Privacy and cookie policy

Entry into force: May 2020

Preamble

VALLOUREC TUBES France (hereinafter, “VALLOUREC”) collects and processes personal data concerning individuals, acting on their own behalf or for the needs of their employer and browsing or registering on the smartengo.vallourec.com website, through which they can buy and sell products on an online intermediation platform, named "Smartengo" (the "Website").

The protection of your personal data is of great importance to VALLOUREC. VALLOUREC takes all necessary precautions to ensure that your personal data is securely processed and in compliance with data protection regulations when you browse the Website.

Thus, VALLOUREC undertakes to collect and process your personal data in accordance with the regulations applicable in this respect, among which French Law No. 78-17 of 6 January 1978 on Information technology, data files and civil liberties in its latest version in force and European Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR").

Thus, the purpose of this privacy and cookies policy (the "Policy") is to determine the terms and conditions for the processing of personal data by VALLOUREC concerning:

(i) persons browsing and registered on the website (the "Users") and

(ii) Users purchasing, on their own behalf or on behalf of their employer, products or services from VALLOUREC (the "Clients").

(together, the Users and the Clients, "you", "your", in small or capital letters)

The Policy also sets out the conditions relating to the cookies that VALLOUREC uses on the Site.

VALLOUREC may modify the Policy according to the needs of VALLOUREC or to comply with applicable regulations. Updates shall be carried out without prior notice and published online; in this event, VALLOUREC shall notify you of such updates.

For any questions or comments relating to this Policy or on how VALLOUREC collects and uses the Personal Data, You can send an e-mail to the following address data.protection@vallourec.com or a postal mail to VALLOUREC.

1. DEFINITIONS

The terms defined below shall have the following meanings, whether used in the singular or plural:

• "Personal Data" means any information relating to an identified or identifiable natural person. An "identifiable" person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to that natural person.

• “Purposes” refers to all the purposes of the processing of Personal Data pursued by VALLOUREC, under the conditions of the Policy.

• “Policy” refers to the present privacy policy and cookies.

• “Website" refers to the Smartengo website accessible at smartengo.vallourec.com.

• "Terminal" refers to the various media through which the Website will be accessible, among which smartphones, tablets, microcomputers via the Internet (PC or Apple) and any object connected/connectable to another object as well as to the Internet.

• "VALLOUREC" or "we" or "us" refers to Vallourec Tubes France.

2. DATA CONTROLLER

Your data is collected and processed by Vallourec Tubes France, acting as data controller.

Vallourec Tubes France is a company incorporated under the laws of France and registered within the Nanterre Trade and Companies Register under number 652 044 991, headquartered at 27 avenue du Général Leclerc, 92110 Boulogne-Billancourt.

For any query regarding data protection, VALLOUREC’s contact details are the following:

Email : data.protection@vallourec.com

3. SOURCES AND CATEGORIES OF PERSONAL DATA

3.1. Sources of personal data

VALLOUREC collects your Personal Data mainly in the following cases:

- when you use or brows our Website, in particular when using cookies,

- when you create a personal account on the Website,

- when you offer one or more products for sale,

- when you declare your interest in a product offered on the intermediation platform by a professional seller and when you purchase said product,

- when you fill in and validate a form on the Website or any form issued by VALLOUREC,

- when you contact us for any reason.

Personal data are collected by VALLOUREC either online or offline. The present Policy is applicable regardless of the method of collection of your personal data, being observed that:

- in the event of an online collection, this Policy is available on the Website,

- in the event of an offline collection, you will be informed of the existence of this Policy.

3.2. Categories of personal data

VALLOUREC mainly collects the following data:

- your surname, first name, and professional details,

- business postal address, e-mail address and telephone number,

- occupation,

- data relating to the acquisition or sale of products on the intermediation platform, such as the list of products ordered, written exchanges, invoices etc.

