PRIVACY AND PERSONAL DATA PROTECTION POLICY

Last Updated: 05-05-2025

SHAZPARK is committed to protecting your personal data to allow you to browse with peace of mind on our site www.shazpark.com/the SHAZPARK application (hereinafter referred to as the “Platform”).

We protect your privacy by ensuring the protection, confidentiality, integrity, availability, and security of the personal data you entrust to us across all our communication channels.

We wish to inform you through this policy about the processing of your personal data (hereinafter referred to as the “Policy”) in the context of using our Platform in accordance with Articles 12, 13, and 21 of the European General Data Protection Regulation (GDPR) and the French Data Protection Act adopted thereafter.

Personal data refers to any information relating to an identified or identifiable natural person in accordance with Article 4 of the GDPR (hereinafter referred to as “Data”).

Data Controller

The controller of your Data under the GDPR is:

SHAZPARK

Simplified joint-stock company with a share capital of €1000

Registered with the Lyon Trade and Companies Register under number 909 940 413

Head office: 181 rue Joliot Curie – 69005 Lyon

Email: support@shazpark.com

Purposes and Legal Bases for Data Processing

We collect and process your Data to provide our Platform and offer you the best possible service.

Visiting Our Platform

You can use the Platform without providing any personal information.

If you use our Platform for informational purposes only, we do not process any Data, except for the data transmitted by your browser to enable the consultation of our Platform and the information transmitted in the context of cookies for the purpose of statistical analysis of the use of the Platform (see below, Article 6).

We process your Data to provide you with technical access to our Platform based on the following legal bases:

• In pursuit of our legitimate interests, to ensure the technical provision of the Platform. Our legitimate interest is to provide you with an attractive, technically functional, and user-friendly Platform, take all measures intended to protect our Platform from cybersecurity risks, and prevent third parties from being exposed to such risks on our Platform.

For more information, we invite you to refer to Article 6.

In any case, the retention period for the information thus collected is a maximum of thirteen months from the insertion of the corresponding cookie.

Registration on the Platform

If you wish to register on our Platform, you will need to provide certain mandatory information, including your name, first name, date of birth, and email address, to enable your registration and the creation of an account.

The information thus provided will be stored on our servers.

Your Data is retained for the duration strictly necessary for the proper management of our commercial relationship and, in any case, for a period not exceeding three years from the last unanswered request from you and, failing a request for deletion and/or opposition from you in the meantime.

We do not transmit your Data to any third party without your express consent, except those mentioned in Article 5.

We process your Data for the purpose of managing your orders based on the following legal basis:

• In pursuit of our legitimate interest, which consists of providing you with an account in accordance with your registration request.

Using the Account on the Platform

If you wish to use your account and our services on our Platform, you will need to provide additional information, including:

• A photograph;
• A postal address;
• Your phone number;
• Information about your vehicle;
• Your mini-biography, your gender when you agree to provide this information;
• A copy of all written exchanges between you and SHAZPARK; we may record and/or listen to telephone conversations between you and SHAZPARK (for example, with agents of our Community Relations service). We provide you with the means to object to this processing at the beginning of the conversation;
• A copy of all reservations or publications made on our Platform;
• Details of financial or accounting transactions carried out on our Platform or by any other means, including information about your payment card, your bank details, information about the parking spaces reserved or for which you have published an advertisement on our Platform. This information may include your parking preferences, such as indicating whether you accept or not to present a health pass at the time of departure, if applicable;
• Details of your visits to our Platform and the content you have accessed;
• If applicable, your responses to our surveys and questionnaires and the reviews you have left to evaluate a trip made through our Platform, this information being likely to be used in the context of research and analysis of user behavior;
• The data we may ask you to provide when you report a problem related to our Platform or our services, such as the subject of your assistance request;
• Data related to your location when you have agreed that we collect and process this data so that we can respond to your search for parking spaces near you;
• A copy of your passport, your driver’s license, your identity card, or any other similar document that you have agreed to provide to us;
• Data related to your insurance subscriptions, as well as to your waivers of these subscriptions, if applicable, and a copy of the declarations made and forms completed for the purposes of subscriptions or contract management.

The information thus provided will be stored on our servers.

Your Data is retained for the duration strictly necessary for the proper management of our commercial or contractual relationship and, in any case, for a period not exceeding three years from the last unanswered request from you or five years from the end of the contract and, failing a request for deletion and/or opposition from you in the meantime.

