Dataventure Group Privacy Policy

Online publication 20/07/26.

Welcome to our Privacy Policy. This document is intended to inform you about the processing of your personal data on the websites and media published or operated by the companies of the DATAVENTUREgroup (the “Site”). Through this Privacy Policy, we want you to understand the nature of the personal information we collect, how we use it, with whom we share it, how we strive to protect it, how you can exercise your rights and how to contact us. This document also serves to provide you with all the information required by Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”). Finally, please note that we may make changes to this document, in particular to bring it into line with any new regulation or to adapt it to our practices.

The Site is published by DATAVENTURE GROUP, a French simplified joint-stock company (société par actions simplifiée) with share capital of €3,746,032.20, registered with the Nanterre Trade and Companies Register under number 913 824 462, whose registered office is located at 10b Rue Escudier – 92100 Boulogne-Billancourt (“DATAVENTURE GROUP”, “we”,“us”).

This Privacy Policy is common to all the companies of the DATAVENTURE group. As the group is not, as such, a legalentity, it is not a data controller. For each processing operation described below, the data controller is the DATAVENTURE group company that determines the purposes and means of that processing. Where several group companies jointly determine those purposes and means, they act as joint controllers within the meaning of Article 26 of the GDPR and set out their respective obligations by agreement, the essential elements of which are made available to you on request.

Group companies concerned. The DATAVENTURE group companies covered by this Policy are:
- Car Data (a French public limited company / société anonyme with share capital of €744,259, whose registered office is located at 10 B rue Escudier – 92100 Boulogne-Billancourt, registered with the Nanterre Trade and Companies Register under No. 500 942 990);
- Adventure Conseil (a French simplified joint-stock company / société par actions simplifiée with share capital of €31,030, whose registered office is located at 10 bis rue Escudier – 92100 Boulogne-Billancourt, registered with the Nanterre Trade and Companies Register under No. 793 819 673);
- Dataventure Global SL (a company incorporated under Spanish law, whose registered office is located at Passeig de Gràcia 77, 2nd floor, 08008 Barcelona, registered with the Barcelona Trade Register under tax ID (NIF) B67239806).

The partner advertisers referred to, where applicable, within the forms or on the Site may also act as data controllers if (i) you expressly agree that they receive your data so that they can send you their newsletters and/or commercial offers, or (ii) they receive your data following a request concerning them when you submit a form (e.g. a creditapplication – with a credit proposal sent by our partners).

The concept of “personal data” refers to any information relating to an identified or identifiable natural person. In accordance with the data minimisation principle, we ensure that we collect onlythe personal data strictly necessary for the purposes of the processing carriedout.

When you browse the Site and depending on youractions, we may collect personal data concerning you: your browsing data suchas your IP address and other technical information made available by yourdevice or browser. This data may be collected as soon as you arrive on the Site or after we have obtained your consent. Statistical data may be collected during your visit (e.g. number of pages viewed, number of visits, etc.). For more information on the data collected via cookies, please refer to the “Cookies” section of this Privacy Policy.

The Site provides you with various forms through which you may, for example, book a test drive, obtain a discount on a vehicle, obtain credit or vehicle trade-in offers, etc. To access these services, you will need to provide us with information and personal data concerning you. This may include: identification data (surname, first name, title, date of birth, etc.), contact data (email address, telephone number, postal address, etc.), data concerning your personal life (family situation, dependent children, etc.), data concerning your project in connection with the relevant form, and data concerning your financial situation where applicable (expenses, income, etc.). The fields to be completed on the forms are mandatory for your request to be processed.

The Site also allows you to use a contact form addressed to our teams (identification and contact data, and data related to your request), as well as to post a review (title, surname, first name, postal code, email, subject and content of the review). This data is provided directly by you.

When you interact with the AI agent (voice or chat) in connection with a vehicle test-drive request, and with your consent, DATAVENTURE processes your exchange in order to qualify your request and forward it to the relevant dealership. If you indicate that you are available immediately, your data will be transferred to a call centre operated by the dealership, which will call you back. Your exchange is recorded for the purpose of improving our services, on the basis of our legitimate interest. You are informed when you are interacting with an automated conversational agent. The data collected consists of identification data (surname, first name), contact data (email, telephone number, postal code, city) and data qualifying your project (desired vehicle, dealership or point-of-sale preferences).

