Personal data protection policy

1. General statement

Data OPP attaches great importance to the security and confidentiality of your personal data. We process your data in accordance with applicable law, in particular Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and Directive 2002/58/EC ("ePrivacy"), respecting the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

Data OPP S.à r.l., a limited liability company incorporated under Luxembourg law with a share capital of 12,000 euros, registered with the Luxembourg Trade and Companies Register under number B257953, with intra-Community VAT number LU33337974, whose registered office is at 9, rue de Louvigny, L-1946 Luxembourg, Grand Duchy of Luxembourg, represented by its manager in office (hereinafter "Data OPP" or "we"), is in the business of putting professionals in touch with users (individuals or businesses) looking for goods and services.

For the purposes of this activity, Data OPP works with Data Hope S.L., a limited liability company incorporated under Spanish law, identified by NIF B16685935, with its registered office at Carrer del Consell de Cent, 357, 6º, L'Eixample, 08007 Barcelona, Spain, represented by its sole director in office (hereinafter "Data Hope"). Data Hope operates the call centre and the operational qualification of contacts initiated through the Data OPP website.

This policy applies to the processing of personal data carried out by Data OPP and Data Hope acting as joint controllers within the meaning of article 26 GDPR, where it falls within the scope of the GDPR, in particular where the data subjects are located in the territory of the European Union, regardless of their nationality or place of residence.

Where telephone qualification targets consumers residing in France, it falls under the prior consent regime for telephone marketing introduced by law no. 2025-594 of 30 June 2025 and article L. 223-1 of the French Consumer Code, in force since 11 August 2026. Since that date, the absence of registration on an opt-out list no longer allows us, on its own, to contact you: only your prior consent, for which we must be able to produce proof, authorises a prospecting call.

2. Joint controllership between Data OPP and Data Hope

In accordance with article 26 GDPR, Data OPP and Data Hope have entered into a joint controllership arrangement setting out how their roles and obligations are allocated in processing your data. Its essential terms are as follows:

• —Data OPP (Luxembourg) handles the initial collection of data through the website (introduction forms), the acquisition of leads from external sources where applicable, the definition of processing purposes and the contractual management of relationships with commercial partners, as well as verifying that consents obtained by external sources are compliant.
• —Data Hope (Spain) operates the call centre responsible for contacting data subjects, qualifying their request, directing it to the most relevant commercial partner, and handling the operational follow-up of the introduction, as well as recording and immediately passing on refusals and withdrawals of consent expressed during calls.
• —Decisions on the essential means of processing (categories of data collected, retention periods, security measures, procedures for exercising rights, arrangements for obtaining and retaining proof of consent) are taken jointly by Data OPP and Data Hope.

In accordance with article 26(3) GDPR, you may exercise your rights with either Data OPP or Data Hope. For operational simplicity, we recommend sending any request to the Data Protection Officer at dpo@data-opp.com, who coordinates responses on behalf of both entities. The full text of the joint controllership arrangement is available to data subjects on request to that same address.

3.1 Data collected directly through the website

When you fill in our forms, we collect the following data (mandatory fields are marked with an asterisk):

• —First and last name
• —Email address
• —Date of birth (age)
• —Phone number
• —Postal address

This data is collected in order to process your request to be put in touch with a commercial partner. Where you agree to be contacted by telephone on behalf of advertisers, that consent is obtained through a separate, unticked box, independent of acceptance of the terms of use, naming the advertiser or advertisers concerned.

3.2 Data collected indirectly

We may also receive your personal data through the following channels:

• —From external lead acquisition sources (affiliate advertisers, lead generation providers) that have previously obtained your consent to transfer your data to Data OPP. Where that data is intended for telephone contact with persons residing in France, the consent obtained by the source must meet the requirements of article L. 223-1 of the French Consumer Code, in particular naming the advertiser or advertisers on whose behalf you may be contacted. The source of each lead is documented and available to you on request.
• —From our commercial partners, who tell us what action you took on the offer presented to you (for example: appointment booked, refusal, conversion).

Data acquired before 11 August 2026 under the former opt-out regime is not used for any prospecting call until consent compliant with the current regime has been obtained and documented.

