Personal Data Protection Policy

Target Skills (hereinafter “Target Skills” or “We”) is committed to preserving the confidentiality of your personal information and attaches great importance to protecting the privacy of the users of its services.

The purpose of this Privacy Policy is to define the rules applicable to the collection and processing of the personal information of persons interacting with our online services (hereinafter the “Users” or “you”). In particular, it explains what data we may collect about you, how we use this data, with whom we may share it and what measures we take to ensure its security. This Privacy Policy applies to the Planningpme.com website (hereinafter “the Website”).

Some hyperlinks or social network buttons on the Websites may redirect you to third-party websites that do not belong to Target Skills. These may be websites operated by partner companies. The publishers of these third-party websites have their own personal data protection rules, which may differ from ours: it is your responsibility to read them. Target Skills is not responsible for any subsequent use of your data made by the publishers of these third-party websites on their own behalf.

By using our online services, it is deemed that you have fully and completely accepted this Policy.

Should you disagree with one of its terms or conditions, you are free not to use our services, or not to continue using them where the Policy has been amended.

The content of our Policy may be subject to change over time in order to accommodate functional modifications and regulatory reforms. You will be automatically made aware of updates by any means available (e-mail, pop-up window, etc.).

More generally, the Policy is always available via our website’s various pages.

The processing of the Personal Data of internet users and our services is governed by the European Regulation 2016/679, dated 27 April 2016, concerning the protection of individuals as regards personal data processing and the free circulation of this data, (known as the “GDPR”) and Law no. 78-17, dated 6 January 1978, regarding information technology, files and freedoms, amended (known as the “Law on Information Technology and Freedoms”) (hereafter referred to as the “Regulation”).

Under the requirements of this Policy, the term “Personal Data” refers to any information relating to a natural person who may be directly or indirectly identified, such as their last name, first name, email and postal address, telephone number, login, password, etc. (hereafter referred to as “Personal Data”).

Within the meaning of the Regulation, the Target Skills company is responsible for the processing of personal data carried out via the Website, and undertakes to comply with the legal and statutory obligations which are incumbent upon it.

Using the Websites and via online forms, we gather the Personal Data of internet users who would like to:

• Contact us for any requests, in particular to find out more about what we do;
• Contact us for a free trial;
• Receive our newsletters.

For instance, the Personal Data gathered and processed by us relates to

• Data relating to your identity, for example your name;
• Your contact details such as your email address, telephone numbers and country;
• Your connection data such as the IP address and connection logs.

Finally, and subject to your giving your consent, each time you visit our Website and use our online services, we gather data and information relating to your browsing history. This data and information is recorded in “Cookie” files which are installed on your device.

We gather and process your data for the following purposes:

• To manage the prospective customer relationship (for example, in order to respond to your requests);
• To send newsletters, sales promotions, special offers and alerts which match your chosen criteria, by email, telephone or via the internet;
• To improve our service quality (e.g. to measure Website traffic);
• To ensure Personal Data security (e.g. to prevent digital identity theft);
• To resolve any potential legal action and any problems which may arise from the use of services.

The Target Skills company undertakes to only access or use your Personal data for the purposes stated here.

The processing of your Personal Data is justified on a variety of grounds (legal bases) which depend on the use we make of it.
The legal bases that apply include:

• Consent: you accept the processing of your Personal Data by expressly giving your consent (tick box, click, etc.). You may withdraw this consent at any time.
• Legitimate interest: Target Skills has a business interest in the processing of your data which is justified, balanced and which in no way infringes your personal privacy. Apart from a few exceptions, you can object at any time to processing on the basis of legitimate interest by alerting us to it.
• Legal obligation: the processing of your Personal Data is made mandatory by a law.
• Contract: the processing is necessary for the performance of a contract you have entered into with TARGET SKILLS (e.g. to give you access to your personal account).

The legal basis for our data processing is shown in detail in the table below.

We retain your Personal Data for as long as you continue to use our services.

In addition, even if you decide to stop using our services, we will need to continue holding your Personal Data for a certain time in order to meet certain obligations. This includes, for instance, in order to comply with the applicable legislation, to manage complaints and/or disputes, to defend our interests and enforce our rights, as well as to respond to requests from the competent authorities.

