AGORIZE PRIVACY AND COOKIE POLICY

Agorize SAS, Agorize Singapore Pte. Ltd. and Agorize Japan K.K. (together “Agorize”, “we”, “us” or “our”) are committed to protecting your personal data. This privacy policy describes how we collect, use, share and protect your personal information, in accordance with the General Data Protection Regulation (GDPR), the Singapore Personal Data Protection Act 2012 (PDPA), the Japanese Act on the Protection of Personal Information (APPI) and other applicable laws.

1. Scope of this policy

This policy applies to the personal data we collect when you:

visit our website;
interact with us via forms, emails or calls;
use our services on a platform or take part in our challenges;
apply for a job at Agorize;
work with us as a supplier or partner.

This policy does not apply to data we process on behalf of our clients as a processor.

2. Who are we?

This policy applies to the following entities of the Agorize group:

Agorize SAS, a simplified joint-stock company (société par actions simplifiée) incorporated under French law, with its registered office at 10 Rue Mabillon, 75006 Paris, France;
Agorize Singapore Pte. Ltd., a private company limited by shares incorporated in Singapore (UEN: 201905145W), with its registered office at 135 Cecil Street, #10-01, Philippine Airlines Building, Singapore 069536;
Agorize Japan K.K., a kabushiki kaisha incorporated in Japan, with its registered office at Akasaka Intercity 5F, 1-11-44 Akasaka, Minato-ku, Tokyo 107-0052, Japan.

The entity responsible for processing your personal data (the “controller”) is the Agorize entity with which you interact, contract or apply for a position. Where several Agorize entities jointly determine the purposes and means of a processing activity, they act as joint controllers.

For any question about this policy or your personal data, you can contact us at: [email protected].

3. Personal data we collect

We collect personal data in the following cases:

A- Prospects or clients

1. Personal data we collect

We collect the following categories of personal data when you interact with our services or our website:

Identification data: depending on your interaction with us, we may collect your name, your business email address, your phone number and your postal or billing address.
Professional data: depending on your interaction with us, we may collect your job title, your company name and any information you choose to provide during your exchanges with our team (demo requests, contact forms, event attendance, etc.).

2. Personal data we collect from other sources

We may also obtain information about you from third-party sources, including:

LinkedIn: used to research prospects and analyze advertising engagement on the platform. To learn more, please refer to LinkedIn's privacy policy.
Other Agorize clients or employees: they may provide us with your business contact details as part of a referral or to initiate a business relationship.

3. Use of personal data

We use the personal data collected from prospects and clients for the following purposes:

Purpose: Client relationship and prospecting management, including customer support, commercial communications, prospect and contract management, invoicing, satisfaction surveys, and the organization of business meetings or demonstrations.
Legal basis: Agorize's legitimate interest in providing the requested information, developing its business relationship with prospects and ensuring quality follow-up with its clients.
Retention period:
- If you are a client:
  - General data: 5 years after the end of the contract.
  - Recordings of phone calls or meetings: 6 months.
  - Chatbot conversations: 2 years.
  - Invoicing documents: 10 years from the date of issue.
- If you are a prospect:
  - Data retained for up to 5 years after your last active contact (e.g. replying to an email or booking a meeting).

4. Sharing of personal data

We do not sell your personal data and we do not pass it on to third parties for commercial purposes. However, we may share your personal data in the following cases:

Suppliers and processors: We share certain data with service providers who assist us in our operations (e.g. customer management tools, hosting services, ticketing platforms). These providers act on Agorize's instructions and process your data solely in the context of the services they provide to us.
Transfers in the event of structural change: Your data may be shared in the context of operations such as a merger, acquisition, restructuring, insolvency proceedings or sale of assets. In that case, the data will be transferred to the successor or the entity concerned by the operation.
Legal obligations: We may disclose your personal data if required by law or if necessary to:
- comply with a legal or regulatory obligation,
- protect or defend our rights or property,
- prevent fraud,
- ensure the safety of the users of our services or of the public,
- or protect ourselves against any legal liability.

5. Data transfers

When we use certain third-party services (in particular SaaS tools), your personal data may be transferred to countries outside the European Union, including the United States.

