Privacy Policy

Automata France SAS was the subject of a decision to strike it from the register of digital asset service providers maintained by the Autorité des marchés financiers, with effect from 30 June 2026, upon expiry of the transitional period provided for by Regulation (EU) 2023/1114 (MiCA). Its custody, purchase-sale and exchange services for digital assets ended on that date and the company no longer provides digital asset services.

Subscriptions and new entries were halted on 22 May 2026. The company now carries out only those operations strictly necessary to wind down its position, within the framework of a plan for the discontinuation of services (the “Wind-Down Plan”) submitted to the Autorité des marchés financiers.

Consequently, the processing of personal data described in this policy is now limited to that necessary for the implementation of the Wind-Down Plan, compliance with the company’s legal and regulatory obligations, and the handling of client requests and complaints. Processing for commercial, prospecting or marketing purposes has ceased. The interface made available to clients is limited to information and the visualisation of existing positions and does not permit any transaction to be carried out.

The rights you have over your personal data, described in article 10 of this policy, continue to be exercised under the same conditions. The retention periods imposed by law, in particular in accounting, tax and anti-money-laundering matters, remain applicable notwithstanding the cessation of activity.

This data protection policy describes how the platform collects and processes your personal data through the visualisation platform referring to this Data Protection Policy.

This Data Protection Policy applies to all personal data processing activities that we carry out on the visualisation platform accessible here: https://app.automatafrance.com (the “Platform” or the “Site”).

In so far as you are a client or a user of our services, this Data Protection Policy applies together with the commercial terms and other contractual documents, including but not limited to the agreements we may have with you.

In so far as you are not a stakeholder, client or user of our services, but you use our website, this Data Protection Policy also applies to you, as does our Cookie Policy.

This Policy must therefore be read together with our Cookie Policy, which provides further details on our use of cookies on the website.

Automata France SAS (also referred to as “the company” or “we” in this policy) is a simplified joint-stock company (société par actions simplifiée) with its registered office at 965, avenue Roumanille, COLOFT - Arteparc Sophia Antipolis Bâtiment A, 06410 Biot, registered with the Trade and Companies Register of Antibes under number 902 498 617 (intra-Community VAT number: FR47 902 498 617).

Automata France SAS was struck from the French register of digital asset service providers with effect from 30 June 2026.

The Platform is published, operated and hosted by Automata Holding Ltd, a company registered in the United Arab Emirates (private company limited by shares) with its registered office at ResCo-Work79, Floor 1, Pixel Plaza – Tower 6, The Makers District, Abu Dhabi, Al Reem Island, United Arab Emirates, registered with the Abu Dhabi Global Market under number 33537, the parent company of Automata France SAS.

Automata France SAS remains the controller of the personal data processed via the Platform. Automata Holding Ltd acts as processor within the meaning of Article 28 of the GDPR, on the basis of a data processing agreement to be entered into with Automata France SAS.

The company operates the website publicly accessible at the following address (hereinafter the “Site”): https://app.automatafrance.com. In view of the striking-off mentioned at the head of this policy and the discontinuation of digital asset services which took place on 30 June 2026, this Platform is not intended to permit the subscription of services or products. Its purpose is:

• to make available to users the information relating to the cessation of activities and the Wind-Down Plan;
• to allow clients to view their existing positions, without any possibility of management or transaction;
• to offer functionalities and information enabling users to contact the companies carrying the projects, in particular for any request or complaint.

The company also administers pages presenting its activity and enabling it to publish content on social networks and to interact with internet users (in particular on Facebook, Instagram, X, YouTube or LinkedIn).

When you browse and interact on the Site, on the pages administered by the company on social networks or, generally, during your interactions or exchanges with the company, the latter may collect and process Personal Data concerning you, for the management of the activities it carries out and on its own behalf, in its capacity as Controller, whether you are a client, prospect, contact, internet user, applicant, supplier, service provider or partner, potential or current (also referred to as “you” or “the Data Subject(s)” or “the user(s)” in this policy).

In this context, the company applies the principles defined by the legal and regulatory provisions on the protection of Personal Data, in particular Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as well as its implementing decrees.

2.1 Your Personal Data is collected directly from you, or indirectly from third parties

2.1.1 Direct collection

Your Personal Data is in particular collected or processed in whole or in part when you browse the Site, interact with the Site, and enter information in the data collection forms that may appear on it, but also more generally in connection with requests that you may send to the company by any means convenient to you, your relationship and exchanges with the company, as well as when you share content from the Site by means of social network sharing “buttons”, or when you browse one of the company’s pages on social networks.