Minors

Our services and forms are reserved for adults (aged 18 or over). Where a form asks for your date of birth or age, this information is self-declared: we rely on the accuracy of the information you provide and do not carry out any systematic age verification. We do not knowingly collect data concerning minors; if you believe that a minor has provided us with data, please contact us so that we can delete it.

The purposes and legal bases of the personal data processing carried out on the Site are as follows:

Action 1 – When you browse the Site.
‍Purposes: see the “Cookies” section. Legal basis: your consent or our legitimate interest, as applicable.

Action 2 – When you use a data collection form.
Purposes: to process and respond to your request according to the purpose of the relevant form. Legal basis: our legitimate interest in facilitating your access to services and in connecting you with our partner advertisers; performance of pre-contractual measures with the relevant partner advertisers. The applicable legal basis depends on the purpose of each form: depending on the case, it may be the performance of the contract or of pre-contractual measures, our legitimate interest, or your consent (in particular where the form allows you to consent to receiving commercial prospecting communications).

Action 3 – When you consent to receive our commercial offers, those of the DATAVENTURE group or those of our partner advertisers.
‍Purposes: to send you offers, news or promotional content likely to be of interest to you. Legal basis: your consent.

Action 4 – When you wish to contact us.
Purposes: to take into account, process and respond to your contact request. Legal basis: our legitimate interest in providing you with an effective means of contact.

Action 5 – When you wish to post a review on the Site. Purposes: to assess the quality of your reviews, publish them and make them accessible to other users. Legal basis: our legitimate interest.

Action 6 – When you interact with the AI agent (voice or chat) in connection with a vehicle test-drive request. Purposes: to process and forward your test-drive request to the brand and its dealership network, including, where applicable, to the dealership's call centre; recording of the exchange for the purpose of improving our services. Legal basis: your consent.

Action 7 – Profiling and automated decision-making. As part of qualifying your requests and combating fraud, we may carry out profiling operations (lead qualification and scoring, fraud detection). Depending on the case, this processing is based on our legitimate interest or on your consent. It does not give rise to any decision producing legal effects concerning you or similarly significantly affecting you and based solely on automated processing within the meaning of Article 22 of the GDPR, as human intervention takes place in the handling of your request.

Action 8 – Collection on behalf of partner advertisers (co-sponsoring, co-registration, dedicated landing pages). Purposes: to collect your request or your lead on our sites or on partner publishers' sites, and then forward it to the relevant partner advertiser in order to process your request and/or send you its commercial prospecting communications. Legal basis: your consent for commercial prospecting; the performance of pre-contractual measures or our legitimate interest for the connection.

Action 9 – Building and renting B2B prospecting files. Purposes: to build a database of business contacts and rent it to advertisers for business-to-business commercial prospecting purposes. Legal basis: our legitimate interest, in compliance with the rules applicable to B2B prospecting.

Action 10 – Data enrichment and qualification.
Purposes: to complete and enhance the reliability of your profile (self-declared data and data from partner sources) in order to improve the relevance of solicitations and connections. Legal basis: our legitimate interest, unless your consent is required.

Action 11 – Telephone call-backs and call recording. Purposes: as part of certain campaigns (in particular white-label campaigns), you may be called back by telephone, by an adviser within a call centre or by an automated conversational agent (voicebot), in order to qualify your request and then, where applicable, to connect you with the relevant partner advertiser. When you interact with an automated conversational agent, you are informed of this at the start of the call. These calls may be recorded for service improvement and quality purposes. Legal bases: your consent for the call-back for qualification and prospecting purposes; our legitimate interest for the recording, which you may object to at any time during the call (in the event of an objection, no recording is kept); the performance of pre-contractual measures where a connection is made at your request. Prospecting calls are screened against the Bloctel list under the conditions set out in Article 6.

The advertising activities carried out by DATAVENTURE GROUP and the sponsors of the operations published on the Site may be conducted through the following channels: email, postal mail, telephone calls, SMS and/or MMS messages, or any similar means of communication. Finally, your data may also be processed to carry out corrective and/or adaptive maintenance of the Site (legitimate interest in ensuring its proper functioning and security), to respond to your requests to exercise your rights and, where applicable, to demonstrate compliance with our legal and regulatory obligations (legal obligations).