These transfers may involve the following providers:

Dropbox Sign (United States)

When such transfers take place, we ensure they are governed by appropriate safeguards, in accordance with the General Data Protection Regulation (GDPR), such as:

the signing of standard contractual clauses approved by the European Commission;
or any other safeguard compliant with applicable law.

B- Platform users

1. Personal data we collect

We collect the following categories of personal data when you create an account and use our platform:

Identification data: last name, first name, email address, password (encrypted), profile picture (optional).
Professional data: job title, company name, industry, skills.
Activity data: submitted projects, messages sent, comments, votes, interactions on the platform.
Connection data: IP address, browser type, log data, browser language, time zone.

2. Personal data we collect from other sources

In some cases, you may sign up or log in to the platform using a third-party account (e.g. LinkedIn, Google). In that case, we collect the following data from these services:

Public profile information (name, email address, picture, employer) according to the permissions you have granted to the third-party service.

Please refer to the privacy policies of these services for more information on how they process your data.

3. Use of personal data

We use platform users' personal data for the following purposes:

Purpose: Providing and managing access to the platform, participation in challenges or projects, communication between users, personalization of the user experience, technical support.
Legal basis: Performance of the contract (platform terms of use), legitimate interest in ensuring the security and quality of the service.
Retention period:
- Challenge-related data: retained for 3 years after the challenge closes, unless the organizer specifically requests otherwise.
- Connection logs: 6 months.

4. Sharing of personal data

We may share your personal data in the following cases:

With challenge organizers: when you take part in a challenge, your profile data and deliverables are accessible to the organizers, who act as independent controllers for their own purposes (evaluation, recruitment, partnership…).
Technical providers: platform hosting, messaging tools, user account management.
Other users: certain information (name, picture, biography, skills) may be visible to other users in the context of participating in a project or a public interaction on the platform.
Legal obligations or restructuring operations: as detailed in the previous section.

5. Data transfers

The technical services used to operate the platform may involve data transfers outside the European Union, in particular to the United States.

Examples of providers involved:

Amazon Web Services (hosting, processing country may vary)
Mailchimp (email notifications, EU or non-EU depending on location)

These transfers are governed by:

standard contractual clauses (Standard Contractual Clauses – SCC),
or other safeguards recognized by the GDPR, such as certifications or adequacy decisions.

C- Job applicants at Agorize

1. Personal data we collect

When you apply for a job at Agorize, we collect the following data:

Identification data: last name, first name, email address, phone number.
Professional data: resume, cover letter, position applied for, work experience, education, skills, languages spoken, salary expectations, availability.
Additional data: any information you choose to share with us as part of your application (e.g. portfolios, links to social profiles, supporting documents).

2. Personal data we collect from other sources

We may obtain additional information about you from third-party sources in the following cases:

Internal referrals: an Agorize employee or contact may pass on your details to us as part of a referral.
Third-party platforms: if you apply through a recruitment platform (Welcome to the Jungle, LinkedIn Jobs, Indeed, etc.), we will receive the information you have published there.
Professional social networks: when searching for profiles, we may consult publicly available information on LinkedIn.

3. Use of personal data

We use applicants' personal data for the following purposes:

Purpose: managing applications, organizing interviews, assessing skills and fit for the position, tracking the recruitment process, getting in touch.
Legal basis: performance of pre-contractual measures at the applicant's request; Agorize's legitimate interest in building a team suited to its needs; consent when you agree to be contacted about future opportunities.
Retention period:
- If your application is not successful: your data is retained for 2 years after the last contact, unless you object.
- If you are hired: your application data is added to your HR file and becomes subject to the employee data management policy.

4. Sharing of personal data

Your data may be shared with:

HR providers: applicant tracking solutions (e.g. ATS), technical tests, video conferencing platforms for interviews.
Managers and internal teams: the people involved in the recruitment have access to your application in order to assess your profile.
Competent authorities: only where required by law or in the context of legal proceedings.

None of your application data is passed on to third parties for commercial purposes.

5. Data transfers

Some platforms used in the recruitment process may involve transfers outside the European Union.

For example:

Workable or Lever (ATS),
Zoom, Google Meet (video conferencing).

