last update: Jan 06, 2026

Respecting your privacy is of paramount importance to us. At United Heroes,

we apply several fundamental principles:

We do not ask you for personal information unless we really need it.

We do not sell your personal information to third parties for commercial

purposes.

We treat your personal information with the utmost respect for security and

privacy.

These principles are described in more detail in this policy.

Capitalized terms in this Privacy Policy (hereinafter the "Policy") refer to terms

as defined in the United Heroes Terms of Use (hereinafter the "TOU").

What is United Heroes and how does it work?

United Heroes is a digital services platform that enables its Users to develop

their sporting activities. The Platform is accessible to anyone who has created a

User Account in accordance with the Terms of Use. Through their User

Account, Users can access the Platform from:

United Heroes websites and United Heroes Applications, for Services

developed by United Heroes on its own behalf:

United Heroes: Service that Users can use when they are Employees of

a Subscribing Company by logging into their User Account;

VRace: Service provided by United Heroes at the request of a partner

company that the User can use spontaneously or after being invited by

a partner company, by logging into their User Account.

Sites and applications developed, operated, and managed by a white-label

partner company integrating the United Heroes platform (or "partner

platform"):

Virtual Club Service that a User can use by logging into their User

Account spontaneously or after being invited to do so by a partner

company.

United Heroes guarantees the continuity of this Policy on all means of access

to the Platform that we offer, both for United Heroes Sites and for United

Heroes Applications, and when the Platform is integrated into a Partner

Company's Application or Site.

Roles and Responsibilities (Data Controller and Data

Processor)

When using the Platform, two situations should be distinguished:

United Heroes as Data Controller: United Heroes acts as Data Controller

with regard to the creation and management of your User Account, the

provision of basic Services (activity tracking, access to social features),

and the security of your data. As registration is a voluntary process on the

part of the User (even when by invitation), United Heroes determines the

means and purposes of this processing.

United Heroes as a Processor: For certain specific features activated by

the Subscribing Company (such as specific reporting, management of

internal communication campaigns, or custom settings), United Heroes acts

on the instructions and on behalf of the Subscribing Company, which is

then the Data Controller. United Heroes undertakes to process this data in

accordance with the customer's documented instructions.

United Heroes' contact details are as follows:

United Heroes

8 Rue de Sofia, 75018 Paris

France

help@united-heroes.com

United Heroes is committed to respecting your right to privacy and the security

of the Personal Data you provide via the United Heroes Websites and

Applications or the Application and Website of a Partner Company that is part

of the Platform.

This Policy sets out the guidelines established by United Heroes to protect the

Personal Data you provide when visiting the Platform.

In the context of providing the Services, United Heroes collects personal data,

within the meaning of Article 4.1 of the GDPR, concerning Visitors and Users

(hereinafter " Personal Data" ) under the conditions detailed below.

In particular, United Heroes may collect the following personal data:

Concerning Visitors:

Data Goals Justifications / Legal Basis

Browsing data

Audience and traffic

measurement

Free, informed,

unequivocal, and

retractable consent of the

User

Personal data provided

voluntarily in the contact

form

Contact United Heroes to

respond to the visitor's

request and follow up on it.

Provision of services and

responses to visitors

Regarding Users:

Data Goals Justifications / Legal Basis

Identification data

Creation of the account

and management of

United Heroes'

relationship with Users

Need to provide the User

with services related to the

use of their account

Data provided voluntarily

and optionally by the User

on their User account or in

one of the application's

discussion threads.

Personalization of

services and rewards

Fulfillment of United Heroes'

legitimate interests in

adapting and measuring the

conditions of use of its

services

Data relating to sporting

activities provided by the

User or generated on the

platform

Taking into account

activities and calculating

points

Need to provide the User

with services related to the

use of their account

Data collected via third-

party applications if the

User chooses to connect

them to the platform

Recording of activities

and calculation of points

Free, informed,

unambiguous, and

retractable consent of the

User

Identification data and

statistical data on the

Activity report on the use

of services, when

requested by the

Legitimate interest for

United Heroes and the need

to perform its contract with

sporting activity of

employees or Users

Subscribing Company or

partner company.

the Subscribing Company or

partner company

Account Management and Deletion

In order to ensure sound data management (principle of minimization), the

Sport Heroes account lifecycle is linked to the User's activity on experiences:

Multi-experience User: If a User is registered for several experiences, the

deletion or termination of one of them does not result in the deletion of their

Sport Heroes account, which remains active for access to other experiences.

Single-experience user: If a User is only linked to a single experience, the

deletion or termination of that experience will result in the automatic and

simultaneous deletion of their Sport Heroes account, thus avoiding the

retention of inactive accounts ("ghost accounts").