VALLOUREC processes the personal data in numerous manners, among which the use, conservation, recording, transfer, adaptation, analysis, summary, modification, declaration, sharing and destruction of personal data according to what is necessary in light of circumstances or legal requirements.

3.3. Necessary data

Some information can be necessary for the performance of some services, i.e. mainly accessing to the Website, the creation of an account and the purchase or sale of products through the intermediation platform.

When creating your personal account or on the form for the offer for sale of products, necessary data is indicated on the forms by an asterisk.

If you do not provide the necessary data, related services cannot be performed.

3.4. Accuracy of data

VALLOUREC makes its best efforts to maintain accurate and complete personal data. To ensure that we have up-to-date information, you can inform us of any changes to your details or any other data by contacting VALLOUREC at the above-mentioned contact details.

3.5. Location of personal data

Personal data collected through our Website and/or via our application are hosted in Ireland. Amazon Data Services Ireland Limited, Unit 4033, Citywest Avenue Citywest Business Park, Dublin.

4. PURPOSES AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

Personal Data processing carried out by VALLOUREC through the Website, pursue the following purposes (hereinafter the "Purposes"):

 Data processing is necessary for the performance of a contract

(i) To manage the relationship with Users, including but not limited to :

- the creation and use of a personal account on the Website,

- the acceptance of the terms and conditions of use and of the present Policy

- the communication with Users,

- the performance of a help desk and support services,

- the management of Clients complaints,

- and, more generally, the execution of any contract entered into between Users and VALLOUREC.

(ii) To manage the relationship with Clients, including but not limited to:

- the management of the acceptance of the general terms and conditions of use, the general terms and conditions of sale where applicable (for Clients) and this Policy,

- the order of products,

- the payment of products,

- the processing of your product order,

- the follow-up of the commercial relationship,

- the management of Clients complaints,

- and more generally, the execution of any contract entered into between Clients and VALLOUREC

 On the basis of our legitimate interest, in accordance with your rights

(i) To ensure the proper functioning and continuous improvement of the Website, its functionalities and service,

(ii) To improve all of our products and services,

(iii) To conduct User or Clients surveys

With regards to the abovementioned data processing (i) to (ii), VALLOUREC's legitimate interest is to ensure the best possible experience on our Website, and the best possible quality of service.

(iv) To establish statistical, demographic, marketing and other analyses, for example on your use of our Website or on the ordering of products for Clients,

(v) To offer to Clients, by email, products or services similar to those ordered and acquired from VALLOUREC,

(vi) To offer to Users, by telephone or postal mail, any product or service or to inform you of commercial offers from VALLOUREC or its third party partners

(vii) To forward the postal address and telephone number of the User or Clients to third parties or business partners for the purposes of marketing with human intervention

With regards to the abovementioned data processing (iv) to (vii), VALLOUREC's legitimate interest is to define the type of clients for its products and services, to develop its activity, to ensure the best commercial relationship and the best quality of services.

(viii) To manage recovery and litigation,

(ix) To detect, investigate, prevent or take action regarding illegal activities, abuses, suspected fraud or situations involving potential threats to the security or rights of a person or entity and to use them as evidence in litigation,

(x) To investigate, prevent and deter violations of our Terms and Conditions, this Policy and our property,

(xi) To protect and defend our property, rights and interests, in particular in litigation before any jurisdiction or administration.

Please be advised that personal data required to perform a contract, at the end of said contract, be processed on the basis of our legitimate interest, namely to preserve our rights in the event of legal action.

With regards to the abovementioned data processing (viii) to (xi), the legitimate interest of VALLOUREC is to have its rights respected and enforced and to prevent fraud and any prohibited or illegal activity.

(xii) To communicate with Users and Clients concerning the modification or improvement of our services and amendments to the Policy.

VALLOUREC's legitimate interest is to develop its service and commercial relationship.

