Sampleo is a brand of Webedia, located at 2, rue Paul Vaillant Couturier, 92300 Levallois-Perret. Webedia, in its capacity as data controller, places great importance on respecting your privacy and is committed to building strong and lasting relationships with you. The protection of your personal data is a top priority for us. That’s why we are providing our data protection policy to inform you, as clearly as possible, of our practices regarding the collection, use, and sharing of the information you provide through the website www.sampleo.com (the "Site" or "Sampleo").

What personal data do we process and how did we collect it?

1/ Information collected through questionnaires:

a- Upon registration

We collect information when you register on our Site. During registration, you will only be asked for your personal email. Later, if you wish to apply to receive products to test at home, we will request the following information:

• First name
• Last name
• Landline phone
• Mobile phone
• Mailing address
• Occupation
• Marital status
• Number, age, and gender of children
• Interests

b- Throughout your time on the Site

Once registered on the site, you may complete additional surveys:

• Consumption habit questionnaires: required for campaigns you wish to apply to. These allow us to gather all necessary information to select individuals for brand partnerships.
• Your responses are never shared with third parties in a way that could personally identify you, unless requested or expressly consented to.

We share the questionnaire results only with campaign partner brands and in aggregated form only.

2/ Information collected in the form of photos/videos

As part of your ambassador programs, you may submit photo and/or video content of your experience. At the time of submission, you can choose whether the content is for Sampleo staff internal use only (for internal evaluation purposes), or public (visible to other platform visitors).

Your content will be retained by Sampleo as long as the related campaign appears on the Sampleo website. After this, all content related to the campaign will be deleted. You may delete this content anytime via your personal space (or by request via email if your account has been deleted).

Sampleo may also present your content to partner brands to inform them about progress, usage examples, or results. In this case, your identity is never associated with the content. Brands cannot use your content without your explicit consent.

When you allow your content to be published, you expressly authorize Sampleo to use it in any form (brochure, commercial leaflet, newsletters, presentations, online banners, etc.) to promote Sampleo and its community.

3/ Information collected through your browsing on the site

While browsing the Site, we may collect personal data via cookies, such as date and time of connection and/or browsing, browser type, browser language, IP address. Please consult our cookie management policy here for more information.

Why do we process your personal data and for how long?

We are committed to processing your personal data for specific, legitimate, and relevant purposes.

In accordance with Regulation 2016/679 of April 27, 2016 on personal data processing (“GDPR”), we have defined a legal basis for each processing operation.

We retain your personal data for a duration that complies with legal and regulatory provisions and, where not specified, only for the time strictly necessary and proportionate to achieve the purposes for which your data was collected. Criteria for defining these durations are provided in the table below.

When we no longer need to use your personal data, we delete it from our information systems or anonymize it so it can no longer be identified irreversibly.

WHEN DO WE PROCESS YOUR PERSONAL DATA?	WHY DO WE PROCESS YOUR PERSONAL DATA?	WHAT IS THE LEGAL BASIS FOR THIS PROCESSING?	HOW LONG DO WE KEEP YOUR PERSONAL DATA?
Browsing the Sampleo Website or App	- Enable your authentication - Adapt the service to your device and language preferences - Store your cookie consent - Measure and analyze the Site’s audience	Legitimate interest	As long as necessary to fulfill the purpose (e.g., session duration for session cookies). This period shall not exceed 13 months from the date they are first stored on your device.
Creating your personal account on Sampleo	Provide a personal space	Contract performance	- until you request your account deletion, - until you ask us to erase your data or - after 3 years of inactivity (no active interaction with Sampleo).
	Invite you to product testing campaigns
	Receive the test product
	Keep you informed through newsletters about current and upcoming campaigns	Legitimate interest
When you answer consumption habit questionnaires	To offer you relevant campaigns based on your responses	Contract performance
When you apply for a campaign	Manage follow-up of your applications and ambassador missions
	Manage delivery of the product to be tested
	Handle reimbursement for tested products purchased by the ambassador
Campaign publication on the Site	Display campaign-related photo/video content		For the duration of the campaign display on the Site
reCaptcha input during registration	Identify real registrations and filter massive bot-generated sign-ups (spam)	Legitimate interest	Google is responsible for this processing. As such, it determines the retention period for the collected data. For more information about how long Google retains data, click here
In case of a complaint	Respond to your requests for information and complaints	Legitimate interest	3 years from the handling of your request
Requests to exercise data subject rights	Keep a record of individuals exercising their personal data rights: access, rectification, objection, withdrawal of consent, erasure, etc.	Legal obligation	3 years from receipt of the request
Legal or similar proceedings	Provide evidence necessary to defend our rights	Legitimate interest	If legal proceedings are initiated, data is retained until the end of the proceedings, plus the applicable statutory limitation period. The general limitation period for civil and commercial matters is five (5) years from the day the right holder became or should have become aware of the facts allowing the right to be exercised.

Who are the recipients of your data?

Your personal data is shared with Sampleo and Webedia staff who need to process it to provide quality service. This may include customer service, marketing, and IT teams.

We consistently strive to protect your personal data. From the moment we receive your data, we apply strict security measures to limit data breach risks. For example, each of our employees must use a strong, individual password.

Your data is also processed by our subcontractors who perform services on our behalf, such as:

• Sending newsletters
• Data hosting
• Sending products to be tested
• Technical service interfacing social media APIs and Sampleo

We contractually require our subcontractors to take all appropriate measures to protect your personal data.

We may also share your data with our business partners for the purposes mentioned above. These entities may contact you directly using the contact information you provided.

Finally, as required by applicable law, we may share your personal data with lawyers, judicial officers, or administrative/judicial authorities in case of a dispute or to fulfill legal obligations or defend our rights and interests.

Is your data transferred outside the European Union?

To fulfill the purposes mentioned above, your personal data may be transferred to companies in countries outside the European Union that do not provide adequate data protection as per the European Commission. We ensure these transfers are covered by appropriate transfer mechanisms as required by law.

You may access these clauses by contacting our Data Protection Officer at: dpo@sampleo.com

What are your rights?

Under applicable data protection regulations, you have the following rights regarding your personal data:

• Access to your data: You can request a plain-language copy of all personal data we hold about you
• Erasure of your data: You can request deletion of all your personal data unless required for ongoing operations, legal obligations, or the establishment, exercise, or defense of legal claims
• Rectification of your data: You can request correction of inaccurate or incomplete information about you
• Withdrawal of your consent: For processing based on consent (e.g., newsletters), you may withdraw consent at any time via a simple and equivalent method as used for giving it
• Objection to processing*: You have the right to object to the use of your personal data (see more below)
• Data portability: You can request your data in a structured, commonly used, and machine-readable format and transmit it to another entity
• Restriction of processing: You may request temporary freeze of your data usage for accuracy verification, to oppose erasure, or for legal claims
• To set general or specific directives (via a trusted digital third party certified by the CNIL) regarding the fate of your personal data after death

* Specifically about the right to object:

You may object to processing of your data based on our legitimate interest, citing reasons related to your particular situation.

We will stop processing unless there are compelling legitimate grounds overriding your interests, rights, and freedoms, or your data is required for legal claims.

You may also object to direct marketing processing without needing to cite personal reasons.

How to exercise your rights?

For practical reasons, please make your request using the email address used as your login, so we can ensure it's really you.

You may exercise these rights by contacting us by mail or email:

SAMPLEO (Webedia Group) 2 rue Paul Vaillant Couturier 92300 Levallois-Perret Email: dpo@sampleo.com

We will respond within 1 month from receipt of your request.