Invitation

The United Heroes service allows subscribing companies to invite employees

to join the applications.

If an Employee is invited in this way, United Heroes will retain the email address

of the invited Employee and the message sent to them in order to track their

registration (and, where applicable, to enable a reply message to be sent).

The legal basis for this is the fulfillment of United Heroes' legitimate interests

and the need to perform its contract with the Subscribing Company.

United Heroes will inform the invitee who invited them and allow them to

request that their information be deleted from our systems by submitting a

request to help@united-heroes.com.

Health data

None of the Personal Data collected by United Heroes, nor that resulting from

its processing, constitutes health data as defined by the GDPR.

Anonymous data

United Heroes may use this data by aggregating it in such a way that the

individuals concerned can no longer be identified, for statistical purposes and

to improve the quality of its Services.

Geolocation data

United Heroes does not use your GPS tracks or your precise location to provide

the Service. However, certain third-party connectors (smartwatches, third-

party applications) send us these GPS coordinates GPX/TCX files) by default

via their APIs when synchronizing activity.

This transmission constitutes incidental technical collection.

United Heroes does not use this location data: we only extract the metadata

necessary for the Service (distance, duration, etc.) and immediately delete the

raw GPS coordinates from our active servers.

This data is not stored, displayed, or shared with the Subscribing Company.

Activity details and timing

Detailed activity data, including precise timestamps (start time, end time,

detailed chronology of the effort), are strictly linked to your personal User

Account.

It is processed to enable you to track your history and personal progress.

These time details are not part of the employee experience provided to the

Subscribing Company.

Therefore, in accordance with the principle of data minimization GDPR, this

granular time information is never communicated to the Subscribing Company,

which only has access to aggregated or summarized data (e.g., total number of

hours per month), unless explicit consent is given in the context of a specific

Challenge (see dedicated section).

Interaction between Users and social features

On United Heroes applications, Users can interact with Users of the same

solution.

Special case of United Heroes: Users can only interact with members of the

same company. United Heroes applications are separate from each other.

Due to its objectives of inclusion and cohesion, United Heroes integrates social

features into its applications (sending messages, photos, reacting to and

sharing activities).

Discussion forums and moderation Discussion forums (chat, comments, news

feed) are moderated social spaces. United Heroes and the Subscribing

Company reserve the right to remove any content that does not comply with

the Terms of Use (hate speech, illegal content, harassment) and the

Subscribing Company's internal practices.

Voluntary disclosure of sensitive data or health data

United Heroes does not request or process sensitive data (political or religious

opinions, detailed health data, etc.) on the Platform. If you choose to disclose

such information (for example, by discussing your recovery or state of health),

you acknowledge that this data is clearly made public by you voluntarily within

the meaning of Article 9.2.e of the GDPR.

We recommend that you exercise the utmost caution when sharing private

information.

Sharing multimedia content and external links

By sharing photos, videos, or links on the Platform, you guarantee that you

have the necessary intellectual property rights (copyright, image rights of

visible persons).

It is strictly prohibited to share hyperlinks to sites whose content is illegal,

malicious (phishing, viruses) or contrary to the rules of the United Heroes

community or the Subscribing Company.

Any content identified as such will be immediately deleted and may result in the

suspension of the User Account.

United Heroes accepts no responsibility for the content of third-party sites

shared by Users.

Default User Account Status

In its initial state, a User's account is configured as "public."

This allows the User of a United Heroes experience to display certain elements

of their account to other Users of the same experience, namely:

Name

Clubs

Summary of activities carried out during the month and year (without time

details)

Teams

Badges

Accounts can be set to private at any time by the User, in which case only the

name is displayed.

Ranking information always displays the name and is visible to all Users of the

experience.

List of data provided by third-party sports

applications:

The United Heroes Applications allow Users who wish to do so to connect one

or more third-party sports applications to the Platform in order to automatically

retrieve the data listed below and integrate them into the experiences and

challenges offered by United Heroes.

