Personal data protection policy

Last update: March 29th, 2023
WeWard SAS
WeWard SAS, the data controller, (hereinafter referred to as "WeWard SAS") is a simplified joint stock company with a share capital of €1113.50, having its registered office at 111 Avenue Victor Hugo - 75016 - Paris, registered under the SIRET number 85361417000027 with the Paris Trade and Companies Registry. This privacy policy applies to the use of the WeWard Mobile Application (the "Mobile Application"), to the access to the Services we provide and is intended to inform you about the collection, use and more generally the processing of your personal data. All capitalized terms not defined herein shall have the meaning ascribed to them in the Terms of Use. Please note that you must be 15 years of age or older to use the Services.

Personal data processed, legal basis and purposes

1/ WeWardSAS collects and electronically processes personal information including, but not limited to, your name, cell phone number, e-mail address, IP address, unique device identifiers and other identifying information, photographs and/or payment information. The legal basis for the processing is the performance of the contract (Terms of Use to which you have agreed) between you and the Company.
More specifically:
Data
Goals
Email address, unique identifiers related to the user's account
Consents
Your time zone
Language
- Enable the connection to the Service (create an account), authenticate users and enable the proper use of the app
- Know which time zone you are connected to (to reset your step counter from midnight)
- Translate the texts according to your language
Last name, first name, postal address
Mobile phone

Provide "physical" gifts (data transmitted to merchants who need to deliver gifts)
Assist the delivery person in case of concern
Manage any purchases on the marketplace
IP address (city level)
Provide service by awarding points based on actions at WeWard partners
Photographs of receipts for purchases made in the recommended locations
Give you rewards for your purchases
Transaction and earnings history
Transaction and earnings history
In the case of a connection with the Facebook Connect or Google service: email address, name, first name and profile photo of the Facebook or Google account
Logging in to the service and completing the user profile
Number of steps and geolocation data
Counting the user's steps, assessing the distance travelled, verifying eligible physical activities and giving rewards
Your identification data, including your email address, your journey on the app, messages you send us, problems encountered


Support, proper functioning of the app and respect of our commitments
Sending emails (transactional)
As part of the Services, we may provide you with a feature that allows you to search for friends using their phone number, last name, first name, nickname, or by using your Facebook and/or Google credentials. If you choose, you will be asked to allow the Weward Application to access your address book or certain information associated with your Facebook and/or Google account, such as your name, profile picture, gender and list of friends. To the extent you consent, this information will be processed by us to identify your friends who use the Application or to allow you to invite friends to install the WeWard Application. WeWard SAS will never directly contact your friends, non-users of the platform.

2/ With your consent (legal basis), we will collect information about your location, history of places visited, and your physical activity in order to (i) personalize the reward offers visible on the Application according to your profile and your location, (ii) propose you points of interest corresponding to your profile (places to visit). You can enable and disable location by using your mobile device's operating system settings. However, when you disable this feature, you will only have access to limited functionality of the Application and, in particular, it will be technically impossible for us to collect your physical activity and location information, which will prevent tracking and/or converting your movements into Wards. You will, however, be able to earn Wards by performing other actions (viewing advertisements, making purchases, participating in surveys etc.).

With your consent, we also process:
Data
Goals
Email address
Sending emails about partners' offers (personalised advertising)
Data needed for targeted advertising: date of account creation, number of Wards, country, age (if entered), Ad ID (information on your phone that you can reset), path on the app, clicks
Data transferred by WeWard to advertising partners for the purpose of advertising targeting. The non-exhaustive list of partners is as follows: Facebook, Ironsource, Adcolony, Vungle, Applovin...
Gender and date of birth (optional)
Commercial targeting

You may withdraw your consent at any time by contacting us at the email address listed at the end of this Policy or directly from the Mobile Application settings.

3/ As WeWard is a community of users, each person can view certain information related to other users (number of steps, number of Wards, their subscribers, CO2 saved, their contribution to the funding of the community's user rewards). To not share this data, you can choose to make your account "private" in the "settings" of the application so that it is only visible to your subscribers and not to all users. You can also remove subscribers from your account at any time.

WeWard may ask you to upload a photograph. The purpose of this processing is to provide social features that allow you to have a profile that can be identified by another user. The interest is only to make the App more "friendly".