In accordance with article 14 GDPR, data collected indirectly is processed transparently: the nature of the data received, its source, the purposes and the legal bases are identical to those described in this policy.

3.3 Data generated during call centre processing

During telephone contact by the call centre operated by Data Hope, the following are collected and generated:

• —The call outcome (answered, no answer, refusal, drop-off, conversion).
• —The details qualifying your request (needs expressed, preferences, availability).
• —Proof of consent to telephone marketing and, where applicable, of its withdrawal: date and time it was obtained, channel and source, exact wording presented, list of named advertisers, validity period and, where applicable, date of withdrawal.
• —Where applicable, audio recordings of telephone conversations, for quality control and training purposes. You are informed at the start of the call and may object, in accordance with the requirements of the CNIL, the AEPD and the CNPD.

3.4 Data collected through cookies and trackers

We also collect, through cookies and similar technologies placed on your device, information about your browsing on our websites (traffic data, connection logs, IP address). Placing and reading cookies that are not strictly necessary is subject to your prior consent, obtained through our cookie management banner. You may change your preferences or withdraw your consent at any time. For more information, please see our cookie policy.

4. Purposes and legal bases of processing

In accordance with article 13 GDPR, you will find below, for each processing purpose, the applicable legal basis and the associated retention period.

4.1 Note on telephone marketing (article L. 223-1 of the French Consumer Code)

Independently of the GDPR legal basis, any commercial prospecting call to a consumer residing in France has required, since 11 August 2026, their prior consent, which must be a freely given, specific, informed, unambiguous and revocable indication of their wishes. That consent: (i) names the advertiser or advertisers on whose behalf you may be contacted; (ii) is obtained for a limited period of 12 months; (iii) may be withdrawn at any time, free of charge and without consequence; (iv) is evidenced by proof retained by the joint controllers, on whom the burden of producing it rests. No call is made on behalf of an advertiser not covered by that consent. This requirement does not apply to calls made in the performance of an existing contract and related to its subject matter.

Calls are made from numbers identified in accordance with the numbering plan set by ARCEP for marketing calls, and the identity of the advertiser on whose behalf the call is made is given to you at the very start of the exchange.

Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out beforehand, by contacting us at dpo@data-opp.com, by simply saying so during any call, or through the unsubscribe mechanism included in every electronic communication.

5. Profiling and automated decision-making

When matching your request with our partners' offers, we operate a process combining automated pre-selection (algorithmic matching run by Data OPP) and human qualification by the operators of Data Hope's call centre. This processing does not give rise to a decision based solely on automated processing producing legal effects or similarly significantly affecting you within the meaning of article 22 GDPR, since systematic human intervention conditions the transfer to the partner. You are in any event entitled to object to this processing and to obtain human intervention.

6. Recipients of the data

Your data is accessible, within the limits of their respective duties, to authorised staff of Data OPP (Luxembourg) and Data Hope (Spain), in accordance with the joint controllership arrangement referred to in section 2. Data transfers between Data OPP and Data Hope take place exclusively within the European Union and do not constitute an international transfer within the meaning of articles 44 et seq. GDPR.

Your data is also passed on to the following recipients:

• —To the named commercial partners covered by your consent, so that they can respond to your request to be put in touch. Each partner acts as a separate controller for the processing it carries out after receiving the data. The list of advertisers named in your consent is shown to you when it is collected; the current list of partner categories (and, on request, the list of names) is available from dpo@data-opp.com.
• —To the processors acting on behalf of Data OPP and Data Hope under contracts compliant with article 28 GDPR: hosting providers, customer relationship management (CRM) providers, telephony and call recording providers, audience measurement providers.

Any withdrawal of your consent or refusal to be contacted is passed on without delay, and within 72 hours at the latest, to the advertisers and partners receiving your data.

We may also disclose aggregated or anonymised data (within the meaning of the GDPR) to our advertisers and advertising partners for statistical purposes. Finally, we may disclose personal data concerning you where required by law, in judicial or administrative proceedings, or with your prior consent.

7. Data location and transfers outside the EU

Your data is hosted on servers located within the European Union. Data moving between Data OPP (Luxembourg) and Data Hope (Spain) stays entirely within the European Economic Area and involves no international transfer.

