LOXAM, a simplified joint-stock company (SAS), registered on the LORIENT company register with the reference 450 776 968, with its head office at 256 rue Nicolas Coatanlem, 56850 CAUDAN, FRANCE (hereinafter "LOXAM"), processes Personal Data (defined below) as part of its business.

• This Personal Data Protection Policy (the "Policy") describes how LOXAM collects, uses and processes your personal data, in compliance with applicable regulations. For LOXAM, respecting your private life is important and thus we are committed to protecting and preserving your rights in respect of data confidentiality.

• This Policy applies to the personal data we collect from our customers, suppliers, service providers and our lessors within the framework of completing all types of business contracts. It also applies to the personal data of users of our different websites, of job applicants and of any other people we may legitimately contact as part of LOXAM Group activities.

• Within the framework of applicable data protection legislation (including the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), the company responsible for your personal data is LOXAM.

• LOXAM may modify this Policy. We encourage you to regularly visit this page to view any changes that we publish here.

• In the event of disagreement on certain aspects of our Policy, you are entitled to legal rights which are specified to you when necessary.

• This Policy applies in all countries where LOXAM is present. However, the approach to data confidentiality may differ slightly from one country to another.

• LOXAM subsidiaries may also collect and process personal data. This Policy applies to LOXAM subsidiaries.

1. SCOPE OF THIS PERSONAL DATA PROTECTION POLICY

   This Policy states the principles and guidelines for protecting your personal data, which includes personal data collected on - or via - the different websites of LOXAM and its subsidiaries.

   LOXAM collects personal data online (including by email) or offline; this Policy applies to all forms of collection or processing.

   Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

   Note for the attention of visitors and users of the LOXAM website: our different websites contain the specific terms and conditions of use which are part of this Policy. The use of our websites and of the personal data sent by users on our websites is subject to the provisions of this Policy and to the applicable terms and conditions of use.

2. COLLECTED DATA

   The personal data we may collect varies depending on the purpose for processing. Its main purpose is to be able to identify people within the framework of their relations with Loxam.

   In all events, personal data collected shall be restricted to data required for the purposes set down in Article 4 below.

   Note for the attention of visitors and users of our website: some functions and characteristics of our websites can only be used if some personal data is sent to us. The user is free to provide or not all or part of the personal data requested. However, if the user decides not to provide such data, the decision could prevent the satisfactory completion of the objectives described in Article 4 below, and some of the services and functions of our websites may not work correctly and/or the user may be denied access to some pages.

   Customer-related data:

   The data we collect on the subject of our customers is restricted. In general, we need the contact information of points of contact in the customer company or potential customer company (notably their name, telephone number, email address and postal address) in order to be able to complete the contracts agreed with our customers. Within the framework of customer satisfaction surveys, we also hold information relating to customers' requirements or constraints, which we may then use in order to ensure that our marketing correspondence is relevant and appropriate for you. We may also hold additional information that our points of contact within our customer companies have chosen to send us. In some circumstances, when you interact with our divisions or departments, our calls may be recorded, depending on applicable local laws and requirements.

   Data relating to suppliers and service providers:

   We also collect data on the subject of our suppliers and service providers. For the purposes of managing our business relations, we collect information from our points of contact in the supplier company or service provider company, such as their name, telephone number, email address and postal address. We may also hold additional information that our points of contact within our supplier or service provider companies have chosen to send us.

   Data relating to personnel management:

   For applicants applying for job offers, notably concerning LOXAM, we may collect different types of information in order to analyse the applicants in relation to the vacancies, notably identity, personal contact details, elements of their career, certificates, motivations, etc.

   Loxam also collects useful information for the proper management of its personnel, notably identity, civil status, personal contact details, elements of their career, certificates, bank information, social security, administrative information in compliance with legal and regulatory provisions.

   Data relating to users of our different websites:

   We collect personal data from users of our different websites, which we use to improve the use of our websites and to manage the services we supply. This information includes, in particular, the way in which our websites are used, the frequency at which the user accesses the websites, the type of browser, the location from which users visit our websites, the language used to view them and the busiest times for visiting our websites. If you contact us via one of our websites, for example using the chat function, we will collect any information you give us, such as your name and your contact details.