We do not transmit your Data to any third party without your express consent, except those mentioned in Article 5.

We process your Data for the purpose of managing your reservations and sending you promotional emails based on the following legal basis:

• Based on the consent that you can withdraw at any time by sending an email to support@shazpark.com
• Based on the execution of the contract concluded when you make a reservation.
  1. Chat Form

If you contact us through our chat form, you must provide your name, first name, subject of the contact, and send us your message.

The Data is recorded with us for the purpose of processing your request and/or in case you have questions to ask us.

Your Data is retained for the duration strictly necessary for the proper management of our commercial relationship and, in any case, for a period not exceeding three years from the last unanswered request from you and, failing a request for deletion and/or opposition from you in the meantime.

We do not transmit your Data to any third party without your express consent, except those mentioned in Article 5.

We process your Data for the purpose of responding to your requests based on the following legal basis:

• In pursuit of our legitimate interest, which consists of providing you with appropriate responses to your requests.

Reservation (Purchase) on the Platform

If you wish to make a reservation on our Platform, you will need to provide certain mandatory information, including your …, as well as certain financial information (such as your bank card number) to enable the payment of the ordered reservations and the processing of your reservations.

The information thus provided will be stored on our servers.

Your Data is retained for the duration strictly necessary for the proper management of our contractual relationship and, in any case, for a period not exceeding five years from the end of the contract.

We do not transmit your Data to any third party without your express consent, except those mentioned in Article 5.

We process your Data for the purpose of managing your orders based on the following legal basis:

• Based on the execution of the contract concluded when you make a reservation.

Reviews

After your reservation on the Platform, we would like to know if you are satisfied with our services.

We will then send you an email within the month following the reservation, inviting you to evaluate the services.

The publication of this review on the Site will be done with your prior consent and after acceptance of the specific general terms of use of said service accessible here.

Your Data (are retained for the duration strictly necessary for the management of this review and, in any case, for a period not exceeding that necessary for the pursued purpose and/or that indicated by our service provider and, failing that, by sending an email to …).

We do not transmit your Data to any third party without your express consent, except those mentioned in Article 5.

We process your Data for the purpose of responding to your requests based on the following legal bases:

• Based on the consent that you can withdraw at any time by sending an email to support@shazpark.com

Newsletter Subscription

You can subscribe to our newsletter in the relevant section by providing your email address.

For the subscription to our newsletter, we use the double opt-in (double confirmation) technique. After you have logged in to our Platform, you will receive an activation email. It is only if you confirm the activation link it contains that you will be subscribed to the newsletter.

We will then regularly send you our newsletter containing current information and promotional emails about our services. You can, at any time, unsubscribe and/or request not to receive our newsletter anymore.

Your Data is retained for the duration strictly necessary for sending this newsletter and, in any case, for a period not exceeding three years from your subscription or the last unanswered request from you and, failing a request for deletion and/or opposition from you in the meantime by sending an email to support@shazpark.com or by clicking on the unsubscribe link appearing at the end of each newsletter received by email.

We do not transmit your Data to any third party without your express consent, except those mentioned in Article 5.

We process your Data to send you our newsletter based on the following legal basis:

• Based on the consent that you can withdraw at any time by sending an email to support@shazpark.com or by clicking on the unsubscribe link appearing at the end of each newsletter.

1. Deletion

Your Data is deleted as soon as the purpose of their processing has ceased or no longer exists or you request their deletion.

Your Data is also deleted upon the expiration of the retention periods mentioned above, unless it is necessary or legitimate to retain the Data for the signing, execution, or termination of a contract, or you have given your express consent for them to be retained.

Categories of Recipients

Initially, only our employees are likely to process your Data. They are bound by the confidentiality of the Data and are regularly trained in data protection and security.

However, we may communicate them to other SHAZPARK members in the context of a reservation or to other recipients providing us with services related to our Platform, to the extent permitted or provided by law. In this case, we limit the transfer of your Data to what is strictly indispensable. On the one hand, our service providers receive your Data as subcontractors and are strictly bound to comply with our instructions regarding the processing of your Data, including compliance with the regulation relating to the protection of personal data. On the other hand, the recipients process your Data independently and seriously, as they are transmitted to them by us.