These transfers are governed by:

standard contractual clauses,
or an adequacy decision issued by the European Commission,
or any other GDPR-compliant safeguard.

D- Suppliers or business partners

1. Personal data we collect

When you work with Agorize as a supplier or partner, we collect the following personal data:

Identification data: last name, first name, business email address, business phone number.
Professional data: job title, company name, department, geographic area.
Contractual data: information contained in contracts (e.g. signatory, main contact), terms of collaboration, correspondence related to the services.
Billing data: business bank details, billing address, VAT number.

2. Personal data we collect from other sources

Internal referrals or existing clients: employees or contacts may recommend a provider to us by passing on business contact details.
Public directories or professional websites: we may collect publicly available data (e.g. website, LinkedIn) in order to make first contact or verify certain information.

3. Use of personal data

We use this data in the following context:

Purpose: managing the contractual relationship with suppliers or partners, entering into and performing contracts, operational exchanges, monitoring the quality of services, managing invoicing.
Legal basis: performance of a contract or pre-contractual measures; Agorize's legitimate interest in ensuring the smooth running of its operations.
Retention period:
- Contractual and operational data: 5 years after the end of the contract.
- Billing data: 10 years from the invoice date, in compliance with accounting obligations.

4. Sharing of personal data

Your data may be shared with:

Internal teams: legal, procurement, finance and the relevant operational teams.
Third-party providers: contract management, accounting and electronic signature tools.
Administrative authorities: upon request or where legally required (e.g. tax audit, accounting verification).

The data is never shared for advertising or commercial prospecting purposes.

5. Data transfers

Some tools used to manage partners may be hosted outside the European Union. These include:

Docusign (contract signing)
Quickbooks, Xero (invoicing)
Google Workspace, Microsoft 365 (document exchange)

These transfers are governed by standard contractual clauses or other appropriate safeguards approved under European regulations.

E- Website visitors

1. Personal data we collect

When you browse our website https://agorize.com, we automatically collect certain data, and further data if you fill in a form or actively interact with the site:

Technical browsing data: IP address, browser type and version, operating system, pages viewed, visit duration, links clicked, language, time zone.
Form data: last name, first name, email address, company, job title, phone number if you complete a contact form, an event registration form or a newsletter sign-up.

This data may be collected using cookies or tracking tools embedded in our website.

2. Personal data we collect from other sources

We may also receive data indirectly through:

Advertising platforms (e.g. LinkedIn Ads, Google Ads): we obtain engagement statistics and, where applicable, data associated with your browsing or conversion behavior if you have interacted with a targeted ad.
Marketing enrichment solutions: these may associate an IP address or a business domain with a company or industry for lead qualification purposes.

3. Use of personal data

We use website visitors' data for the following purposes:

Purpose: providing access to the site, ensuring its proper functioning and security, measuring audience, improving the user experience, qualifying prospects, responding to requests submitted via contact or registration forms.
Legal basis: legitimate interest (site operation, audience measurement), performance of pre-contractual measures (contact form), consent (placement of non-essential cookies).
Retention period:
- Data collected via technical cookies: 13 months maximum.
- Form data: 2 years after the last contact.
- Technical logs and security logs: 6 months.

4. Sharing of personal data

The data collected may be shared with:

Technical providers: website hosting, maintenance and security services.
Marketing tools: tracking, audience analytics, email automation and CRM solutions (for example Hubspot, Google Analytics, LinkedIn Ads).
Competent authorities: only where legally required or upon a justified request (cybersecurity, fraud).

No sharing for resale or commercial exploitation by non-partner third parties.

5. Data transfers

The use of marketing or analytics tools may involve data transfers outside the European Union, in particular to:

Google LLC (Google Analytics, Google Ads – United States)
LinkedIn Corporation (LinkedIn Ads – United States)
Hubspot Inc. (CRM and forms – United States)

4. Sharing of your personal data

We may share your personal data with:

the other entities of the Agorize group (Agorize SAS, Agorize Singapore Pte. Ltd. and Agorize Japan K.K.), for internal administrative purposes, to provide our services or to manage our business relationship with you;
our service providers and business partners, to the extent necessary to provide our services;
the competent authorities, where required by law or to protect our rights.

We do not sell your personal data to third parties.

