This English text is a courtesy translation. The French version is the sole legally binding version.

Regulatory Compliance Charter — Glaura.ai

Legal Notice, Privacy Policy & Cookie Policy

1. Legal Notice

1.1 Legal information

Pursuant to Article 6 of Act No. 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN), users of the website https://glaura.ai/ are hereby informed of the identity of the various parties involved in its creation and maintenance.

The website https://glaura.ai/ is owned by OCTOPUS, a simplified joint-stock company (Société par Actions Simplifiée, SAS) whose registered office is located at 60 rue François 1er 75008 Paris, France. The company is registered with the Paris Trade and Companies Register.

Access to and/or use of the website is voluntary and confers the status of user. From the moment they access and/or use the Site, the user unreservedly accepts the present Legal Notice.

The user (hereinafter "the User") may contact GLAURA by writing to the following email address: support@glaura.fr.

1.2 Use of the website

The User assumes responsibility for the use of the website. The website may provide access to numerous texts, graphics, drawings, photographs, personalised skin diagnoses, artificial intelligence technologies, predictive algorithms, multimedia content and information (hereinafter the "Content") belonging to GLAURA or to third parties to which the User may have access.

The User undertakes to make appropriate use of the Content and of the Services offered on the website (by way of example but not limited to), and not to use them to:

• (i) carry out unlawful, illegal activities or activities contrary to public order and good morals;
• (ii) cause damage to the physical and logical systems of GLAURA's website, of its hosting providers, suppliers or third parties;
• (iii) introduce or spread computer viruses into the network or any other physical or logical system liable to cause the damage referred to above;
• (iv) attempt to access, use and/or manipulate the data of GLAURA, of third-party suppliers, of its artificial intelligence models or of other Users;
• (v) reproduce or copy, distribute, make available to the public through any type of public communication, transform or modify the Content (including by means of reverse engineering, automated data harvesting or scraping of the algorithm), unless with the express written authorisation of GLAURA;
• (vi) delete, conceal or manipulate the Content subject to intellectual or industrial property rights and any other data identifying such rights of GLAURA or of third parties present in the Content, as well as the technical protection devices or any information mechanism that may be inserted into the Content.

GLAURA shall have the right to investigate and report the aforementioned conduct in accordance with French law, as well as to cooperate with the authorities in any investigation relating to such acts.

GLAURA may temporarily and without notice interrupt access to the website due to maintenance, repair, update or algorithmic improvement operations. However, as far as circumstances permit, GLAURA will notify the User, sufficiently in advance, of the scheduled date of the interruption of the Services.

GLAURA is not held liable for the use that Users may make of the Content or of the diagnoses generated by its artificial intelligence tools included in the website.

1.3 Intellectual property

This website and the content included therein: algorithms, calculation structures, diagnostic prompts, source codes, articles, texts, images, logos, trademarks, buttons, graphic charters, etc. are protected by the law in force regarding industrial and intellectual property and belong to GLAURA or to third parties who have authorised GLAURA to use them. Their exploitation is formally prohibited without the express authorisation of GLAURA.

For this reason, and in accordance with the provisions of the regulations in force, any reproduction, transmission, adaptation, translation, distribution, public communication including its making available, or any other exploitation and/or modification of all or part of the content of the website, are prohibited without the express authorisation of GLAURA.

GLAURA grants no licence or authorisation of use of any kind over its intellectual and industrial property rights or over any other property or right in connection with the website, the Services or the Content of said Site.

The legitimacy of the intellectual and industrial property rights corresponding to the Content provided by Users (in particular the skin characteristics or photographs submitted) is the exclusive responsibility of the latter; the User therefore releases GLAURA from any third-party claim arising from the unlawful use of the Content of the website.

1.4 Liability and warranties

GLAURA declares that it has adopted the necessary measures, to the extent of its means and the state of technology, to ensure the proper functioning of its website as well as the absence of viruses and harmful elements. However, GLAURA shall not be held liable:

• (i) for the continuity, the constant updating and the availability of the Content and of the artificial intelligence diagnostic Services;
• (ii) for the absence of assessment errors in said Content, nor for the impossibility of correcting any type of deviation or technical approximation generated by the AI (the reports constituting beauty routine advice and not dermatological or medical opinions);
• (iii) for the absence of viruses and/or other harmful elements on the processing servers;
• (iv) for the damage and losses caused by any person having hacked or fraudulently altered GLAURA's security systems.

