In the Policy, "ARMOR INOX" refers to the company Armor Inox SAS, whose registered office is located at PA de Broceliande, 56430 Mauron, France. To exercise your rights regarding the processing of your personal data, you can contact the ARMOR INOX Data Protection Department as set out in section 9 "HOW TO EXERCISE YOUR RIGHTS" of this Policy.

Privacy is one of our major concerns and is at the heart of the experience we wish to offer through the use of our services. We are committed to guaranteeing a high level of protection for the personal data of our customers, prospects, users of our website or mobile applications and, more generally, of any data subject concerned by our processing operations. We undertake to comply with the regulations applicable to all processing of personal data that we implement, in particular the provisions of the French Data Protection Act of 6 January 1978 (“Loi informatique et libertés”) as amended and the General Data Protection Regulation (EU Regulation 2016/679) or "GDPR". In particular, we are committed to the following principles:

• Your personal data is processed lawfully, fairly and transparently (lawfulness, fairness, transparency).

• Your personal data is collected for specific, explicit and legitimate purposes, and is not furthered processed in a manner incompatible with these purposes (purpose limitation).

• Your personal data is collected in an adequate and relevant manner and is limited to the purposes for which it is processed (data minimisation).

• Your personal data is accurate, kept up to date and every reasonable step is taken to ensure that inaccurate data, having regard to the purposes for which it is processed, is deleted or updated (accuracy).

We are committed to implementing the appropriate internal procedures in order to raise the awareness of all our employees and to ensure compliance with these rules within our organization. Furthermore, we undertake to implement the appropriate technical and organizational measures to ensure an adequate level of security and to protect your personal data, as from the beginning of our projects and design of our processing operations. Finally, we impose the same level of personal data protection in our contracts with our subcontractors. In order to ensure that these rules are properly applied, we have appointed a Data Protection Officer (DPO) who is the main contact for the Commission Nationale de l'Informatique et des Libertés (CNIL), the French data protection authority.

3.1. Categories of standard personal data

We may collect and process the following categories of personal data:

a) Contact, personal account or registration information Your contact information includes your telephone number and email address. When you create a personal account or subscribe to a specific service, we may also record your postal address, login details and any other data you provide to us through the corresponding registration forms. We may also collect information about your company, such as the company name and address, through the contract numbers we have with your company account.

b) Interactions, electronic or telephone communications When you communicate with us by email, by online chat or on social networks, we save these exchanges. We may also record telephone calls when you contact our customer service department by telephone as part of our service quality monitoring or for evidentiary or fraud prevention purposes. We also record your communication preferences, for example when you subscribe or unsubscribe to one of our newsletters or when you choose to receive communications through other channels (such as WhatsApp, Facebook, Messenger or WeChat).

c) Information we collect when you use our websites, mobile applications or other digital services When you visit our websites or use one of our mobile applications, we may record your IP address, browser type, operating system, referring site and browsing or application usage behavior. We also collect information through the use of cookies or other similar technologies. We keep track of the fact that you open our emails or the links in those emails. We may associate this information with other data we already have about you. With your permission, through the ARMOR INOX mobile application, we may also receive your location data or access certain data stored on your mobile phone, such as photos, contacts and data relating to your agenda.

d) Information about social networks In order to facilitate the creation of your account as well as your future connections, you have the possibility to link this account with most social networks (Facebook, Twitter, Instagram, etc.). You will therefore benefit from an optimized navigation on our website or our mobile applications. In this case, we do not share any personal data about you with the providers of these social networks. We receive statistics from Facebook about visitors to our Facebook page. You can find more information about the personal data we receive through the social network you use, as well as how to change your settings, on your social network provider's website and in their privacy policy.

e) Other information you choose to share with us We process the information you choose to share with us, for example when you share your interests and preferences on our website, leave a comment on our Facebook page or complete a customer satisfaction survey.