8. Data security

Data OPP and Data Hope implement appropriate technical and organisational measures to preserve the confidentiality, integrity and availability of personal data. These measures include: encryption of communications (TLS), strict access control, logging of sensitive operations, regular tested backups, and periodic security audits. Access to data is limited to authorised staff bound by a contractual duty of confidentiality.

As regards the call centre operated by Data Hope specifically, additional measures are in place: strong authentication of operators, logging of record consultations, restrictions on data exports, and reinforced confidentiality clauses in employment contracts. Proofs of consent are timestamped and stored in a format that guarantees their integrity.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and, where applicable, inform you individually, in accordance with articles 33 and 34 GDPR.

9. Your rights

Under articles 15 to 22 GDPR, you have the following rights over your personal data: right of access (art. 15), right to rectification (art. 16), right to erasure (art. 17), right to restriction (art. 18), right to data portability (art. 20), right to object (art. 21), right to withdraw your consent (art. 7(3)), right not to be subject to a solely automated decision (art. 22), and the right to give instructions on what happens to your data after your death.

As regards telephone prospecting, you may at any time refuse to be contacted or withdraw your consent, free of charge and with no consequence for access to the services; that refusal or withdrawal cannot be held against you. On simple request, you may also obtain the proof of consent on the basis of which you were contacted, together with the identity of the source that supplied your data.

9.1 How to exercise your rights

To exercise your rights, simply send an email to dpo@data-opp.com stating which right you wish to exercise. In accordance with article 26(3) GDPR, your request will be handled on behalf of either Data OPP or Data Hope; you do not need to contact both entities separately.

No copy of an identity document will be requested as a matter of course. Such a document may only be requested exceptionally, where there is reasonable doubt as to your identity, and after an attempt to verify it by other means.

We undertake to respond to your request within one month of receiving it, extendable by two months where it is particularly complex (art. 12(3) GDPR). Exercising your rights is free of charge (art. 12(5)).

9.2 Right to lodge a complaint

If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the competent supervisory authority:

• —Commission Nationale pour la Protection des Données (CNPD, Luxembourg) — 15, boulevard du Jazz, L-4370 Belvaux, Luxembourg — www.cnpd.lu (supervisory authority for Data OPP's establishment).
• —Agencia Española de Protección de Datos (AEPD, Spain) — c/ Jorge Juan, 6, 28001 Madrid — www.aepd.es (supervisory authority for Data Hope's establishment).
• —Commission Nationale de l'Informatique et des Libertés (CNIL, France) — 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr, if you reside in France.
• —Or with the supervisory authority of your habitual residence, your place of work or the place where the alleged infringement occurred.

Any marketing call you believe was made without consent may also be reported to the French Directorate-General for Competition, Consumer Affairs and Fraud Control (DGCCRF) via the SignalConso platform (signal.conso.gouv.fr).

10. Protection of minors

Our services are not intended for minors. We do not knowingly collect data concerning persons under 16 (15 for users residing in France, in accordance with article 45 of law no. 78-17 of 6 January 1978, known as the "Informatique et Libertés" Act). Should we discover that data has been collected about a minor without the required parental consent, we would delete that data immediately.

11. Data Protection Officer

Data OPP and Data Hope have jointly appointed a Data Protection Officer (DPO), the single point of contact for data subjects and supervisory authorities:

Postal address

9, rue de Louvigny, L-1946 Luxembourg, Grand Duchy of Luxembourg

Email address

dpo@data-opp.com

12. Changes to this policy

This policy may be updated. The date of the latest update appears at the top of this document. In the event of a substantial change affecting your rights, we will inform you by an appropriate means.

13. Contact us

For any question about this policy or about exercising your rights:

By email

dpo@data-opp.com

By post (Luxembourg)

Data OPP S.à r.l. — For the attention of the DPO — 9, rue de Louvigny, L-1946 Luxembourg, Grand Duchy of Luxembourg

By post (Spain)

Data Hope S.L. — For the attention of the DPO — Carrer del Consell de Cent, 357, 6º, L'Eixample, 08007 Barcelona, Spain