3. PERSONAL DATA PROTECTION OF CHILDREN UNDER 18

   LOXAM products and services are reserved for adults and are not intended to be sold to minors; LOXAM does not voluntarily collect or store personal data of minors, except within the framework of information for personnel management.

4. PURPOSES OF PERSONAL DATA COLLECTION

   Personal data is collected for the requirements of LOXAM's business, such as executing contracts agreed with our customers, suppliers and other service providers or third parties, for the purposes of our legitimate interests or to comply with reporting requirements stipulated by law, as well as to recruit employees and to manage LOXAM employees.

   LOXAM collects and uses personal data for the requirements of its business and notably to carry out the following activities:

   • to allow our points of contact to request and obtain information concerning LOXAM, our equipment and our material, and our services;

   • to prepare and submit sales bids, to take part in tenders;

   • for sales and contractual relationship monitoring (orders, cost estimates, sending invoices, provision of materials, technical assistance, management of any technical disputes, etc.) ;

   • to carry out customer satisfaction surveys;

   • to carry out operations to promote our services to existing or potential customers;

   • to invite our points of contact or potential customers to take part in events organised by LOXAM within the framework of trade shows, seminars or professional events;

   • to make bids for tender and to monitor the sales and contractual relation with suppliers, sub- contractors and service providers;

   • to perform quality audits;

   • to meet our contractual obligations;

   • to enforce our rights;

   • to manage spontaneous applications or applications sent in response to job offers;

   • to manage LOXAM's human resources;

   • to meet our legal obligations;

   • any other purpose connected with LOXAM'S activities.

     Subject to applicable local legislation, by supplying your email address, you explicitly authorise LOXAM and its subsidiaries to use it along with other useful personal data to send you promotional or corporate messages.

     If necessary, and in compliance with local laws and requirements, we can obtain more information within the framework of analyses or market surveys by third parties and within the framework of online and offline media analyses (which we may carry out ourselves or via other companies).

5. COOKIE POLICY

   What are cookies?

   Cookies are small files which are stored on a computer hard drive and which record your browsing history on a website so that the next time you visit, it can give you personalised options in line with the information stored from your last visit. Cookies can also be used to analyse traffic and for advertising and marketing purposes.

   Nearly all websites use them and they do not damage your system. If you want to check or modify the types of cookies you accept, you can generally do this by changing your browser settings. We also provide information on this on our Marketing preferences page on our websites.

   How do we use cookies?

   We use cookies for two reasons:

   • to track your use of our site. This way, we can understand how you use the site and monitor trends observed in individuals or larger groups. This allows us to develop and improve our site and our services in response to our visitors' wants and requirements; and

   • to help us suggest uses that we think could be of interest to you; this should mean that you spend less time browsing through multiple pages and you can find what you want more quickly.

     There are two types of cookie:

   • Session cookies: these cookies are stored on your computer during your web session only and are automatically deleted when you close your browser – they generally store an anonymous session identification that allows you to visit a site without having to reconnect to each page, but they do not collect any information on your computer; or

   • Persistent cookies: these are stored in the form of a file on your computer and stay there when you close your browser. The cookie can be read by the website that created it when you visit this site again. We use persistent cookies for Google Analytics and for customization (see below).

     Cookies can also be categorised as follows:

   • Strictly necessary cookies: These cookies are essential for you to use the website effectively and can therefore not be disabled. Without these cookies, the services you have on our websites cannot be provided. These cookies do not collect your information to be used for sales purposes or to memorise the pages you have viewed on the Internet.

   • Performance cookies: These cookies allow us to monitor and improve performance of our website. For example, they allow us to record visit numbers, identify traffic sources and see which parts of the site are the most viewed.

   • Functionality cookies: These cookies allow our sites to memorise the choices you make (user name, language, country, etc.) and to provide improved experiences.

     For example, we can send you information or updates in relation to the services you use. These cookies may also be used to memorise changes you make to the text size, the font and other web page elements that you can personalise. They may also be used to provide services you have requested, such as to watch a video or post comments on a blog. The information these cookies collect is generally made anonymous.

   • Customization cookies: These cookies allow us to send information on rental solutions that are likely to interest you. These cookies are persistent (as long as you are registered with us), which means that when you connect to the site or you return to the site, you can see rental offers that are similar to those you previously consulted.

