Who is the Data Protection Officer?

Identity: ONE BY BNP PARIBAS - ASSOCIAÇÃO DE COLABORADORES DO GRUPO BNP PARIBAS EM PORTUGAL

NIPC: 514783575

Legal Nature: Non-profit Private Association

Postal address: Rua Galileu Galilei, Torre Ocidente, Nº 2, 13º - 1500-392 Lisboa - Portugal

Email address: one.by.bnp.paribas@bnpparibas.com

With which purpose do we treat data?

ONE BY BNP PARIBAS shall collect the registration data of the applicant in order to manage the different discount redemption processes carried out through this service, as well as to attend to their needs.

ONE BY BNP PARIBAS will also process the browsing data that each user generates from his or her activity on the ONE BY BNP PARIBAS platform, to be able to verify the origin of the application of the discounts that he or she decides to access. As well as the data related to the purchases made and the interests shown to be able to offer periodic and personalized information about products and related services on the platform that may be of interest to them. These data may be related to: users’ geolocation, type and detail of purchases made and browsing data.

In addition, ONE BY BNP PARIBAS will process the data so that the data subject can receive communications regarding products or services from the platform, by email or by any other similar means of electronic communication. By marking the corresponding box when signing up on the platform the data subject will expressly, freely, specifically and unequivocally consent to the processing of his or her personal data, and the data subject may revoke the previous consents at any time, as well as exercise access, rectification, cancellation, erasure or portability rights by directing a letter to the company's headquarters, located in Rua Galileu Galilei, Torre Ocidente, Nº 2, 13º - 1500-392 Lisboa - Portugal or by sending an email for this purpose to the following address: one.by.bnp.paribas@bnpparibas.com.

Colectivos Vip platform is designed for your personal and familiar economy. Therefore, the savings, obtained through certain purchase partners, are materialized in the form of Euros that will be deposited in a private account (Vip Account) on your behalf. In order to guarantee the adequate use of the platform, Colectivos Vip may request accredited documentation about your purchase to certify the ownership.

TELEPERFORMANCE (hereinafter "COMPANY") does not intervene in this type of agreement, which corresponds exclusively to a relationship between the partners and the User, therefore, the User expressly exempts the COMPANY from any claim related to the goods and services acquired through the Colectivos Vip platform.

Nevertheless, the User understands that the discounts channelled through the Vip Account refer to the delivery of a discount, therefore such value does not have the consideration of profit or increment of wealth or income, exempting COMPANY from any fiscal responsibility related to the same.

For how long shall we keep his or her data?

ONE BY BNP PARIBAS shall keep personal data as long as the data subject do not ask for it to be erased or, otherwise, until the entity that develops the service to which he or she belongs decides to keep the service operational. In that case, once this is finished, his or her data will be erased.

Which is the legitimisation for the processing of his or her data?

The processing of the necessary personal data for the applicant to sign up in the service is based on the ONE BY BNP PARIBAS legitimate interest to manage the offered service in an effective and efficient way, offering in turn an optimal satisfaction as users of the service.

For the processing of data related to the sending of communications of services concerning products or services which appear in this platform, the legitimisation is based on the consent the data subject gave for this purpose in a free, specific, informed and unequivocal way.

In the weighting of interests between the rights of the user and the legitimate interest of ONE BY BNP PARIBAS for the personal data processing, ONE BY BNP PARIBAS always prioritises the user's rights, therefore minimises to the maximum the data subjected to process by selecting only the essential data which allow to maintain a balance between effective and efficient management of the service and the optimization of its business model. To this end, priority will be given to any request or suggestion made by interested parties in order to protect their data as much as possible.

To whom will the data subject’s data be communicated?

ONE BY BNP PARIBAS will not communicate or transfer none of his or her data to third parties.

Which are the rights of the data subject’s rights when he or she provides us the data?

Any user who provides his or her data, as the interested party he or she shall be able to exercise the rights described below whenever the user deems it appropriate.