GLAURA assumes no liability relating to the links to other websites offered on the website, which may direct the User to other websites over which GLAURA exercises no type of control. The User therefore accesses the Content of these sites under their exclusive responsibility and under the terms of use that apply thereto.

1.5 Duration and modification

The present Legal Notice shall be in force for the duration of its publication on the website and until it is replaced by a new version. GLAURA may make changes to the conditions specified therein, which would come into force upon their publication.

GLAURA may, without notice, remove, add or modify both the Content and the Services offered, as well as the manner in which they are located or presented. The conditions published at the time the User accesses GLAURA's website shall be deemed to be in force.

Access to and/or use of the website shall be deemed to constitute acceptance by the User of the present Legal Notice and of its conditions and, where applicable, of any modifications made to them.

2. Privacy Policy

GLAURA attaches great importance to the confidentiality and protection of your personal data. This is why it is stored securely and processed with the utmost care, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

This Privacy Policy governs access to and use of the diagnostic and personalised recommendation service (hereinafter the "Service") that GLAURA makes available to the User interested in the services and Content offered on the website. The Site installs cookies that collect information about browsing. We recommend that you read the Cookie Policy for more information.

2.1 Who is the controller of your data?

The controller of your personal data is OCTOPUS SAS, having its registered office at 60 rue François 1er 75008 Paris, France. The company is registered with the Paris Trade and Companies Register.

We inform you that the domain of our site https://glaura.ai/ (hereinafter the "website") belongs to GLAURA SAS.

Access to and/or use of the website confers the status of user (hereinafter "the User") and implies that the latter will be subject to the data processing set out in this Privacy Policy.

The User may contact GLAURA by writing to the following email address: support@glaura.fr.

2.2 For what purposes is your personal data processed by GLAURA?

Your personal data collected by GLAURA may be used for the following purposes:

• i) Processing of physiological and cosmetic data to carry out the skin analysis, the algorithmic diagnosis and the tailor-made recommendation of routines and products on the website.
• ii) Sending personalised beauty follow-up and evolution communications by post, telephone, email, SMS/MMS, push notifications or by other equivalent electronic means of communication, in the event that the User has consented to the processing of their personal data for this purpose.
• iii) Processing of and responding to any comments, requests, complex skin analyses, questions, complaints or claims made by you.
• iv) Creation and management of user accounts, and retention of the history of your diagnoses.
• v) The processing of information to fulfil our legal and regulatory obligations, but also to comply with any court decisions and other decisions taken by the competent authorities. This includes the disclosure of your personal data to law enforcement in the event of doubt or evidence of an action that could constitute an offence or a criminal infraction (such as an attempted hacking).
• vi) Sending surveys and questionnaires, as well as invitations to take part in review management platforms or an online opinion community, in order to know your level of satisfaction regarding the routines generated by the AI, to analyse it and improve the quality of our products, services and customer service.
• vii) Analysing information relating to our interaction with you in order to improve our engagement and/or to carry out studies and statistics to improve the platform, the AI algorithm, the functioning of our company, as well as our relationship and experience with customers.

2.3 Why is GLAURA entitled to process the data?

The data processing carried out by GLAURA is carried out on the basis of the following legal framework:

• i) When the information you provide to us is processed to formalise a diagnosis or to take out a subscription, the processing is carried out on the basis of the performance of a contract to which the data subject is a party, or for the performance of pre-contractual measures (Article 6.1.b of the GDPR);
• ii) When their data is processed to send them promotional information or routine reminders, the processing is carried out on the basis of their consent (Article 6.1.a of the GDPR) and/or the legitimate interest of the publisher (Article 6.1.f of the GDPR). We remind you that the sending of these communications may be stopped at any time in each of the communications received by means of the mechanism provided for this purpose (unsubscribe link);
• iii) When your data is processed to assist, handle and respond to any comments, requests and/or questions on the use of our Beauty Tech AI, the processing is carried out on the basis of your consent when sending your request and/or question (Article 6.1.a of the GDPR);
• iv) When the data is processed to create and manage user accounts, the legal basis shall be the consent given by the user when submitting their registration request (Article 6.1.a of the GDPR);
• v) When the information is processed to fulfil our legal obligations, the legal basis is compliance with our legal obligations (Article 6.1.c of the GDPR);
• vi) When the information is processed for the purpose of analysing it to know the degree of satisfaction of our users, improve our engagement and/or carry out studies and statistics to optimise our processing AI, the processing is carried out on the basis of our legitimate interest, which consists in managing and improving the technical reliability of our services (Article 6.1.f of the GDPR). Our interest in no case prevails over your interests, freedoms and fundamental rights.

