Privacy policy

Last updated: October 2023

1. General

Offspend, a company operating under the trade name Greenly, processes your personal data to help you improve your ecological impact, taking care of the health of the planet and that of your data.

Personal data refers to any information likely to identify you directly (e.g. your name) or indirectly (e.g. your IP address) ("Personal Data").

This privacy policy ("Privacy Policy") explains how we process your Personal Data when you ("you") browse the greenly.earth website ("Greenly Website"). We therefore invite you to read the Privacy Policy carefully.

2. What are the sources of your Personal Data?

a. Personal Data you provide directly to us

We process Personal Data that you may communicate directly to us, for example when you subscribe to a demo or to our newsletter, when you contact us in writing via our chatbot on the Greenly Website, or when you download one of our resources in the "Resources" section of the Greenly Website (the "Greenly Resources").

b. Personal Data that you indirectly provide to us

We also process your Personal Data shared by external service providers when you browse the Greenly Website, for example your IP address collected by audience measurement cookies.

3. Characteristics of the processing of your Personal Data

For the purposes of this Privacy Policy :

· a "Prospect" refers to any individual who expresses an interest in the Greenly Services (as defined below) by visiting the Greenly Website, for example by (i) formulating questions via the chatbot of the Greenly Website, (ii)subscribing to a demo or to our newsletter and/or (iii) downloading one of the Greenly Resources, without creating a customer account;

· an "Internet user" refers to the individual browsing the Greenly Website, without expressing interest in the Greenly Services.

· the "Greenly Services" refer to the services provided via the Greenly Corporate SaaS platform, intended for companies.

PROCESSING PURPOSE	DATA SUBJECTS	PERSONAL DATA COLLECTED	LEGAL BASIS	RETENTION PERIOD*
Management of demo requests subscribed via the Greenly Website	Prospects	Data relating to professional life (position held, name and size of company, business sector) as well as identification and contact data (surname, first name, phone number)	Offspend's legitimate interest	3 years from (i) the last contact made by the Prospect or (ii) the end of the contractual relationship with the Prospect, if the Prospect enters into a contract with Offspend following the demo request
Processing requests to download Greenly Resources	Prospects	Data relating to professional life (position held, name and size of company, business sector) as well as identification and contact data (surname, first name, phone number)	Offspend's legitimate interest	3 years from (i) the last contact made by the Prospect or (ii) the end of the contractual relationship with the Prospect, if the Prospect enters into a contract with Offspend following the demo request
Processing contact requests / questions submitted via our chatbot on the Greenly Website	Prospects	Content of the contact request / questions (subject, date of the request / question), and e-mail address in case of electronic mail	Offspend's legitimate interest	3 years from the data collection or from the last contact made by the Prospect
Direct marketing	Prospects	Contact details (e-mail address and phone number)	Consent	Until (i) unsubscription or, (ii) failing that, 3 years from collection of the Personal Data or from the last contact made by the Prospect
Managing the sending of newsletters	Prospects	Contact details (surname, name and e-mail address)	Consent	Until unsubscription or, failing that, 3 years from the last contact made by the Prospect.
Audience measurement on the Greenly** Website Sending of targeted advertising by third-party companies	Internet users Prospects	Connection identifier (IP address) and browser data Clickstream data	For audience measurement cookies: Offspend's legitimate interests For other cookies (e.g. advertising): consent	For audience measurement cookies: the information collected via these cookies is kept for 25 months For other cookies (e.g. advertising): 6 months from the date of choice by the data subject.

*At the end of these retention periods, your Personal Data, which is strictly necessary, may be archived in an intermediate database for administrative reasons (legal, accounting, tax, etc.). For example, it may be archived for a period of 5 years from the end of the retention period in the active database, for litigation purposes (duration of the statute of limitations), or for 10 years for accounting purposes. At the end of these periods, the data will be deleted from our databases.

** These tracers do not allow the overall tracking of your browsing on the Greenly Website and are only used to produce anonymous statistical data, allowing us to measure the frequentation and/or the performance of the Greenly Website, as these measures are essential to the proper functioning of the latter.
We may also carry out statistical processing, as further processing for certain purposes in order to improve Greenly Services and carry out aggregate studies for the purposes of communication and information.

4. Do we share your Personal Data?

Your Personal Data is processed by Offspend for the purposes described in this Privacy Policy.