3.2. Categories of special personal data

As mentioned above, in order to provide you with the appropriate service, we may need to collect information that is sensitive under applicable data protection laws. Indeed, this data, such as specific assistance needs or meal preferences, may indirectly give information about your ethnic origin, your religious beliefs or your state of health and may fall under Article 9 of the GDPR. This data is only collected with your consent – when you select the corresponding services– and is only used to provide the relevant service. You may of course refuse to give your consent at the time of collection of this information, but this may result in your not being able to benefit from these services or benefits. Biometric data is also subject to stricter rules. However, as mentioned in section 3.1.d, we do not collect or process any biometric data about you when these devices are used at airports from or to which we operate.

3.3 Cookies and similar technologies

When you use our website or mobile applications, we collect information through cookies and other similar technologies.

3.4 Specific services, applications, events, campaigns or competitions

For certain specific services, applications, events, campaigns, games or sweepstakes that we may offer to enhance your customer experience in addition to our usual services, we may collect other types of data than those described in this Policy. In this case, in accordance with the applicable regulations, information relating to the processing of this data may be communicated to you by a specific privacy statement or policy when you download the application or register for the service, event, campaign or sweepstakes by means of the corresponding form.

We may collect the categories of personal data mentioned above by various channels:

a) We collect the personal data that you provide directly to us For example, we collect personal data when create an account, use our services, download files, respond to a satisfaction survey, leave us a message on social networks, contact our customer service department, chat with a chatbot, subscribe to receive our emails or mobile notifications, or sign up for one of our specific events.

b) When you use our website or mobile applications, we collect information using cookies and similar technologies ARMOR INOX uses its own cookies and third-party cookies.

c) If you use social networks, we may also receive information from your social network provider For more information, please see section 3 "3. Which type of personal data do we process?" above.

5.1. Processing purposes

The main purposes for which we use your personal data are: a) To provide our services to you General information: To manage your services, we need to process most of the information listed in section 3.1. Among other things, we need your identification data to identify you. In order to provide you with all the services about your equipment , we need your contact information. To provide you with a service that meets your expectations, we also process all the data related to your equipment, especially if you have created a personal account. Legal basis for the processing: We process your personal data because it is necessary for the performance of our services.

5.2. Legal basis

As mentioned in the purposes described above, we may only process your personal data if we have a legal basis for doing so. In many cases, the legal basis for processing your data is "necessary for the performance of your contract of support" and, more generally, for the provision of our services. Some processing of personal data may be based on your consent. You can then withdraw it at any time for the processing concerned (see section 9 "HOW TO EXERCISE YOUR RIGHTS" below). In some cases, we may use your personal data if we (or third parties) have a legitimate interest in doing so. We always carefully assess all interests: yours, those of third parties and those of our company.

6.1. General information

Armor Inox services are provided all across the world. In order to provide our services and to offer you the same experience across all our services, we need to share your personal data with internal and external parties. Within our company, your data is processed by duly authorized employees: agents of our customer support center, sales departments, IT departments, etc. We may also transfer your data to third parties such as companies in The Middleby Corporation, payment service providers, service providers or subcontractors, etc. for the purposes described in point 6.2. In this respect, we remind you that we require all our subcontractors to implement strict confidentiality and protection measures for personal data processed, in accordance with the regulations and this Policy.

6.2. Sharing your data with third parties

We may transfer or share your personal data with third parties for the following purposes:

a) To provide our services In order to provide our services, we also use other types of third parties, such as providers of specific IT services, social network providers, marketing agencies or external fraud detection and prevention services. As with all of our subcontractors, these third parties are required to adequately safeguard your personal data and to process it only in accordance with our instructions in application of the regulations and this Policy. Within the The Middleby Corporation, our processing activities are handled by centralized databases and systems which may be hosted or managed by a group company on behalf of other group companies. In addition, for the sake of efficiency, certain operational and commercial functions may be performed by one of the group companies for other group companies. This means that our group companies may have access to your personal data in the context of these processing operations. Our group companies may only process your personal data in the context of these activities and in accordance with this Policy.

b) To improve our online services and mobile applications

For more information, you can read point c) in section "5. FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?".

c) For personalized marketing through social network platforms

6.3. Specific services, applications, events, campaigns or sweepstakes

We may offer specific services, applications, events, campaigns, games or sweepstakes to enhance your customer experience in addition to our usual services. For these purposes, we may share your data with third parties other than those described in this Policy (for example, when we organise a campaign or event with a partner or when we add their services to our applications). In this case, in accordance with the applicable regulations, information relating to the processing of these data may be communicated to you by a dedicated privacy statement or by privacy policy when you download the application, register for the service, event, campaign or sweepstake via the dedicated form.