6. PERSONAL DATA PROCESSING AND STORAGE CONDITIONS

   Personal data "processing" includes the use, storage, recording, transfer, adaptation, analysis, modification, declaration, sharing and destruction of personal data depending on what is necessary in view of the circumstances or legal requirements.

   If you suspect misuse, loss or non-authorised access concerning your personal information, please inform us immediately.

   We will erase personal data from our systems in the absence of significant contact with your (or, if applicable, with the company for or with which you work) for five years (or a longer period if we genuinely think that the law or relevant regulation authorities demand that we store your data), unless otherwise stipulated by law. After this period, your data will probably no longer be relevant in respect of the purposes for which it was collected.

   By "significant contact", we mean, for example, any communication between us (verbal or written), or an active engagement from you concerning our services. The fact of your receiving, opening or reading an email or other digital message from us will not be deemed significant contact – it will only be the case if you click on the message or respond directly.

7. TRANSFER OF PERSONAL DATA

   To offer you the best services and to meet the purposes outlined in this Confidentiality Policy, your data may be transferred as follows:

   • between and within LOXAM group entities in France and abroad;

   • to third parties (such as advisors or other suppliers or sub-contractors);

   • to one or more cloud-based storage suppliers.

   LOXAM may disclose your personal data if the law enforces it or if LOXAM genuinely considers that this disclosure is reasonably necessary to comply with a legal procedure (for example, a mandate, a subpoena or any other court decision) or to protect the rights, property or safety of LOXAM employees, our customers or the public.

   We strive to ensure that your data is stored and transferred securely. Consequently, we will only transfer data outside the European Economic Area or EEA (including member states of the European Union, plus Norway, Iceland and Liechtenstein) to countries that comply with legislation in terms of data protection and where the means of transfer ensure adequate protection of your data.

   To ensure that your personal information receives adequate protection, we implement appropriate procedures with the third parties with which we share your personal data to guarantee that your personal information is processed coherently and with respect for data protection legislation.

8. YOUR RIGHTS CONCERNING YOUR DATA

   LOXAM has set up suitable personal data protection systems to ensure that personal data is used in compliance with the purposes indicated above and to ensure its accuracy and updating.

   Right to object:

   You can object to us processing your personal data at any time.

   Your objection request will be processed diligently and we will stop the activity you object to. However, we reserve the possibility to not stop the activity in question if:

   • we can prove that we have legitimate and overriding reasons to process your data which take precedence over your interests; or

   • we process your data for the purposes of determining, exercising or defending a legal claim. If your objection concerns direct marketing, we must act in compliance with your objection by stopping this activity which concerns you.

     Right to withdraw consent

     If we have received your consent to process your personal data for some activities other than those for which no consent is required, you may withdraw this consent at any time and we will stop the particular activity to which you have given consent, unless we consider that there is another reason that justifies continuing processing of your data for this purpose, in which case we will inform you of this situation.

     Requests for access:

     You can ask us at any time to confirm the information we have concerning you, and you can ask us to modify, update or delete it. We can ask you to verify your identity and request additional information concerning your request. If we give you access to the information we have concerning you, we will not invoice this access, unless your request is "clearly unfounded or excessive". If you request other copies of this information from us, we may invoice reasonable administrative fees if permitted by law. If this is not permitted by law, we may reject your request. If we do this, we will always provide a reason for this rejection.

     Please note that in some countries in which we are present we are subject to specific local legal requirements in terms of requests for access from data subjects and we may therefore reject your request in compliance with these laws.

     Right to erasure:

     You can ask us to erase your personal data in certain circumstances. In principle, the information in question must meet one of the following criteria:

   • the data is no longer necessary for the purposes for which we collected and/or processed it in the first place;

   • you have withdrawn your consent to processing your data and there is no other valid reason for us to continue processing it;

   • the data was processed unlawfully;

   • the data must be erased in order for us to comply with our legal obligations as the processing manager; or

   • in the event that we process data because we consider it necessary for our legitimate interests, you object and we are not able to prove that there is a legitimate and overriding reason to continue processing the data. Please note that in some countries in which we are present we are subject to specific local legal requirements in terms of the rights to erasure of data subjects and we may therefore reject your request in compliance with these local laws. .