Connector

Data collected and processed by

United Heroes

Apple Health

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

Coros

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

 GPS coordinates

Google Fit

 Date of activity

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

Garmin  Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

 Activity entered manually or not

Polar

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

 GPS coordinates

Suunto

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

 Activity entered manually or not

TomTom

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

Runkeeper

 Date of activity

 Time zone

 Distance

 Duration of activity

 Type of activity

 GPS coordinates

Nike+  Date of activity

 Distance

 Duration of activity

 Type of activity

Decathlon Coach

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

Fitbit

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

Health Mate

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

 Number of daily steps

(excluding activity)

Adidas Running Runtastic)

 Date of activity

 Time zone

 Distance

 Duration of activity

 Type of activity

Underarmour apps Map My Run, Map My Ride,

Map My Walk, Map my Fitness)

 Date of activity

 Time zone

 Distance

 Duration of activity

 Number of steps

 Type of activity

Rouvy

 Date of activity

 Distance

 Duration of activity

 Type of activity

 GPS coordinates

FulGaz

 Date of activity

 Distance

 Duration of activity

 Type of activity

 GPS coordinates

Wahoo

 Date of activity

 Distance

 Duration of activity

 Type of activity

 GPS coordinates

Social Ride

 Date of activity

 Distance

 Duration of activity

 GPS coordinates

Samsung Health

 Date of activity

 Distance

 Duration of activity

 Type of activity

 GPS coordinates

 Number of daily steps

(excluding activity)

Kinomap

 Date of activity

 Distance

 Duration of activity

 Type of activity

The connection to a third-party application is made by the User and can be

disabled at any time by the User.

The data listed above is processed by United Heroes for the sole purpose of

providing the Services. Any processing of data by third-party applications for

their own purposes is subject to the terms of use and privacy policies of each

third-party service, which the User is invited to read.

Activity data (such as steps, distances, or sports activities) collected via the

Solution is directly and technically linked to the End User's unique Sport Heroes

account, and not exclusively to the Experience or white label.

As a result, the User retains full control and availability of their activity history.

This model ensures that activity data remains linked to the User regardless of

the Experiences in which they participate, thus ensuring the portability of their

data even if a specific Experience is closed.

2.3 Use of data by Sport Heroes

We use your personal data in the following cases and those defined in the

Operation of the service:

Providing and improving the service

Providing you with information about our services;

Establishing and maintaining your User profile on the service;

Communicate with you about the service, including sending you

announcements, updates, security alerts, or other support information;

Communicate with you about events and contests in which you have

participated;

Better understand your needs and interests and thus personalize your

experience on the service and in our communications with you;

Provide you with support and maintain the service;

Respond to your questions, requests, or feedback.

Research and development: We analyze the use of the service in order to

improve it and provide new related services and products, including by

analyzing the demographics of our Users and their usage habits. This analysis

is performed on anonymous data.

Legal compliance: The data processed may be transmitted to the competent

authorities, at their request, in the context of legal proceedings, in the context

of judicial investigations and requests for information from the authorities, or in

order to comply with other legal obligations. Finally, it may be transmitted to

third parties authorized by a court decision.

Security and fraud prevention: We monitor interactions with United Heroes

services in order to prevent abuse and limit security risks to United Heroes

services or Users. The data processed may also be used to build a case file for

fraud investigations. These security and fraud aspects relate to the risks of

cyber attacks or abuse.

United Heroes Applications allow Users who wish to do so to connect one or

more third-party sports applications to the Platform in order to automatically

retrieve the data listed below and integrate it into the experiences and

challenges offered by United Heroes.

Special case of third-party connection connectors

You can link your third-party account to a United Heroes service. By linking

these services, you authorize us to collect, store, and use the information they

may provide us (e.g., your email address).

By registering or logging in, Users allow United Heroes to identify them and

give them access to dedicated services.

As described below, third parties may provide registration and authentication

services. In this case, United Heroes may access certain data stored by these

third-party services for registration or identification purposes.

Some of the services listed below may also collect personal data for targeting

and profiling purposes (independent data controllers); for more information,

please refer to the description of each service.

Google OAuth

Google OAuth is a registration and authentication service provided by Google

and is connected to the Google network.

Personal data processed: different types of data as specified in the privacy

policy of the service.

Place of processing: Ireland  Privacy policy

(https://policies.google.com/privacy).

The use by United Heroes and the transfer to any other application of

information received from Google APIs complies with the rules relating to the

processing of user data of the Google API services, including limited use

requirements.

Facebook Connect is a service provided by Meta (formerly Facebook).

This service identifies you and offers you the opportunity to share certain

personal information with us, such as your name and email address, in order to

pre-populate your account information.

Services such as Connect with Facebook give you the ability to post

information about your activities on this website to your profile page to share

with others in your network.

The use and transfer by United Heroes to any other application of the

information received by the Meta APIs complies with the Facebook terms.

Signing in with Apple is a service provided by Apple.

This service authenticates your identity and provides you with the ability to

share certain personal information with us, such as your name and email

address, in order to pre-populate your account information.

United Heroes' use and transfer to any other application of information

received from Apple's APIs complies with the Apple privacy policy.

How long are Personal Data kept by United Heroes?

United Heroes only keeps visitors' and Users' personal data for as long as is

strictly necessary to achieve the above-mentioned purposes, subject to

compliance with its legal and regulatory obligations.