Generally, your Personal Data is therefore collected directly from you in the aforementioned situations.

2.1.2 Indirect collection

However, your Personal Data may also be collected through third parties (indirect collection).

The Personal Data we collect and process concerning you may be gathered or enriched by us by means of other sources of information (social networks, so-called “public” information, websites, list rentals, etc.). It is specified that, since the cessation of the company’s commercial activities, these operations are no longer carried out for prospecting, solicitation or marketing purposes.

Likewise, your Personal Data may be transmitted to us by other staff members or contacts within your company, or through third parties in certain situations.

2.2 Mandatory or optional nature of the collection

Generally, you are informed that, as a matter of principle:

• if the Processing of your Personal Data is necessary for compliance with our legal or regulatory obligations, the collection of the said Data is mandatory;
• if the Processing is subject to your consent, the communication of the said Data is entirely optional (the failure to communicate it may, however, in certain cases prevent us from carrying out the Processing concerned);
• if the Processing is necessary for the performance of a contract or of pre-contractual measures taken at your request, the communication of the said Data is necessary for that purpose, failing which the company may be prevented from performing its obligations;
• if the Processing is based on the pursuit of our legitimate interests, the communication of the said Data is necessary for that purpose, and failure to communicate it might not allow us to carry out the Processing concerned.

Special case: if collection forms involve the entry of Data that is mandatory for the implementation of the associated Processing, you will be informed of this on the form, together with the possible consequences of a failure to communicate. Failing that, the information requested is optional.

2.3 Special data

Save for specific legal obligations or contrary indications in this policy, we do not collect so-called “special” Personal Data, that is to say data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor genetic data, nor data concerning health, sex life or sexual orientation of a natural person.

2.4 Data of minors or protected adults

We offer our services only to adults having legal capacity. The use of the Site and of the company’s dedicated pages on social networks is reserved for adults having legal capacity, the company not being liable for the use of the Site or of its pages by minors or persons lacking capacity.

3.1 Management, handling and follow-up of requests for information and exchanges with our users

We may collect, use, store and transfer different types of personal data concerning you: identity, contact, financial, transaction, device, content, profile, usage, marketing and communication, location and biometric data.

We also collect, use and share aggregated data, such as statistical or demographic data. Aggregated data may be derived from your personal data but is not considered personal data under the law, as it does not directly or indirectly reveal your identity. If we combine or connect aggregated data with your personal data in such a way that it can identify you, we treat the combined data as personal data.

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes during our relationship with you.

3.2 Management of our relations with our partners, service providers and suppliers

Our Site may contain links to and from the websites of our partner networks, advertisers and affiliates. These websites and the services accessible through them have their own privacy policy and we accept no liability for these policies or for the personal data that may be collected there. Please check these policies before submitting personal data to these websites.

The purpose of this Processing is the management, follow-up and response to partners’ requests, as well as the management of our relations with them, including the management and follow-up of the performance of contracts, of the services entrusted, of invoices, payments and transactions, of the associated accounting, and the handling of any complaints or disputes. The search for new partners has no longer been carried out since the cessation of activities.

On this occasion, we collect: identity (title, surname, first name), contact details (e-mail address, postal address, telephone number), information on service proposals and contracts, data relating to payments and means of payment, to transactions, to the follow-up of contracts and to invoices.

The retention period relates to the duration of the pre-contractual, contractual or commercial relationship with the company.

3.3 Compliance with legal and regulatory obligations

In order to comply with the legal or regulatory obligations incumbent on us (accounting, tax and administrative obligations, obligations relating to the fight against money laundering and terrorist financing — KYC and/or KYT), resulting from the performance of the contracts to which we are party and more generally from our activity, we process the Personal Data of our contacts, as well as with a view to monitoring our accounts and our financial and budgetary position.

On this occasion, we collect: identity (title, surname, first name), contact details (postal address, telephone number, e-mail address), photograph, nationality, data relating to payments and means of payment, to transactions, to the follow-up of contracts and of relations with our contacts, and to invoices. We also use your IP address, which may determine your geolocation, for the purposes of monitoring, preventing and detecting fraud, as well as ensuring the compliance of our internal procedures.

The retention period relates to the duration of the current accounting or tax year plus six months; 5 years from the end of the business relationship or of the transactions concerned as regards the obligations relating to the fight against money laundering and terrorist financing.

These processing operations and retention periods remain applicable notwithstanding the cessation of the company’s activities and the implementation of the Wind-Down Plan.