Internal recipients. Your data is accessed only by the teams whose duties require such access. Access-rights management is implemented internally in accordance with the least-privilege principle.

Processor recipients. Your data may be transferred to, or accessed by, processors where necessary for the performance of their assignments. DATAVENTURE GROUP's processors include, in particular: Scaleway (France, hosting/cloud, including the Matomo audience-measurement tool), OVH (France, hosting/cloud), Infomaniak (Switzerland, hosting/cloud), Hetzner (Germany, hosting/cloud), Cloudflare, Inc. (United States, DNS cloud services); DoctorSender (Spain), CM Telecom France (France), Spot-Hit / Link Mobility (France), High Connexion (France), Webmecanik (France) for message routing; Anthropic (United States), OpenAI (United States), Mistral AI (France), ElevenLabs, Inc. (United States) for artificial intelligence and voicebot operation; Google Cloud (United States), Microsoft Azure (United States) for cloud services and APIs; Respawn SAS (France, managed IT services), Okube / Smart Traffik (France, traffic measurement), 76310 SAS (France, data-quality checks for postal campaigns), Consoprote / Bloctel (France, telephone marketing opt-out list), E-Hawk (United States, fraud detection and lead qualification).

External recipients. Depending on your actions on the Site, the forms you submit or your consent, your data may be transferred to our partner advertisers and/or to our subsidiaries and sister companies (the members of the DATAVENTURE group) for the purposes mentioned above. The partner advertisers and the members of the DATAVENTURE group are solely responsible for the processing they carry out on your data, in compliance with the purposes mentioned above and with the applicable rules. They have their own data protection policies, which we recommend you consult.The list of partner advertisers on whose behalf we may act, and with whom your data may, in certain contexts, be exchanged, is available at the following address: https://partenaire.dataventure.com/. These partners most often act as data controllers, alone or jointly with us, for the processing they carry out.

Being a data controller does not mean being a recipient. The fact that a partner advertiser acts as a data controller does not mean that it is a recipient of your data.

Cases in which partner advertisers are not recipients of your data: during your mere browsing, your use of the contact form or the posting of a review; where you have not consented to the transfer of your data or have objected to it; where we carry out, on behalf of a partner advertiser, commercial prospecting operations (email, SMS, etc.) without that partner having access to your data, such data being processed by us or, depending on the campaign, by the publisher holding it and acting on our instructions; where the partner only intervenes downstream by means of aggregated or anonymised data that does not allow you to be identified.

Cases in which partner advertisers are recipients of your data: primarily where we generate and forward leads to them, in particular by means of a collection form designed specifically for the partner concerned; where you have consented to the transfer of your data for this purpose; where you request a connection involving the transfer of your request to the partner (request for a quote, credit, offer, appointment, etc.); as part of a dedicated collection or a co-registration carried out for the partner's benefit; in the event of a call transfer at your request.

Judicial, public or governmental authorities. Where applicable, we may be required to disclose some of your data in order to comply with the law or a court decision, to respond to legitimate requests from public authorities, to prevent an offence or conduct an investigation, or to protect the rights, property or safety of our company, of users or of any third party.

Transfers of data outside the European Union. In the event of a transfer of your data outside the European Union, we ensure that our providers comply with their data protection obligations in accordance with the GDPR. The transfer may be governed by an adequacy decision of the European Commission (e.g. the United Kingdom). Failing this, it is governed by the signing of the Standard Contractual Clauses issued by the European Commission. As regards transfers to the United States, these are governed, for certified providers, by the European Commission's adequacy decision of 10 July 2023 relating to the Data Privacy Framework (DPF); for non-certified providers, by the Standard Contractual Clauses. Transfers to Switzerland also benefit from an adequacy decision.

DATAVENTURE GROUP has appointed a DPO responsible for compliance with the regulations relating to the protection of personal data. Contact by post: Mr Grégory Margoline, 6 rue Halévy, 75009 Paris, France. Contact by email: gmargoline@forperspectives.com.

