Privacy Policy

1. Introduction & Scope

Exclusive Networks S.A. and its worldwide subsidiaries and affiliates (collectively "Exclusive Networks", "EXN", "we", "us") are committed to protecting the personal data of all individuals with whom we interact — customers, partners, vendors, event participants, and website visitors. This Privacy Policy ("Policy") is issued at Group level by Exclusive Networks S.A., the French parent company of the Group. It sets out the principles and rules that govern the collection, use, storage, sharing, and protection of personal data across all Group entities operating in Europe, the Americas, Africa, the Middle East, and Asia-Pacific.

2. Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

• Personal Data: any information relating to an identified or identifiable natural person (the Data Subject). 
• Data Subject: the individual to whom the Personal Data relates (e.g., customer, partner contact, vendor contact, event participant, or website visitor). 
• Processing: any operation performed on Personal Data (e.g., collection, recording, organisation, storage, use, disclosure, transfer, or deletion).
• Data Controller (or Controller): the entity that determines the purposes and means of Processing Personal Data. • Data Processor (or Processor): a third party that Processes Personal Data on behalf of the Data Controller, under documented instructions.
• Recipient: any person or entity to which Personal Data is disclosed (including service providers and other third parties, and public authorities where required by applicable law).
• Group / Exclusive Networks Group: Exclusive Networks S.A. and its worldwide subsidiaries and affiliates.
• Legal Basis: the lawful ground that permits Processing under applicable law (e.g., contract, legitimate interest, legal obligation, or consent).
• Consent: a freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they agree to the Processing of their Personal Data (and, where required, an explicit consent).
• Legitimate Interest: a business or operational interest pursued by the Data Controller, provided that such interest is not overridden by the Data Subject’s interests or fundamental rights and freedoms.
• Sensitive Data: Personal Data that is subject to enhanced protection under applicable law. Under the GDPR, this includes Special Categories of Personal Data. Where processed, Sensitive Data generally requires a specific legal basis and additional safeguards.
• Cookies / Trackers: small text files or similar technologies placed on a device that may collect information about browsing activity, device identifiers, preferences, and/or interactions with online services.
• International Data Transfer: a transfer of Personal Data to a recipient located outside the country or jurisdiction where the data was collected or is otherwise protected (including, where applicable, transfers outside the EU/EEA).
• Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• Supervisory Authority: the public authority responsible for monitoring the application of data protection laws in a jurisdiction (e.g., data protection authority).

3. Data Controller

The data controller for Group-level processing activities is:

Entity Exclusive Networks S.A. 
Registered Address 20 Quai du Point du Jour, 92100 Boulogne-Billancourt
SIREN 401196464
Group DPO dpo@exclusive-networks.com

For processing activities carried out locally by a subsidiary, that subsidiary acts as Data Controller for its own processing activities. Contact details for each local entity are available on their website.

4. Personal Data We Collect

4.1. Data You Provide Directly

• Identity Data: first name, last name, job title, company name, professional biography 
• Contact Data: professional email address, telephone number, business postal address
• Account & Credentials: login details, account preferences, communication history
• Event & Training Data: registration information for events, webinars, training programs
• Mobile & SMS Data: mobile phone number and SMS opt-in consent (US only — see 15. Addendum 1)
• Commercial Data: purchase history, quotes, orders, payment information 4.2. Data Collected Automatically 
• Technical Data: IP address, browser type and version, device identifiers, operating system
• Usage Data: pages visited, time on site, click paths, search terms, referral URLs
• Cookies & Trackers: see Section 13

4.3. Data from Third Parties

• Business data from partners, resellers, and vendors
• Data from marketing platforms, lead generation tools, and industry databases
• Data provided by your employer or organization in the context of a commercial relationship

5. How We Use Your Personal Data

• Manage and administer our business relationships with resellers, partners, and vendors 
• Deliver products, solutions, and services you have requested
• Communicate with you about products, services, events, training, and promotions
• Process transactions, manage invoicing, and fulfil contractual obligations
• Send SMS/text message communications where you have provided explicit consent (US — see 15. Addendum 1)
• Improve our websites, platforms, and services through analytics
• Personalize your experience and deliver relevant content
• Manage security, detect fraud, and prevent unauthorized access
• Comply with applicable legal and regulatory obligations
• Exercise or defend our legal rights

6. Legal Bases for Processing

We process personal data on the following legal bases, which may vary depending on the applicable local law: Contract Processing necessary to perform a contract with you or your organisation, or to take pre-contractual steps at your request

Legitimate Interest Business development, security, B2B marketing campaigns, fraud prevention — subject to a balancing test

Legal Obligation Processing required to comply with applicable law, regulation, or court order

Consent Where we have obtained your specific, informed, and freely given consent — including for SMS communications (US), B2C marketing campaigns, cookies, and sensitive data processing

 7. Data Sharing & Disclosure

We do not sell your personal data to third parties. We may share your personal data with the following categories of recipients, strictly for the purposes described in this Policy:

• Group entities: subsidiaries and affiliates within the Exclusive Networks Group, for internal operational purposes
• Technology & service providers: third parties supporting our operations (cloud hosting, CRM, analytics, email delivery, event management)
• Vendor & distribution partners: facilitate delivery of products, solutions, or training you have requested
• Financial & legal advisors: for accounting, audit, legal, and compliance purposes
• Public authorities: where required by law, regulation, court order, or lawful governmental request

8. International Data Transfers

As a global group, EXN may transfer personal data across borders as part of its normal business operations. When personal data is transferred outside the country of collection, we ensure that appropriate safeguards are in place.

