Introduction

The ORTEC Group recognises the fundamental importance of protecting individuals when processing their personal data. Therefore, in accordance with European Regulation 2016/679, adopted on 27 April 2016, and all laws adopted pursuant to this Regulation by Member States of the European Union, in particular French law N° 2018-493 of 20 June 2018, the ORTEC Group undertakes to respect and protect any personal data (hereinafter referred to as "Data") to which its employees have access, in whatever capacity that may be.

Definitions

"Personal data" means any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to them (including but not limited to geolocalisation data, online login, genetic traits, physiological, economic, cultural or social identity....) The CNIL (Commission Nationale de l'Informatique et des Libertés), the French Data Protection Authority, operates in accordance with European Regulation 2016/679, adopted on 27 April 2016, and is the "Supervisory Authority Concerned” for the ORTEC Group as defined below, when acting in its capacity as "Controller(s)", or “Processor". The CNIL also acts as the “Supervisory Authority Concerned" for any person residing in France affected by, or likely to be affected by, Data Processing. For persons residing in the United Kingdom, the "Supervisory Authority Concerned" is the Information Commissioner’s Office (ICO). "Applicable Legislation" refers to European Regulation 2016/679, adopted by the European Parliament on 27 April 2016, and all laws adopted pursuant to this Regulation by Member States of the European Union, in particular French law N° 2018-493 of 20 June 2018. For the United Kingdom, it is the Data Protection Act 2018 and other legislation relating to the collection, processing and retention of personal data, including the Privacy and Electronic Communications (EC Directive) Regulations 2003. The terms "Processing", "Data Controller(s)", "Processor(s)", "Transfer", “Cross-border Transfer(s)”, "Third Party", "Recipients", "Control Authority” and "Data Protection Officer (DPO)“ are defined by European Regulation 2016/679, adopted on 27 April 2016, and can be consulted on the AEPD Guide for the citizen https://www.aepd.es/media/guias/guia-ciudadano.pdf and the Guideline on transparency under Regulation 2016/679. ORTEC Group refers to all companies owned and / or controlled by ORTEC EXPANSION SA within the meaning of Article L 233.3 of the French Commercial Code. See the attached organisation chart.

Scope

This policy and the commitments it entails apply to Data which is accessible by ORTEC Group employees, whether communicated by a customer, a supplier, a subcontractor, a partner, a prospect or any participant external to the ORTEC group, all of which must be able to have trust in our ability to protect their Data and to respect their rights under Applicable Legislation.

Data categories

Data sent to us in the context of any commercial relations between the ORTEC Group and its customers, suppliers, subcontractors, partners or prospects may fall into one or more data categories. This section may also refer to Data communicated to us by visitors to our establishments or Data that we receive via our website initiatives. The categories of Data concerned are essentially identification data (surname, first name, photograph, etc.), data relating to an individual’s professional life (positions held, email address, etc.) and bank data for payment purposes.

Our commitments

We are committed to ensuring the protection, confidentiality, non-alteration, availability and security of Data entrusted to us whether hosted physically, on computer applications or received via our communication channels (websites). In compliance with Applicable Legislation, we take all necessary measures:

• To provide, at your request, clear and transparent information on how your Data will be processed.
• To implement all technical and organisational measures necessary to protect your Data against disclosure, loss, alteration or access by an unauthorised third party.
• To retain your Data only as long as is necessary and for the sole processing purpose specified.
• To offer you at any time, should you request it, the possibility to access and modify your Data.

To achieve these objectives, we implement appropriate technical and organisational measures to ensure that processing is performed in accordance with Applicable Legislation. In particular, we undertake to inform you about:

• Your rights concerning your Data and ways to exercise these rights,
• The possibility of Cross-Border Transfers of your Data and transfers outside the European Union as well as the identity of the Recipients of your Data
• The retention period for your Data and the security measures we have implemented.

The ORTEC Group

When the ORTEC Group carries out Data Processing, it is ORTEC SERVICES G.I.E, through its different departments and directorates, that acts as the Data Controller. GIE ORTEC SERVICES - 550 rue Pierre Berthier - 13799 Aix en Provence - CS8034 - France Tel: +33 4 42 12 12 12 Depending on the type of processing being carried out, the contact person will be as follows: the Communication & Marketing department (websites, commercial prospection, etc.); the IT department (internal & external IT developments and maintenance); Procurement ("Non-production Procurement" and "Industrial Procurement"); managers working within different business departments and collecting data pertinent to the ORTEC Group’s commercial activities; Accounting and Finance department, etc. The ORTEC Group has appointed a Data Protection Officer whose contact details are as follows: - Email: dpo@ortec.fr - Postal address: GIE ORTEC SERVICES – Data Protection Officer - 550 rue Pierre Berthier - 13799 Aix en Provence - CS8034 – France - Telephone number: +33 4 42 12 12 12 For SONOVISION INGENIEROS, the Deputy Data Protection Officer is the Security Manager: - Email : info-spain@sonovisiongroup.com - Postal address: SONOVISION INGENIEROS ESPAÑA – Responsable de Seguridad - C/ Miguel Faraday 20, Oficina A204 Getafe 28906 (Madrid) - Telephone number: 0034 637072598

The purpose of our Data Processing

Details of our data processing are listed and their respective purposes are determined, legitimate, explicit, and compatible with the carrying out of our business activities and missions. These are our main reasons for data processing:

• Response management to calls for tenders / letters of consultation received by the ORTEC Group.
• Litigation management.
• Accounting.
• Management of referenced suppliers.
• Client and prospects management.
• Commercial prospection.