 With the Users’ consent

(i) To perform the promotion of non-similar products or services by the transmission by email of advertising and prospecting offers, for example by offering you customized services or to inform you of commercial offers from VALLOUREC or its third party partners,

(ii) To customize our services and the user experience, based on your preferences and/or consumption habits,

 To comply with a legal obligation

(i) To comply with legal and regulatory obligations to which VALLOUREC is subject,

(ii) To manage your requests under your personal data rights.

5. DISCLOSURE OF PERSONAL DATA

VALLOUREC only discloses your Personal Data to authorised and determined recipients. The personal data collected and processed may be transmitted:

- to authorised persons in the relevant departments within VALLOUREC, whom are subject to a non-disclosure agreement.

- to service providers or subcontractors commissioned by VALLOUREC to pursue the Purposes set out in article 4 of the present Policy (i.e., mainly, advertising agencies, computer maintenance services and data hosting providers).

Those service providers act only upon instructions from VALLOUREC and are bound by the same obligations of security and confidentiality as VALLOUREC.

- In the event of a claim, theft or any other breach of terms and conditions or the law, personal data may be transmitted to our insurance company and/or our brokerage company, which is required to keep the data transmitted confidential and, where applicable, to the police and judicial services.

- to the administrative and judicial authorities and more generally to public organisations in the context of compliance with our legal obligations or to enable us to ensure the defence of our rights and interests,

- where appropriate, to our legal counsels and attorneys,

- if we sell or transfer our business or a part of it and if your Personal Data relates to that part sold or transferred, or if we merge with another business, we will share your Personal Data with the new business owner or our partner, respectively.

6. DATA TRANSFER OUTSIDE THE EUROPEAN ECONOMIC AREA

VALLOUREC will take all reasonable legal, technical and organizational measures to ensure that if your data is transferred outside the European Economic Area ("EEA"), it shall be processed securely and with an adequate level of protection compared to the level of protection offered in the EEA.

We may share your personal data with members of the VALLOUREC Group based outside the EEA. We may share your personal data with partners, suppliers or subcontractors based in countries outside the EEA.

In this case, we will endeavour to limit the transfer of your personal data to those countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.

However, we must anticipate that, in the future, recipients may be located in a country outside the EU/EEA that does not offer an adequate level of data protection compared to the European level of data protection. In such an event, VALLOUREC shall choose service providers which accept the standard European contract clauses as authorised by the European Commission and will require them to take all organisational and technical measures to ensure an adequate level of protection for your personal data.

7. STORAGE PERIOD OF PERSONAL DATA

The Personal Data collected are kept for the time necessary to achieve the various Purposes described above.

Personal Data will be deleted following the occurrence of one of the following events:

• The end of the storage period;

• Valid exercise of your right of deletion in accordance with the French Data Protection laws, the GDPR and the terms and conditions provided in the clause "Your rights of access to Your collected data" of the present Policy;

• Deletion of the Website by VALLOUREC for any reason whatsoever.

Purpose Storage period
Create a user account, execute the order of a product and more generally manage the relationship with the User and the Client. As long as the user account is active and 5 years following closure of the account.
Litigation management (recovery, breach of contract or tort ...) According to the limitation period applicable to the obligations between the parties (e.g., under ordinary French law, five years following the event giving rise to the claim) and during the pre litigation / litigation period
Commercial prospecting, either directly by VALLOUREC or by a third party company to which the personal data would be transferred. 3 years following the last contact from the Client (subject to withdrawal of consent, if applicable)
Customization of services and user experience, based on preferences and/or user habits As long as the user account is active and 5 years following closure of the account.
Improvement of the website and of the products and services As long as the user account is active and 5 years following closure of the account.
Establishing statistics As long as the user account is active and 5 years following closure of the account.
Prevention and fight against fraud and, more generally, against any illegal activity or potential threat to VALLOUREC According to the limitation period applicable to the obligations between the parties (e.g., under ordinary French law, five years following the event giving rise to the claim) and during the pre litigation / litigation period
Data collected through cookies See clause 10 of the present Policy. Login logs: 1 year.

In this context, VALLOUREC applies the following storage periods.

