Privacy Policy

Article 1. General Information

The company MAUNA (hereinafter referred to as the "Company" or "Mauna") considers the protection of personal data to be of fundamental importance for the operation of its activities. The personal data of its customers, users, and visitors of its application are protected and processed with the utmost care, in compliance with the applicable legislation.

The Company is committed to respecting your rights regarding data privacy when you use the Digital Media (namely its website mauna-ai.com, its web or mobile application MAUNA (the "Application"), its pages on social networks, its online forms, etc.) and communicate with it electronically.

This Privacy and Data Protection Policy (hereinafter the "Privacy Policy") allows you to learn more about your rights and about the origin and use of your personal data processed in the management of your subscription to the Application's services and the use of the Digital Media managed by the Company.

For the purposes of this Privacy Policy:

• The term "Personal Data" refers to information that can be used to identify or contact you online or offline, as well as any information you provide to us. This information includes your name, first name, username, postal address, email address ("Personal Information"), as well as, where applicable, medical and health data such as your cardiac activity, demographic data such as your date of birth, age, gender, your geolocation data, and your sleep and dietary habits or preferences when this data is associated with your personal information (collectively referred to as "Personal Data").
• The term "Data Controller" refers to the Company, which alone or jointly determines the purposes and means of the processing of Personal Data described in this policy. Before using the Digital Media, please read this Privacy Policy carefully and accept it. Legally, you are not obliged to provide the Company with personal data, and you hereby confirm that you knowingly and freely provide your Personal Data to it. By using the Digital Media, you accept the terms of this Privacy Policy and the collection, analysis, and sharing of Personal Data for the purposes set out herein. If you do not agree to the terms of this Privacy Policy, you will not be able to use the Digital Media.

The Company reserves the right to modify this Privacy Policy at any time. The Company will inform you of any changes by publishing them in this Privacy Policy. The Company therefore invites you to regularly consult this Privacy Policy to ensure that you are aware of any changes made and how your data may be used.

Article 2. Collection of Personal Data

Personal Data is collected only with your consent, particularly during your initial connection and only if you wish to access the features and various services offered by the Digital Media, namely, for example:

• Creating a user profile to access the services offered by the Application;
• Subscription to a paid subscription;
• Subscription to a newsletter;
• nvitation or participation in an event organized by Mauna;
• Use of the contact form.

The types and amount of data collected for the aforementioned features will vary depending on the activity.

Among the Personal Data requested are, in particular,

• for any "athlete" user: Name, first name, gender, email, username, date of birth, avatar, photo, nickname, gender, health data (physiological information, dietary information, heart rate, weight, sleep information, menstruation day), geolocation data, information about potential injuries and pains, mindset and mood (as well as perceived energy level) at the time of the recorded sports activity or on the day of data recording.
• for any "coach" subscriber: Name, first name, company (if applicable), email, gender, username, date of birth, avatar, photo, nickname, affiliated sports club.

For certain activities, especially when creating a user profile, you will be prompted to create a username and/or password and/or provide other information, including (i) your age or date of birth, (ii) your gender, and/or (v) other information about you.

Subject to the requirements of the applicable laws, the Company may use multiple technologies that collect and provide information about how you view and use the Digital Media, as well as demographic data about Digital Media users that may be obtained from third parties such as Google or the social networks you use ("Usage Data"). Usage Data may include the pages you have viewed, the time you spent viewing them, the product associated with the information or other content you viewed, the display language, demographic data about you (such as your age, gender, and interests, where applicable), and the pages you viewed before arriving at the current page, so that the Company can have a more accurate idea of how its users interact with the services and features of the Digital Media, and thus adjust and improve its services accordingly. Generally, most Usage Data collected cannot be personally associated with you. However, if the Company is able to associate it with you, it will consider it as your Personal Data, in accordance with this Privacy Policy.

