OASES Privacy Policy

OASES is operated by ZEYO, a French simplified joint-stock company with a sole shareholder (SASU), registered with the Paris Trade and Companies Register under number 830 635 512, whose registered office is at Esc B 3ème étage, 2 Cité Noël, 22 rue Rambuteau, 75003 Paris (the « Company »).

The Company publishes the OASES Application and Website.

The Company attaches particular importance to protecting its Users' personal data. This privacy policy is established in accordance with the General Data Protection Regulation (EU) 2016/679 (« GDPR ») and French Act no. 78-17 of 6 January 1978 as amended (the « Data Protection Act »). Its purpose is to describe transparently how the Company collects, uses, retains and secures the personal data processed through its mobile Application and its Website, as well as the rights granted to every User.

The Company undertakes to collect and process personal data fairly and lawfully.

To that end, the Company ensures that the User concerned by the Processing is informed of its purpose, of the retention period of the personal data processed, of the controller and of the recipient of the Processing.

The Company undertakes to take the measures necessary to secure the data it has collected and to prevent its disclosure to unauthorised third parties.

This Privacy Policy forms an integral part of the Terms of Use of the Application and the Website.

1. Definitions

Application: the OASES mobile application published by the Company.

Account: the customer account created by the User with the Company through the Application or the Website.

Personal data: any information identifying a natural person, directly or indirectly.

The Company: ZEYO, a French simplified joint-stock company with a sole shareholder (SASU), registered with the Paris Trade and Companies Register under number 830 635 512, whose registered office is at Esc B 3ème étage, 2 Cité Noël, 22 rue Rambuteau, 75003 Paris, publisher of the OASES Application and Website.

Website: the official OASES website, available at www.oases.so, through which Users can access all the features of the Application, in particular account creation and management, browsing and sharing content, social interactions, and the related online services.

Processing: any operation, or set of operations, performed on personal data, whatever the method used.

User: any natural or legal person who has created an account on the OASES application or on the Website, allowing them to interact with other users, to create and share folders (« OASES ») and subfolders (« Sub-OASES »), and to publish content in them.

2. Collection of Personal Data

2.1 Data collected

The Company collects personal data when the Application or the Website is used, in particular in the following cases:

• When creating or modifying a User Account (username, email address, password, date of birth, city, profile picture, etc.);
• When using the features of the Application or the Website, in particular creating and sharing content within OASES or Sub-OASES (photos, videos, files, links, music, posts, comments, likes, etc.);
• During interactions between Users, as part of the social features (follows, exchanges, collaborative sharing);
• During exchanges with the Company by email (contact@oases.so) or through the contact form;
• While browsing the Application or the Website: technical connection data, device identifier, IP address, session duration, browsing logs, display preferences.

In connection with the use of the Application or the Website, the Company may collect the following data:

• Identification data: first name, username, mobile phone number (verified by SMS), date of birth, gender, email address, profile picture;
• Contact data: postal address;
• Payment data: date, payment method, partial information passed on by the provider;
• Browsing data: IP address, session duration, origin of the connection, browsing logs;
• Behavioural data: interactions, comments, preferences, folders followed or liked.

This data is processed for the following purposes:

• Creating, managing and securing User Accounts;
• Providing the services related to the Application or the Website (OASES, Sub-OASES, collaborative and social features);
• Identity verification and fraud prevention;
• Managing payments and invoicing through approved providers;
• Responding to contact or support requests;
• Analysing the use of the Application or the Website in order to improve its performance, security and usability;
• Sending information, notifications and targeted commercial offers, subject to prior consent.

2.2 Users under the age of 15

In accordance with Article 45 of the French Data Protection Act, access to the services of the Application and the Website is reserved for persons aged 15 or over, able to consent on their own to the processing of their personal data.

The Company does not knowingly collect data concerning minors under the age of 15. Should a minor register fraudulently, the data will be deleted as soon as possible.

Where the minor is between 15 and 16 years old and certain features require parental consent, the Company may ask for validation by the legal representative in order to comply with the GDPR.

Users are invited to report any suspicious use by a minor.

2.3 Third-party data contained in imported content

When a User saves into their OASES a piece of content published on a third-party service (Instagram, YouTube, TikTok, Pinterest, a web page, etc.) by providing its address, the Company retrieves and stores, together with the content, the publicly available information that identifies its author and source: username or pseudonym, display name, profile picture, caption or title, identifier and date of the post, and the original URL. That information may constitute personal data relating to people who are not OASES Users.

