Legal

Data Privacy Notice

Last reviewed: March 26, 2026 — Imerys IT Department

The full legal text below is provided in English only.

This Data Privacy Notice (“Notice”) describes how Imerys S.A. and its affiliated group companies (“Imerys”, “we”, “our”, or “us”) collect, process, store, and protect the personal data of employees and authorized personnel who access the ImageMine internal media asset management platform (“Platform”). This Notice applies in accordance with the EU General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés), and all other applicable data protection legislation.

1Data Controller

The data controller for personal data processed through this Platform is:

Imerys S.A.

Tour Maine-Montparnasse, 33 Avenue du Maine

75015 Paris, France

Corporate Registration No.: 562 008 151 RCS Paris

For data protection-related enquiries, please contact the Imerys Data Protection Officer (DPO) at dpo@imerys.com.

2Personal Data We Collect

When you access this Platform via the Imerys Single Sign-On (SSO) identity provider, we collect and process the following categories of personal data:

Identity Data: Full name and professional display name as registered in the corporate directory.
Contact Data: Corporate email address.
Profile Data: Profile photograph sourced from the corporate identity directory (where available).
Role & Access Data: Your assigned role within the Platform (e.g., Viewer, Contributor, Administrator) used for Role-Based Access Control (RBAC).
Usage & Activity Data: Pages visited, media assets uploaded, downloaded or modified, album actions, and search queries — collected for audit, security, and service improvement purposes.
Technical Data: IP address, browser type and version, operating system, session identifiers, and access timestamps.

We do not collect special categories of personal data (as defined under Article 9 GDPR) through this Platform.

3Legal Basis and Purposes of Processing

Purpose	Legal Basis (GDPR)
Authenticating and managing your access to the Platform	Art. 6(1)(b) – Performance of a contract / employment relationship
Enforcing Role-Based Access Control (RBAC)	Art. 6(1)(c) – Compliance with a legal obligation; Art. 6(1)(f) – Legitimate interests (IT security)
Maintaining security audit logs and active session records	Art. 6(1)(c) – Compliance with a legal obligation; Art. 6(1)(f) – Legitimate interests (IT security)
Improving Platform performance and user experience	Art. 6(1)(f) – Legitimate interests (service improvement)
Investigating security incidents or policy violations	Art. 6(1)(c) – Compliance with a legal obligation; Art. 6(1)(f) – Legitimate interests

4Data Storage and Security

Personal data processed on this Platform is stored in cloud-based infrastructure managed and operated exclusively by the Imerys IT Department, hosted within the European Economic Area (EEA). We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or disclosure, including:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
Access controls limited to authorized personnel on a need-to-know basis.
Regular security reviews and penetration testing.
Automated monitoring and alerting for anomalous access patterns.

We do not sell, rent, or otherwise transfer your personal data to any third-party commercial entities. Data is shared only with authorized Imerys group entities and with identity providers (currently Okta) solely for the purpose of authentication.

5Data Retention

Personal data is retained for no longer than necessary for the purposes described in this Notice. Specifically:

Active session data is deleted at the end of each authenticated session.
Audit and access logs are retained for a maximum of 12 months from the date of creation.
User profile data is removed within 30 days of the termination of the employment relationship or authorized access agreement.
Uploaded media assets attributed to a user are retained in accordance with the applicable Imerys Records Retention Schedule.

6Your Rights as a Data Subject

Subject to applicable data protection law, you have the following rights with respect to your personal data:

Right of Access

Obtain a copy of the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Erasure

Request deletion of your data where no legal basis for retention exists.

Right to Restriction

Request that we limit the processing of your data in certain circumstances.

Right to Data Portability

Receive your data in a structured, machine-readable format.

Right to Object

Object to processing based on legitimate interests.

To exercise any of these rights, please submit a written request to dpo@imerys.com. We will respond within the timeframe prescribed by applicable law (typically 30 days). You also have the right to lodge a complaint with the competent supervisory authority (in France: CNIL).

7Updates to This Notice

Imerys reserves the right to update this Notice periodically to reflect changes in our data processing practices or applicable legislation. Material changes will be communicated to users through the Platform interface. The date of the most recent revision is indicated at the top of this document. Continued use of the Platform following any update constitutes acknowledgement of the revised Notice.

For any questions regarding this Notice or the processing of your personal data, please contact the Imerys IT Helpdesk at it.support@imerys.com or the Data Protection Officer at dpo@imerys.com.