Personal data

Respect for privacy and the protection of personal data is a key factor of trust,
a value that companies within the Groupe Maître Prunille hold particularly dear.

This policy has been developed to share our group’s commitments regarding the protection of privacy.

1. Data protection policy of the bargues.com website

1.1. Introduction

The main purpose of this document is to bring together, in a concise, transparent, understandable, and easily
accessible format, information concerning the data processing carried out by Bargues Agro Industrie
(hereinafter “Bargues” or “we”) so that you can understand the conditions under which your data is processed.

1.2. Fair and transparent collection of your data

For the sake of fairness and transparency, we take care to inform you of every processing activity we carry out
through information notices.

Personal data is collected fairly. No collection is carried out without the knowledge of the individuals concerned or
without them being informed.

1.3. Legitimate and proportionate use of your data

When we process data, we do so for specific purposes: each data processing activity we implement pursues a
legitimate, determined, and explicit purpose.

For each processing activity implemented, we undertake to collect and use only data that is adequate,
relevant, and limited to what is necessary in relation to the purposes for which it is processed.

We ensure that data is kept up to date and implement procedures to allow the erasure or
correction of inaccurate data.

1.4. The personal data we process

As part of the personal data processing activities whose purposes are presented below, Bargues
collects and processes the following categories of data:

identification data of the individuals concerned, such as your title, first and last name, phone and
electronic contact details.

1.5. The legal bases and purposes of our data processing

The processing activities implemented by Bargues have the following purposes and legal bases:

No.	PURPOSE	SUB-PURPOSE	LEGAL BASIS
1.	Management of business relationships	Handling reports of product / delivery issues	Consent
1.	Management of business relationships	Customer management	Consent
2.	Management of external communication	Handling of contact requests	Consent

1.6. Recipients of your data

The recipients of your data are:

authorized members of Bargues staff;
Bargues’ service providers and subcontractors, as applicable to them;
competent authorities or courts;

We ensure that, among these recipients, only authorized individuals may have access to this data.
Bargues applies a strict authorization policy that ensures the data it processes is only shared
with individuals authorized to access it.

1.7. Transfers of your data

We may transfer personal data outside the European Union as part of the IT tools
we use for our business activities.

Such transfers can only be carried out once Bargues has taken the necessary measures to secure them, for example by
ensuring the conclusion of the standard contractual clauses defined by the European Commission to govern the
resulting cross-border data flows.

1.8. How long we retain your data

We ensure that data is kept in a form permitting identification of the individuals
concerned only for as long as necessary in relation to the purposes for which it is processed.

The retention periods we apply to your personal data are proportionate to the purposes
for which it was collected.

More specifically, we organize our data retention policy as follows:

No.	Data category	Purposes	Retention period
1.	Identification of individuals	Handling of requests and complaints	3 years from the collection of data or from the last contact from the requester

1.9. Security of personal data

We place particular importance on the security of personal data.

We have implemented technical and organizational measures suited to the degree of sensitivity of the
personal data, in order to ensure its integrity and confidentiality and to protect it against any malicious
intrusion, loss, alteration, or disclosure to unauthorized third parties.

1.10. Subcontracting

When we use a service provider, we only share personal data with them after having
obtained from them a commitment and guarantees regarding their ability to meet these security and
confidentiality requirements.

In compliance with our legal and regulatory obligations, we enter into contracts with our subcontractors
that precisely define the terms and conditions under which they process personal data, in
accordance with personal data protection regulations.

1.11. Cookies

Cookies are covered by a dedicated cookie policy.

1.12. Your recognized rights

Bargues is particularly committed to respecting the rights granted to you in connection with the data
processing it carries out, in order to guarantee fair and transparent processing given the specific circumstances
and context in which your personal data is processed.

1.12.1. Your right of access

Under this right, you have confirmation as to whether or not your personal data is being processed, and where it
is, you have the right to request a copy of your data and information concerning:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients, as well as, where applicable, if such disclosures were to be
made, the
international organizations to which the personal data has been or will be disclosed, in particular
recipients established in third countries;
where possible, the envisaged retention period for the personal data, or, where this is not
possible, the criteria used to determine that period;
the existence of the right to request the data controller to rectify or erase your
personal data, the right to request a restriction of the processing of your personal data, and the right to
object to such processing;
the right to lodge a complaint with a supervisory authority;
information relating to the source of the data when it was not collected directly from the
individuals concerned;
the existence of automated decision-making, including profiling, and in such cases,
useful information about the underlying logic, as well as the significance and expected consequences of such
processing for the individuals concerned.

1.12.2. Your right to rectification of your data

You may ask us to have your personal data, as appropriate, corrected, completed if it is
inaccurate, incomplete, ambiguous, or outdated.

1.12.3. Your right to erasure of your data

You may ask us to erase your personal data in the cases provided for by
applicable laws and regulations.

Please note that the right to erasure of data is not a general right and can
only be granted if one of the grounds provided for under applicable regulations is present.

1.12.4. Your right to restriction of data processing

You may request the restriction of the processing of your personal data in the cases provided for by legislation
and regulations.

1.12.5. Your right to object to data processing

You have the right to object at any time, on grounds relating to your particular situation, to
processing of your personal data whose legal basis is the legitimate interest pursued by the
data controller (see the article above on the legal basis for processing).

If you exercise such a right of objection, we will ensure that we no longer process your personal data as
part of the processing concerned, unless we can demonstrate compelling legitimate grounds
for continuing such processing. These grounds must override your interests and your rights and freedoms, or the
processing must be justified for the establishment, exercise, or defense of legal claims.

1.12.6. Your right to data portability

You have the right to the portability of your personal data. Please note that this is
not a general right. Indeed, not all data from all processing activities is portable, and this right only
applies to automated processing, excluding manual or paper-based processing.

This right is limited to processing whose legal basis is your consent or the performance of
pre-contractual measures or of a contract.

This right does not include derived data or inferred data, which are personal data created by Bargues.

1.12.7. Your right to withdraw your consent

Where the data processing we carry out is based on your consent, you may withdraw it
at any time. We will then stop processing your personal data, without affecting the
lawfulness of processing carried out prior to your withdrawal based on the consent previously given.

1.12.8. Your right to lodge a complaint

You have the right to lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris) in
France, without prejudice to any other administrative or judicial remedy.

1.12.9. Your right to set post-mortem directives

You have the option of setting specific directives regarding the retention, erasure, and
disclosure of your personal data after your death, in accordance with the terms defined below. These specific
directives only concern the processing activities carried out by us and will be limited to that
scope alone.

You also have the right, once such a person has been designated by executive authority, to set
general directives for the same purposes.

1.12.10. How to exercise your rights

All the rights listed above may be exercised at the following email address (dpo@maitreprunille.com) or
by post to the following address (DPO France Prune – Maître Prunille SAS – 460 rue du Mémorial – BP2 –
47440 CASSENEUIL), providing proof of your identity by any means.

1.13. Amendment of this document

We invite you to regularly review this policy on our website. It may be
updated from time to time.