8. SECURITY OF PERSONAL DATA

VALLOUREC takes all actions to protect Your Personal Data against damage, loss, misappropriation, intrusion, disclosure, alteration or destruction.

VALLOUREC has implemented material, electronic and organizational protection measures to prevent any loss, misuse and unauthorized access, disclosure, alteration or destruction of this Personal Data.

Those security measures imply the use of advanced technologies designed to protect personal data during transfer and to prevent transmission errors or unauthorized acts by third parties.

Physical and electronic backup procedures for Personal Data collected on the Website are implemented.

The employees of VALLOUREC whom, given their position, would have access to Your Personal Data are committed to the utmost confidentiality in this respect.

In any event, it is important that you take special care to prevent any unauthorized access to Your Personal Data. You are responsible for maintaining confidentiality of your password and account information. Therefore, for instance, you must ensure that you log off if you use a shared computer.

VALLOUREC has no control over the content of third party Internet sites or over the practices of these third parties with regard to the protection of any personal data they may collect, which thus removes this data from the control of VALLOUREC. Consequently, VALLOUREC declines all responsibility with regard to the content of third party Internet sites or the practices of these third parties with regard to the protection of personal data. Therefore, VALLOUREC invites you to inquire about the personal data protection policies of these third parties.

VALLOUREC is committed to protect your personal data. If you have reason to believe that the security of your personal data has been compromised or that it has been misused, please contact VALLOUREC by email: data.protection@vallourec.com.

VALLOUREC will investigate complaints regarding the use and disclosure of personal data and will try to find a solution in accordance with the principles of the present Policy and the applicable regulations on Data Protection.

9. COOKIES

When You visit the Website, some information relating to your browsing may be recorded in "cookie" files installed on Your Terminal.

A cookie is a file installed on Your Terminal, which records information relating to navigation on a website. These cookies are deposited during your browsing on our Website, either directly by us or by some of our partners.

Cookies have many functions. In particular, they allow you to navigate between pages in an efficient manner, they remember Your preferences and generally improve the user experience. Cookies allow the ads that appear on your screen to be more relevant and adapted to your interests. For more information about cookies, please visit: www.allaboutcookies.org .

9.1. Which cookies do we use on the Website?

The Website uses both :

- the cookies issued by VALLOUREC, placed directly by us on your Terminal.

- third party cookies, set by third parties on our behalf. We use third-party cookies to help us analyse the use of our Site.

Only the emitter of a cookie is likely to read or modify the information contained in this cookie.

You can configure your internet browser so as to be able to oppose, totally or partially to the recording of "cookies". The configuration also gives You the possibility to accept or refuse cookies occasionally, before they are installed on Your Terminal.

If You refuse the installation of some cookies, this will be likely to modify Your navigation and/or the functionalities and services and conditions of access to certain services requiring the use of cookies, such as, for example, an ergonomic layout of the Website adapted to Your Terminal.

9.1.1. Strictly necessary cookies

This kind of cookies are essential to enable you to use the Website and to use its features, such as access to your user account. These cookies are activated following actions you perform that correspond to a request for services, such as configuring your privacy preferences, logging in, filling out forms or using a shopping cart.

These cookies do not collect any information that could be used for marketing or targeting purposes.

You can set your browser to block or be alerted about the use of these cookies. However, if you refuse the registration of these cookies, you will no longer be able to enjoy some functionalities that are nevertheless necessary to navigate on some pages of the Website. This is for example the case of our services requiring you to identify yourself on your user account.

❖ Which strictly necessary cookies do we use on the Website?

Name of the cookie Description of the cookie Storage period
PHPSESSID Enables to keep the session active when a user logs in. 24 hours
_la, _lt Enables the link between the running session and the javascript files called from a CDN Related to the running session

9.1.2. Audience measurement cookies

This kind of cookies allows us to know, among other information, the number of visits on the Website’s pages and which pages are consulted. This information allows us to improve the Website and to always offer you a better experience.