Article 3. Purposes of the Collection of Personal Data

The Company collects and processes only personal data about you for which it has legal grounds. Legal grounds include your consent (when you have given your consent to the processing of data), the contract (when the processing of data is necessary for the performance of the services offered by the Application between the Company and yourself), and "legitimate interests."

When the processing of personal data is subject to your prior consent, you have the right not to consent or to withdraw your consent at any time; when the processing of your personal data relates to legitimate interests, you have the right to object. For any questions regarding the legal grounds on which the Company relies for the collection and use of your personal data, please do not hesitate to contact us by email, mail, or phone at the contact details below:

Mauna SAS

18, rue Molitor 75016 Paris

Email: data@mauna-ai.com

In general, all data collected is used for the sole purposes for which you have transmitted them, or for any other purpose stated at the time of collection or in this Privacy Policy. These purposes are as follows:

• When you register on the Digital Media, the Personal Data you provide is used to provide you with the benefits and services associated with creating a user profile, including the ability to receive the information and communications selected at the time of registration or automatically associated with your registration (e.g., subscribing to a newsletter, creating an account, providing informational content, using services related to the Application, invitation or participation in an event organized by the Company);
• When you have used the "Invite coach/athlete" feature: the Personal Data requested for one-time use features (typically, names and email addresses) are used only once (e.g., to send communication) and are retained for a period not exceeding 2 years;
• When you subscribe to a subscription on the Digital Media: the Company uses your Personal Data to:
  • manage the subscription and services offered by the Application
  • feed the Mauna artificial intelligence database and thus improve the services provided via the Digital Media, during the learning phase, to train, test, and improve the algorithm, and during the production phase, to improve the quality of the services on the Digital Media, develop and improve the algorithm;
• When you use a contact form: your Personal Data is used to respond to your request or comment.

In addition to the purposes for which you have provided your Personal Data, you may also have the opportunity (through a checkbox or otherwise) to authorize the use of your Personal Data for an activity or service that differs from the primary activity or service you are requesting. If you decide to take advantage of these additional services, the Company will use your data to provide them to you.

The Company may also use your email address to send you transactional or administrative communications (e.g., a confirmation email when you subscribe or unsubscribe to the Application, as well as certain announcements related to services (e.g., notifications regarding updates to its Privacy Policy, addition or discontinuation of features or programs on the Digital Media).

The Company may also use your Personal and/or demographic data as part of its internal marketing and demographic studies, in order to continuously improve and personalize the services it provides, and better meet your needs.

The Company may also pseudonymize or anonymize the Personal Data collected.

Article 4. Refusal to Provide Personal Data

If you decide not to provide your Personal Data when requested, you may not be able to access all the features offered by the Digital Media. Additionally, the personalized features available on the Digital Media will limit the services and special offers that the Company may offer you. For example, if you refuse to provide your email address, you will not be able to receive any newsletters or register on the Digital Media.

However, if you simply wish to explore the Digital Media and learn more about the Company, it is not necessary to provide any additional Personal Data.

Article 5. Sharing and Disclosure of Personal Data

The Company guarantees the confidentiality of your Personal Data.

To this end, the Company undertakes never to disclose your Personal Data to a third party intending to use it for direct marketing purposes unless it has expressly informed you of this possibility and has obtained your explicit authorization.

For the purposes set out in Article 3, the Company may share your Personal Data with third parties, but only in the following cases:

• The Company may transmit certain data from one user to other users of the Digital Media, particularly between coach and athlete, to provide the services associated with the Application, namely, in particular, the transmission of some of the Personal Data between each "athlete" user and their coach, or the transmission of messages between users.
• The Company may use service providers, agents, or suppliers to support the internal operations of the Digital Media and help manage them. These third parties must at all times guarantee the same levels of security as the Company regarding your Personal Data and are bound, where applicable, by a legal agreement under which they are required to preserve the confidentiality and security of your Personal Data and to process it only according to the specific instructions of the Company.