This processing is based on the legitimate interest of the Company and of its Users (Article 6(1)(f) GDPR): allowing the User to keep and organise content they have chosen, and fairly crediting the author and the source of each imported item, in line with the author's right of attribution. The data is limited to what is necessary for attribution and display; it is not subject to any profiling, enrichment, cross-referencing with other sources, or use for marketing purposes.

This data is retained for as long as the imported item exists in the User's OASES; it is deleted along with it, or when the Company receives a request from the person concerned or a notice under Section 11 bis of the Terms of Use, or when it becomes aware that the original post has been deleted or made private.

The Company is not in a position to inform individually every non-User concerned, as providing that information would involve disproportionate effort (Article 14(5)(b) GDPR); this Policy constitutes the public information provided for by that provision. Anyone whose data appears in imported content may exercise their rights of access, objection, rectification and erasure by writing to legal@oases.so, stating the URL of the item concerned. The Company handles such requests within one (1) month.

2.4 Contact syncing (optional)

During the « Collaborate with your friends » step of the sign-up flow, or from the settings, the User may allow the Application to access their device's address book in order to find contacts already registered on OASES. This feature is optional and relies on the User's consent, collected through the system permission (iOS: access to Contacts; Android: READ_CONTACTS permission), which can be withdrawn at any time in the device settings.

Phone numbers from the address book are normalised and then turned on the device into irreversible fingerprints (SHA-256 hashes); only those fingerprints and the number of contacts are sent to the Company's servers. Plain phone numbers, names and other contact details never leave the device and are not retained by the Company. The fingerprints are compared with those of registered Users' numbers, for the sole purpose of suggesting connections; they are kept for as long as the Account is active and the permission is granted, and are deleted when the Account is deleted or on request. People listed in the address book who are not registered on OASES are neither identified nor contacted by the Company.

3. Legal Bases for the Processing

The Company processes its Users' personal data only in the cases permitted by the applicable regulations, and in particular on the following legal bases:

• Performance of the contract: to allow the User to access the Application and the Website, create an Account, use the features (creating content, interacting with other Users), where applicable take out a Subscription, manage invoicing or respond to their requests.
• Consent: for sending commercial communications, using trackers or certain optional features. Consent may be withdrawn at any time.
• Legal obligations: to meet accounting, tax or anti-fraud obligations.
• Legitimate interest: to ensure the security of the Application and the Website, prevent abuse, improve the services and guarantee an optimal user experience, provided this does not adversely affect the User's rights and freedoms.

Processors may process certain data on behalf of the Company (in particular technical, hosting or payment providers), in compliance with the GDPR.

4. Retention Period of Personal Data

The Company retains Users' personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, in compliance with the applicable regulations.

For example:

• Data relating to the management of the User Account is kept for as long as the Account is active, then archived for 3 years from the last activity for evidential purposes or to handle disputes;
• Data relating to orders and invoices is kept for 10 years in accordance with accounting obligations;
• Data used for marketing purposes is kept for 3 years from the User's last contact.

In the event of prolonged inactivity (beyond 12 months), the Account may be suspended, and the data will be either anonymised or archived, before final deletion at the end of the statutory periods.

The User may at any time request the deletion of their data, unless retaining it is justified by a legal or contractual obligation.

An Account is deleted from the Application (Settings > Account Details > Delete Account). The Account and data deletion page sets out the steps, the seven (7) day grace period during which the request can be cancelled, and which data is deleted, which is anonymised and which is kept.

5. Rights of Users who are Natural Persons

A User concerned by the Processing of personal data has a right to object, which may be exercised at any time by contacting the Company under the conditions set out below. Should that right be exercised, the User will no longer be able to access the features of the Application and the Website that require the Processing of their data.

The User also has a right of access, rectification, erasure and restriction of their data, allowing them in particular to access the information concerning them and to require that their data be, as the case may be, rectified, completed, updated or deleted.

The User may also withdraw any consent at any time, without that withdrawal having retroactive effect.

The User further has a right to data portability, allowing them in particular to retrieve the data concerning them and processed by the Company, for their personal use and/or to transfer it to another organisation.

The User also has the right to give directions as to what happens to their data after their death, in accordance with French Act no. 78-17 of 6 January 1978 on information technology, data files and civil liberties.

The User also has the right to withdraw their consent at any time to the use of trackers (cookies, pixels, similar technologies) on the Application and the Website, and to object to any processing based on legitimate interest, except where the law requires it.

Any question or request relating to the Processing of data must be sent electronically to: contact@oases.so

The User must state in their request their surname, first name, postal address and email address, and send the Company a copy of an identity document so that it can verify their identity.