There shall be kept in mind that his or her exercise of particular rights may implicitly entail the impossibility that ONE BY BNP PARIBAS is able to maintain active the service that they enjoy, as a consequence of the unconditional compliance of the request of the own data subjects.

Right of access: the data subject shall have the right to obtain confirmation as to whether or not data related to him or her are being processed and, in this case, right to access to the personal data and the following information: the purposes of the processing operation, the categories of data concerned; if possible, the laid down time limit of the personal data storage or, if not possible, the criteria used to establish this term; the existence of the right to request from the Officer the rectification or erasure of personal data or the limitation of the processing of personal data relating to the data subject, or to oppose this processing; the right to lodge a complaint before a supervisory authority; when personal data has not been obtained directly from the data subject, any information available about its origin; the existence of automated decisions, including profiling at least in such cases, significant information on the logic applied, as well as the importance and expected consequences of such processing for the data subject.

ONE BY BNP PARIBAS shall facilitate one copy of the personal which are being processed. The Officer may receive from any other copy requested by the data subject a reasonable canon according to the administrative costs. When the data subject lodges a complaint by electronic means, and unless he or she asks to facilitate it in different means, the data shall be facilitate in a common electronic format.

Right of restriction of the processing: the data subject shall have the right to obtain from ONE BY BNP PARIBAS the restriction of the personal data processing if one of the following conditions is met: that he or she impugns the accuracy of the personal data, for a period that allows the Officer to verify their accuracy; the processing is illicit and the data subject objects to the personal data erasure and request the limitation of their use instead; ONE BY BNP PARIBAS no longer needs personal data for the purposes of the processing, but the data subject needs them for the formulation, exercise or defence of complaints.

When the data processing becomes more restricted, said data may only be subject to processing by ONE BY BNP PARIBAS, with the exception of its conservation: with the data subject consent or for the formulation, exercise or defence of complaints, or with the purpose to protect the rights of another individual or legal entity or for reasons of important public interest for the Union or for a Member State.

Right of rectification: the data subject shall have the right to obtain without undue delay by ONE BY BNP PARIBAS rectification of inaccurate personal data concerning him or her. Considering the purposes of the processing, the data subject shall have the right to complete his or her incomplete personal data, including by means of an additional declaration.

Right of portability: the data subject shall have the right to receive the personal data related to him or her which were provided to a processing Officer, in a structured format of common use and machine-readable, and to transmit them to another data Officer, without being prevented by the Officer to whom it was provided, when: the processing is carried out by automated means.

The data subject, exercising his or her right of portability of the data in accordance with the preceding section, shall have the right the right that his or her personal data are transmitted directly from Officer to Officer when it is technically feasible.

Right to object: the data subject shall have the right to object at any time, for reasons related to his or her particular situation, to the fact that the personal data that concerns him or her are object of a necessary treatment for the satisfaction of legitimate interests pursued by ONE BY BNP PARIBAS or by a third party, Provided that over these interests do not prevail the fundamental rights, freedoms and interests which require the personal data protection, particularly when the data subject is a child. ONE BY BNP PARIBAS shall stop processing personal data, unless it proves legitimate compelling reasons for the processing that prevail over his or her interests, rights and freedoms, or for the formulation, exercise or defence of complaints.

Right of erasure: the data subject shall have the right to obtain without wrongful erasure delay of the personal data related to him or her, ONE BY BNP PARIBAS shall be subject to erase without wrongful delay the personal data one of the following conditions is met: the personal data are not necessary anymore in relation to the purposes for which it was collected or processed in a different way; the data subject shall object to such processing and other legitimate grounds do not prevail for the processing, or the data subject objects to the personal data processing when it has direct marketing as a purpose; the personal data has been unlawfully processed; the personal data shall be erased for the compliance of a legal obligation established in the Law of the Union Right or of a Member State applied to the data Officer.

This right of erasure shall not be exercisable when the processing is required for the formulation, exercise or defence of complaints.