on the User’s terminal for a maximum period of thirteen (13) months. After this period, the raw traffic data associated with an identifier is either deleted or anonymised. Information collected by cookies and tracers is kept for a maximum period of twenty-five (25) months. After this period, the data is either deleted or anonymised.

8. Your rights In accordance with the French Data Protection Act and the GDPR, you have the following rights:

Right of access (GDPR article 15), rectification (GDPR article 16) and updating;
The right to erase your personal data (GDPR article 17), if it is inaccurate, incomplete, ambiguous, out of date, or if its collection, use, disclosure or storage is prohibited;
The right to withdraw your consent at any time (GDPR article 13-2c);
The right to oppose the processing of your data (GDPR article 18);
The right to oppose the processing of your data (GDPR article 21);
The right to the portability of the data you have provided to us, in cases where your data is subject to automated processing based on your consent or on a contract (GDPR article 20);
The right to file a complaint with the CNIL in France (GDPR article 77);
The right to decide what happens to your data after your death and to choose whether or not we pass on your data to a third party that you have designated. In the event of your death and in the absence of instructions from you, we undertake to destroy your data, except if we need to keep it for evidential purposes or to meet a legal obligation.

These rights can be exercised by making a simple request, by email to the address dpo@mym.fans or by post to AIR MEDIAS (MYM) - 16, rue Cuvier 69006 Lyon. If you send us a copy of your identity document to prove your identity, we will keep it for one (1) year, or three (3) years if it is provided within the framework of the exercise of a right of opposition. For more information about your rights in France, you can also visit the website of the Commission Nationale de l’Informatique et des Libertés at the following address: http://cnil.fr. 9. Security AIR MEDIAS (MYM) and any Data Processors undertake to implement all technical and organisational measures to ensure the security of the processing of personal data and the confidentiality of your data, according to the current resources available and in application of the IEL ACT, the European General Data Protection Regulation (GDPR) and French law 2018-133 of February 26, 2018 "regarding various provisions of adaptation to the law of the European Union in the field of the security". AIR MEDIAS (MYM) takes appropriate precautions, as regards the nature of your data and the risks presented by our processing, to preserve the safety of the data and, in particular, to prevent it from being distorted, damaged, or from unauthorized third parties gaining access to it (physical protection of buildings, the customer authentication process with personal and protected access using confidential identifiers and passwords, encryption of the passwords, logging of connections, etc.). 10. Transfers outside of the EU AIR MEDIAS (MYM) principally processes your data within the European Union. Due to the nature of its activity, AIR MEDIAS (MYM) may need to transfer your data outside the European Union. In this event, such transfers are covered by the appropriate guarantees in accordance with regulations. Details of these guarantees are available on request from dpo@mym.fans or by post from AIR MEDIAS (MYM) - 16, rue Cuvier 69006 Lyon. 11. Updates to our privacy policy This Privacy Policy is subject to modification, in particular due to legislative and regulatory changes. As such, Users may consult updates directly on the Platform.