Data collected in accordance with a specific purpose will not be used for any other purposes, in accordance with Applicable Legislation. The legal bases for this data processing relate to compliance with legal obligations, the performance of contractual or pre-contractual obligations, your consent and legitimate interests of the ORTEC Group (for example, safeguarding the security of premises and persons ).

Data Transfer

Only that Data which is strictly necessary to achieve the relevant purpose is collected and processed by those persons duly authorised by the ORTEC Group. This may be the Communication & Marketing Department (websites, commercial prospection, etc.); the IT department (internal and external IT developments and maintenance); Procurement ("Non-production Procurement" and "Industrial Procurement"); employees working within different business departments and participating in all levels of the Group commercial activities (costing, execution); Accounting and Finance department, etc. Access rights are defined in the Information System Security policy implemented by ORTEC Group, which provides for the implementation of the necessary means to protect the Processing of your Data. in order to prevent unauthorised access by a third party and any loss, alteration, deterioration or unauthorised disclosure of your Data. Where necessary, and when required by the relevant purpose outlined in this policy, your Data may be communicated to third parties, partners or processors (for example, IT providers for hosting and IT maintenance of certain tools). Processors act according to ORTEC Group instructions: they are required to implement appropriate measures to protect your Data.

Transfers outside the European Union

As a general rule, your Data is stored within the European Union. However, we may have to transfer some of your Data outside the European Union. In this event, we will ensure that this Transfer is made in accordance with Applicable Legislation and that it will guarantee you an adequate level of protection. In the event some of these countries do not offer the same level of protection as that of EU Member States, the ORTEC Group will ensure that these Transfers are carried out in accordance with the provisions imposed by current legislation, such as the implementation of contractual clauses adapted to the identified risks. Additional information and a copy of the relevant documents relating to these Transfers may be requested by post or by email for which the relevant contact details can be found below: By email to dpo@ortec.fr and/or by post to: GIE ORTEC SERVICES - 550 rue Pierre Berthier - 13799 Aix en Provence - CS8034 - France Tel: +33 4 42 12 12 12 For SONOVISION INGENIEROS, the Deputy Data Protection Officer is the Security Manager: Email : info-spain@sonovisiongroup.com Postal address: SONOVISION INGENIEROS ESPAÑA – Responsable de Seguridad - C/ Miguel Faraday 20, Oficina A204 Getafe 28906 (Madrid) Telephone number: 0034 637072598

Security measures

We are committed to implementing appropriate technical and organisational measures to ensure a level of security appropriate to the risks likely to threaten the protection of individuals within the framework of the processing of their Data. These measures are defined by taking into account the state of knowledge, the costs of implementation and the nature, scope, context and purposes of the data processing as well as any identified risks.

Data retention period

Your Data is collected by the ORTEC Group in line with the time required for processing, for example:

• 1 month for surveillance videos.
• 3 years for data relating to prospects...

Information and rights of individuals

In accordance with Applicable Legislation, the ORTEC Group will, whenever it collects Data, and at your request, communicate to you important information about the processing contemplated. This will allow you:

• To request access to, and rectification of, your Data.
• To request the restriction of processing of your Data.
• To request erasure of your Data.
• To exercise your right of objection (in particular your right to object to commercial prospection without reason).
• To modify or unsubscribe from the newsletters we publish.
• To express specific and general post-mortem directives concerning the retention, deletion and communication of your Data (France only).
• To exercise your right to data portability.
• To withdraw your consent for the processing of your Data when your consent is required.
• Not to be the subject of a decision based exclusively on automated processing which may result in legal consequences for you or affect you significantly.
• To make a claim, at any given moment, to the relevant Supervisory Authority Concerned, that is to say the ICO.

More detailed information about exercising these different rights can be found on the AEPD website: To exercise your rights, please send your request (indicating your e-mail address, surname, first name, postal address and a copy of your identity document) to the ORTEC Group Data Protection Officer (DPO) by email to dpo@ortec.fr and / or by post to: GIE ORTEC SERVICES - 550 rue Pierre Berthier - 13799 Aix en Provence - CS8034 - France Tel: +33 4 42 12 12 12 You also have the right to raise any concerns in relation to how we process your personal data to the relevant Supervisory Authority Concerned, that is to say the ICO. For SONOVISION INGENIEROS, the Deputy Data Protection Officer is the Security Manager: Email : info-spain@sonovisiongroup.com Postal address: SONOVISION INGENIEROS ESPAÑA – Responsable de Seguridad - C/ Miguel Faraday 20, Oficina A204 Getafe 28906 (Madrid) Telephone number: 0034 637072598

Policy reviews and updates

This policy will be updated as necessary to meet the requirements of the Applicable Legislation. It will be revised at least every three (3) years.