Below is the list of categories of recipients who may receive your Data:

• Social network platforms that may offer you features allowing you to integrate information from your account on their own platform into your SHAZPARK profile,
• Our commercial partners who promote their services on our Platform and to whom you may decide to subscribe. These services may include insurance services, banking services, vehicle rental services, etc.,
• Our commercial partners on whose websites we may possibly advertise our services,
• Identity verification providers: to ensure your identity and the absence of fraud,
• Payment providers: in the context of combating online payment fraud and/or debt collection, we may be required to transmit your financial information to an external provider equipped with an online fraud detection tool to authenticate a payment or collect a debt,
• Communication providers: we may also communicate the information you provide on our Platform to third parties who provide services related to the Platform,
• Legal providers: we may also communicate the information you have provided to us if this disclosure is necessary to comply with the current regulation, respond to a summons, or exercise or defend a right in court.

1. Cookies

We invite you to consult our cookie policy.

1. Data Transfer

The collected Data will generally not be transferred outside the European Union.

However, to the extent that, for example, some of our service providers are located in countries outside the European Union (“Third Countries”), we transfer some of your Personal Data to Third Countries. This may be the case, in particular, to Third Countries for which the European Commission has not made an “adequate protection” decision. In such a case, we ensure that this transfer is carried out in compliance with the applicable regulation and guarantees an adequate level of protection of privacy and the fundamental rights of individuals (in particular by the standard contractual clauses of the European Commission).

Upon simple request made to support@shazpark.com, we can provide you with more information about these guarantees (in particular the standard contractual clauses of the European Commission).

1. Security

We have implemented security and confidentiality measures to protect the Data you provide against unauthorized access and use.

To this end, appropriate technical and organizational measures are implemented to prevent the loss, misuse, alteration, and deletion of personal data concerning you. These measures are adapted according to the level of sensitivity of the data processed and the level of risk presented by the processing or its implementation.

All financial information you provide on our Platform is stored on the secure site of the financial institution chosen by us. Transactions concluded on our Platform are protected by an SSL encryption procedure.

However, you must be aware that despite all the security measures implemented, no transmission of Data over the Internet is 100% secure and that all information communicated online may potentially be intercepted and used by persons other than the intended recipient.

1. Rights of the Data Subjects

You have the following rights:

Right of Access: You are authorized at any time to request confirmation that Data concerning you is or is not being processed; in case of processing, you are also authorized to receive information concerning said Data and certain other information (including the purposes of the processing, the categories of Data, the categories of recipients, the planned retention period, the origin of the Data, the use of automated decision-making, and, in case of Data transfer to a non-member State, the appropriate safeguards), as well as a copy of your Data.

Right of Rectification: You are authorized to request the rectification of all incorrect or erroneous Data.

Right to Erasure (“Right to be Forgotten”): You are authorized, under certain conditions, to request the erasure, as soon as possible, of Data concerning you. The right to erasure does not apply, in particular, in cases where the processing of Data is required under (i) the exercise of the right to freedom of opinion and information, (ii) the fulfillment of a legal obligation to which we are subject (legal retention obligations, for example), or (iii) the establishment, exercise, or defense of legal claims.

Right to Restriction of Processing: You are authorized, under certain conditions, to request the restriction of the processing of your Data.

Right to Data Portability: You have the right to receive, in a structured, commonly used, and machine-readable format, the personal data concerning you that you have provided to us.

Right to Object: Under certain conditions, and in view of your personal situation, you can object to the processing of your Data. In this case, we will cease to process your Data unless the processing must be continued for legal reasons or for the exercise or defense of our rights in the context of any legal/judicial claims.

Right to Withdraw Consent: You have the right at any time to withdraw your declaration of consent regarding the protection of Data. The withdrawal of consent does not affect the lawfulness of the processing carried out based on this consent until its withdrawal.

You can exercise these rights by contacting us at support@shazpark.com .

If you have exercised one or more of your rights, we are obliged to inform, if necessary, all the recipients to whom the personal data concerning you have been disclosed, with your prior express consent, unless this proves impossible or requires disproportionate effort. You have the right to obtain information concerning these recipients.

1. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the CNIL.

The CNIL will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy in accordance with Article 78 of the GDPR.

However, we recommend that you always send us your complaints first at support@shazpark.com , we will respond within a period of two months.

Modifications and Updates to the Policy

By using the Platform, you accept the collection, use, and disclosure of your information as described in this Policy. This Policy reflects the professional practices in force within SHAZPARK and may be modified and updated at any time.