For requests relating to a minor's data, the legal representative may also exercise these rights by providing proof of their capacity as legal representative.

The Company has two (2) months from the date of receipt of the User's request in which to reply.

Where personal information relating to a minor User has been collected, their legal representative may contact the Company in order to access, rectify, complete, update or delete that data under the same conditions as those set out in Article 5 of this Privacy Policy.

The User may also lodge a complaint with the CNIL if they consider that their rights have not been respected.

6. Data Controller

Personal data is processed by the Company:

ZEYO, a French simplified joint-stock company with a sole shareholder (SASU), registered with the Paris Trade and Companies Register under number 830 635 512, whose registered office is at Esc B 3ème étage, 2 Cité Noël, 22 rue Rambuteau, 75003 Paris.

The Data Protection Officer (DPO) can be contacted at contact@oases.so, for any question concerning the processing of personal data and the exercise of Users' rights.

Requests relating to data appearing in content published or imported by a User (section 2.3), reports of illegal content and notices of infringement may be sent to legal@oases.so, the contact point designated under Articles 11 and 12 of Regulation (EU) 2022/2065.

7. Recipients of the Processing

The User's personal data may be disclosed to providers acting on behalf of the Company and strictly necessary to deliver the services, in particular:

• technical service providers (hosting, maintenance),
• payment providers,
• statistical analysis or communication tools.

These third parties act as processors contractually bound to the Company, and undertake to comply with the GDPR, in particular as regards security, confidentiality and purpose limitation.

As at the date of this Policy, the main processors are: Google LLC (Firebase and Google Cloud services: authentication, database, file storage, server functions, notifications, audience measurement — United States and European Union; transfers framed by the « Data Privacy Framework » adequacy decision and standard contractual clauses); Apple Inc. and Google LLC for the distribution of the Application and, where applicable, payment of Subscriptions; the card payment provider indicated at the time of subscription; and a technical provider for extracting public content, used by the import feature (that provider receives only the URL of the content to be imported, never any data relating to the User). An up-to-date list can be obtained on request at contact@oases.so.

If some of those recipients are located outside the European Union, the Company ensures that appropriate safeguards are in place (adequacy decision, European Commission standard contractual clauses, or equivalent mechanisms guaranteeing a sufficient level of protection).

8. Security of Personal Data

The Company implements appropriate technical, organisational and physical measures to ensure the security, integrity and confidentiality of the personal data processed, in particular against any loss, unauthorised access, disclosure or alteration.

Those measures include, as the case may be: restricted access to data, encryption, firewalls, system monitoring, and backup and restore protocols.

The Company cannot guarantee the security of Users' devices and connections. It is for each User to protect their equipment (passwords, antivirus software, secure network).

In the event of unauthorised access to their Account or their data, the User must inform the Company without delay at: contact@oases.so

In the event of a data breach presenting a risk to the rights and freedoms of the persons concerned, the Company will notify the CNIL within 72 hours and, where applicable, will inform the affected Users directly.

The Application and the Website may use cookies and other trackers to improve the user experience, analyse usage and offer personalised content. The User can configure their consent through the account settings and withdraw it at any time. Trackers strictly necessary for the operation of the Application or the Website are exempt from consent.

9. Updates to the Privacy Policy

The Company may amend this Privacy Policy to reflect changes in its practices or in the applicable regulations.

Any amendment will be published on the Application and on the Website. In the event of a substantial change affecting the purposes of the processing or Users' rights, the Company will inform Users by any appropriate means and, if necessary, will obtain their consent again.

The User will be informed clearly and proactively of any substantial change by notification in the Application, by email or by a message on the Website.

Users are invited to consult the Privacy Policy regularly in order to stay informed of the version in force.

Previous versions of the Privacy Policy will be archived and made available on request, in accordance with the GDPR principle of transparency.

10. Governing Law and Complaints

This Privacy Policy is governed by French law.

In the event of any difficulty relating to the processing of their personal data, the User may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) - www.cnil.fr - 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07.

The User may also contact the Data Protection Officer (DPO) at contact@oases.so for any question, complaint or exercise of their rights relating to their personal data.

For any transfer of personal data to countries outside the European Union, the Company will implement appropriate safeguards in accordance with Articles 44 et seq. of the GDPR (standard contractual clauses, adequacy decision, binding corporate rules, etc.), and will inform the Users concerned when such a transfer takes place.

The User has the right to lodge a complaint with the CNIL if the transfer of their data outside the European Union does not comply with the safeguards provided for by the GDPR.