PRIVACY POLICY

appaloosa.io

Last updated: 1 October 2025

---

1. PREAMBLE

Your privacy is important to us. OB2J (operator of the appaloosa.io brand) is committed to respecting your privacy and to complying with all applicable laws and regulations regarding the personal information we may collect about you, in particular through our websites https://www.appaloosa.io, https://www.appaloosa-store.com, and all other websites we own and operate.

Personal information means any information about you that can be used to identify you. This includes information about you as an individual (such as name, address and date of birth), your devices, your payment information, and even information about how you use a website or an online service.

If our site contains links to third-party websites and services, please note that these websites and services have their own privacy policies. After following a link to third-party content, you should read their published privacy policy regarding how they collect and use personal information. This Privacy Policy does not apply to any of your activities after you leave our site.

This policy has been in effect since 1 October 2025.

2. IDENTITY OF THE DATA CONTROLLER

OB2J

Société par actions simplifiée with a share capital of 1,010.50 euros

Registered office: 9 impasse Rolland, 64200 Biarritz, France

RCS Bayonne 901 232 520

Intra-community VAT: FR82901232520

Data Protection Officer (DPO):

Jérémy Bodokh

Email: dpo@appaloosa.io

3. INFORMATION WE COLLECT

The information we collect falls into two categories: information "voluntarily provided" and information "automatically collected".

Information "voluntarily provided" means any information that you knowingly and actively provide to us when using or taking part in our services and promotions.

Information "automatically collected" means any information automatically sent by your devices when accessing our products and services.

3.1 Log Data

When you visit our website, our servers may automatically record the standard data provided by your web browser. This may include your device's IP (Internet Protocol) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page and other details about your visit.

In addition, if you encounter certain errors while using the site, we may automatically collect data about the error and the circumstances in which it occurred. This data may include technical details about your device, what you were trying to do when the error occurred, and other technical information relating to the problem.

Please note that although this information may not be personally identifying in itself, it may be possible to combine it with other data to personally identify individuals.

Retention period for technical logs: 30 days + a one-year archive

3.2 Device data

When you visit our website or interact with our services as a customer, we may automatically collect data about your device when using our mobile fleet management solution (MDM/MAM), such as:

• Device type
• Operating system
• Unique device identifiers
• Device settings

The data we collect may depend on the individual settings of your device and your software. We recommend that you check the policies of your device manufacturer or software provider to find out what information they make available to us.

Geolocation data (iOS and Android):

Our service uses geolocation data only in specific and controlled circumstances:

• Purpose: Locating a lost or stolen device reported by the company's IT administrator
• Legal basis: Geolocation is unused by default and is only activated at the express request of an authorised administrator of the customer for the strict purposes provided for (one-off location of a lost or stolen device).
• Processing: Geolocation operates in real time only when a location request is made by the authorised administrator
• No retention: We do not retain the history of geolocation data by default. We retain it when lost mode is activated until lost mode is exited. Where the employer so requires and where this request complies with the regulations and with the employee's employment contract, real-time geolocation is retained for 2 months.

3.3 Personal information

We may request personal information, for example when you subscribe to our newsletter or when you contact us, which may include one or more of the following:

• Last name
• First name
• Business email
• Company
• Job title
• Telephone number

3.4 User-generated content

We consider as "user-generated content" the materials (text, image and/or video content, applications) voluntarily provided by our users for the purpose of being published, processed or used on our platform. All user-generated content is associated with the account or the email address used to submit the materials.

Please note that any content you submit for the purpose of being published will be made available in your private app store after publication (and any subsequent review or verification process). Once published, it may be accessible to users or to third parties to whom you have explicitly granted access through our API, who are not covered by this privacy policy.

3.5 Transaction data

Transaction data means the data that accumulates in the course of the normal operation of our platform. This may include transaction records, stored files, user profiles, analytics data and other metrics, as well as other types of information, created or generated, when users interact with our services.

3.6 Marketing data

We collect marketing data when you sign up for our newsletter or interact with our marketing content. This data is retained for the entire duration of your consent, which you may withdraw at any time.

Retention period: For the duration of the consent given by the contact

4. LEGAL BASES FOR PROCESSING (GDPR)

We only collect and use your personal information where we have a legal right to do so. In that case, we will collect and use your personal information lawfully, fairly and transparently.