The DPO appointed with the CNIL (the French data protection authority) is Mr Grégory Margoline (Perspectives), whose contact details appear above. Requests to exercise your rights are, for their part, received and handled by the Legal Department of the DATAVENTURE group, whose contact details appear in Article 6.

You have the right of access, rectification, erasure and portability of the data concerning you. You may also request the restriction of processing or object to it. You are entitled to provide us with your instructions regarding the fate of your data in the event of death. Where you have given your consent, you may withdraw it at any time and free of charge.

You may exercise your rights by contacting us. Contact by post: Legal Department – DPO, 10 bis rue Escudier – 92100 Boulogne-Billancourt, France. Contact by email: dpo@dataventure.com. In order to protect your privacy, we may take reasonable steps to verify your identity before acting on your request.

Telephone prospecting. You are informed of the existence of the “Bloctel” telephone marketing opt-out list, on which you can register: https://conso.bloctel.fr/. As from 11 August 2026, pursuant to French Law No. 2025-594 of 30 June 2025, telephone prospecting is subject to your prior consent; until that date, the Bloctel scheme remains applicable.

Communications by email and SMS. You may, at any time, object to receiving our communications and/or those of our partner advertisers by clicking on the unsubscribe link at the bottom of each email, by clicking on “STOP” or by sending “STOP” to the number indicated in each SMS, or by contacting us via one of the means mentioned above.

Recording of your exchanges with the AI agent. Where you exchange with our online assistant (chat or voice) on our Sites, the recording of the exchange is based on your consent; you may withdraw it and you have a right of access, rectification and erasure of this data, which is kept for 60 days.

Where you are called by an automated conversational agent (voicebot) as part of a campaign, the recording of the call is based on our legitimate interest; you may object to it and you have the same rights, this data being kept for 90 days (see Article 8). To exercise these rights, contact us using the details above.

In any event, in the event of failure to respect your rights, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés, 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07; www.cnil.fr).

We implement organisational and technical measures designed to ensure the security, confidentiality, integrity and availability of your personal data, in order to protect it against loss, theft, unauthorised access or transmission, and any unlawful modification or destruction. These measures are adapted to the nature of the data collected and of the processing carried out. The storage servers comply with the security standards in force and are protected against digital and physical attacks. All pages of the Site intended to collect personal data are secured (HTTPS).

We ensure a limited retention of your data, adapted to the nature and purposes of the processing. Depending on your situation, the following periods apply.

The table below summarises the main retention periods:

The Site may contain links redirecting you to third-party sites or services (e.g. social networks, partner sites). This Privacy Policy applies only to the processing carried out on the Site. DATAVENTURE GROUP has no control over how third-party sites or services may use your data and is not responsible for their practices. We therefore invite you to consult their own data protection policies.

A cookie is a small text file saved on your device when you use an online service. The cookies used on the Site are used for the purposes defined within our consent management platform (“CMP”), which can be consulted via the “Cookies” module at the bottom of the page. The Site also uses functional cookies, necessary for its proper operation, which are placed automatically. For all other cookies that are not exempt from consent, these are placed only after your consent has been obtained via our CMP.

On your first visit, our CMP allows you to accept all cookies, to choose purpose by purpose or partner by partner, or to refuse the use of all non-essential cookies. Your choice is kept and applied for 6 months. You can change it or withdraw your consent at any time from the “Cookie management” module at the bottom of the page.

Audience measurement exempt from consent. The Site uses an audience-measurement tool that is exempt from consent, configured in accordance with the CNIL's recommendations: no data is stored on your device, your IP address is truncated and no link is established between your browsing and your identity. The data is used solely for internal statistical purposes. You may object to this measurement via the opt-out mechanism available for the relevant campaigns.

The DATAVENTUREgroup operates sites and landing pages under brands distinct from the“DATAVENTURE” brand (the “White Labels”). This Privacy Policy constitutes thelevel of information applicable to these White Labels, in addition to theinformation provided directly on each collection medium.

Depending on the operation concerned (co-sponsoring, co-registration or dedicated landing page), the data controller is the DATAVENTURE group company that operates the White Label and/or the partner advertiser in the relevant sector, each for the purposes it determines.