❖ Which audience measurement cookies do we use on the Website?

Name of the cookie Description of the cookie Storage period
Google Analytics « Google Analytics is a Google tool for web trafic analysis that enables website owners to better understand the behavior of their users. This tool uses cookies to collect information and generate reports on usage statistics of a website without that individual users are identified personally by Google.The cookie "__ga" is the one most used by Google Analytics. For more information on this cookie, we invite you to consult the privacy policy set by Google https://policies.google.com/privacy?hl=en ». This processing is used for the purpose of analysis and statistical study of the use of our Site. Google processes the data mentioned in its privacy policy :
- https://support.google.com/analytics/answer/6004245?hl=fr/
- https://policies.google.com/privacy?hl=fr#infocollectbr
This data includes in particular the IP address of the devices used to consult the Site. The person concerned is not obliged to provide this data and may object to its processing at any time. In order to prevent the collection of data relating to the use of the Website and the processing of this data by Google, the person concerned must follow the instructions of Google: http://tools.google.com/dlpage/gaoptout.
_ga, _gid, collect, gcl_au, gid These cookies are used by Google Analytics to save a unique identifier used to generate statistical data on how the visitor uses the website. 24 hours
_gat This cookie is used by Google Analytics to reduce the rate of requests 24 hours
A3 This cookie is used by Yahoo for audience tracking. 1 year
APID Yahoo - Collects information about visitor behavior on multiple websites. This information is used on the website in order to optimize the relevance of advertising. 24 hours
B Yahoo - Collects anonymous data related to visits to the user's website, such as the number of visits, average time spent on the website and pages that have been loaded. The recorded data is used to categorize user interest and demographic profiles in order to customize the website content depending on the visitor. 1 year
GUC Yahoo - Cookie enabling to track conversions 24 hours
IDSYNC Yahoo Analytics - Used to identify the visitor through visits and devices. This allows the website to display relevant advertising to the visitor - The service is provided by third party ad centers, making it easy for advertisers to bid in real time. 1 year
NID Google - The NID cookie contains a unique ID that allows Google to save your preferences and other information, including your preferred language (for example, English), the number of search results to display per page (for example, 10 or 20), and the desired state of the Google SafeSearch filter (enabled or disabled). 2 hours


9.2. Your choice with regards to the installation of cookies on your terminal

We offer you several ways to manage your choices regarding the installation of cookies. Your cookie settings may modify your browsing on the Website or even prevent the use of certain features of the Website.

9.2.1. The management of your preferences on the Website

In accordance with applicable regulations, we obtain your consent before installing cookies on your terminal.

9.2.2. The management of your preferences through your Internet browser

Your internet browser can be configured to allow cookies to be saved on your terminal or to reject them, either systematically or according to their originator. You can also configure your browser so that you are offered the option of accepting or rejecting cookies before a cookie is likely to be stored on your terminal.

In addition, your browser offers the possibility of browsing in "Private Browsing" mode. This mode allows you to browse without keeping a history of pages visited or downloads. With regard to cookies, any cookies that have been saved during your browsing will be erased when you close your browser. It is therefore not a solution that allows you to refuse cookies, but their lifetime is then limited to the duration of your navigation.

You will find below additional information for each browser, as well as information about the Google Analytics audience measurement cookies that we use. More information is available via the "Help" tab of your browser.

 For Internet Explorer

https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies

Internet explorer does not enable the management of cookies on a case-by-case basis. To delete all your cookies :

· Select the “tools” button, and then select “Internet Options”

· In the "General" tab, under the section "Browsing History", click on "Delete”

· Select the “cookies” check box, and then select “Delete”.

 For Safari

https://support.apple.com/fr-fr/guide/safari/sfri11471/mac

· From the Safari menu, select "Preferences".

· In the window that opened, go to the "Security" tab.

· Click on "Show Cookies".

· In the window that opened, find and select the Cookies you want to delete, and click on "Delete".