To this end, the Company uses providers established mainly in the European Union and the United States. The Company makes sure to act responsibly and to interact only with third-party service providers who display a data privacy policy governing their own processing of personal data and who ensure an adequate level of protection in accordance with the requirements of European data protection regulations (including the General Data Protection Regulation (EU) 2016/679 of April 27, 2016, the "GDPR"). If the Company were to transfer Personal Data beyond the borders of the EEA, it would establish contractual mechanisms and binding legal processes to lawfully transfer and secure these data flows.

• All so-called "sensitive" Personal Data, i.e., medical and health data, are hosted by an approved health data host service provider ("HDS"), which guarantees maximum security and compliance with the recommendations of the CNIL.
• When the Company launches a common service on the Digital Media or in partnership or sponsored by another company, another organization, or a third party, and it collects and processes Personal Data in the context of this event or service, the Company may share your Personal Data with its partner or sponsor. If your Personal Data is collected by (or shared with) a company other than the Company in connection with this promotion, the Company will inform you at the time of the collection of your Personal Data.
• The Company may make your Personal Data known to certain of its employees, who are also subject to a confidentiality obligation, and only within the strict framework of the purposes mentioned in Article 4.
• In the event of a merger or acquisition of the Company, in whole or in part, by another company, or if the Company were to sell or transfer all or part of its business, the acquirer would have access to the information obtained by the Company, including the Personal Data, subject to the applicable laws. Similarly, Personal Data may be transferred in the context of a company restructuring, insolvency procedure, or similar event, if permitted by and in accordance with the applicable legislation.
  The Company may also disclose your Personal Data when required by law or if it believes in good faith that such action is reasonably necessary to comply with legal proceedings, respond to any claims, or protect the safety or rights of the Company, its clients, or the public. In this case, the Company undertakes to notify you in accordance with the conditions provided by the applicable legislation.

The Company may share aggregated information from surveys or statistical information with third parties. However, this information is anonymized and does not contain any Personal Data. The aggregated information shared may include anonymized information collected through the use of cookies and other trackers, as explained in Article 11.

In any case, the Company will make its best efforts to ensure the confidentiality and security of the Personal Data collected when transmitting them to the aforementioned persons.

Article 6. Data Retention Period

Your Personal Data will be retained by the Company for a period not exceeding the duration necessary for the purposes for which they were collected or processed, in accordance with the applicable provisions. In this respect, the Company keeps your personal data for as long as your user profile has not been deleted (within the limit of the maximum legal retention period for Personal Data), or as long as the contract concluded with you continues.

The Company may also need to retain your Personal Data for a longer period, solely for the purposes of complying with any legal or regulatory obligations, responding to any questions or complaints that may be addressed to it after the cessation of the contractual relationship with you, settling any disputes, enforcing its contracts, or for any other similar file management purposes.

The Company may thus retain your Personal Data for a reasonable period following the cessation of the use of the services or Digital Media. Beyond this period, your Personal Data will be deleted from all systems operated by the Company, or anonymized.
If you wish the Company to cease using your Personal Data to provide you with services (for example, refuse to receive emails), please contact the Company as indicated in Article 9.

Article 7. Security Measures

The Company takes the security of your Personal Data very seriously.

The Company undertakes to take all necessary technical and organizational measures to preserve the confidentiality and security of your Personal Data collected on Digital Media, including your sensitive Personal Data. These efforts include, among others: (i) the storage of your Personal Data in secure operating environments, only accessible to authorized employees of the Company, as well as its agents and service providers; (ii) verification of the identity of registered users, before allowing them to access the Personal Data that the Company holds about them; (iii) internal training and awareness within the Company of the importance of the protection of Personal Data.

Employees of the Company who have access to your Personal Data by virtue of their duties undertake to maintain the highest level of confidentiality in this regard.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. Thus, even if the Company makes its best efforts to protect your Personal Data, it does not control the risks related to the operation of the Internet and draws your attention to possible risks in terms of occasional data loss or breach of the confidentiality of data transiting through this network.