Nevertheless, these retention periods comply with the legal and statutory demands and recommendations of CNIL. In this respect, we will not conserve your Personal Data for longer than is necessary, and when we no longer need it we will destroy it by a secure method in compliance with our internal policy, or we will anonymise it.

Here are some concrete examples of retention periods for your Personal data:

• Deletion within a week after a request for removal from the newsletter mailing list;
• Deletion of cookies 90 days from the time they are installed on the internet user’s device;
• Deletion of your PlanningPME database where there has been a 30 day free trial 90 days after the end of the trial period, unless the service is signed up for;
• Deletion of the personal data of contacts at prospects 3 years after the last contact.

As part of our business, we communicate your Personal Data to third parties which are involved in the provision of our services (technical service and hosting providers, quotation requests, customer follow-up and customer satisfaction surveys, security incident management, etc.). The Target Skills company undertakes only to communicate your Personal Data to competent, trustworthy service providers who will process them on our behalf and as instructed by us.

Furthermore, your Personal Data may be shared with a third party:

• if the company Target Skills is obliged to do so by law, a statutory provision or a court order, or if this disclosure is made necessary by an enquiry, an injunction or legal proceedings within the French territory or abroad;


• in order to enforce the policy (including for the purpose of identifying potential breaches of these) and in order to safeguard against any infringements of the rights, property or security of the Target Skills company and the users of our service, in accordance and compliance with the law (e.g. lawyers, bailiffs, etc.).

We implement both organisational and technical measures in order to protect your personal data against unauthorised access and disclosure, modification, alteration, damage, accidental loss, accidental or deliberate destruction, as well as against any other form of wrongful processing or communication to unauthorised persons.

In order to do this, we insist that our staff and technical service providers observe strict rules regarding security and data protection (e.g. contractual confidentiality obligations, the use of encryption and anonymisation techniques, the implementation of physical security measures, etc.).

Furthermore, we inform you that your Personal Data is stored on servers in a member country of the European Union. Finally, you should be aware that your Personal Data is never transferred by us outside the European Union. The use of cookies from Google Analytics and Google Ads services may involve the transfer of your Personal Data outside the European Union. For this purpose, Google relies on the European Commission's Standard Contractual Clauses for data transfers outside the EU, in its contracts with customers of its professional services.

All internet users or users of our services whose Personal Data is processed by the Target Skills company have the following rights:

• The right to access it (e.g. to check your data held by us and obtain a copy);


• The right to rectify it (e.g. to update or correct your data if it is incomplete or incorrect);
• The right to oppose at any time the gathering and processing of part or all of your data for the purposes of business prospection, for instance, including for profiling to the extent that it is related to prospection of this kind. Therefore, this right provides you with the option of modifying your notification preferences at any time.
• The right to limitation (e.g. in certain cases stipulated by the law, and if you challenge the processing of certain pieces of data, you can demand that we restrict its use in the course of managing our dispute);
• The right to portability (e.g. you have the right to get your data back or to demand that it be sent to a third party service provider);
• The right of deletion (e.g. you can demand that your User Account be definitively deleted);
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

You can exercise your rights at any time by making requests to the addresses provided in section 11 below. If there is any doubt about your identity, we may ask you to provide proof of your identity.

If you do exercise your rights, we undertake to respond as soon as possible, and, in any case, by a legal deadline of 1 month from the date your request is received.

If necessary, and as permitted under law, this deadline may be extended by 2 months should the requests that you make to Target Skills be complex or numerous. In this case, you will be informed of this deadline extension and the reasons for the delay.

If Target Skills fails to respond to your request, we will inform you of the reasons for this failure to take action, and if you consider it to be necessary, you will have the option of making a complaint to CNIL and/or lodging legal action.

To find out more about your rights or to make a complaint, you can contact the Commission Nationale de l’Informatique et des Libertés (National Commission on Information Technology and Freedoms (known as “CNIL”)) (website: https://www.cnil.fr/).

Cookies are small text files which are added to the browser of an internet user’s device when they visit Websites. Cookies are widely used on Websites. They ensure that they function correctly or can improve browsing. They also provide specific information, specifically in terms of measuring visitor numbers for website owners.

The data gathered by cookies enable Target Skills to analyse the use of the Website and to provide the website user with a better user experience when visiting the Website. The information gathered by these cookies is not used to send advertisements to the user by email or through the post.

You are made aware of the presence of these cookies when you log on to the Website by an information banner at the top of the homepage.