As WeWard is present on social networks, the messages exchanged and the publications are also analyzed and taken into account for the proper functioning of the company.

The legal basis of these processing operations is the legitimate interest of WeWard being specified that the sending of the requested photo is not compulsory and that a refusal does not carry any consequence.

Other processing operations are based on the legitimate interest of WeWard:
Data
Goals
Legitimate interest of the Company
Photograph of your ID, IBAN, date of birth, surname, first name and address.
Traceability and compliance with legal obligations in the case of a bank transfer
To be able to answer the questions of the banks within the framework of their legal obligations
Activity time and calories
Step data for up to 12 months before installing the app
Provide statistics on the person's physical activity in order to improve performance
Provide additional content to users and allow the user to track their performance and measure the effectiveness of the application on user motivation and develop motivational factors.
IP address (city level)
Conducting anonymous statistical studies on the geolocation of users
Know the number of users in each city
Email address
To communicate with you, including to inform you of new features, updates to the Application, the Website, our Terms of Use and/or this Privacy Policy
Provide additional information
Referral code, referral-sponsor links, Balance of Wards of the referral
Propose sponsorship offers
Increase the number of users and enhance the user experience
Geolocation data and history of places visited
Produce anonymous statistics
To know the number of users in certain streets or neighbourhoods
Mobile device type and model, browser type, device identification, connection times and pages viewed
To enable the operation of the Application, the detection of malfunctions to maintain its quality and for general anonymous statistical purposes
Maintain service quality and improve overall customer knowledge
Statistical data (number of views, number of clicks, turnover generated) per partner business
Produce general statistics and improve its knowledge of partner businesses
Transfer of this information to partner businesses, in an anonymous form
Improving service knowledge and performance
Enable partner businesses to evaluate the performance of WeWard
Device ID
Cheat score*
Number of referrals
Verification of suspicious actions
Detection of fraud (people having several IPs for 1 phone, having an abnormal number of referrals, having the same IBAN for several accounts)
Detecting fraud
Photographs of receipts for purchases made in the recommended locations
Know the conversion rates between a visit and a purchase
Transfer of this information to partner businesses (as proof of your visit and for billing purposes)
Evaluating the service and managing the business
Enable partner businesses to evaluate the performance of WeWard
Email exchanges and data on banking transactions and reward distributions.
Access to your transaction and earnings history
Respect contractual and regulatory obligations.
Keep evidence in case of litigation
Ad ID, app journey, impressions, clicks
Measuring the effectiveness of marketing campaigns
Conducting your business
Purchases made on the marketplace
Management of the marketplace and compliance with its accounting obligations
Keeping your business records
File of requests to exercise rights (right of access, opposition, deletion...)
Respond to your requests within the legal timeframe
Respect our legal obligations (GDPR)
*A cheating detection algorithm is used by WeWard whenever a user requests a transfer, a gift card, asks to exchange his Wards for certain gifts or makes a donation. The objective is to detect suspicious behavior (e.g. artificial simulation of steps, artificial simulation of geolocation points, inconsistent viewing of advertisements, sending of forged or non-owned receipts, forging of sponsorships). If the user uses such methods, his account will be suspended. He will be informed beforehand.

4/ We work with third parties (convenience stores, advertising networks, analytics providers, affiliate platforms hereinafter "Partners") that may provide or receive information about you.
Data
Goals
Responses to questionnaires from survey companies (data for which Weward is not the controller)
Weward only sends a customer ID to the partner.
Only when the user answers a survey: data collected and processed by partner survey companies (e.g. tap research and Theoremreach responsible for processing) for their own statistical study purposes. Questionnaires allowing the user to earn Wards. The non-exhaustive list of partners is as follows: Tap Research, InBrain, Pollfish...
Ad ID (information on your phone that you can reset)
To provide rewards based on videos viewed (legal basis: performance of the contract)
To provide targeted advertising (legal basis: consent): ID collected by WeWard and transferred to advertising partners for the purpose of advertising targeting. The non-exhaustive list of partners is as follows:
Facebook, Ironsource, Adcolony, Vungle, Applovin...
Unique account ID and purchases from partners
Provide rewards based on videos viewed (legal basis: performance of the contract) Provide statistics on the person's physical activity in order to improve performance.
Unique identifier (email, database identifier) and user sessions (pages visited, clicks...)
Provide statistics on the use of the application (page views, clicks, retention ...) and allow support and engineers to resolve bugs to improve the performance of the application. The list of partners is not exhaustive: Amplitude, Google (Firebase), Onesignal, Datadog...