Article 8. Links and Interactions with Third-Party Sites

The Digital Media may allow you to interact with third-party sites or may contain links to other sites, mobile applications, and third-party services that are neither owned nor controlled by the Company (each a "Third-Party Service"). The Company is not responsible for the privacy practices or content of Third-Party Services. Please note that the Third-Party Service may collect information about you. Therefore, the Company invites you to read the terms and conditions and privacy policies of each Third-Party Service with which you choose to interact.

Article 9. Rights of Individuals regarding Personal Data

In accordance with the applicable legislation, and in particular French Law No. 78-17 of January 6, 1978 known as the "Data Protection Act" as amended and the GDPR, you have the following rights:

• a right of access, that is to obtain confirmation as to whether or not Personal Data is being processed and, where such data is being processed, access to such Personal Data, as well as various information including the purposes of the processing, the category of Data, the recipient(s) of the Personal Data, etc.
• a right of rectification, as soon as possible, of Personal Data that is inaccurate, incomplete, outdated, or ambiguous, or whose collection and processing are prohibited;
• a right to object to the processing or transfer of Personal Data, unless there are compelling legitimate grounds for the Data Controller that override the interests of the Data Subjects;
• a right to erasure of Personal Data that you can request in the cases defined by law for the following reasons:
• a right to limitation of the processing of Personal Data concerning the Client for the following reasons:
  1. for a period allowing the Data Controller to verify the accuracy of the personal data, when the data subject disputes it;
  2. the processing is unlawful and the data subject opposes their erasure and instead requests the limitation of their use;
  3. the Data Controller no longer needs the Personal Data for the purposes of the processing, but they are still necessary for the data subject for the establishment, exercise, or defense of legal claims;
  4. during the verification as to whether the legitimate grounds pursued by the Data Controller prevail over those of the data subject when the data subject has objected to the processing.
• a right to the portability of Personal Data which can be exercised free of charge, at any time, and in particular when closing your user account on the Digital Media, in order to retrieve and retain your Personal Data. In this context, we will send you your Personal Data, by any means deemed useful, in a standard open format commonly used and machine-readable, in accordance with the state of the art.
• a right to define directives concerning the processing of Data after your death: These directives can be general, i.e., they then concern all the personal data concerning you. They must be registered with a digital trusted third party certified by the CNIL. The directives can also be specific to the Personal Data processed by our company. You must then transmit them to us at the contact details indicated below. By transmitting such directives to us, you expressly consent to the fact that these directives will be kept, transmitted, and executed in accordance with the provisions hereof. You can designate a person responsible for their execution in your directives. This person will then have the authority, when you are deceased, to take note of such directives and ask us to implement them. In the absence of designation, your heirs will have the authority to take note of your directives upon your death and ask us to implement them. You can modify or revoke your directives at any time by writing to us at the contact details below.

You also have the right to lodge a complaint with the CNIL if you consider that the processing of your Personal Data covered by this policy constitutes a violation of applicable laws.

You can exercise your legal rights at any time by sending your request by email, by post, or by phone to the contact details below:

Mauna SAS

18, rue Molitor

75016 Paris

Email: data@mauna-ai.com

In order for the Company to satisfy this request, you must provide the necessary elements for your identification: name, first name, email.

After the deletion of Personal Data concerning you, you will not be able to restore it. Furthermore, the Company cannot guarantee that such deletion will completely eliminate any content or personal information that you may have otherwise made public.

Article 10. Information about Minors

The Digital Media is not intended for children who have not reached the age of majority ("Minors"), but is not reserved for adults as they do not contain content prohibited to Minors.

Minors under the age of 15 are not allowed to create their own user profile; only their legal representative has the power to create a user profile for them.

If the Company is informed that it has collected the Personal Data of a Minor under circumstances other than those mentioned above, the Company will take steps to delete this information as soon as possible.