 For Chrome

https://support.google.com/chrome/answer/95647?hl=en&hlrm=en

· From the Chrome menu, select "Settings".

· View site settings

· Go to the "Privacy" section

· Click on "content settings".

· In the "cookies" paragraph (first paragraph), click on "cookies and site data".

· Find the Cookies you want to delete and click "OK". You can also choose to delete all your Cookies.

 For Firefox

https://support.mozilla.org/fr/kb/desactiver-cookies-tiers

· In the Firefox menu, go to "Tools" then "Options".

· On the "Privacy" tab, click on "Show Cookies".

· Find the Cookies you want to delete and click on "Delete Cookies".

 For Opera

https://help.opera.com/en/latest/web-preferences/#cookies

 Desactivate Google Analytics cookies

You can prevent the use and deposit of this cookie on your terminal by going to https://tools.google.com/dlpage/gaoptout?hl=en . The cookie is called " _ga " and is an audience measurement cookie.

9.3. What are your rights regarding cookies?

You can delete cookies at any time, being observed that some cookies are necessary to allow the use of some features of the website.

Insofar as some cookies, in certain circumstances, may be considered as personal data, you enjoy all the rights resulting from the applicable regulations on personal data.

10. YOUR RIGHTS REGARDING YOUR PERSONAL DATA

VALLOUREC informs you that you enjoy the following rights under applicable regulations on personal data, among which the GDPR and French law No 78-17 of 6 January 1978.

You have the right to access your personal data. In addition, you have the right to request that your personal data be corrected, completed, updated or deleted. You also have the right to obtain communication of your personal data kept by VALLOUREC. You also have the right to object to the processing of Your Personal Data for legitimate reasons.

You may file a complaint with the CNIL, which website is accessible at the following address: http://www.cnil.fr, and which head office is located at 3 Place de Fontenoy, 75007 Paris.

With regards to processing based on his consent, the Client may withdraw it at any time, without prejudice to the lawfulness of the processing prior to such withdrawal.

You may exercise Your rights by sending Your request by e-mail or by post to the contact details below, specifying Your request and enclosing proof of identity:

Vallourec Tubes France

27 avenue du Général Leclerc, 92110 Boulogne-Billancourt.

Email : data.protection@vallourec.com

In addition to the information below, VALLOUREC invites you to consult the CNIL website <cnil.fr>:

- Right of access: you have the right to obtain confirmation from VALLOUREC as to whether or not your personal data are processed and, where that is the case, access to said data as well as information relating to the purposes of the processing (art. 15 of Regulation 2016/679 of the General Data Protection Regulation ("GDPR")). Manifestly unfounded, excessive or repeated requests may not be answered.

- Right to rectification: you have the right to obtain from VALLOUREC, without undue delay, the rectification of your personal data which you consider inaccurate (art. 16 of the GDPR),

- Right to erasure: you have the right to obtain from VALLOUREC the erasure of your personal data, under the conditions set out in article 17 of the GDPR,

- Right to data portability: you have the right to receive the personal data concerning you which you have provided to VALLOUREC, in a structured, commonly used and machine-readable format (art. 20 of the GDPR).

- Right to restriction of processing: you have the right to obtain from VALLOUREC restriction of the processing of your personal data under the conditions of article 18 of the GDPR,

- Right to withdraw consent: You have the right to withdraw your consent to the processing of your data if such processing is based on consent. Withdrawal of such consent shall not affect the lawfulness of the processing based on consent prior to the withdrawal of consent.

- Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, where such processing is based on a legitimate interest and subject to the conditions of Article 21 of the GDPR,

- Right to organise the processing of your personal data in the event of your death: you have the right to define general or specific guidelines relating to the storage, erasure and communication of your personal data after your death (French law No 78-17 of 6 January 1978, art. 40, II),

- Right to file a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, you have the right to file a complaint with a supervisory authority if you consider that the processing of your personal data infringes the regulations applicable to personal data (art. 77 of the GDPR).