3.4 Communication by e-mail

The processing of Personal Data for the purposes of commercial operations, customer loyalty, prospecting or marketing (including segmentation and targeting operations, the sending of product and service proposals, newsletters or promotional information) has ceased.

The communications now sent to you by e-mail are limited to the information necessary for the implementation of the Wind-Down Plan, the handling of your requests and complaints, and compliance with our legal and regulatory obligations. The data processed in this respect is your identity and your e-mail address.

The data retention period is three years from collection or from the end of our relations, or from the last contact from the Data Subject.

3.5 VANCELIAN account created via the application

We collected your personal data when your account was created via the former “VANCELIAN” application: identity (surname, first name, title, date of birth), contact details (postal address, telephone number, e-mail address), nationality and financial information. The Platform is now accessible exclusively in the form of a Web interface; the former mobile application is no longer available.

The creation of new accounts has no longer been possible since subscriptions were halted on 22 May 2026.

Your personal data is retained until the closure of your account, with the exception of that necessary for compliance with legal and regulatory obligations (see point 3.3 of this policy).

The company uses “cookies” in the application. Cookies are small files containing textual information, stored on your mobile device only when you accept their placement while using our application.

Cookies and other trackers or similar technologies may be installed and/or read in your browser or terminal when you visit the Site (see also article 12 below).

For further information on cookies used on this Platform, please consult this Cookie section and article 12 of this Privacy Policy. Where a dedicated Cookie Policy page is published, it will be linked from the footer of the Site.

We will use your personal data only where the GDPR and the legislation of the EU Member State to which we are subject authorise us to do so. Most often, we will use your personal data in the following circumstances:

• where we must comply with a legal or regulatory obligation;
• where we must perform a contract we have entered into with you;
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
• where you have given your consent prior to the processing.

Where personal data is processed on behalf of the company, we enter into a separate contract with the processor. That contract constitutes an undertaking of compliance with the GDPR and provides sufficient contractual guarantees for the implementation of appropriate technical and organisational measures ensuring the protection of your rights.

As regards the transmission of personal data to external recipients, we transmit data to third parties only where required by law, necessary for the performance of the contract, or where you have consented to it. On these conditions, the third-party recipients may be:

• public authorities and institutions (in particular financial authorities and law enforcement agencies);
• other credit and financial services institutions or similar institutions, to which we transmit the data necessary for the performance and handling of the business relationship;
• the other companies in our group, for risk control on account of legal or official obligations;
• service providers who process personal data on our behalf (identity verification, hosting, data analysis, information technology and related infrastructure, customer service, sending of e-mails, audit);
• the bodies appointed within the framework of any proceedings applicable to the company, as well as its advisers, strictly to the extent necessary for the accomplishment of their tasks.

We authorise these service providers to use or disclose personal data only in order to provide services on our behalf or to comply with legal requirements. We require them to undertake contractually to protect the security and confidentiality of the data they process on our behalf. Our processors are established in the European Union, with the exception of Automata Holding Ltd, established in the United Arab Emirates, which publishes, operates and hosts the Platform and acts in that respect as processor within the meaning of Article 28 of the GDPR. The resulting transfers are described in article 7.

Some of our external third parties are established outside the EEA, so that their processing of your personal data involves a transfer of data outside the EEA. This is in particular the case of Automata Holding Ltd, established in the United Arab Emirates, which publishes, operates and hosts the Platform. That transfer concerns technical connection data (IP addresses, device data, connection logs) as well as the e-mail address used for authentication.

The United Arab Emirates is not the subject of an adequacy decision of the European Commission within the meaning of Article 45 of the GDPR. The transfer to Automata Holding Ltd will be governed by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), controller-to-processor module, together with the appropriate supplementary measures.

Please contact us if you wish to obtain further information on the mechanism used when transferring your personal data outside the EEA.

We recognise the importance of protecting and managing your personal data. All the personal data we process is processed with the utmost care and security. We use a range of physical and technical measures to ensure the security of your data and to prevent any unauthorised access, use or disclosure:

• electronic data and databases are stored on secure computer systems, with control of access to information by physical and electronic means;
• our staff receives training in data protection and information security;
• our security and data protection policy must be complied with by staff when processing your personal data.

Although we take all reasonable measures to protect your personal data against unauthorised access, no system being capable of being regarded as 100% secure, we cannot guarantee the security of the personal data you provide to us.

Payment transactions carried out by us or by the third-party payment service provider are encrypted using SSL or TLS technologies. Where we have given you (or where you have chosen) a password enabling access to certain parts of our website or our application, you are responsible for its confidentiality. We ask you not to share either your personal information or your password.