Our legal bases depend on the services you use and how you use them. This means that we only collect and use your information on the following bases:

4.1 Consent

Where you give us your consent to collect and use your personal information for a specific purpose. You may withdraw your consent at any time using the means we make available; however, this will not affect any use of your information that has already taken place.

Example: You may consent to providing your email address for the purpose of receiving marketing emails from us. Although you may unsubscribe at any time, we cannot recall an email we have already sent.

4.2 Performance of a contract or a transaction

Where you have entered into a contract or a transaction with us, or in order to take preparatory steps before entering into a contract or a transaction with you. For example, if you purchase a product, a service or a subscription from us, we may need to use your personal and payment information in order to process and deliver your order.

4.3 Our legitimate interests

Where we assess that it is necessary for our legitimate interests, such as to enable us to provide, operate, improve and communicate our services. We consider our legitimate interests to include research and development, understanding our audience, marketing and promoting our services, measures taken to operate our services efficiently, marketing analysis and measures taken to protect our legal rights and interests.

4.4 Compliance with the law

In some cases, we may have a legal obligation to use or retain your personal information. These cases may include (but are not limited to) court orders, criminal investigations, government requests and regulatory obligations.

5. COLLECTION AND USE OF INFORMATION

We may collect personal information from you when you carry out any of the following actions on our website:

• Create an account
• Take out a subscription
• Sign up to receive updates from us by email or via social networks
• Use a mobile device or a web browser to access your private app store
• Contact us by email, social networks or similar technologies
• Mention us on social networks

We may collect, hold, use and disclose information for the following purposes, and personal information will not be further processed in a manner incompatible with these purposes:

• To provide you with the core features and services of our platform
• To enable you to personalise your experience of our website
• To contact and communicate with you
• For analytics, market research and business development, including to operate and improve our website, associated applications and associated social network platforms
• For advertising and marketing, including to send you promotional information about our products and services and information about third parties that we consider may be of interest to you
• To enable you to access and use our website, associated applications and associated social network platforms
• For internal record keeping and administrative purposes
• For security and fraud prevention, and to ensure that our sites and applications are safe, secure and used in accordance with our terms of use
• For technical assessment, including to operate and improve our application, associated applications and associated social network platforms

We may combine personal information voluntarily provided and automatically collected with general information or research data that we receive from other trusted sources.

6. SECURITY OF YOUR PERSONAL INFORMATION

When we collect and process personal information, and for as long as we retain that information, we will protect it by commercially acceptable means to prevent its loss and theft, as well as unauthorised access, disclosure, copying, use or modification.

Although we do our best to protect the personal information you provide to us, we inform you that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security.

You are responsible for selecting any password and for its overall security, as well as for the security of your own information within the limits of our services. For example, you must ensure that all passwords associated with access to your personal information and your accounts are secure and confidential.

7. RETENTION PERIOD OF YOUR PERSONAL INFORMATION

We retain your personal information only for as long as we need it. This period may depend on the use we make of your information, in accordance with this privacy policy.

7.1 During the term of the subscription

If you have provided us with personal information in connection with the creation of an account with us, we may retain that information for the duration of the existence of your account on our system.

7.2 After termination of the subscription

Deletion of data within 30 days: If you terminate or delete your account, we will delete your personal information within 30 days following the deletion of your account.

During the termination notice period, you may request the return of your data in a usable format.

7.3 Legal obligations

Where necessary, we may retain your personal information for our compliance with a legal, accounting or reporting obligation, or for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes.

7.4 Marketing data

Retention according to consent: Marketing data is retained for the entire duration of your consent, which you may withdraw at any time.

7.5 Technical logs

Retention: 30 days and 1 year of archives.

8. CHILDREN'S PRIVACY

We do not direct any of our products or services at children under the age of 16, and we do not knowingly collect personal information about children under the age of 16 in accordance with the GDPR.

9. DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES

We may disclose personal information to:

• A parent company, subsidiary or affiliate of our company
• Third-party service providers for the purpose of enabling them to provide their services, including (without limitation) IT service providers, data storage, hosting and server providers, analysts, error loggers, debt collection agents, maintenance or troubleshooting providers, marketing providers, professional advisers and payment system operators
• Our employees, subcontractors and/or related entities
• Our existing or potential agents or business partners
• Credit agencies, courts and regulatory authorities, in the event that you fail to pay for the goods or services we have provided to you
• Courts, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or potential legal proceedings, or in order to establish, exercise or defend our legal rights
• Third parties, including agents or subcontractors, who assist us in providing information, products, services or direct marketing
• Third parties to collect and process data
• An entity that purchases, or to which we transfer, all or a substantial part of our assets and our business

9.1 Third parties we currently use

We call upon the providers listed below for needs that are strictly necessary for the performance and improvement of our services. Where their processing operations involve transfers outside the European Union, these are governed by appropriate safeguards (standard contractual clauses of the European Commission and/or participation in the EU-U.S. Data Privacy Framework, as applicable), with additional technical and organisational measures.

Important clarifications:

• Application scope in France: the application data of our services (platform, app stores, device management) is hosted exclusively in France (see §10.1).
• Excluded categories: we do not send to marketing/analytics tools any application data (content of app stores, MDM/MAM data, operational geolocation data) beyond what is strictly necessary and pseudonymised/anonymised where possible.
• Minimisation and retention: we apply minimisation (adequate, relevant and limited data) and retention periods consistent with each purpose (see §7 and §13).
• Sub-processors: where these providers themselves use sub-processors, they contractually undertake to offer equivalent safeguards (art. 28 GDPR).
• Updates: this list may change. We will publish any significant update in accordance with §16.

10. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

10.1 Data hosting

The personal information we collect and process in connection with our application services (platform, app stores, device management) is hosted and processed exclusively in France by our hosting provider:

Scalingo

Société par actions simplifiée

Registered office: 13 rue Jacques Peirotes, 67000 Strasbourg, France

RCS Strasbourg 808 665 483

Scalingo certifications:

• SecNumCloud: SecNumCloud-qualified IaaS infrastructure (the highest level of cloud certification in France, issued by ANSSI)
• HDS (Hébergeur de Données de Santé, health data hosting): Certification for the hosting of health data
• ISO 27001: Certification for information security management

Location: Datacenters located in Paris, France

Accordingly, the application data hosted on our servers remains exclusively on French territory.

However, certain specific data (such as browsing, support, payment or marketing data) may be processed by third-party providers located in other countries, as specified in section 10.2.

10.2 Third-party services

Some of our service providers (for example Google Analytics, HubSpot, Intercom, Stripe, Segment) may process data in other European Union countries or, in certain cases, in the United States.

Where such transfers outside the European Union are necessary:

• They are carried out in accordance with the requirements of applicable law, in particular the GDPR;
• We protect the personal information transferred in accordance with this privacy policy;
• We use standard contractual clauses approved by the European Commission, or other recognised legal mechanisms (such as the EU-U.S. Data Privacy Framework, as applicable);
• We implement additional technical and organisational measures to guarantee an adequate level of protection.

11. YOUR RIGHTS AND CONTROL OVER YOUR PERSONAL INFORMATION

11.1 Your choice

By providing us with personal information, you understand that we will collect, hold, use and disclose your personal information in accordance with this privacy policy. You are not obliged to provide us with personal information, however, if you do not do so, it may affect your use of our website or of the products and/or services offered on or through it.

11.2 Information from third parties

If we receive personal information about you from a third party, we will protect it as set out in this privacy policy. If you are a third party providing personal information about someone else, you represent and warrant that you have that person's consent to provide the personal information.

11.3 Marketing permission

If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by contacting us using the contact details below.

11.4 Access

You may request details of the personal information we hold about you.

11.5 Rectification

If you believe that the information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact us using the contact details provided in this privacy policy. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading or out of date.

11.6 Non-discrimination

We will not discriminate against you for exercising any of your rights over your personal information. Unless your personal information is necessary to provide you with a particular service or offer (for example, the processing of transaction data), we will not deny you goods or services and/or charge you different prices or rates for goods or services.

11.7 Data breach notification

We will comply with the laws applicable to us in respect of data breaches.

11.8 Complaints

If you believe that we have breached a relevant data protection law and wish to lodge a complaint, please contact us using the contact details below and provide us with full details of the alleged breach. We will promptly investigate your complaint and reply to you in writing, setting out the outcome of our investigation and the steps we will take to deal with your complaint.