In particular, a User's personal data processed for the purpose of providing

services is deleted immediately after the closure of a User account at the

User's initiative or after a period of inactivity by the User of three years.

In addition, a User's personal data processed for commercial prospecting

purposes is deleted three years after the User's last interaction with United

Heroes in the context of commercial electronic communications.

Data Retention duration Basis

User account content

(email, name,

activities)

3 Years from last

service interaction

Contractual necessity: Required to

manage the user account and provide

ongoing service until the user decides to

terminate the account.

IP Address 1 Year

Legitimate interest: Necessary for

ensuring network and information

security, including monitoring and

preventing unauthorized system access.

What cookies does United Heroes use?

For the purposes of this Article 5 the expression “cookie » refers indifferently to

a cookie or a tracker.

For your complete information, we would like to inform you of the difference in

operation between what is generally called a “cookieˮ and the specificities that

this leads to, and what the expression “tracerˮ covers in terms of realities and

modes of operation.

What is a cookie " ?

A “cookieˮ, or connection witness, is a small text file that can be placed on the

computer, tablet or smartphone of the Visitor and/or User (hereinafter the

“cookieˮ) when consulting a website or a mobile application, thanks to the

navigation software.

A cookie file allows its issuer to identify the Terminal in which the cookie is

recorded, during the validity or recording period of said cookie.

Certain cookies are essential for the use of the United Heroes Sites and

Applications or for the provision of the Services provided by United Heroes. In

this case, they are systematically deposited in the User's Terminal.

Other cookies make it possible to optimize and personalize the content or

available functionalities displayed within the United Heroes Sites and

Applications.

In this case, the deposit and reading of these cookies in the Visitor's and User's

Terminal takes place subject to the choices offered to them within the United

Heroes Sites and Applications.

What is a “trackerˮ?

The expression “trackerˮ designates an identifier recorded in the Terminal of a

Visitor or User, without the intervention of the navigation software, and likely to

be issued by the Terminal and to be read by a technical service provider to

which the Terminal is connected, without this identifier having itself been

placed in the Terminal by this service provider.

In practice, the expression "tracker" most often corresponds to an identifier of

the User's or Visitor's Terminal managed by their operating system. This is the

case in particular of the identifier of the mobile Terminal, the accessibility or

reading of which can be managed differently by the operating system

concerned, depending on whether the User or Visitor uses an Android Terminal

(l The identifier is often called a “Android ID » or «AAID ") or iOS (the identifier

is often called " IDFA » or «ID for Advertiser "), or another operating system.

The expression "tracker" can also correspond to the identifier of a mobile

application installed in the User's or Visitor's Terminal, and which can be read

by the publisher of this mobile application or by one of the providers of this

editor.

This is particularly the case for the number of “SDK » (« Software

Development Kit "), through which information flows between the mobile

application installed in the User's or Visitor's Terminal and the publisher of this

application (or its service providers), can be established to allow the operation

of the various software components of the application.

By whom are cookies placed and read?

Cookies placed on the User's or Visitor's Terminal from the United Heroes Sites

and Applications may be placed or read by United Heroes or by third parties.

The cookies placed or read by United Heroes are mainly linked to the operation

of the United Heroes Sites and Applications.

The others are “third-partyˮ cookies placed or read by our United Heroes

partners. United Heroes ensures that the issuance and use of cookies on their

part is carried out in compliance with the regulation in application.

Only the issuer of a cookie (within the meaning defined in Article 5.1 has the

possibility of reading the information contained therein.

How and why do we use cookies?

Multiple categories of cookies or trackers are implemented within the United

Heroes Sites and Applications for the purposes described below.

For completeness, we inform you, as far as possible, of the purpose of cookies

or tracers placed or read by third parties and of the means available to the User

or Visitor to make choices with regard to these cookies. or tracers.

Cookies strictly necessary for the operation of the Sites

These are cookies essential for browsing the United Heroes Sites and

Applications which allow the User or Visitor to use the main functionalities of

the United Heroes Sites and Applications and to secure their connection.

More precisely, these cookies allow in particular:

to adapt the presentation of the United Heroes Sites and Applications to the

display preferences of the Terminal (language used, display resolution,

operating system used, etc.) when using the United Heroes Sites and

Applications, according to the hardware and software for viewing or

reading that the Terminal includes;

to allow access to the User Account on the United Heroes Sites and

Applications;

to memorize information relating to the forms that the User or Visitor has

completed when using the United Heroes Sites and Applications;

to memorize the usage preferences, display parameters and players that

the User or Visitor uses in order to facilitate their navigation during their

next visit to the United Heroes Sites and Applications.