We do not keep your personal data for any longer than is necessary. The duration of storage depends on the purposes for which data are processed, as described in section 5 of this Policy. These retention periods are set based on the purposes of the processing and also take into account the applicable legal provisions imposing a precise retention period for certain categories of data, any applicable limitation periods and the recommendations of the CNIL, the French data protection authority, regarding certain categories of processing.

For the purposes set out in section 5 of this Policy, we may transfer your personal data to recipients who may be located in countries other than your country of residence and in particular outside the European Union. These transfers are carried out to offer you our services. The laws of the countries to which we transfer your personal data may not offer the same level of protection. If these transfers are necessary to offer you our services, we undertake to guarantee the same level of protection of your personal data, in accordance with the requirements of the GDPR, in particular by signing, on a case-by-case basis, standard contractual clauses defined by the European Commission, or any other mechanism described in the Regulation.

9.1. Your rights

In accordance with the applicable regulations, in particular the provisions of the GDPR and the French Data Protection Act of 6 January 1978 “Loi informatique et Libertés” as amended, you can contact us (see section 9.4 below) to exercise your rights to (a) access, (b) rectification, (c) erasure, (d) restriction of processing, (e) data portability and (f) object. In addition, under French law, you also have the right to define guidelines on how we should process your personal data after your death.

a) Right to access You have the right to request confirmation that we process your personal data and, in this case, to receive a copy of it. When we respond to a request to exercise the right to access, we also provide you with additional information such as the purposes of the processing, the categories of personal data and any other information relating to this processing.

b) Right to rectification You have the right to request the rectification of your personal data if you find that it is inaccurate. You can also request to complete your personal data, taking into account the purposes of the processing concerned. This may lead to the provision of additional data.

c) Right to erasure You have the right to request the erasure of your personal data. This right can only be exercised in certain cases where one of the grounds set out in Article 17 of the GDPR applies. This may include, for example, personal data that is no longer necessary for the purposes for which we collected it or that has been unlawfully processed. If you exercise this right and if one of the grounds is applicable to your request, we will erase your personal data as soon as possible.

d) Right to data portability You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, if its processing is automated and based on the collection of your consent or on the performance of a contract to which you have subscribed. This right does not apply to other legal bases for processing. Where appropriate and technically feasible, you may also request the transfer of such data directly to another data controller.

e) Right to restriction of processing You have the right to obtain the restriction of processing of your personal data. From a practical perspective, this means that we mark the data stored to temporarily suspend its processing. This right can be exercised for the grounds provided for in Article 18 of the GDPR, in particular when you dispute the accuracy of your personal data. This right does not give rise to data erasure. We have to inform you before the restriction of processing is lifted.

f) Right to object You have the right to object to the processing of your personal data. This means that you can ask us to stop processing your personal data. This right only applies when processing is based on our legitimate interests (including the resulting profiling) (see 5.2 "Legal basis" above). For example, you can object at any time and free of charge to the processing of your personal data for direct marketing purposes, including for profiling purposes insofar as it is related to this direct marketing. If you exercise this right, we will no longer process your personal data for these purposes. You can also, when you are in contact with our customer service, object to the recording of your telephone call for the purposes of improving the quality of service, preventing disputes and malicious calls by notifying the advisor directly.

