Personal data protection policy

General Framework of the Policy

In accordance with the General Data Protection Regulation and the amended French Data Protection Act of 1978, we are committed to respecting and protecting your personal data.

As part of this commitment, we have established this Policy to describe the measures in place within Ofi Invest regarding personal data protection. It also outlines the conditions under which these entities, in their capacity as data controllers (or as processors on behalf of other Ofi Invest entities or, where applicable, third-party entities), collect and process personal data as part of and/or for the purposes of their activities, or subcontract data processing to third parties. At the forefront of this framework, in compliance with current regulations, is the record of processing activities implemented for the various Ofi Invest entities. This record lists the data processing activities we carry out and allows us to monitor the use of the personal data collected in each subsidiary.

This Policy also aims to specify:

• on the one hand, the individuals who may be concerned, the nature of the personal data involved, the methods by which such data is collected, the purposes of processing, and the lawfulness of the processing;
• on the other hand, the ways in which individuals concerned by such processing can exercise the rights they have regarding such data under the current regulations.

The individuals concerned

Given the nature of the activities conducted by the various Ofi Invest entities, the following individuals may be affected by the data processing activities we carry out:

• On one hand, Ofi Invest clients (or their heirs or beneficiaries), representatives, shareholders, or ultimate beneficial owners of these clients, as well as their prospects and, more generally, individuals who visit their websites or provide their contact details to them/us through any means for the purpose of obtaining services related to the activities of each Ofi Invest entity or associated services. Personal data may be collected either directly from you or from third parties authorized by you to provide us with such data, or from external sources such as publications or databases (Official Journal, BODACC, RCS, INPI, etc.), fraud prevention organizations, authorities, or institutions.
• On the other hand, and for example (without this list being exhaustive), if you:
  • Work with us as a supplier, service provider, or subcontractor;
  • Have a relationship with our company within the framework of a partnership;
  • Are part of our request for proposals (RFP) process to submit an offer for new projects;
  • Visit an office or register to attend an event we organize or sponsor;
  • Are introduced to us by third parties for legitimate marketing purposes; or
  • Participate in a contest or event we organize or sponsor.

Nature of the Data Collected

In compliance with applicable regulations, we collect and use only the personal data necessary for our activities. This may include:

• Your identity: First name, last name, gender, date and place of birth, nationality, signature specimen, photograph, etc.
• Your contact details: Mailing address, email address, phone number, etc.
• Your appearance (image, voice): Particularly when attending events organized by Ofi Invest, as well as when required by regulations.
• Tax-related data concerning you.
• Your professional status: Job title, company, etc.
• Your economic and financial situation: Bank account details (RIB), tax status, origin of assets/funds, etc.
• Your investor profile: Data related to subscribed products and services.
• Transactions carried out, including data related to beneficiaries or ordering parties.
• Data from exchanges and interactions: Interviews, phone calls, letters, emails, chats, access to our social media pages, or any other type of communication.
• Browsing data collected via cookies or trackers, of any kind.
• More generally, connection data related to the use of online services, including identification and authentication data.
• Data from video surveillance systems (i.e., cameras installed in premises we occupy).
• Data necessary for engaging in pre-contractual procedures or for concluding and/or executing contracts with an entity.
• Data related to criminal offenses, subject to the strict conditions defined by data protection regulations.
• Where applicable and in the context of our business relationships, your hobbies and interests.

Methods of Data Collection

The collection of this data is most often carried out directly from you or through cookies and similar technologies (trackers, pixel tags, links, etc.) when you visit our website. In particular, these technologies facilitate your navigation during future visits and enable us to offer the most suitable service and the best possible user experience. To learn more about these technologies and how you can use your browser settings to manage your privacy preferences, please refer to our Cookie Policy.

Data collection may also occur when you contact us through one of our offline channels (e.g., inquiry forms, phone, or email), when you visit one of our sites, or when you participate in an event. In certain cases, your data may also be provided to us by third parties, either directly or upon our request. For example, many clients invest in our products through a financial advisor or one of our business partners; these intermediaries may therefore provide us with personal data about the relevant client. Other third parties (lawyers, trustees, family members, directors, partners, authorized signatories, beneficial owners, and other relevant contacts within your organization, etc.) may also provide us with personal data about individuals involved in a transaction (such as shareholders, associates, owners, beneficiaries, guarantors, etc.).

