1. Introduction

ABADO MEDIA – SAS is committed to protecting the privacy and personal data of its users.

This Privacy Policy describes personal data processing in compliance with the GDPR and applicable French data protection laws.

2. Data Controller

3. Categories of Data Collected

Depending on usage, we may collect:

• Account data: email address, internal identifiers
• Profile and eligibility data: needed for access to surveys/activities
• Reward and redemption data: wallet status, reward history, validation signals
• Technical data: IP address, device type, operating system, browser
• Usage and interaction data: activity on the platform
• Security and fraud-prevention data: signals and logs
• Consent and preference data: cookie preferences, marketing preferences

We do not knowingly collect personal data from individuals who are not legally eligible to use the Service.

4. Purposes of Data Processing

We process personal data for:

• Account creation and management
• Access to surveys, tests, and activities
• Validation of participation and rewards attribution
• Fraud detection, prevention, and investigation
• Platform security and integrity
• Compliance with legal/regulatory obligations
• Service improvement and performance monitoring
• Marketing communications (newsletters, platform updates, re-engagement), where permitted and according to user preferences

5. Legal Bases for Processing

Depending on the context, processing is based on:

• Performance of a contract (providing the Service)
• Consent (notably for certain cookies and some marketing contexts)
• Legitimate interests (fraud prevention, security, service improvement)
• Compliance with legal obligations

Where processing is based on consent, users may withdraw consent at any time.

6. Data Sharing and Recipients

We may share personal data with trusted third parties when necessary to operate the Service, including:

• Hosting and infrastructure providers (Scaleway)
• Transactional email provider (Scaleway Transactional Email)
• Marketing email provider (SparkPost)
• Analytics tools (Google Analytics), subject to your cookie choices
• Survey, research, and reward partners (eligibility, validation, redemption)
• Security and fraud-prevention providers and internal systems

Recipients process data under contractual obligations and applicable laws.

7. International Data Transfers

Some providers (for example, analytics and marketing email providers) may process data outside the European Economic Area.

Where transfers occur, we implement appropriate safeguards in accordance with GDPR requirements (such as Standard Contractual Clauses and/or an adequacy decision where applicable).

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy.

Key retention periods (summary):

9. Data Security

We implement technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure.

No system can guarantee absolute security.

10. Your Rights

In accordance with GDPR, you have the following rights:

• Right to access your personal data
• Right to rectify or complete your data
• Right to erasure (under conditions)
• Right to restrict processing
• Right to data portability
• Right to object to processing (marketing, profiling)
• Right regarding automated decisions – request human intervention

Requests may be submitted via our support channels and may require identity verification.

Users also have the right to lodge a complaint with a supervisory authority. In France, the supervisory authority is the CNIL (Commission Nationale de l'Informatique et des Libertés).

11. Cookies and Tracking Technologies

We use cookies and similar technologies for functionality, security, analytics, and advertising where applicable.

Users can manage preferences via our consent management interface. For more details, see our Cookie Policy.

12. Automated Eligibility and Anti-Fraud Checks

We may use automated checks based on profile and activity signals to determine eligibility for certain surveys/activities and to prevent fraud and abuse.

These checks help protect users and partners and maintain service integrity.

Users may contact support if they believe an eligibility restriction is incorrect.

13. Account Deletion and Data Erasure

Users may request deletion of their account at any time, subject to identity verification and legal obligations.

Certain data may be retained in restricted archives where required by law or necessary for fraud prevention, dispute resolution, or legal defense.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal, operational, or service changes. Users are encouraged to review it regularly.