However, in order to allow you to browse the Greenly Website or to fulfil certain legal obligations, Offspend may share your Personal Data with the following recipients:

Trusted service providers	Categories of trusted service providers: • For the purposes of technical support, maintenance and hosting of the Greenly Website, your Personal Data is shared with our service provider Heroku, established in Ireland; • For communication and marketing purposes: your Personal Data may be shared with Customer.Io, which hosts it exclusively within the European Union; • For the purposes of improving the Greenly Website and and statistics: your Personal Data may be shared with our service providers A/B Tasty, PostHog Cloud EU, Mixpanel and Clearbit. In such cases, your Personal Data is exclusively hosted within the European Union. Offspend ensures that these third parties implement security measures to guarantee the confidentiality, integrity and availability of your Personal Data.
Offspend internal services	Your Personal Data is processed by Offspend's competent internal departments and more specifically by Offspend's marketing and tech teams based in France.
Administrative and judicial authorities	Offspend may also be required to disclose your Personal Data when required to do so by judicial and administrative authorities that have a legitimate need to access such information or to allow Offspend to defend its own rights before the competent authorities. In addition, if Offspend is subject to a transfer of a business or assets, we may communicate your Personal Data to the potential buyer of this business or these assets.

5. Do we transfer your Personal Data outside the European Economic Area (EEA)?

The Personal Data that we process is exclusively hosted within the European Union.

Should we be required to transfer some of your Personal Data to a recipient located outside the EEA, we will ensure, where applicable, that (i) the service provider is located in a country which benefits from an adequacy decision from the European Commission or (ii) where this is not the case, that appropriate safeguards under the GDPR (i.e., standard contractual clauses adopted by the European Commission) are implemented by Offspend, along with additional technical and organisational security measures.

6. What are your rights regarding your Personal Data and how can you enforce them?

As a data subject, you have the following rights:

· a right of access: the right to obtain information on the Personal Data we process about you, for what purposes, for how long, etc., as well as the right to obtain a copy of your Personal Data in an understandable format (proof of your identity may be requested in the event of reasonable doubt);

· a right to rectification: the right to have inaccurate or incomplete Personal Data rectified, completed and/or updated;

· a right to restriction: the right to ask us to restrict one or more processing activities in relation to your Personal Data, in certain cases listed in Article 18 of the GDPR (e.g. while Offspend is processing your objection request);

· a right not to be subject to certain specific processing activities: pursuant to Article 22 of the GDPR, you may ask us not to subject you to a decision based exclusively on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in similar ways;

· a right to object: the right to object to the processing of your Personal Data on grounds relating to your specific situation (under the conditions set out in Article 21 of the GDPR). Where your Personal Data is processed for direct marketing purposes, you may object at any time to such processing, including where it includes profiling activities (to the extent that they are linked to such direct marketing);

· a right to erasure ("right to be forgotten"): the right to ask us to erase your Personal Data in certain circumstances set out in Article 17 of the GDPR. However, we may need to retain your Personal Data in certain specific cases (e.g. to comply with a legal obligation that requires the processing of your Personal Data);

· a right to portability: the right to receive your Personal Data, where it is processed on the legal basis of your consent or if necessary for the performance of a contract, in a structured, commonly used and machine-readable format, and to request that we transfer it to another data controller;

· a right to withdraw your consent where the processing of your Personal Data is based on your consent;

· a right in case of death: in accordance with article 85 of the French Data Protection Act, you have the right to ask us to define directives relating to the preservation, erasure and communication of your Personal Data after your death; and

· the right to lodge a complaint with the supervisory authority, in particular in the country in which you reside or work (if relevant), or in the country where the alleged breach has occurred. In France, the supervisory authority is the Commission nationale de l'informatique et des libertés ("CNIL"), which can be contacted at the following address: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

To exercise your rights, please contact us directly:

· by email: [email protected]; [email protected]

· by post: Paul de Kerret, Data Protection Officer, Greenly (Offspend), 28 rue de Londres, 75009, France.

7. Modification of the Privacy Policy

In order to keep this Privacy Policy up to date, Offspend may amend it from time to time. You can find out when it was last updated by referring to the "Last updated" mention at the top of the Privacy Policy.

When we are considering making substantial changes to this Privacy Policy (e.g., changes to the processing purposes of the Personal Data), we will inform you before these changes become effective.