Without these cookies the User or Visitor would not be able to normally use the

United Heroes Sites and Applications. Consequently, their deposit or reading on

the Terminal is not a matter of choices offered to the User or Visitor.

The main cookies (as defined in Article 5.1 strictly necessary for the provision

of services and the operation of the United Heroes Sites are as follows:

Cookie issuer Purpose

Concerned

person

Duration

Algolia

Search functions in the

application

Visitor and User 12 months

Stripe Bank fraud detection Visitor and User 12 months

United Heroes User ID User 12 months

United Heroes Experience ID Visitor and User 12 months

United Heroes User authentication token User 12 months

United Heroes Language used for translation Visitor and User 12 months

United Heroes

Definition of the technical

environment

Visitor and User 12 months

Audience measurement cookies strictly necessary for the

proper functioning of the Sites

The management of United Heroes Sites and Applications requires the use of

attendance and/or performance statistics,without the identity of the Visitor or

User being known to United Heroes. These measures are essential to analyze

the functioning of the United Heroes Sites and Applications, and for the

provision of the United Heroes Services.

Consequently, United Heroes places and/or reads cookies or trackers in the

Terminal whose purpose is limited to measuring the audience of the Sites, to

meet different needs:

performance measurement,

detection of navigation problems,

optimization of technical performance or ergonomics,

estimation of the power of the necessary servers,

analysis of content consulted, etc.

These cookies or trackers being strictly necessary for the functioning and day-

to-day administration operations of the United Heroes Sites and Applications,

they are not subject, in application of article 82 of the “Informatique et Libertésˮ

law, to the prior consent of the 'User or Visitor.

However, their purpose is strictly limited to the sole statistical and aggregate

measurement of the audience of the United Heroes Sites and Applications, for

the exclusive account of United Heroes.

These cookies do not allow the overall tracking of the navigation of the User or

Visitor, in particular when he uses other mobile applications or browses

different websites outside of the United Heroes Services.

Likewise, these cookies are only used to produce anonymous statistical results,

and the data collected is not cross-checked with other processing operations

or transmitted to third parties.

The audience measurement cookies strictly necessary for the proper

functioning of the United Heroes Sites and Applications are as follows:

Cookie issuer Purpose

Concerned

person

Duration

Sentry Crash report Visitor and User 24 months

Mixpanel

Product improvement and

statistics

Visitor and user 12 months

Braze

Newsletters / application push

notification

User 12 months

Analytical and performance cookies

Analytical and performance cookies allow us to:

know the use and performance of the United Heroes Sites and Applications;

to establish statistics, measurements of attendance and use of various

elements making up the United Heroes Sites and Applications (content

visited, routes, etc.) for the purposes of improving the interest and

ergonomics of our Services (the pages or the most frequently consulted

sections, the most read articles, etc.);

count visitors to a page;

improve the interest and ergonomics of our Services (the pages or sections

most often consulted, the most read articles, highlighting a challenge, etc.);

prevent computer fraud.

The fact of refusing or not accepting the implementation of such cookies or

deleting them has no impact on the navigation of the User or Visitor on the

United Heroes Sites and Applications, but it is of a nature to prevent United

Heroes from ensuring the best quality of Services that it wishes to offer to its

Visitors and Users.

The main analytical and performance cookies used are as follows:

Issuer you cookie Purpose

Concerned

person

Duration

Plausible Count visitors Visitor and User 30 days

Google Tag

Manager

Tracking aggregator Visitor and User 30 days

Adjust

Campaign/course

monitoring

Visitor and User 7 days

Hubspot Audience measurement Visitor and User 7 days

Sharing cookies (social networks)

United Heroes may include on its United Heroes Sites and Applications,

computer applications from third parties, which allow the User or Visitor to

share content from said United Heroes Sites and Applications with other people

or to make known to the latter its consultation or its opinion concerning the

content of the United Heroes Sites and Applications.

Some of our Sites may therefore contain sharing links to Facebook, Twitter and

other similar social networks, which allow the User or Visitor to share content

from United Heroes Sites and Applications with other people. When the User or

Visitor uses these sharing buttons, a third-party cookie from the social network

concerned is installed, but only if the User or Visitor uses these buttons, or if

the User or Visitor has previously consented on a Site or United Heroes

Application to the installation of cookies by these social networks. If the User or

Visitor is connected to the social network when browsing the United Heroes

Sites and Applications, the sharing buttons allow the content consulted on our

United Heroes Site or Application to be linked to the user account of the social

network concerned. .

If the User or Visitor has refused the implementation of social network cookies

or if they have not previously consented, the User or Visitor must authenticate

with their social network account during each operation. sharing that he wishes

to make to the network(s) concerned.

