General Policy for the Protection of Personal Data

Respect for privacy and the protection of personal data is a key factor in building trust, a value that Pole Star is particularly keen to uphold, as it is committed to respecting the fundamental rights and freedoms of every individual.

This personal data protection policy reflects Pole Star's commitment to the responsible use of personal data in its day-to-day activities.

Data Privacy Contact

Pole Star has designated a data privacy contact responsible for overseeing the protection of personal data across all its establishments. The data privacy contact is the main point of contact for all persons concerned by the collection or processing of personal data, and coordinates with the Commission Nationale de l'Informatique et des Libertés (CNIL) when required.

To contact our data privacy contact: dpo@polestar.eu

Principles Applicable to the Protection of Personal Data

Pole Star develops, markets, hosts and maintains on-premise and cloud-based indoor geolocation solutions for its customers, enabling them to collect and process personal data in compliance with current laws and regulations, and in particular with the French Data Protection Act of January 6, 1978, as amended, and the standards laid down by the CNIL.

It applies the principles defined by Privacy by Design in all its projects, and pursues a policy of informing, raising awareness and training its teams in compliance with the principles laid down by the General Data Protection Regulation.

1. Specific, explicit and legitimate purpose of processing

Personal data is collected for specific purposes defined by the needs of the processing carried out within the framework of validated specifications.

2. Proportion and relevance of data collected

The personal data collected is strictly necessary for the purpose for which it was collected. Pole Star's data processing sheets are designed to minimize the amount of data collected.

3. Limited retention period for personal data

Personal data is kept for a limited period, which does not exceed the time required to meet the purposes for which it was collected or to comply with its legal obligations.

4. Sharing personal data

Pole Star may share Users' personal data with third-party service providers who assist it in the performance of its services, such as service providers providing services for the deployment and implementation of Pole Star solutions in the field. Pole Star undertakes to select third-party service providers who offer sufficient guarantees in terms of personal data protection.

Pole Star may also disclose Users' personal data if required to do so by law or by a court order.

5. Confidentiality / Data security

Information Systems Security Policies (ISSP) are implemented, adapted to the nature of the data processed and its handling.

Appropriate physical, logical and organizational security measures are in place to guarantee data confidentiality, and in particular to prevent unauthorized access.

Pole Star also requires any subcontractor to provide appropriate guarantees to ensure the security and confidentiality of personal data.

6. Personal rights

We take all necessary steps to ensure that people's rights to their personal data are respected.

Personal data is collected fairly; it is not collected without the knowledge or consent of individuals.
The personal data collected is brought to the attention of the persons concerned.
The data collected is not subsequently used in a manner incompatible with these purposes.
Personal data is kept accurate and up to date.
Data retention periods are made known to individuals, and vary according to the nature of the data, the purpose of processing, or legal or regulatory requirements.
Should personal data be transferred to countries inside or outside the European Union, the persons concerned will be informed in detail, and specific measures will be taken to control such transfers.
The means necessary to guarantee the effectiveness of people's rights with regard to their personal data are implemented, in particular through clear and complete information on the data processing implemented, easily accessible and understandable by all.

All individuals have the right to access their personal data, at any time and free of charge, by providing proof of their identity. Individuals can thus access their personal data, and in certain cases have it corrected, deleted or objected to being processed. Individuals also have the right to withdraw their consent at any time, and the right to file a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés).

Access to these rights (access, rectification, deletion, opposition) is facilitated by the functionalities of the software used by Pole Star.

7. Applicable law and jurisdiction

This Policy is governed by French law. In the event of any dispute relating to this Policy, the French courts shall have exclusive jurisdiction.

Follow-up of the Personal Data Protection Policy

This policy is updated regularly to take into account legislative and regulatory developments, and any changes in the organization of Pole Star or in the offers, products and services provided.

This Personal Data Protection Policy is supplemented by:

Documentation of our data processing operations with regard to their explicit purposes concerning individuals, data recipients, retention periods, and procedures for exercising individuals' rights.
A comprehensive and regular assessment of our data hosting and software subcontractors' compliance with their obligations under the GDPR.
Appropriate contractual clauses for our subcontractors in the event of a normal or significant risk to data protection.
Specific confidentiality clauses in the employment contracts of our employees who handle private data.
Rules governing the use of computer equipment.

Toulouse, October 22, 2026