     We shall be within our rights to refuse to respond to your request for one of the following reasons only:

   • to exercise the right of freedom of expression and information;

   • to comply with legal obligations;

   • for reasons of public health in the public interest;

   • for archiving, research or statistical purposes; or

   • to exercise or defend a legal claim.

     When we respond to a valid request to erase data, we take all appropriate practical measures to delete the data in question.

     Right to restriction of processing

     You can ask us to restrict processing of your personal data in certain circumstances. This means that we will only be able to continue to store your data and that we will only be able to proceed with other processing activities in one of the following cases: (i) termination of one of the circumstances mentioned below; (ii) your consent; or (iii) future processing is necessary for determining, exercising or defending a legal claim, protecting the rights or another person, or for important reasons of public interest of the European Union or a member state.

     The cases in which you are within your rights to ask us to restrict processing of your personal data are the following:

   • when you contest the accuracy of your personal data processed by us. In this case, our processing of your personal data will be restricted while the accuracy of the data is verified;

   • when you object to us processing your personal data for the purposes of our legitimate interests. You may request for the data to be restricted while we verify our reasons for processing your personal data;

   • when your data has been illicitly processed by us, but you simply prefer us to restrict processing rather than to delete the data; and

   • when we no longer need to process your personal data but you request the data in order to declare, exercise or defend legal claims.

   If we have sent your personal data to third parties, we will inform them of the restricted processing unless this is impossible or requires disproportionate efforts.

   Naturally, we will inform you before removing any processing restriction of your personal data.

   Right to rectification:

   You also have the right to request that we rectify your inaccurate or incomplete personal data that we hold. If we have sent this personal data to third parties, we will inform them of the rectification unless this is impossible or requires disproportionate efforts. If applicable, we will also inform you which third parties have been sent your inaccurate or incomplete personal data. If we believe that it is reasonable to not respond to your request, we shall provide you the reasons for this decision.

   Right to data portability:

   If you wish, you have the right to transfer your personal data from one processing controller to another. In concrete terms, this means that you are able to transfer the data to another online platform. For you to be able to do this, we will send you the data in a legible format. This right to portability applies to the following data: (i) personal data that we process automatically (i.e. without human intervention); (ii) personal data that you supply; and (iii) personal data that we process based on your consent or within the framework of completing a contract.

   Right to lodge a complaint with a supervisory authority:

   You also have the right to lodge a complaint with your local supervisory authority.

   It is important that the personal information we hold concerning you is accurate and correct. Please inform us of any changes to your personal information during the period in which we hold your data.

9. DATA SECURITY AND RECIPIENTS

   We undertake to take all reasonable and necessary measures to protect the personal information we hold against any misuse, loss, alteration, disclosure, destruction or non-authorised access. To do this, we have a range of appropriate technical and organisational measures. They may consist of measures to deal with suspicions of data breaches.

   As all personal data is confidential, access is restricted to LOXAM employees, service providers and agents who need access within the framework of carrying out their work. All persons with access to your personal data have a duty of confidentiality and face disciplinary and/or other sanctions if they do not comply with these obligations.

10. CONFLICT RESOLUTION

    Although LOXAM has taken reasonable measures to protect personal data, no transfer or storage technology is completely infallible.

    However, LOXAM is keen to guarantee personal data protection. If you have reasons to believe that the security of your personal data has been compromised or that it has been misused, please contact LOXAM at the following address:

    • By post to the following address: Direction juridique – 256 rue Nicolas Coatanlem – 56850 Caudan (France), or

    • By email at the following address: service.juridique@loxam.fr

    LOXAM will handle complaints concerning the use and disclosure of personal data and will attempt to solve them in compliance with the principles provided in this Policy.

    Non-authorised access to personal data or misuse of personal data may be considered an offence under local legislation.

11. CONTACT

    For questions regarding this Policy, to stop receiving information from LOXAM or for any request to rectify, add to, update or erase your personal data, you can send an email to: service.juridique@loxam.fr

12. REVISIONS TO THE PERSONAL DATA PROTECTION POLICY

This Policy may be updated according to LOXAM'S requirements and circumstances or if it is required by law. Therefore, we recommend you read any updates regularly.