The social network providing such an application button is likely to identify the

User or Visitor thanks to this button linked to the User's or Visitor's account on

this social network, even if the User or Visitor has not used this button when

consulting one of our United Heroes Sites or Applications. Indeed, this type of

application button can allow the social network concerned to follow the

navigation of the User or Visitor on the United Heroes Sites and Applications,

simply because the social network account concerned was activated on the

Terminal (open session) during the User's or Visitor's navigation on said United

Heroes Sites and Applications.

United Heroes invites its Users and Visitors to consult the privacy protection

policies of these social networks in order to be aware of the purposes of use, in

particular advertising, of the navigation information that they can collect thanks

to these sharing buttons with these networks.

These data protection policies must in particular allow the User or Visitor to

exercise the choices offered to them by these social networks, in particular by

configuring the usage accounts of each of these networks.

The refusal, absence or withdrawal of consent from the User or Visitor with

regard to these social network cookies has no impact on the use of the United

Heroes Sites and Applications.

The main social media cookies used are as follows:

Cookie issuer Purpose Concerned person Duration

Facebook Connect SSO connection Visitor and User 24 months

Google Connect SSO connection Visitor and User 24 months

Apple Connect SSO connection Visitor and User 24 months

Facebook Content sharing Visitor and User 24 months

Facebook Messenger Content sharing Visitor and User 24 months

Twitter Content sharing Visitor and User 24 months

Cookie management

All of the rights recognized are also applicable to the User or Visitor.

The User and the Visitor have different means to manage the implementation of

cookies subject to their choice.

The User and the Visitor can at any time choose to deactivate the

implementation of cookies subject to their choice or to delete those which have

already been installed on their Terminal by using the corresponding function in

their account setting in the mobile application or via the dedicated button in the

website access.

The settings of the User's and Visitor's navigation software may modify the

conditions of access to the Services when the use of certain cookies is

necessary, while the settings of the navigation software or the Terminal's

operating system prevent the deposit or reading of these cookies or trackers.

In addition, if the User's or Visitor's Terminal is used by several people and

when the same Terminal has several navigation software, United Heroes cannot

ensure with certainty that the services intended for the Terminal of the The

User and the Visitor correspond to their own use of this Terminal and not to that

of another user of this Terminal.

To whom, and how, does United Heroes transfer my

Personal Data?

Main data flows

In order to provide Users with the Services and functionalities relating to their

use of the Services, United Heroes may transfer or make accessible certain

User data, strictly necessary for this purpose, to the following categories of

recipients:

Recipient categories Purposes of the transfer

Partner Companies

Subscribing Companies

Delegation of certain support request

management services

Provision of Services as part of a Partner

Platform

Providers Provision of Services

Collaborators within United Heroes, needing

to know as part of their duties

Provision of Services

Partner Companies

Subscribing Company

Activity report (identification data and

sports activity statistical data)

Messages and photos posted on the

global feed

The Subscribing Company is granted the right to use the content of the global

discussion feed, provided that all contributions comply with applicable laws

and respect privacy and intellectual property rights.

Personal Data and Specific Challenges

Certain Challenges offered on the Platform may, by their nature (e.g., prize

draws, award ceremonies, charity events, internal communications, etc.),

involve sharing your identification and performance data with the Subscribing

Company for further use as defined by the latter.

In this case, a specific mention will be added to the description ("card") of the

Challenge concerned, detailing the purpose of the sharing.

Your voluntary registration for this Challenge (by clicking on "Join") constitutes

your explicit consent to the sharing of this limited data for the duration and

purpose of the Challenge.

You may withdraw this consent at any time by unsubscribing from the

Challenge before it closes, which will, however, cancel your participation and

your rights to any associated rewards.

Quizzes

All data from quizzes are stored on secure servers within the European Union,

complying with EU data protection regulations.

Subscribing Companies who commission these quizzes are the Data

Controllers of all collected information.

United Heroes only formats and provides quiz results to Subscribing Company

and does not use them for any other purpose.

We act solely as a Data Processor, handling data according to the Subscribing

Company's instructions.

All requests regarding data access, correction, or deletion for answers sent to

the quizzes should be directed to the client company that commissioned the

quiz.

Quiz data is retained for the duration of the contract with the Subscribing

Company or until the Subscribing Company requests data deletion. Upon

contract termination or deletion request, we ensure secure and complete data

removal from our systems.

Details on activity reports

Activity reports are only transferred as part of the United Heroes solution.

The transfer of activity reports only concerns aggregated activity data used to

measure engagement (the proportion of Users who actively use the Solution) or

participation in Challenges, as well as rankings within the Solution.

