Privacy Policy: Heropolis App

At Heropolis, protecting your personal data is a priority.

When you use the Heropolis mobile app (hereinafter the “App”), we collect personal data about you.

The purpose of this policy is to inform you about how we process this data in accordance with Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).

01. Who is the data controller?

The data controller is HEROPOLIS, a simplified joint-stock company (SAC), registered with the Pontoise Trade and Companies Register under No. 840 822 993, with its principal place of business located at 10 Allée de la Paix, 95320 Saint-Leu-la-Forêt (hereinafter “We”).

02. What data do we collect?

The Solution is a platform designed for authorities responsible for public safety and peace in a given area or for providing public services. It enables representatives of these authorities (e.g., municipal police officers, lone workers, authorized personnel) to send geolocated alerts with additional information (location, classification, chat messages, ambient sound, device movement, images, video) via a mobile app.

The alert management platform is based on three distinct processes:

managing the sending and receiving of alerts via a mobile alert app ;
managing users (responders and alert senders) and alerts received through the Heropolis app to enable emergency responders to take action and/or record information about these alerts via the web-based monitoring interface ;
an exchange of information in connection with alerts issued via the Heropolis app to enable emergency responders to take action and/or to record information about these alerts via chat.

The platform distinguishes access rights to these various applications based on four roles:

platform administrator (access to the web-based monitoring interface) ;
supervisor (access to the web-based monitoring interface) ;
responder (access to the mobile alert app) ;
transmitter (access to the mobile alert app).

03. What is the purpose of the data collected?

The Data Controller determines the purpose(s) for which the data is processed. Unless otherwise specified in the Data Controller’s Information Document, these purposes are generally as follows: :

Mobile App: Alert Management in the Solution — Enabling Emergency Response.
Web Monitoring Interface: User and Alert Management — Enable Actions in Response to Alerts.
Chat: Information Exchange — Enable the implementation of actions in response to alerts.

Treatment	Purpose	Legitimacy
Mobile app (alert management within the solution)	Alert Management	Enabling emergency responders to intervene, recording information
Web-Based Monitoring Interface	User and Alert Management	Enable actions in response to alerts (e.g., sending emergency assistance)
Chat	Information exchange to support alert management	Enable the implementation of actions in response to alerts

04. What is the legal basis for the processing?

The legal basis for processing is determined by the Data Controller, depending on the purpose for which it uses the Solution. Unless otherwise specified in the Data Controller’s Information Document, this legal basis is, in principle, one or the other of the following :

The processing is necessary to comply with aa legal obligation to which the Data Controller is subject.
Processing is necessary for the protection ofto protect the vital interests of the individual concerned or of another natural person.
The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.

Data	Recipients	Durations
Location Alert	Administrator	30 days after the end of the alert
Location	Supervisor	Duration of the alert
Location	Committed Speakers	Duration of the alert
Location	Supervisor and Stakeholders	Duration of the alert
Speaker's Location	Supervisor / Administrator	30 days after the end of the alert
Location	Committed Speakers	Duration of the alert
Location	Supervisor / Administrator	Duration of the alert
Location	Committed Speakers	Duration of the alert
Chat related to the alert (text + photos + document)	Supervisor	30 days after the end of the alert
Chat related to the alert	Broadcasters and Contributors	Duration of the alert
Discreet photos, Audio recording	Administrator	30 days after the end of the alert
Identification data: user email address, last name, first name	Administrator	Account Active Period
Environmental Data	Supervisor / Administrator	Durée de l'alerte (< 24h)
Sender's profile photo (if provided)	Administrator	Account active period. Deletion is possible.
Speaker's profile photo (if provided)	Supervisor / Administrator	Account active period. Deletion is possible.
Discreet Streaming	Supervisor (upon request)	No storage
Identity: last name / first name (if provided)	Administrator / Supervisor	Account Active Period

05. Other Recipients of the Data

Without prejudice to other recipients to whom the Data Controller may disclose your data, we, for our part, disclose it to our own processors for the purpose of implementing the Solution :

Our Accommodation Providers ;
Service providers that enable the sending of notifications to smartphones, text messages, and emails ;
The service provider that enables video streamingéo.

6. Is there a possibility that your data will be transferred outside the European Union?

Your data is retained and stored on the servers for the entire duration of the processing owned by OVH, located in France.

As part of the tools we use (see the article on recipients regarding our subcontractors), your data may be processedthe subject of transfers outside the European Union. The transfer of your data to cThis framework is secured using the following tools :

either the data is transcarried out in a country that has been the subject of an adequacy decision of the European Commission, in accordance with Article 45 of the GDPR: in this case, that country ensures a level of protection deemed sufficient and adequate under the provisions of the GDPR ;
either the data is transferred to a country whose level of data protection has not been recognized as adequate under the GDPR : In such cases, these transfers are based on appropriate safeguards as set forth in Article 46 of the GDPR, tailored to each specificstataire, including, but not limited to, the conclusion of standard contractual clauses that applyfound by theEuropean Commission, the enforcement of business rulesbinding regulations or under an approved certification mechanismé ;
either the data is transferred based on one of the appropriate safeguards described in Chapter V of the GDPR.

7. What are your rights regarding your data?

You have the following rights regarding your personal data :

Right to Informationion: That is precisely why we have drafted this policy. This right is provided for in Articles 13 and 14 of the GDPR.
Right of access: You have the right to access all of your personal data at any time, pursuant to Article 15 of the GDPR.
Right to rectification: You have the right to correct your inaccurate or incomplete personal data at any time, ou obsolete in accordance with Article 16 of the GDPR.
Right to restriction: You have the right toto have the processing of your personal data restricted in certain cases specified in Article 18 of the GDPR.
Right to erasure: You have the right to request that your personal data be deleted, and to prohibit any future collection of such data for the reasons set forth in Article 17 of the GDPR.
Law to introduceFile a complaint with a competent supervisory authority (in France, the CNIL), if you believe that the processing of your personal data constitutes a violation of applicable laws (Article 77 of the GDPR).
Right to D efining Guidelines regarding the retention, deletion, and disclosure of your personal data after your death, in accordance with Article 40-1 of the Data Protection Act.
Right to withdraw your consent at any time: For purposes based on consent, ArticleArticle 7 of the GDPR states that you may withdraw your consent at any time. This withdrawal does not affectThe legality of the processing carried out prior to the withdrawal is not in question.
Right to data portability: Under certain conditions specified in Article 20 of the GDPR, you have the right to receive the doPersonal data that you have provided to us in a standard, readable formatby machine and require their transto the recipient of your choice.
Right to object: eUnder Article 21 of the GDPR, you have the right to object to the processing of your personal datas. Please note, however, that we may continue to process their data despite this objection, for legitimate reasonsimes or the defense of rights in courtjustice.

You can exercise these rights by writing to us at the address listed below. At that time, we may ask you to provide us with additional information or documents to verify your identity.

8. What cookies do we use?

To learn more about how we handle cookies, please see our Cookie Policy.

9. Contact Point for Personal Data Matters

Contact email: dataprivacy@heropolis.fr
Contact address: 10 Allée de la paix, 95320 Saint-Leu-la-Forêt

10. Changes

We may modify this policy at any time, in particular to comply with any regulatory, legal, editorial, or technical changes.. These amendments will take effect on the effective date of the amended version. We therefore encourage you to review the latest version of this policy on a regular basis. However, we will keep you informed of any significant changes to this privacy policy.

Effective Date: November 1, 2021