Article 11. Cookies and Other Technologies

The Company may use tracking devices such as cookies, IP addresses, or event logs to collect certain information, including the type of browser and operating system, the referrer page, the browsing path through the site, the ISP's domain name, etc., to improve the use and functionality of its Digital Media and to better understand how visitors use the Digital Media, as well as the tools and services offered therein. Tracking technologies allow it to tailor its Digital Media to your personal interests and needs.

Subject to obtaining your consent where required by applicable law, the Digital Media uses cookies and similar technologies ("Cookies"). Cookies are small files installed on your device, which serve various functions, including enabling you to navigate between pages efficiently, remembering your preferences, and generally enhancing your experience. The use of cookies on the Digital Media allows you to navigate more smoothly during your visits and to track your movements on the Digital Media more accurately.

Generally, a cookie contains the name of the website/application from which it originates, the duration for which the cookie will remain on the device, and a value, usually a randomly generated unique number.

An IP address is a number used by computers on the network to identify your computer each time you are connected to the Internet. The Company may store IP addresses (Internet Protocol) in order, in particular, to: (i) solve certain technical problems, (ii) ensure the security of its website, (iii) limit access to its Digital Media to certain users, and (iv) better understand how its Digital Media is used.

The Company (or a third party on its behalf) may collect information in the form of event logs that record the activity of the Digital Media and gather statistics regarding users' browsing habits. These entries are generated anonymously and allow, among other things, to collect (i) the user's operating system and browser type, (ii) information about a user's session (such as the original URL, date and time of consultation of the Digital Media, pages viewed on the Digital Media, and their duration of consultation), and (iii) other similar data regarding the browsing path.

The Company also uses the information contained in event logs for internal marketing and demographic studies, in order to constantly improve and personalize the online services it offers. Event logs are used only internally and are not associated with any particular user. Among the types of cookies that the Company may use are session cookies, persistent cookies, and internal cookies.

• Persistent cookies are used to save your login data and remember your settings for your next connections to the Digital Media. A persistent cookie is stored as a file on your computer and remains there when you close your web browser. The cookie can be read by the Digital Media that created it when you visit it again.
• Session cookies are used to enable certain features of the Company's services and Digital Media, to better understand how you interact with the Digital Media, and to track overall usage and Internet traffic routing. Unlike persistent cookies, session cookies are deleted from your computer when you close your browser. They generally store an anonymous session ID on your computer, allowing you to navigate a website/application (for example) without having to log in on each page.
• Internal cookies are the Company's own cookies, which it uses to enhance your experience. They are associated with an individual user's personal information. No third party can access the information that the Company collects through its own cookies.

Below is a list of the different types of cookies that the Company uses on its Digital Media :

Essential Cookies :
They are absolutely necessary for the proper functioning of the Digital Media and the use of its services and features.
The Company also uses technical cookies that allow the Digital Media to remember your choices (such as your username, language, or country) for customization purposes. These cookies do not collect any information about you that can be used for advertising purposes or to remember the pages you have viewed on the Internet.
These cookies are essential for the proper functioning of the Digital Media. You cannot refuse their use.

Analysis Cookies
The Digital Media may also use analysis cookies (such as Google Analytics). These cookies collect information about how you use and navigate the Digital Media.
For example, these cookies will remember the most visited pages, IP addresses (Internet Protocol), browser type, Internet Service Provider (ISP), referral/exit pages, operating system, timestamp, and browsing path. The Company uses this information to analyze trends, manage the website, track user browsing on the Digital Media, and collect demographic data about the user base as a whole.
You can control cookies through your browser preferences and other tools. To disable these cookies, please refer to our dedicated page on the Digital Media.

Article 12. Questions / Contact

If you have any questions, complaints, or comments regarding this Privacy Policy or data collection and cookie management practices, please contact the Company by sending a letter to Mauna SAS or by sending an email to data@mauna-ai.com.