8.1. Transfers from the EU/EEA

• Standard Contractual Clauses (SCCs) as approved by the European Commission
• Adequacy decisions issued by the European Commission
• Binding Corporate Rules (BCRs)

8.2. Transfers from Other Jurisdictions

• South Africa (POPIA): transfers are based on consent, contractual necessity, or equivalent protection in the recipient country
• Singapore (PDPA): transfers are subject to contractual obligations ensuring equivalent protection
• Japan (APPI): transfers to countries not providing equivalent protection require the data subject's consent or binding internal rules
• Other jurisdictions: transfers are conducted in accordance with applicable local data transfer rules (see regional addenda)

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.

10. Security

EXN implements appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include encryption in transit and at rest, access controls, identity management, regular security assessments, and employee training. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority (and, where required, the affected individuals) within the timeframes required by applicable law (72 hours under GDPR, as a reference standard).

11. Your Rights as a Data Subject

Subject to applicable local law, you may have the following rights regarding your personal data. The regional addenda specify any additional or modified rights applicable in your jurisdiction.

Access Request a copy of the personal data we hold about you 
Rectification Request correction of inaccurate or incomplete data
Erasure Request deletion of your data, subject to legal exceptions 
Restriction Request that we limit processing in certain circumstances 
Portability Receive your data in a structured, machine-readable format (EU/GDPR) 
Objection Object to processing based on legitimate interests
Withdraw Consent Withdraw consent at any time without affecting prior lawful processing
Lodge a Complaint File a complaint with the competent supervisory authority in your country

To exercise any of these rights, please contact: dpo@exclusive-networks.com We will respond within 30 days, or within the timeframe required by applicable local law. We may request proof of identity before acting on your request.

12. Regional Privacy Compliance

EXN processes personal data of US, Asian, and African residents in compliance with applicable local legislation, including the California Consumer Privacy Act (CCPA/CPRA), the Telephone Consumer Protection Act (TCPA), and the CAN-SPAM Act in the United States; the Protection of Personal Information Act (POPIA) in South Africa; the Personal Data Protection Act (PDPA) in Singapore; the Act on the Protection of Personal Information (APPI) in Japan; the Personal Information Protection Law (PIPL) in China; and applicable national laws in Nigeria, Kenya, Morocco, and other jurisdictions where EXN operates. Across all these geographies, EXN collects data only for specified purposes with an appropriate lawful basis, requires explicit consent for sensitive data and direct marketing communications, honours individual rights of access, correction, deletion, and opt-out, and ensures that cross-border data transfers are subject to equivalent protections. Where local legislation does not provide a comprehensive data protection framework, EXN applies the principles of this Group Policy as a minimum standard.

13. Cookies & Tracking Technologies

EXN uses cookies and similar tracking technologies on its websites to enable essential functionality, analyse traffic, and support marketing activities. Consent is obtained before any non-essential cookies are placed, in accordance with applicable law (ePrivacy Directive and GDPR for EU/EEA users; PDPA for Singapore users; etc.). For detailed information on the cookies we use, their purpose, and how to manage your preferences, please refer to our Cookie Policy, available on each EXN website footer.

14. Changes to This Policy

We may update this Policy periodically to reflect changes in our practices, the Group's structure, or applicable legal requirements. The updated Policy will be published on our website with a revised effective date. For material changes, we will provide advance notice via email or a prominent notice on our website, where required by applicable law. Your continued use of our services or websites after the effective date of any update constitutes your acknowledgement of the revised Policy.  

15. 🇺🇸 Addendum 1 — United States of America — CCPA/CPRA · FTC Act · CAN-SPAM · TCPA · A2P 10DLC · COPPA · EU-US DPF

Exclusive Networks USA, Inc. (4038 Clipper Court, Fremont, CA 94538) operates in compliance with applicable US federal and state privacy requirements, including the FTC Act, the California Consumer Privacy Act (CCPA) as amended by the CPRA, comprehensive privacy laws enacted by other US states, the CAN-SPAM Act, the Do Not Call rules, the Telephone Consumer Protection Act (TCPA), the Children's Online Privacy Protection Act (COPPA), and the EU-US Data Privacy Framework. The provisions below describe how these obligations apply to individuals whose personal data EXN processes in the United States.

15.1. SMS & Mobile Communications — TCPA & A2P 10DLC

15.1.1. Consent & Opt-In

Exclusive Networks USA, Inc. will only send SMS/text messages to individuals who have explicitly opted in. By providing your mobile phone number and checking the SMS consent box on our forms or event registration pages, you expressly and voluntarily consent to receive messages. Types of messages include:
• Event invitations, reminders, and follow-up communications
• Cybersecurity product and solution updates
• Promotional communications related to EXN services
• Transactional notifications (order confirmations, registration confirmations)

15.1.2. Data Collected for SMS

• Mobile phone number
• Opt-in consent status, date, and source/method
• Message interaction data (delivery status, timestamps, opt-out requests)

15.1.3. No Third-Party Sharing — Mobile Opt-In Data

Mobile opt-in data — including your phone number and consent status — will NOT be sold, rented, or shared with any third party or affiliate for marketing or any other purpose. This exclusion applies regardless of any other sharing provisions in this Policy. We may share this data solely with SMS delivery providers (telecommunications carriers and platform providers) strictly to deliver messages. Such providers are contractually prohibited from using your data for any other purpose.

15.1.4. Opting Out 

Email dpo@exclusive-networks.com to request removal

15.1.5. Consent Records & Retention

Records of SMS opt-in consent are retained for a minimum of 4 years in accordance with TCPA requirements.