Data protection

Controller

Groupe COFINA. [Name, address and contact of the controller: to be completed by Compliance.]

Purpose

To receive and handle internal reports, in line with the Group's whistleblowing procedure, and to let each reporter follow their report.

Data processed

The content of the report and of the messages, attachments (after their metadata is removed), the categories and entity concerned and, if you report under your own name, your identity and contact details.

The platform records neither your IP address nor the characteristics of your browser. Dates about your report are kept to the day, without the time.

Recipients

Only the people entitled to handle your report: the Group Compliance & Human Capital team, Group Audit, the ESG team for environmental and social matters, or, if the report is about executive management or the Board of Directors, the Audit, Compliance and ESG Committee alone. No data leaves the platform without your explicit agreement.

Retention

A report's data is kept for [5 years] after it is closed, then destroyed. Only information with no content and no identity, needed for the register of reports, remains. [Duration to be confirmed by Compliance.]

Security

The content of reports, identities, messages and attachments are encrypted. The access code is kept only in a form from which it cannot be recovered.

Your rights

[Rights of access, rectification, erasure and objection, and how to exercise them: to be completed by Compliance.]

Contact

[Contact of the data protection officer: to be completed by Compliance.]