A complete list of these partners is available upon request to the email address listed at the end of this Policy.

Recipients

Your personal data is processed by WeWard for the purposes described above and to this end, WeWard is likely to transmit your data to third parties belonging to the following categories:

On the one hand, to our subcontractors: WeWard may engage trusted partners acting as subcontractors and more specifically:

- as part of the provision of the Services by analyzing your data to tally your Wards as well as to allow us to provide you with the Wards you wish to convert into Reward;
- to our advertising partners, such as Ironsource https://developers.ironsrc.com/ironsource-mobile/air/ironsource-mobile-privacy-policy/. Ironsource shares data with the following advertising partners: https://developers.is.com/ironsource-mobile/general/ironsource-exchange-programmatic-partners/, who act as data controllers.
- more generally in connection with the use of the Application to provide support and respond to your requests, to send you an email, to assist you in using the Service, or to help us perform statistical analysis.

These third parties are contractually prohibited from using personal data submitted by WeWard except to provide the services they have been contracted to provide to us, and they are required to maintain the security and confidentiality of your information with equal or greater protection than that provided by WeWard. A contract in accordance with Article 28 of the GDPR is entered into with each of our subcontractors. You can obtain a list of these subcontractors upon request to the email address indicated at the end of this Policy.

On the other hand, to our Partners: WeWard ensures as much as possible that the Services are offered with transparency by the Partners with whom WeWard collaborates. For example, in this regard Partners may request WeWard to obtain information as confirmation of a visit in order to enable you to benefit from the Services offered (Rewards). In the event that your Wards are converted into Rewards with an e-merchant, we may transmit your data so that the latter can know the origin (email address, user name) of their customers. WeWard ensures that Partners with access to your personal data only process it for the purposes described at the time of converting Wards to Rewards.

You can obtain additional information about these Partners by sending an email to the address listed below.

In any event: in addition to the assumptions described above, WeWard will only disclose your personal data, without prior notice, if required by applicable regulations, or if such disclosure is necessary to comply with applicable law or regulation, a legal proceeding and/or an administrative or judicial order; to protect and defend the rights or property of the Company; and/or to act in urgent circumstances to protect the personal safety of the Application Users or third parties. WeWard will never transmit its list of Users to third parties without your prior consent. Subject to your express prior consent, WeWard's partners may contact you directly or through us to offer you commercial offers.

Security

WeWard ensures that your data is processed in complete confidentiality and security by implementing the technical and organisational measures necessary to preserve its security, confidentiality and integrity under optimum conditions.

Only persons strictly authorised by WeWard will have access to your data. No unauthorised third party will have access to your data, except in the case of a legal or union obligation incumbent on the data controller.

Shelf life

WeWard retains your personal data for the period necessary to provide the Services. Thereafter, the data is kept in active base for a maximum of 7 days after the account is deleted, or after 24 months of inactivity

Special features:
Data
Conservation
IP address (city level)
Only the last IP is kept for the duration of the relationship. It is however deleted after 3 months of inactivity on the Application or 7 days after the deletion of your account.
Information that you participated in a survey
WeWard only keeps track of the fact that you have won x Wards for a survey on such and such a day and time for the duration of the relationship, 7 days after account deletion, and/or after 24 months of inactivity.
Facebook or Google username, Facebook or Google profile picture, gender and Facebook or Google friends list.
WeWard does not keep the list of friends. You can delete the Facebook-Google/WeWard link from your Facebook/Google account. WeWard keeps the link for as long as the account exists.
(Geo)location data
Location data related to a transaction is retained as long as your account is active.
Geolocation points are pseudonymized after 2 months and deleted after 24 months.
Cheat Score
WeWard does not keep the cheat score after deleting your account.
Messages (content)
4 years
File of requests for exercising RGPD rights
3 years from the end of the calendar year of your application. 1 month for the copy of your ID if requested.

Identity document
1 month after your ID is uploaded. Information that your ID is validated is retained for the duration of the relationship, 7 days after account deletion, and/or after 24 months of inactivity.