You also have the right to contact a regulatory body or a data protection authority in relation to your complaint. In France, the competent authority is the CNIL (Commission Nationale de l'Informatique et des Libertés): www.cnil.fr

11.9 Unsubscribing

To unsubscribe from our email database or to opt out of communications (including marketing communications), please contact us using the contact details provided in this privacy policy, or opt out using the opt-out means provided in the communication. We may need to request specific information to help us confirm your identity.

11.10 Contact to exercise your rights

To exercise any of your GDPR rights, please contact our Data Protection Officer:

Email: dpo@appaloosa.io

We undertake to respond to you within a maximum period of one month from receipt of your request.

12. RIGHTS SPECIFIC TO THE GDPR (EU)

In addition to the rights mentioned above, if you reside in the European Union, you have additional rights:

12.1 Restriction of processing

You have the right to request that we restrict the processing of your personal information if:

• You are concerned about the accuracy of your personal information
• You believe that your personal information has been processed unlawfully
• You need us to retain the personal information solely for the purposes of a legal claim
• We are in the process of examining your objection relating to processing based on legitimate interests

12.2 Objection to processing

You have the right to object to the processing of your personal information based on our legitimate interests or the public interest. If this is done, we must provide compelling legitimate grounds for the processing that override your interests, rights and freedoms, in order to continue processing your personal information.

12.3 Data portability

You may have the right to request a copy of the personal information we hold about you. Where possible, we will provide this information in CSV format or in another readily accessible machine-readable format. You may also have the right to request that we transfer this personal information to a third party.

12.4 Deletion

You may have the right to request that we delete the personal information we hold about you at any time, and we will take reasonable steps to delete your personal information from our current records.

If you request the deletion of your personal information, we will inform you of the impact of the deletion on your use of our website or of our products and services. There may be exceptions to this right for specific legal reasons which, where applicable, will be set out to you in response to your request.

Deletion period after termination: If you terminate or delete your account, we will delete your personal information within 30 days following the deletion of your account.

Please note that search engines and similar third parties may still retain copies of your personal information that has been made public at least once, such as certain profile information and public comments, even after you have deleted the information from our services or deactivated your account.

13. USE OF COOKIES

We use "cookies" to collect information about you and your activity on our site. A cookie is a small item of data that our website stores on your computer and accesses each time you visit, so that we can understand how you use our site. This helps us serve you content based on the preferences you have specified.

Please refer to our Cookie Policy for further information.

14. BUSINESS TRANSFERS

If we or our assets are acquired, or in the unlikely event that we cease our activities or go bankrupt, we would include the data, including your personal information, among the assets transferred to any party that acquires us. You acknowledge that such transfers may occur, and that any party that acquires us may, to the extent permitted by applicable law, continue to use your personal information in accordance with this policy, which it will be required to assume as it constitutes the basis of any ownership or usage rights we have over this information.

15. LIMITS OF OUR POLICY

Our website may contain links to external sites that are not operated by us. Please note that we have no control over the content and policies of these sites, and cannot accept any responsibility for their respective privacy practices.

16. CHANGES TO THIS POLICY

At our discretion, we may amend our privacy policy to reflect updates to our business processes, current acceptable practices or legislative or regulatory changes. If we decide to amend this privacy policy, we will publish the changes here at the same link through which you access this privacy policy.

If the changes are significant, or if applicable law so requires, we will contact you (according to your selected preferences for communications from us) as well as all our registered users with the new details and links to the updated or amended policy.

If required by law, we will obtain your permission or give you the opportunity to accept or refuse, as the case may be, any new use of your personal information.

17. ROLE OF CONTROLLER / PROCESSOR

The GDPR distinguishes between organisations that process personal information for their own needs (known as "controllers") and organisations that process personal information on behalf of other organisations (known as "processors").

OB2J acts as:

• Controller for the data we collect through our website and our marketing services
• Processor for the data that our customers (companies using appaloosa.io) entrust to us for the management of their mobile fleet

Where we act as a processor, our customers (the companies) are the controllers and determine the purposes and means of the processing of their data. A data processing agreement compliant with article 28 of the GDPR may be put in place on request.

18. CONTACTING US

For any question or concern regarding your privacy, you may contact us using the following contact details:

Data Protection Officer (DPO):

Jérémy Bodokh

Email: dpo@appaloosa.io

General support:

Email: support@appaloosa.io

Postal address:

OB2J

9 impasse Rolland

64200 Biarritz

France

---

Document updated on 1 October 2025 - Version 2.0