2.4 Accuracy of the data provided by Users

The User warrants that the personal data and skin characteristics provided are true, and shall be responsible for informing GLAURA of any changes made to this data. The User is in any event responsible for the accuracy of the data provided, and GLAURA reserves the right to exclude from the registered services any User who has provided false data, without prejudice to any other legal action where applicable.

2.5 Recipients

Depending on the purposes for which the personal data was collected, the following third parties may have access to it:

• (i) The competent public administrations, bodies, authorities and law enforcement agencies, in cases where there is a request, a legal obligation, or if we believe there is sufficient evidence and/or indications that an offence or a criminal infraction has been committed.
• (ii) Partners and third-party service providers that process the information as data processors (in particular our secure cloud host and our API provider for artificial intelligence calculations). We have concluded with all our providers the corresponding data processing agreement in accordance with the regulations relating to the protection of personal data.
• (iii) Review manager. GLAURA may send you invitations to rate our diagnostic services via review managers or online opinion communities. We remind you that the ratings and reviews you leave on our products and services via these managers will be subject to the terms of use and privacy policy of the manager, which, once your rating or review has been submitted, will process your personal data according to its own purposes as controller. We therefore recommend that you read the corresponding policies carefully.

2.6 International transfers

GLAURA, through its collaborators and its secure cloud servers, transfers where necessary personal data to countries located outside the European Economic Area (EEA) for infrastructure needs or specific algorithmic calculations. The international data transfers that may be carried out benefit from adequate protection of personal data through the use, in all cases, of appropriate safeguards, in particular the use of standard contractual clauses approved by the European Commission.

2.7 Data retention

The personal data provided will be processed for the period necessary: for the purposes established in this Privacy Policy; for the retention of your personal data in accordance with the provisions of the laws and regulations in force, particularly with regard to the legal limitation periods; and for the formulation, exercise or defence of claims.

The criterion we follow for this purpose is determined by the purpose of the data collected and compliance with that purpose (for example, in the case of consent linked to the skin analysis history, you may revoke it at any time) and by the mandatory storage periods according to contractual and regulatory requirements.

2.8 User rights over their data

The User has the right (i) to access their personal data, as well as (ii) to request the rectification of inaccurate data or, where applicable, to (iii) request its erasure, (iv) request the restriction of the processing of their data, (v) object to the processing of their data and (vi) request its portability. The User may also exercise their (vii) right to be forgotten.

If you have given us your consent to process your skin analysis or routine data, you can withdraw it whenever you wish, without this affecting the lawfulness of the processing based on the consent carried out before the withdrawal.

The User may exercise all these rights by writing to the email address support@glaura.fr, indicating the reason for their request, or by post addressed to GLAURA's registered office.

Without prejudice to any other administrative remedy or legal action, the User shall have the right to lodge a complaint with the competent supervisory authority (in France, the CNIL - Commission Nationale de l'Informatique et des Libertés) if they consider that the processing of their personal data does not comply with the regulation, or if the exercise of their rights is not ensured.

2.9 Data security

The confidentiality and protection of Users' personal data are of great importance to GLAURA. This is why GLAURA has adequate technical and organisational measures to prevent data from being used inappropriately, and allows access to this data only to authorised technical staff.

GLAURA maintains security standards regarding the protection of personal data in accordance with the applicable legislation and has put in place the appropriate technical means to prevent the loss, inappropriate use, alteration, unauthorised access and theft of the data provided by the User during their browsing on GLAURA.

GLAURA undertakes to comply with the duty of secrecy and confidentiality regarding personal data in accordance with the applicable legislation.