The law requires us to retain certain information concerning our clients (contact, identity, financial and transaction data) under three separate regimes: (i) accounting documents and supporting records are retained for ten (10) years from the closing of the financial year, in accordance with Article L. 123-22 of the French Commercial Code; (ii) the documents and records over which the tax authorities may exercise their right of communication are retained for six (6) years, in accordance with Article L. 102 B of the French Book of Tax Procedures; (iii) the identification data and the documents relating to transactions, collected in respect of the fight against money laundering and terrorist financing, are retained for five (5) years from the end of the business relationship or from the execution of the transaction, in accordance with Article L. 561-12 of the French Monetary and Financial Code.

These retention obligations remain applicable notwithstanding the striking-off of the company and the cessation of its activities.

You may, under certain conditions, ask us to erase your data: see article 10 “Your rights” below.

In certain circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use that information indefinitely without notifying you.

In certain circumstances, you have the following rights under data protection laws:

• right to withdraw your consent;
• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability.

These rights continue to be exercised under the same conditions notwithstanding the striking-off of the company and the implementation of the Wind-Down Plan, subject to the limits indicated below and to the legal retention obligations mentioned in articles 3.3 and 9.

For any request, you may contact us:

• by post: 965, avenue Roumanille, COLOFT - Arteparc Sophia Antipolis Bâtiment A, 06410 Biot;
• by e-mail: mydata@vancelian.com.

In the event of reasonable doubt as to the identity of the person making a request to exercise their rights, the company may request additional information necessary to confirm their identity, in particular a copy of an identity document bearing the holder’s signature. In such a case, the response times are suspended pending receipt of that information.

Any request will be answered as soon as possible and, in any event, within a maximum period of one month from its receipt. That period may be extended by two months having regard to the complexity and number of requests received, in which case the applicant will be informed.

The request may be made by the Data Subject or by a person specially authorised for that purpose, provided that such person provides evidence of their identity, of that of the principal, of their authority as well as of the duration and precise purpose thereof. The authority must also specify whether the authorised representative may be made a recipient of the response.

You also have the right to lodge a complaint with the competent supervisory authority (in France, the Commission Nationale de l’Informatique et des Libertés — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris cedex 07, tel.: 01 53 73 22 22) if you consider that the Processing of your Personal Data is not carried out in accordance with the applicable provisions.

To understand your rights, you may also refer to the explanations provided by the CNIL: https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles.

11.1 This data protection policy may be modified at any time, such modifications taking effect on the date of publication of the corresponding update.

11.2 In the event of modification, the new policy will be placed online on the Site in the dedicated section.

11.3 We therefore invite you to consult it regularly.

In view of the cessation of the company’s activities, this policy is liable to be updated to take account of developments in its situation.

12.1 Cookies and other trackers or similar technologies may be installed and/or read in your browser or terminal when you visit the Site.

12.2 Our cookie management policy is accessible via a link embedded in the footer of all the pages of the Site (this Cookie section of the Privacy Policy).

Legal bases

Consent: processing of your personal data where you have signified your agreement by a statement or a clear affirmative acceptance of the processing for a specific purpose. Consent is valid only if it is a freely given, specific, informed and unambiguous indication. You may withdraw it at any time by contacting us.

Legitimate interest: our business’s interest in conducting and managing our activities. We take care to consider and balance any potential impact on you and on your rights before processing your data in the context of our legitimate interests.

Performance of the contract: the processing of your data is necessary for the performance of a contract to which you are party or for taking steps at your request prior to entering into such a contract.

Compliance with a legal obligation: processing of your personal data where this is necessary for compliance with a legal obligation to which we are subject.

Categories of personal data

• Identity data: first name, surname, maiden name, username or similar identifier, marital status, title, date of birth, gender.
• Contact data: billing address, delivery address, e-mail address and telephone numbers.
• Financial data: bank account and payment card details.
• Transaction data: details of payments made to and by you, as well as of purchases made in the application.
• Device data: type of mobile device, unique device identifier, mobile network information, operating system, IP addresses, browser type, time zone setting.
• Content data: information stored on your device, including login information.
• Profile data: username and password, purchase history in the application, interests, preferences, comments and survey responses.
• Usage data: details of your use of our applications or of your visits to our sites, including traffic data and other communication data.
• Marketing and communication data: your preferences regarding the receipt of messages and communications.
• Location data: geolocation revealed by your IP address.
• Biometric data: facial recognition and image data for the verification of your identity, by means of automated technology comparing the photographs of your face with the photograph appearing on your identity document.