We take the protection of your privacy and your data very seriously. Please read this Privacy Policy carefully: it contains important information about who we are, and how and why we collect, process and share your personal data. It also explains what rights you can exercise to keep control of your personal data and how.

Your privacy is important to us!

Talisman Brands, Inc. d/b/a Established., a company incorporated under the laws of the United States of America with an establishment registered in France under the number 91335717400022 and located at 22 rue Chauchat, 75009 Paris, France, acts as the "Data Controller" with respect to the personal data you entrust to us.

This Privacy Policy applies to the personal data we collect on each of our websites, as well as to the personal data of our prospects and clients. We have established this Policy to inform you of our commitments regarding the respect of your privacy and the protection of your personal data in compliance with the French law "Informatique et Libertés" of January 6, 1978 (as amended) applicable in France and the General Data Protection Regulation of April 27, 2016 ("GDPR") valid throughout the European Union (hereinafter together "the Personal Data Regulation").

PROVISION OF SERVICES BY ESTABLISHED.

In the course of providing its services, Established. may collect certain personal data. The personal data we collect is collected for specific purposes and its processing is limited to what is strictly necessary for these purposes. Your personal data will not be used subsequently and for purposes other than those described in this privacy policy. In particular, we do not sell any personal data collected on our websites and we explicitly prohibit anyone from using them for commercial purposes.

Why and how do we collect personal data?

The personal data collected by Established is processed in accordance with the principles of the RGPD: principles of purpose, proportionality, relevance, minimization, limitation, and for defined retention periods, according to technical and organizational modalities ensuring their security and confidentiality.

We collect your personal data directly from you when you log on to our websites and/or if you contact us via the contact forms available on our websites.

In addition, we also collect some of your personal data (identification and contact data) indirectly from our partners, where you have given your consent. Under the Personal Data Regulation, we may only use and retain your personal data if we have a valid reason to do so: to comply with our legal and/or regulatory obligations, for the performance of a contract with you, or where you have given us your consent; processing may also be based on our legitimate interest where we have a business reason to use your personal data, provided that your own rights and interests do not override this.

As a general rule, Established does not collect any sensitive data about you.

PROTECT YOUR INFORMATION

The security of the personal data we collect about you is one of our highest priorities.

Our employees access your personal information in accordance with their security clearance. Your personal data is only accessible to the teams involved in the relevant departments (marketing, sales, IT, HR, security, finance, and any subcontractors working with these departments). Our employees are trained to understand and respect the principles of data protection.

We protect information in accordance with established security standards and procedures and we continually evaluate new data protection technologies.

Established. implements adequate organizational and technical measures to protect your Personal Data against loss, theft, unauthorized access, use and modification.

How and why may your personal data be shared ?

Your personal data is collected and stored for a limited period of time which is necessary for the purpose of the processing (see below).

We limit the number of persons, internally by our collaborators and externally by our sucontractors, who access, receive and/or process your personal data and the type of personal data that is shared to the extent necessary to accomplish the identified purposes.

We ensure that our employees and our subcontractors respect our commitment to the protection of your personal data.

As part of the claims management service, we may share your personal data with our business partners or licensees solely to respond to your request.

How long is your personal information kept?

We may retain your personal data for as long as is reasonably necessary to fulfill the purposes for which Established. collected it, as stated above, in compliance with the Personal Data Regulation.

The criteria we use to determine the retention periods for your personal data include the following:

• retention in case of inquiries - for example, when you contact us to receive further information - about how we process your data;
• retention for the period during which you can legally bring an action against us;
• retention in accordance with legal, tax and regulatory requirements - after your relationship with us has ended; and
• to keep in touch with you about your needs for as long as you have agreed to receive solicitations from us.

If you give us permission, we will retain your recruitment data for a period of 2 years in order to contact you for further opportunities.

Please note that we reserve the right to retain certain information for our own records (for example, to ensure that you do not receive marketing communications that you have chosen not to receive) and to defend against any claims.

YOUR RIGHTS AND CHOICES

You have the opportunity to express your preferences regarding the use and disclosure of your personal information. You may be given this opportunity when you register on our websites, subscribe to our newsletters, or fill out a form (if any of these options apply). Although the specific preferences offered may vary from one region of the world to another due to local legislation and/or practices, Established. aims to respect the preferences of its customers and prospects. Your trust in us depends on it.

What are your rights ?

Under the Personal Data Regulation, you have the following rights:

• If our processing of your personal data is based on your consent and you have given it, you have the right to withdraw your consent at any time (art. 7(3) GDPR).
• The right to request access to your personal data (art. 15 GDPR), to find out whether we hold personal data about you and to receive a copy of the information we hold about you - no fee will be charged, except in the case of manifestly unfounded or excessive requests;
• The right to request a rectification or amendment of all or part of the personal data held by us (art. 16 GDPR), to ensure that it is accurate and up to date;
• The right to request the erasure of your personal data (art. 17 RGPD), and therefore their deletion, subject to our retention obligations in the context of our contractual relations and/or to comply with certain tax or accounting laws;
• The right to request a restriction of processing (art. 18 GDPR);
• The right to portability of your personal data (art. 20 GDPR), allowing you to ask us, where possible, to transfer your information to a third party and/or to obtain it yourself;
• The right to object to processing (Art. 21 GDPR): you can ask us to stop processing your personal data if the legal basis for this request is our legitimate interest or your consent.

How to exercise your rights?

To exercise any of your rights above, or any other similar rights that your local regulations may grant you, please contact us by following the contact instructions at the end of this Privacy Policy.

As the exercise of rights is personal, we as data controller are required to verify the identity of the person making a request before fulfilling it. In order to do so, all requests must:

• Provide sufficient information to allow us to reasonably verify that you are the data subject, i.e., about whom we have collected personal data, or a duly authorized representative;

• Describe your request in sufficient detail to enable us to understand, evaluate and respond to it.

We strive to respond within 30 days of receiving a verifiable request. We reserve the right to extend this time period and, if necessary, to request that you provide us with supporting documentation (e.g., identification that will be destroyed once verification is complete).

We do not charge a fee for processing or responding to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why and provide you with an estimate of the cost before processing your request.

What is the supervisory authority?

You have the right to file a complaint with the competent data protection authority:

- the lead supervisory authority designated by Established is the French supervisory authority: the CNIL (https://www.cnil.fr/en/contact-cnil)

- or the competent authority of your place of work or residence.

GENERAL PROVISIONS

Cookies

Established. may use cookies on its websites to facilitate your navigation and to analyze your use of the site. Each website must provide information to better understand how cookies work and to use the tools available to configure them. To learn more about the cookies placed on our site, click here [link to Cookie Policy].

Revisions

We reserve the right to change this Privacy Policy at our discretion and at any time.

When we make changes to this Policy, we will post the updated policy on the website and update the effective date. Your continued use of our website following the posting of changes constitutes your acceptance of those changes.

• Effective date: June 1st, 2022.

• Last review and amendment : December 22, 2022.

CONTACT

Exercise of rights

Requests to exercise your rights, or any questions regarding our Privacy Policy, may be addressed to:

• By email: privacy@established.inc

• By mail:

Talisman Brand Inc.
22 rue Chauchat
75009 PARIS - FRANCE

Security – data breaches

Any suspected data breach or security issue can be reported:

• By mail:

Talisman Brand Inc.
22 rue Chauchat
75009 PARIS - FRANCE