5. International data transfers

Your personal data may be transferred to and stored outside the European Economic Area (EEA). In that case, we ensure that appropriate safeguards are in place to protect your data, in accordance with applicable laws.

As the Agorize group operates in France, Singapore and Japan, your personal data may be transferred between these countries. Transfers from the EEA to Japan rely on the adequacy decision adopted by the European Commission. Transfers from the EEA to Singapore are governed by standard contractual clauses approved by the European Commission, entered into between Agorize SAS and Agorize Singapore Pte. Ltd. Transfers out of Singapore and Japan are carried out in accordance with the requirements of the PDPA and the APPI respectively.

6. Retention of your data

We retain your personal data for as long as necessary to achieve the purposes described in this policy, unless the law requires a longer retention period. The criteria used to determine our retention periods include:

the length of our relationship with you;
legal data retention obligations;
the need to retain data to resolve disputes or enforce our agreements.

7. Security of your data

We implement appropriate technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, disclosure, alteration or destruction.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

right of access;
right to rectification;
right to erasure;
right to restriction of processing;
right to data portability;
right to object.

If you are located in Singapore or Japan, you also benefit from the rights granted by the PDPA or the APPI, including the right to access and correct your personal data and to withdraw your consent. To contact the Data Protection Officer of Agorize Singapore Pte. Ltd., please write to [email protected].

To exercise these rights, please contact us at [email protected].

9. Cookies and similar technologies

We use cookies and similar technologies to improve your experience on our site, analyze traffic and personalize content.

Types of cookies

We use the following types of cookies:

Session cookies for site management. When you access the site, a “token” cookie containing a unique encrypted session identification code is sent to your computer. This token then controls your access to the site for that session, and it is deleted as soon as you close your browser or log out of the site. These cookies also allow us to identify your device and your preferences when you return to our website, including personalized features, language and regional preferences. These cookies are an essential part of the site delivery system, and you will not be able to fully use our site if they are not enabled. [The information collected by these cookies is anonymous and is used solely to improve your experience on our website.]
Persistent cookies for site management. If you register on the site and select the “Remember me” option, a persistent cookie is sent to your computer. This cookie is not deleted when you leave the site or close your browser, but is stored on your computer. This cookie contains an encrypted user identification code that identifies your computer on future visits and logs you in to the site automatically. It is a functional cookie, designed to remember your preferences in order to improve your experience on our site. [It does not contain any personal information that could be used to identify you.]
Analytics cookies. We use Google Analytics and Hotjar to monitor traffic on our site. When you visit our site, these programs place certain cookies that record statistical information about your visits to the site. We measure the number of visits, the number of pages viewed, visitor activity on the site and how often visitors return. This allows us to improve our website and how it works, for example by ensuring intuitive navigation for users. These cookies do not record any personal information that could be used to identify you.
Which cookies are placed?

Cookies placed by Agorize:

Cookie	Description	Opt-out option	Duration
_agorize_session	Contains information about the browsing session and allows the user to access the site		Expires at the end of the session.
cookies_policy_accepted	Records a user's choice regarding cookies		13 months
hide_profile_incomplete	Helps users fill in their information on the website<		13 months

Third-party cookies :

Cookie	Description	Opt-out option	Duration
Google analytics:
_gid	Used to distinguish users.	Google Analytics	24 hours
_gat	Used to throttle the request rate	Google Analytics	1 minute
_ga	Used to distinguish users.	Google Analytics	13 months
Hotjar
_hjIncludedInSample	Session cookie that lets Hotjar know whether a user is included in the sample used to generate statistics.	Hotjar	365 days

How to delete cookies, be notified when they are placed or configure your browser?

Deleting cookies already placed on your computer.

You can delete cookies already placed on your computer by clearing your browser cache. To learn more about how to delete cookies in Chrome, Firefox, Safari, Opera and Internet Explorer, click here.

Configuring your browser to refuse cookies or be notified when cookies are placed.

All web browsers let you set your cookie preferences before browsing the Internet. To learn more about how to configure your web browser to refuse cookies or be notified when cookies are placed, click here.

For any question about our Cookie Policy, please send us an email at [email protected].

10. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We encourage you to review this page regularly to stay informed of any changes.