Cookies / Trackers

Mobile applications do not use cookies, as a website would. They use SDKs (software development kits).

Cookies and SDKs are primarily used to enable the site and application to function, or function more efficiently, but also to provide information to the owners of partner websites or to enhance your user experience and to display personalized content or ads to you.

On www.wewardapp.com, we only use a functional cookie (Datatog) to track malfunctions.
No cookies are set by third parties and WeWard does not use any advertising cookies on this site.

On www.business.weward.fr, we use :
- a functional cookie: Sentry, which allows us to identify "crashes" and malfunctions
- an audience measurement cookie: Amplitude

On the WeWard app, we use:
-Tracers necessary for the app to function properly and improve your experience: tracers (Facebook Sign In, Apple SignIn, Google Sign In, Firebase) in order to recognize you when you arrive on the app and an "IPbase" tracer to identify your country and offer you a version of the app corresponding to your country and language (tracers necessary for the provision of a service you request).
We also use tracers (Firebase Crashlytics, datadog) to detect malfunctions of the app.

- The CodePush tracker in order to update the application and which does not collect any personal data.

-Trackers (Leanplum and Firebase) allow to manage the sending of notifications. You can disable notifications by going to the settings of your device.

- Trackers for audience measurement, not subject to consent (Amplitude and Firebase) and strictly necessary for the provision of the service (performance measurement, detection of navigation problems, optimization of the technical performance of the site or its ergonomics, estimation of the power of the servers required, analysis of the content consulted), and which meet the criteria for exemption from consent.

- Advertising trackers (Ironsource, Applovin, Adcolony, Unity, Fyber, Tapjoy, Facebook, SupersonicAds, Inbrain, TheoremReach, CPX, Pollfish, TapResearch, Adjoe) are used to collect data on the performance and exposure of advertising campaigns and to deliver advertising or surveys when you want them to in order to earn rewards.

- Attribution trackers (Adjust and Facebook Ads) are used to analyze and drive acquisition campaigns. You can review your Facebook ad settings and update your preferences at any time.

You may opt out of one or more of the trackers by sending your request to privacy@wewardapp.com.

You may contact WeWard at any time (contact@wewardapp.com for any topic, privacy@wewardapp.com to access the privacy policies for these trackers).

The information collected by the trackers is kept for a maximum of 6 months.

The processing of data from these cookies is carried out in accordance with our Privacy Policy which we invite you to consult.

Transfer(s) of data outside the European Union

Within the framework of the provision of the Services, WeWard may use analysis and notification service providers whose head office or servers are located in countries that are not members of the European Union and that have not been the subject of a decision of adequacy of protection by the European Commission. These countries (USA, Madagascar, UK) provide a lower level of protection than the existing framework in Europe. In these cases, WeWard ensures that this transfer is carried out under conditions that comply with the regulations in force by taking all appropriate measures and within a legal, technical and operational framework that ensures the confidentiality and security of this data. These third parties undertake to respect the European Commission's Standard Contractual Clauses.

You can obtain information on transfers by sending an email to the address indicated below.

Deleting data

You can delete your data at any time by going to the application, in the profile page, via the "delete my account" button or by sending an e-mail to contact@wewardapp.com.
This data will be deleted in its entirety within 7 days.

Your rights


In accordance with the regulations in force, you have the right to access, oppose, rectify and delete your personal data, as well as the right to limit the processing carried out, to port your data and to define the fate of your data in the event of death. Finally, concerning profiling operations, you have the right to object to the use of such a process. You may also withdraw a prior consent granted. Nevertheless, the exercise of some of these rights (opposition to profiling, withdrawal of consent to geolocation) may make it impossible for WeWard to provide you with access to the Application or use all or part of the Services.
These rights can be exercised by contacting us at the following address privacy@wewardapp.com. In addition, you are reminded that you may exercise some of these rights directly through your account settings (deletion of documents, deletion of optionally requested information, and even general deletion of your account). You can remove the Facebook-Google/WeWard link from your Facebook/Google account. If you are not satisfied, you have the right to file a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the supervisory authority in charge of compliance with obligations regarding personal data:

Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 Tel: 01 53 73 22 22https://www.cnil.fr/fr/vous-souhaitez-contacter-la-cnil