Target Skills’ Cookies

These are cookies installed by Target Skills on your end device to enable browsing on our Website or to optimise and personalise our services on our Website.

Third-Party Cookies

These are cookies placed by third-party companies, for example to understand the use and performance of our website and to improve how it works (for example, the most frequently visited pages, the number of visitors). We inform you that we have no control over the use of cookies by third parties.

Different types of cookies are used on our Website for different purposes. Some cookies are required in order for you to use our Website.

Types of cookie	Name of the cookie or service	Publisher	Link to confidentiality policy (where applicable)
Advertising	Google Ads	Google	https://policies.google.com/privacy
Audience monitoring	Google Analytics	Google	https://policies.google.com/privacy?hl=en
Operation	PlanningPME	Target Skills
Form	Website	Target Skills

The web user/user of our services has the option of configuring their own end device, and therefore can:

• accept all cookies, or
• be informed when a cookie is installed, or
• only refuse certain cookies, or even
• refuse all cookies.

Certain cookies are subject to consent. The agreement given for a cookie is valid for a maximum period of thirteen (13) months, as from the first time it is installed on the end-device.
If you refuse to allow cookies to be installed on your end device or browser, or if you delete the cookies installed on it, we inform you that your web browsing and experience may be limited. Under these circumstances, we decline all responsibility for any consequences associated with the impaired working of our services which results from it being impossible for us to install or consult the cookies that are required for it to function and that you have refused or deleted.

There are different ways for you to manage cookies:

• By making your choice via the cookie banner displayed when you first visit our Website;
• By making your choice via our cookie manager, accessible from the cookie information banner or at the bottom right of the page under “Service management”;
• By configuring your internet browser.

Instructions for settings are provided on each browser’s website:

Internet Explorer:
https://support.microsoft.com/en-us/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d

Firefox:
https://support.mozilla.org/en-US/kb/introducing-total-cookie-protection-standard-mode

Safari:
https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac

Chrome:
https://support.google.com/chrome/answer/95647?hl=de&hlrm=en

You can also find additional information on the website of the “Commission Nationale de l’Informatique et des Libertés” (National Commission for Information Technology and Freedoms (CNIL)) : https://www.cnil.fr/

For any questions relating to the Policy, and more generally to the processing of your Personal data by the Target Skills company, contact us:

• By email at the following address: privacy@planningpme.com
• By post to the following address:Target Skills, GDPR Department, 1-3 rue Marcel Carné – 91080 Courcouronnes.

This appendix to the Privacy Policy supplements the existing Privacy Policy and aims to define the specific rules applicable to the collection and processing of your Personal Data resulting from the implementation by TARGET SKILLS of an MCP connector for PlanningPME. This connector is used to connect the artificial intelligence assistant of your choice (for example the AI assistants Claude, ChatGPT, Gemini, etc., also called AI Client, hereinafter the “AI Assistant”) with PlanningPME.

This connector allows a User of PlanningPME Web Access (Premium and Enterprise editions) to authorise the AI Assistant to consult their organisation’s planning data, within the limits of the rights they already have in PlanningPME Web Access. Use of the connector is entirely optional: no data is shared with the AI Assistant until you have connected it yourself.

The transmission of Personal Data to the AI Assistant is initiated by the User, who chooses to install the connector and then to make a request. The processing of the data received by the company providing this AI Assistant is governed by that company’s terms and privacy policy applicable to the AI Assistant plan subscribed. We invite you to check these terms, in particular regarding the use of data for model training, before authorising the connector.

In its current version, the connector only allows read-only access to the data contained in PlanningPME Web Access: searching and viewing resources, customers, projects and tasks, reference lists, and planning settings (time zone, enabled features). The data accessible to the AI Assistant is only the data you can already view in PlanningPME Web Access. It does not create, modify or delete any data.

You can revoke a connection to the AI Assistant at any time from PlanningPME Web Access. Disconnecting the connector from the AI Assistant does not immediately revoke the authorisation on the PlanningPME Web Access side: it remains valid until it is revoked within PlanningPME Web Access.

This appendix to the Privacy Policy does not cover the following scope:

• the operation of PlanningPME Web Access itself;
• the operation of the AI Assistant, governed by the contractual documents and privacy policy of the company providing this AI Assistant;
• the desktop version of the PlanningPME software.