The personal data included in these activity reports is as follows:

The User's first and last name as provided by the User

The User's email address

The activity reports do not detail the activities of each User (whether in terms

of the times and duration of the activity, geolocation data, or even the category

of activity(ies) practiced).

They only provide an overview of the aggregate engagement per month. These

reports do not in any way affect the User's rights over their data, as detailed in

section 10 of this privacy policy.

The legal basis for this processing is the need for United Heroes to perform its

contract with the Subscriber Company or partner company.

The User must contact the Subscriber Company or partner company in order to

assert their rights regarding the use of their data provided in these reports, as

the Subscriber Company or partner company becomes responsible for the

processing of this data upon receipt of these reports.

Transfer to third parties

United Heroes may transfer data to its service providers. A list of all providers

to whom we transfer subsets of data can be found in the appendix.

Furthermore, in the context of certain Challenges, and subject to the express

consent of the User, United Heroes may transfer the User's contact details to

the Partner Company in the organization of the Challenge. This Partner

Company may then, subject to the User's consent, contact the User again for

promotional and advertising purposes.

When the User uses the Services through a Partner Platform:

The User's Personal Data may be exchanged between United Heroes and

this Partner for the purposes of providing the Services to the User.

Said Partner may share Personal Data with other third parties of its choice,

provided that the User has expressly and previously consented to the

sharing of their Personal Data within our Services or on the Partner

Platform. In this case, the third party recipient of the Personal Data remains

responsible for processing the Personal Data concerned.

The Personal Data of Users may be transmitted to Partners so that the latter

can, if necessary, manage support requests in connection with the Services.

Transfer outside the European Union

All User Personal Data is stored within the European Union, on AWS servers in

Dublin and Frankfurt.

Automatic backups of Data are also carried out within the European Union.

United Heroes undertakes not to carry out any transfer of Personal Data

outside the European Union without implementing appropriate guarantees in

accordance with the Applicable Regulations as interpreted by the CNIL and the

Court of Justice of the European Union, in particular by concluding contractual

clauses based on the models adopted by the European Commission.

What does United Heroes do to protect the data I

transmit to it?

United Heroes attach particular importance to the security of your Personal

Data.

United Heroes has implemented appropriate and stringent security measures

intended to prevent your Personal Data from being deleted, altered, lost, used,

extracted, modified, disclosed or accessed without authorization and

fraudulently.

These measures are adapted according to the level of sensitivity of the data

processed and the level of risk.

In particular, United Heroes has implemented procedures to detect, analyze and

deal with any suspected violation of your Personal Data, and notifies you and

any relevant supervisory authority of a violation when United Heroes is legally

or contractually required to do so.

In addition, United Heroes limits access to your Personal Data only to

employees, subcontractors and other third parties who need access to it to

carry out their missions. They are subject to an obligation of confidentiality.

United Heroes also requires its co-contractors to respect the security of the

Personal Data of its Users and Visitors and to process them in accordance with

the data protection laws in force. To this end, United Heroes ensures that it

works with partners who have certification to guarantee these levels of

security, favoring companies certified with ISO 27001, SOC2 or other

certification standards for security management.

The Sites use the industry standard Transport Layer Security TLS to encrypt

Personal Data, including your name and address. The Sites are also registered

with website identification authorities so that your browser can confirm the

identity of United Heroes before any Personal Data is sent.

Personal Data is also encrypted when recorded on storage media (hard drives).

This encryption uses the AES256 standard.

Finally, the banking data collected by our online sales service providers Stripe)

are subject to a level of security adapted to the risk associated with the

processing of this data.

United Heroes only stores an identifier specific to our online sales service

providers Stripe) and does not have unencrypted access to this data.

What can I do to help keep my data secure?

Here is a non-exhaustive list of measures you can take to secure your

experience on the United Heroes Applications:

Use a reputable and secure web browser, such as Google Chrome or

Mozilla Firefox, and keep it up to date with the latest updates and security

patches.

Use a strong, unique password for every online account and website, and

use a password manager to store and manage your passwords securely.

Avoid clicking on suspicious links or downloading unknown files as they

may contain malware or others.

Install and regularly update antivirus and anti-malware software on your

computer, and regularly scan your computer for viruses and other threats.

Keep your computer and mobile operating system and other software up to

date with the latest patches and security updates.

Update United Heroes apps when a new version is available.

In case you notice any security issue, you can report it to United Heroes

Support at the following address:help@united-heroes.com

United Heroes cannot be held responsible for any compromise of your data

which may have been intercepted due to your use of an unsecured browser or

subpar security practices (ie. weak password, credential sharing).