Processing common to all White Labels. Depending on the campaign and the White Label concerned, all or part of the following processing operations may take place: the collection and qualification of your request; connecting you with the partner advertiser in the sector (i.e. the transfer of your request so that it can follow up and call you back); an exchange with an adviser, or with an automated conversational agent (chatbot or voicebot), by chat or by telephone, in order to qualify your request; the recording of that exchange; the transfer of your call to the partner, at your request; the enrichment and scoring of your profile; the measurement of campaign performance; and, subject to your consent, multichannel commercial prospecting (email, SMS, telephone, mail).

The categories of data likely to be collected are your identification data, your contact data and the project data specific to the relevant sector.

The legal bases are your consent (prospecting, exchange with a conversational agent) and, depending on the case, the performance of pre-contractual measures or our legitimate interest. The retention periods are set out in Article 8. The recipients and the data specific to each sector are set out below.

Certain White Labels are operated abroad, in particular in Spain and Italy; they are subject to information adapted to the applicable local law.

Brands concerned: Mon Énergie Plus, Votre Expert Énergie and the “energy” operations of Mon Enquête.

Recipients: energy suppliers and brokers (electricity, gas, green energy). Project data: your need (electricity contract, gas contract or both) and your situation (change of supplier or new connection).

Specific details for the energy sector. If the campaign provides for a call-back, your request may give rise to an exchange with an adviser or an automated conversational agent in order to qualify your energy needs; for this qualification call, the DATAVENTURE group company operating the White Label and the partner energy supplier act as joint controllers (Article 26 of the GDPR). If, during the call, you ask to receive an offer, your call and your data are transferred to the partner energy supplier, which then acts as an independent data controller, on the basis of pre-contractual measures.

Brands concerned: Travaux Facile and Aide Isolation (as well as, in Spain, Contrata Todo for solar).

Recipients: craftspeople, installers and home-improvement companies (where applicable RGE-certified) and installers of photovoltaic solutions. Project data: type of dwelling, occupancy status (owner/tenant), nature of the planned works, eligibility for grants (household income where applicable).

Brand concerned: Trouver Sa Formation.

Recipients: partner training organisations, schools and apprentice training centres (for example: Centre Européen de Formation, Paris Business School – EDC). Project data: the training or field targeted, professional situation and plans, funding arrangements (including the CPF personal training account).

Brand concerned: the “debt consolidation” operations of Mon Enquête.

Recipients: credit institutions, brokers and intermediaries in banking operations and payment services (IOBSP). Data: financial situation (income, expenses, outstanding debts), nature of the financing project.

Brands concerned: the “Mon Bilan Auditif” operations of Mon Enquête. White-label campaigns on behalf of hearing-care brands may be deployed.

Recipients: hearing-aid specialists and hearing centres. Data: information relating to your hearing and to your hearing-aid project.

Specific details for the hearing-health sector. If you request an appointment for a hearing test, the following processing operations may take place: the collection of your request and, where applicable, of data relating to your hearing, which constitutes health data processed on the basis of your explicit consent (Article 9(2)(a) of the GDPR), obtained by means of a dedicated checkbox; a call-back by a telephone adviser (or contact by email if you cannot be reached); and the booking of an appointment, during the call, on a dedicated platform (for example Doctolib) with a view to carrying out the test with a partner hearing-aid specialist.

Brand concerned: Le Logement (Pinel operations). Recipients: property developers and wealth-management advisers. Data: investment capacity and project, tax situation.

Brand concerned: Le Logement (security operations).

‍Recipients: alarm and remote-monitoring companies. Data: type of dwelling and security needs.

Brands concerned: Daily Opinion (conversational agent) and, in Spain, Pruebas y Coches.

Recipients: car dealerships and distributors. Data: desired vehicle, dealership or point-of-sale preferences (see also the AI agent, Action 6).

Brands concerned: Mon Enquête and Daily Opinion. Recipients: market-research institutes and, subject to your consent, partner advertisers. Data: answers to questionnaires, identification and contact data.

Brand concerned: Mon Commerce 360.
Recipients: providers of solutions and services for retailers. This processing takes place primarily in a B2B context.

This table is provided as a summary; it does not replace the detailed articles above.