The company providing the AI Assistant is neither a service provider nor a GDPR processor of TARGET SKILLS. The company providing the AI Assistant processes your Personal Data only in accordance with the terms of your subscription to its service. In your relationship with that company, you act as data controller and the company acts as processor. The company providing the AI Assistant has its own terms of use and its own privacy policy, which we invite you to consult.

The data required for the operation, security and traceability of the connector (login credentials, audit log, IP addresses) is processed by TARGET SKILLS as data controller.

Through the implementation of the connector, TARGET SKILLS collects the Personal Data of Users who wish to authorise the AI Assistant to consult their organisation’s planning data in PlanningPME Web Access.

For instance, the Personal Data gathered and processed by us relates to

• The organisation’s planning data accessible via the connector (resources, employees, tasks, customers, projects, skills, unavailabilities, etc.);
• The data required for the operation, security and traceability of the connector (login credentials, audit log, IP address).

The User is informed that the connector is not designed to process special categories of data within the meaning of Article 9 of the GDPR. Each User is responsible for not entering health data or any other special categories of data in PlanningPME Web Access in fields exposed by the connector, in particular labels and free-text fields.

We gather and process your data for the following purposes:

• Enabling the connection between the AI Assistant and PlanningPME;
• Authenticating and authorising the User, running the tools they request via the AI Assistant, and enabling planning data to be consulted within the AI Assistant;
• Ensuring the operation, security and traceability of the connector.

The processing of your Personal Data is justified on a variety of grounds (legal bases) which depend on the use we make of it.
The legal bases that apply include:

• Legitimate interest: TARGET SKILLS has a legitimate interest in processing your data that is justified, balanced and does not infringe your privacy. Unless otherwise provided, you may object at any time to processing based on legitimate interest by notifying us.
• Legal obligation: the processing of your Personal Data is made mandatory by a law.
• Contract: the processing is necessary for the performance of a contract you have entered into with TARGET SKILLS.

The legal basis for our data processing is shown in detail in the table below.

Your Personal Data will only be kept for the time necessary to carry out the above-mentioned processing, in accordance with the privacy Regulations, and in any event within the limits imposed by applicable legislation.

In addition, even if you decide to stop using our services, we will need to continue holding your Personal Data for a certain time in order to meet certain obligations. This includes, for instance, in order to comply with the applicable legislation, to manage complaints and/or disputes, to defend our interests and enforce our rights, as well as to respond to requests from the competent authorities.

Nevertheless, these retention periods comply with the legal and statutory demands and recommendations of CNIL. In this respect, we will not conserve your Personal Data for longer than is necessary, and when we no longer need it we will destroy it by a secure method in compliance with our internal policy, or we will anonymise it.

Here are some concrete examples of retention periods for your Personal data:

At the end of these periods, the data is deleted or irreversibly anonymised. Termination of the PlanningPME Web Access subscription results in the revocation of all connector authorisations associated with the account.

In the course of our activities, we share your Personal Data with third parties involved in providing our services (technical and hosting providers, security incident management, etc.).

In all cases, TARGET SKILLS undertakes to share your Personal Data only with authorised and trusted recipients and processors, who process it on our behalf and according to our instructions.

Furthermore, your Personal Data may be shared with a third party:

• if TARGET SKILLS is required to do so by law, a regulatory provision or a court order, or if such disclosure is necessary for the purposes of an investigation, injunction or legal proceedings, in France or abroad;
• in order to enforce the Privacy Policy (including to establish any breaches thereof) and to protect against any infringement of the rights, property or safety of TARGET SKILLS and the Users of our services, in application of and in compliance with the law (e.g. lawyers, bailiffs, etc.).

The Personal Data processed by TARGET SKILLS is hosted on servers located in the European Union.

However, at your request, the AI Assistant can be connected to PlanningPME Web Access. In this context, when PlanningPME responses are transmitted to the AI Assistant at the User’s request, Personal Data may be transferred outside the European Union by the company providing the AI Assistant.

As data controller, if you choose to use the AI Assistant and to allow its connection with PlanningPME Web Access, you are responsible for any transfer of data outside the European Union carried out at your request by the company providing the AI Assistant. TARGET SKILLS is not a party to your contractual relationship with the company providing the AI Assistant and does not know which plan you have subscribed to with that company.