In some cases, particularly when it is necessary to conduct specific research, we may rely on public agencies to assess your creditworthiness (including financial accessibility), determine product suitability, verify your identity, manage your account, track debtors or beneficiaries, and prevent criminal activity. For example, when we invest in assets, we may collect information about the owner of the property we plan to acquire to fulfill our obligations in anti-money laundering compliance. We also collect data on individuals who rent or reside in the property (or, when the tenant is an organization, on key members of that organization, such as its directors or partners). Some of these checks may involve verifying public registers, conducting online searches using websites, social networks, and other information-sharing platforms, and utilizing databases managed by credit agencies and other reputable organizations (we can provide further details about these sources upon request).

For your full awareness, please note that we may process your personal data without notifying you and/or without your consent when required or permitted by law or regulation. Additionally, we may collect data about you from publicly accessible websites where such data is available, particularly for initiating commercial outreach if, based on identified information, you might have an interest in Ofi Invest’s products or activities.

However, we do not collect, use, or transfer information related to investment platform clients. The providers/investment platforms are solely for processing all personal data you share with them. If you are a client of one of these providers or platforms, please refer to their Data Protection Policy or equivalent document.

Important Reminders:

• If you choose not to provide the required information, we may not be able to fulfill our obligations, which could impact the services we provide to you.
• If you provide us with personal data about a third party, you must formally inform that individual and ensure that they consent to the sharing of their data and are satisfied with the data you have shared with us.

Purposes of Processing Collected Data

Regardless of the circumstances surrounding the collection of personal data, it is always carried out in compliance with applicable regulations. In most cases, the collected data is used for the following purposes:

• For the conclusion or execution of a contract that binds us ("contractual necessity").
• More broadly, for managing client relationships, particularly as part of our duty to provide advice (which may involve gathering your needs and, consequently, personal data).
• For prospecting, commercial management, promotional, and customer loyalty operations, including marketing activities and sending communications.
• For the preparation of statistics, including commercial analyses, actuarial studies, or other research and development analyses; in such cases, processing is based on the data controller’s legitimate interest while respecting the rights and interests of the client/investor.
• To improve the quality of our services.
• To respond to any requests you have made to us.
• For your participation in an event, regardless of its nature, that we organize or sponsor.
• When we must comply with a legal, regulatory, or administrative obligation ("legal compliance"), such as fulfilling our customer due diligence obligations, verifying your identity, helping detect and prevent fraud, and combating financial crime. These obligations include all necessary measures to comply with the Anti-Money Laundering (AML) Directive, which states that the fight against money laundering and terrorist financing must be considered a matter of public order.
• To meet reporting obligations, particularly to regulatory authorities, supervisory bodies, or public authorities such as tax administrations.
• To retain necessary evidence in case of regulatory audits by the French financial regulator (AMF), in accordance with AMF regulations and established guidelines.
• To ensure the security of the premises where we operate (video surveillance).
• To manage and track complaints and potential disputes.

Lawfulness of Processing

If the processing activities are not justified by contractual or regulatory obligations (such as those listed above), they are based either on our legitimate interest (after a preliminary analysis considering both the positive and negative impacts such processing may have on your rights and freedoms) or on your consent, which we will have obtained in advance.

To protect privacy rights and enable our clients and prospects to control the use of their personal data, you may request at any time to opt out of direct marketing activities targeting you. To facilitate this, all our marketing communications include unsubscribe links to help you manage your marketing preferences.

Please note that opting out of one type of marketing (e.g., email or phone) does not mean you are unsubscribed from all marketing communications. Kindly consider this when managing your preferences.

In general, we recommend that you regularly review the Data Protection Policy and the preference settings available on the websites, platforms, and social media networks you use, as these dictate how advertisements and other messages are displayed and shared on these media.