Does United Heroes offer to unsubscribe from

communications?

Yes. If you no longer wish to receive emails from United Heroes, we invite you

to:

to follow the unsubscribe instructions accessible in each email; Or

to send an email to the email address:help@united-heroes.com

In such a case, United Heroes will not provide or share its mailing lists or other

information about you to any other company or service for promotional

purposes.

What are my rights ?

In accordance with the Applicable Regulations, you benefit at any time and free

of charge from a right of access, rectification, modification, deletion (right to be

forgotten), limitation of processing, opposition and, where applicable

applicable, limitation of processing and portability (in JSON format) of Personal

Data concerning you, subject to the rights and freedoms of third parties and the

obligations incumbent onUnited Heroes.

You also have the right to define directives relating to the fate of your Personal

Data after your death.

When processing is based on consent, the User may, at any time, request

withdrawal of consent, it being specified that processing carried out prior to

withdrawal remains lawful.

Users can exercise their rights:

By sending an email to the following address:help@united-heroes.com ; or

By writing to the postal address: United Heroes, 91 rue Jean Pierre

Timbaud, 75011 Paris  France;

Regarding the rights of rectification, modification and deletion, by

configuring or updating your profile in “Edit your profileˮ on your United

Heroes User Account.

If you consider that United Heroes has failed to fulfill its legal obligations under

the Applicable Regulations, you, or an association mandated for this purpose,

have the possibility of lodging a complaint with the CNIL or the supervisory

authority of the Member state of the European Union in which you usually

reside.

Changes to the Privacy Policy

United Heroes may modify the Policy at any time, and therefore invites you to

consult it regularly, on the United Heroes Sites and/or United Heroes

Applications that you consult or use.

In the event of a substantial modification of the Policy concerning your rights,

United Heroes will bring them to your attention as soon as possible.

How do I contact United Heroes?

United Heroes welcomes your questions and comments. You can send us your

questions or comments by email to the email address:help@united-heroes.com

or contact our DPO at the email address:dpo@united-heroes.com

Annex

Data Card:

1. Users

● First name - public

● Name – public

● Email – private

● Gender – private or public when the data is

deducted from registration for certain Challenges.

(optional)

● Birthday – private or public when the data is

provided for registration for certain Challenges

(optional)

● Currency - public (optional)

● Language - public (optional)

● Photo - public (optional)

● Facebook - private (optional)

○ Identifier

○ Access token

● Google - private (optional)

○ Identifier

○ Access token

● Places - public (optional)

○ Location identity

○ Would

○ Pays

○ Time zone

○ Code postal

○ Lat.

○ Lng.

● Apps - public (optional)

○ Id. they profile

○ Profile URL

○ Access token

● Company - private (optional)

● Commercial unit - private (optional)

● Bib number - private (optional)

● Phone number - private (optional)

● Postal address - private (optional)

● Shoe size - private (optional)

● T-shirt size - private (optional)

2. Activities - public or private

(at the User's choice)

● Identifier

● Supplier

● Distance

● Duration

● Climb

● Descent

● Departure date

● Waypoints

○ Lat.

○ Lng.

○ Age.

○ Time

● Type

● Time zone

● Calories

● Number of steps

● Duration of activity

List of main third-party providers to whom we

transfer data:

Hosting and Infrastructure

Subcontractor Service/Purpose Data Location Transfer guarantees

AWS Amazon Web

Services)

Cloud hosting and

server infrastructure

Ireland EU

Data Privacy

Framework DPF

MongoDB Atlas Database Ireland EU

Hosted on AWS EU

infrastructure

CloudAMQP

Queue management

Message Queuing)

Ireland EU

Hosted on AWS EU

infrastructure

Third-party features and services

Subcontractor Service/Purpose Data Localization

Transfer

Safeguards

Algolia Internal search engine France EU N/A

Stream

Chat, feeds, and social

interaction management

Ireland EU

Hosted on AWS EU

infrastructure

Typeform

Forms and surveys

Users

Spain EU N/A

Zendesk

User support

management and

ticketing

(Germany/Ireland)

Binding Corporate

Rules BCR

Marketing and Analytics

Subcontractor Service/Purpose Data location Transfer safeguards

Braze

In-app content and

transactional emails

Germany EU

Hosted on AWS EU

infrastructure

Mixpanel

Statistical analysis of

product usage

Ireland EU

Hosted on Google

Cloud/AWS EU

infrastructure

Authentication (SSO)

Subcontractor Service/Purpose Data location

Transfer

safeguards

Meta, Apple,

Google

Simplified login

Single Sign-On)

Worldwide (including

the United States)

Data Privacy

Framework DPF