In the case of the website services that require registration as a User, a secure password must be chosen. The User is responsible for maintaining the confidentiality of this password as well as for all activities that take place during the session started with their username and password. The User undertakes to inform GLAURA without delay of any unauthorised use of their username and/or password or of any other security breach. GLAURA shall not be held liable for the damage or losses that may result from the User's failure to comply with this obligation.

3. Cookie Policy

3.1 What are cookies and how do we use them?

GLAURA, on its own behalf or on behalf of a third-party provider of technical measurement services, uses cookies when a user browses the internet. Cookies are text files containing small amounts of information that are downloaded and installed on your computer or mobile device when it visits our website. Cookies are sent back to the original website on each subsequent visit, or to another website that recognises them.

3.2 What types of cookies do we use?

GLAURA uses four types of cookies:

3.2.1 Technical cookies
These are the cookies that allow the user to browse the website, on our analysis application and to use the various services or options found there, including those that the publisher uses to enable the management and operation of the website and to activate its functions and services, such as, for example, monitoring traffic and data communication, identifying the session, accessing restricted-access areas, remembering the elements that make up a diagnosis request, carrying out the subscription process, processing payment, controlling fraud linked to the security of the service, submitting the registration request, using security elements during browsing, storing content for the delivery of explanatory videos on the use of the AI, activating dynamic content (for example the loading animation of a skin report) or sharing content on social networks.

3.2.2 Analytics cookies
These cookies allow the party responsible for them to monitor and analyse the behaviour of the users of the websites to which they are linked, including the quantification of the impacts of the diagnostic AI features. The information collected through this type of cookie is used to measure the activity of the websites or applications in order to make improvements based on the analysis of the usage data made by the users of the service.

3.2.3 Personalisation cookies
These cookies make it possible to retain information so that the user can access the service with certain characteristics that make their experience different from that of other users, such as, for example, the display language, the type of cosmetic profile selected, the appearance or the content of the service depending on the type of browser through which they access the service, etc.

3.2.4 Advertising cookies
These cookies store information relating to the behaviour of users obtained through the continuous observation of their browsing habits, which makes it possible to develop a specific profile in order to display communications or offers tailored to it.

3.3 Our cookies

You can configure the installation of cookies directly from our configuration panel. The following table presents additional information relating to the cookies installed from the site, indicating in particular the third parties who will have access to the information collected by the cookies and the retention period of the third-party cookies on your device:

3.4 How to delete cookies?

The user may freely decide whether or not to place our cookies on their hard drive, as well as whether to delete them, by following the process established in the "Help" section of their browser. The user may also configure their browser to accept or refuse by default all cookies or to receive an on-screen warning of the receipt of each cookie and decide at that moment whether or not to place it on their hard drive.

Below you will find the links and procedures for the management or deactivation of cookies:

• Google Analytics Tool: Google provides users with a tool that makes it possible to configure the information sent from the main browsers to Google Analytics. This tool can be downloaded from the following link: https://tools.google.com/dlpage/gaoptout
• Google Chrome: Go to Settings > Privacy and security > Cookies and other site data.
• Mozilla Firefox: Go to the menu option: Options > Privacy & Security > Enhanced Tracking Protection.
• Apple Safari (macOS): Go to Preferences > Privacy > Cookies.
• Safari for iOS: Go to Settings > Safari > Block All Cookies.
• Microsoft Edge: Go to Settings > Cookies and site permissions.
• Opera: Go to Settings > Advanced > Privacy & Security > Cookies.

If the User configures their browser to refuse all cookies or expressly our technical or functional cookies, it may be impossible for them to access some of our AI beauty diagnostic services and their experience on our website may be less satisfactory. If you wish to exercise greater control over the installation of cookies, you can install programs or extensions in your browser such as "Do not track", which will allow you to choose which cookies you want to authorise.

3.5 How can you exercise your rights?

If you wish to know how to exercise your rights of access to your personal data, request the rectification of inaccurate data, request that it be erased, restrict the processing, object, request the portability of the data and not be subject to a decision based solely on automated decisions, please refer to our Privacy Policy above.

3.6 International data transfers

You can find out about the transfers to third countries which, where applicable, are carried out by the third parties identified in this cookie policy in their corresponding policies (see the links provided by the third parties identified in paragraph 3.3).