The protection of your personal data is of high importance to THALES, therefore THALES takes all reasonable care to ensure that your personal data is processed safely.

When using the Citadel service (or " Citadel "), you (or the " User ") will share your personal data with THALES SIX GTS France SASU (having its registered office at 4 avenue des Louvresses, 92230 GENNEVILLIERS, registered in the Nanterre Trade and Companies Register under 383 470 937, to the share capital of EUR 163.949.805,00) (" THALES "), acting as data controller.

Your data are used by THALES for the purposes mentioned below:

1. Provision of Citadel services:

   • Authenticate the User on Citadel;
   • Identify people with whom the User exchanges texts, voices or videos ;
   • Share with other Users of Citadel (not systematically and only after manual activation by the User of her/his settings’ phone) the location of the User and / or photos and videos from the photo gallery and / or camera phone of the User;
   • Sending invitations from the User's address book;
   • Manage support requests.

   Please note that the processing activities specified therein are carried out by THALES for the performance of the contract to which you are party. Indeed, your data are used to provide you Citadel services according to the Terms of Use that you have accepted. Concerning the processing of your location data or your photos and videos in order to share them with other Users at your request, THALES carries out said processing based on your consent via the activation of your settings’ phone. You may withdraw your consent at any time via the settings of your phone, without prejudice to the lawfulness of the processing based on the consent given prior to the withdrawal of such consent.

2. Compliance with applicable legal requirements about information and security :

   • Making the requested data available to the judicial authorities;
   • Keep logs of Citadel access and identification data.

   Please note that the processing activities specified therein are necessary for compliance with legal obligation to which THALES is subject.

3. Other purposes :

   • Establish statistics to ensure the security of Citadel and in particular the detection of malicious behaviour ;
   • Communicate information related to Citadel to the Users;
   • Improvement of Citadel services:
     • Carry out Users’ surveys;
     • Establish statistics to improve the Citadel services;
   • Litigation management.

   Please note that, in order to carry out the processing activities specified therein, THALES relies on its legitimate interest which consists in ensure the security of Citadel, communicate with Users, improve Citadel and assert its rights in case of litigation.

When the provision of your personal data is identified as mandatory, this provision is a condition for the conclusion of the contract allowing you to use Citadel. If you choose not to provide your personal data when such provision is identified as necessary, then THALES will not be able to provide you with the services requested.

For the purposes of (i) compliance with applicable legal requirements about information and security and (ii) establish statistics to ensure the security of Citadel and in particular the detection of malicious behaviour, your personal data will be kept :

• one (1) year from collection for the information contained in the connection logs ;
• for the duration of the contractual relationship and one (1) year from the deactivation of the account for information related to the opening of the account: name, first name, e-mail address, telephone number.

Subject to the foregoing and the following, for the purpose of the provision of Citadel services, your personal data will be kept for the duration of the contractual relationship.

For the purpose of improvement of Citadel services and communication of information related to Citadel to the Users your personal data will be kept during the contractual relationship and will be deleted one (1) year following the termination or expiration of the contractual relationship.

In addition, if you do not use Citadel for eleven (11) months, your account will be considered inactive. We will then notify the Users concerned and delete the accounts of those who have not responded within one (1) month. The data associated with these accounts will be deleted in accordance with the above.

Finally, for the purpose of litigation management, your personal data will be kept for the duration of the contractual relationship and within the limit of the applicable legal limitation period.

In the context of such processing, the recipients of all or part of your personal data will be (i) the personnel of THALES and other entities of its group in charge of the administration, supervision and management of THALES information systems, as well as (ii) some personnel of third parties which provide services to THALES, in particular hosting services and (iii) the customer (“Customer”), when Citadel is available as subscription with the fleet management option and/or as an employer. All such recipients being located within the European Economic Area (EEE) and in the countries listed below.

In addition, the Customer, as employer, may have access to some of your personal data in order to be enable to identify risk situations and data leak on Citadel. In this specific case, your employer, the Customer, is data controller (THALES is data processor) and you must refer to the information notice provided by your employer in order, in particular, to address your requests.

When the Customer is the recipient of all or part of your personal data, in particular when Citadel is available as subscription with the fleet management option and/or as an employer, the sharing of your personal data may imply transfers of your personal data out of the European Economic Area (EEA) to the country where the Customer is located. THALES pays particular attention to the protection of your personal data. Thus, where such transfers out of the EEA shall take place, THALES first implements appropriate safeguards by signing the standard contractual clauses of the European Commission with the entity out of the EEA which processes your personal data. You can obtain a copy of such clauses by addressing your request through one of the emails referred to below.

Please note that you have the right to access your personal data and to request that your personal data be rectified or deleted. You are also entitled to object to the processing of your personal data or to request restriction thereof. In addition, you have the right to ask for receiving, in a structured and standard format, your personal data that you provided to THALES and which THALES processes by automated means.

In case of any request or complaint, please send an email to support@citadel.team. You can also contact our Data Protection Officer by sending an email to the following address: dataprotection@thalesgroup.com. In any case, you also have the right to lodge a complaint with the competent data protection authority.