9.2. Withdrawing your consent

Where required by law for certain processing purposes (e.g. electronic marketing), your data is only processed after obtaining your explicit consent. You can withdraw your consent at any time by following the specific instructions relating to the processing operations concerned. You can withdraw your consent by clicking on the unsubscribe link contained in our emails, by changing your communication preferences on your account if the option is available or by changing your smartphone settings for mobile push notifications and location data. For more information on how you can withdraw your consent to the cookies and other similar technologies that we use when you visit our websites or use our mobile applications, please see our Cookie management policy.

9.3. Refusal of certain requests

The rights described above are not applicable in all situations. Indeed, in accordance with the applicable regulations, we may be entitled to refuse certain requests. For each request, we carefully assess whether such an exemption applies and inform you accordingly. We may, for example, refuse your request to access if this is necessary to protect the rights and freedoms of other individuals or refuse to erase your personal data if the processing of such data is necessary to comply with legal requirements. The right to data portability does not apply, for example, if you did not provide the personal data or if we process the data based on other legal grounds than your consent or the performance of a contract.

9.4. Contact for the exercise of rights

When you wish to exercise your rights, simply send a request to the Armor Inox Data Protection Department: PA de Broceliande, 56430 Mauron, France Email address: data-protection@armorinox.com In order to process your request in the best possible way, we kindly ask you to include the necessary identification details with your request (surname, first name, email, copy of an official identity document such as an identity card or passport,etc.) as well as any other information necessary to confirm your identity. Requests are processed as quickly as possible and in accordance with the applicable law. However, any request that is not related to the protection of personal data cannot be processed. You can also contact us if you have any questions, comments or complaints regarding this Policy.

9.5. Questions, comments or complaints

Please do not hesitate to contact us if you have any questions or comments regarding this privacy policy. You can also file a complaint with the French Data Protection Agency (Commission Nationale de l'Informatique et des Libertés (CNIL) in France or any other competent data protection authority.

10.1. Our commitments

Ensuring the security and confidentiality of the personal data you share with us is our priority. We therefore implement all the appropriate technical and organizational measures – in accordance with the applicable legal provisions (in particular Article 32 of the GDPR) – with regard to the nature of the personal data that you communicate to us and the risks presented by its processing, in order to preserve its security and, in particular, to prevent any accidental or unlawful destruction, loss, alteration, disclosure, intrusion or unauthorised access to this data.

10.2. How can you protect yourself?

The security and confidentiality of personal data are based on individual best practices. We invite you not to disclose the passwords you use to access our services to third parties, to systematically disconnect from your profile and your social account (particularly in the case of linked accounts) and to close your browser window at the end of your session, particularly if you access the Internet from a computer shared with other people. This will prevent other users from accessing your personal data. To avoid linked hacking, we recommend that you use different passwords for all the online services you use. We cannot be held responsible in the event of theft of your log in details on a platform that is not managed by our services. Furthermore, we strongly recommend that you do not communicate to third parties or publish on social networks any documents issued by Armor Inox containing your personal data. In this case, you understand that you are responsible for reading and understanding the terms and conditions of use, information security practices and the privacy policy applicable to these social networks managed by third parties and that we cannot be held responsible for the way in which this data is processed, stored or disclosed on these platforms. To find out more about the best practices to apply in terms of IT security, please read the IT security portal. The general conditions relating to certain services accessible from Armor Inox websites, its mobile site or its mobile applications, may include more precise terms regarding the security of your personal data.

10.3. Management of security incidents

Zero risk does not exist and, even if we implement all the measures recognized as standard in terms of security, unexpected events may occur. We have specific procedures and resources to manage security incidents in the best possible conditions. We have also set up a specific procedure to assess the possible breach of your personal data, notify the competent authority within the time limit provided for by the regulations and inform you when this breach is likely to generate a significant risk for you and affect your privacy. Exercises are carried out periodically to check the functioning of the security installations and the adequacy of the procedures and systems deployed.

If you have any further questions about this policy or the way we process your data, please contact our data protection department at data-protection@armorinox.com.

This version is applicable as from February 4th, 2023. We reserve the right to change this Policy from time to time. All changes are published on our website. We invite you to read it regularly.