General Personal Data Protection Policy

To file a complaint or exercise your rights, please write to: contact@madeintracker.com

This “Personal Data Protection Policy” (the “Policy”) informs all data subjects (“you”, “your”) about:

• how MADE IN TRACKER(“Made In Tracker”, “we”) processes your personal data as data controller, in the context of operating the MD Atlas site (dm-atlas.fr / md-atlas.com, the “Site”);
• the rights you have in this respect.

1. Scope of this personal data protection policy

EU Regulation 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”), in force since 25 May 2018, applies to all undertakings that collect, store or process personal data.

The concept of personal data (“Personal Data”) refers to any information relating to an identified or identifiable natural person. An “identifiable natural person” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Made In Tracker transparently processes your Personal Data in the following situations:

• when you create a user account on MD Atlas;
• when you create a QARA professional page on MD Atlas;
• when you subscribe to our newsletter;
• when you contact us via our contact forms or by email;
• when you visit the Site dm-atlas.fr / md-atlas.com.

2. Processing of your Personal Data when creating a user account

2.1 Purpose, legal basis and Personal Data processed

When creating an account on MD Atlas, the following Personal Data is collected and processed:

• email address (required);
• password, stored hashed (never readable in clear text).

This Personal Data is used to create, manage and secure your user account, grant access to the Site's features and authenticate you. It is collected and processed on the basis of MD Atlas's legitimate interest in managing its public relations and replying to you, in accordance with Article 6.1.f) GDPR.

2.2 Retention period

Made In Tracker retains this Personal Data for the entire active life of your account. In the event of prolonged inactivity, the account and associated data are deleted after 5 years of inactivity. You may also request deletion of your account at any time.

2.3 Transfer and recipients of Personal Data

Made In Tracker does not transfer the collected data outside the European Union.

2.4 Recipients of Personal Data

Personal Data may be communicated to Made In Tracker staff who need it for the performance of their duties, to services in charge of controlling Made In Tracker, and to authorities where Made In Tracker is legally required, or where such disclosure is necessary to enforce the general terms or other agreements, protect your rights, your property or those of Made In Tracker.

2.5 Your rights over your Personal Data

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to decide what happens to your data after your death.

Exercise your rights by writing to contact@madeintracker.com.

If you believe the processing does not comply with the regulation, you may lodge a complaint with the CNIL:

CNIL – Complaints department
3, place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07
Tel: +33 1 53 73 22 22
www.cnil.fr

3. Processing of your Personal Data for the newsletter subscription

3.1 Purpose, legal basis and Personal Data processed

When you subscribe to our newsletter, the following Personal Data is processed:

• email address;
• consent record (date, timestamp, source).

This Personal Data is used to send you editorial communications, news and information about MD Atlas. It is collected and processed on the basis of your consent, under Article 6.1.a) GDPR.

You can withdraw your consent and unsubscribe at any time via the unsubscribe link in every email, or by writing to contact@madeintracker.com.

3.2 Retention period

Your data is retained until you unsubscribe. After unsubscription, the email address may be kept as evidence of consent withdrawal for the applicable limitation period.

3.3 Transfer and recipients of Personal Data

Newsletter technical management is handled by our provider Brevo (formerly Sendinblue SAS), headquartered in Paris, France. Data is processed within the European Union. Made In Tracker does not transfer the collected data outside the European Union.

3.4 Recipients of Personal Data

Personal Data may be communicated to Made In Tracker staff who need it for the performance of their duties, to services in charge of controlling Made In Tracker, and to authorities where Made In Tracker is legally required, or where such disclosure is necessary to enforce the general terms or other agreements, protect your rights, your property or those of Made In Tracker.

3.5 Your rights over your Personal Data

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, the right to withdraw your consent at any time, and the right to decide what happens to your data after your death.

Exercise your rights by writing to contact@madeintracker.com or file a complaint with the CNIL.

4. Processing of your Personal Data when sending a message via the contact form

4.1 Purpose, legal basis and Personal Data processed

If you contact Made In Tracker via the Site's contact form or by email, Personal Data concerning you may be transmitted to us and processed on that occasion:

• name;
• email address (required);
• organization (if applicable);
• message content;
• and any Personal Data you choose to share with Made In Tracker in your messages.

This Personal Data is used to handle your message and reply if a reply is required, as well as to improve Made In Tracker's services. It is collected and processed on the basis of Made In Tracker's legitimate interest in managing its public relations and replying to you, under Article 6.1.f) GDPR.

4.2 Retention period

Made In Tracker retains this Personal Data for the entire time necessary to handle your message and any follow-ups, then for an additional period of 5 years from the date of the message as evidence, in accordance with the applicable limitation period. After these periods, the Personal Data is deleted.

4.3 Transfer and recipients of Personal Data

Made In Tracker does not transfer the collected data outside the European Union.

4.4 Recipients of Personal Data

Personal Data may be communicated to Made In Tracker staff who need it for the performance of their duties, to services in charge of controlling Made In Tracker, and to authorities where Made In Tracker is legally required, or where such disclosure is necessary to enforce the general terms or other agreements, protect your rights, your property or those of Made In Tracker.

4.5 Your rights over your Personal Data

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to decide what happens to your data after your death.

Exercise your rights by writing to contact@madeintracker.com. You may also file a complaint with the CNIL.

5. Processing of your Personal Data when you create a professional page

5.1 Purpose, legal basis and Personal Data processed

If you create a QARA professional page on MD Atlas, the following Personal Data is collected and processed:

• full name (required);
• professional role(s) you select (required);
• your account email address, used as the page's identifier;
• any optional profile information you later choose to add (photo, headline, country, contact details, company affiliations);
• a record of your consents (date and timestamp).

This Personal Data is used to create and operate your professional page. It is collected and processed on the basis of your consent, under Article 6.1.a) GDPR. Two separate, optional consents are collected at registration:

• public visibility — your page is private by default (visible only to you); only if you expressly consent does it become searchable on MD Atlas and indexable by search engines. You can change this at any time;
• role-targeted communications — if you expressly consent, we may use your selected roles to send you occasional emails about MD Atlas features for QARA professionals and to tailor what we show you. You can withdraw this consent at any time.

5.2 Retention period

This Personal Data is retained until you delete your professional page or your account. Deleting your page removes the data you contributed; consent records may be kept as evidence for the applicable limitation period.

5.3 Transfer and recipients of Personal Data

Made In Tracker does not transfer the collected data outside the European Union.

5.4 Recipients of Personal Data

Personal Data may be communicated to Made In Tracker staff who need it for the performance of their duties, to services in charge of controlling Made In Tracker, and to authorities where Made In Tracker is legally required, or where such disclosure is necessary to enforce the general terms or other agreements, protect your rights, your property or those of Made In Tracker. If you consent to public visibility, your page (never your contact details, which carry their own visibility settings) is visible to Site visitors and to search engines.

5.5 Your rights over your Personal Data

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, the right to withdraw your consent at any time (from your page settings or by writing to us), and the right to decide what happens to your data after your death.

Exercise your rights by writing to contact@madeintracker.com. You may also file a complaint with the CNIL.

6. Processing of your Personal Data when you visit the Site

6.1 Purpose, legal basis and Personal Data processed

When you visit our website, the browser used by the visitor automatically sends data to our Site's server and stores it in a log file for a limited period. The following data is stored without further input from the visitor until automatic deletion:

• the visitor's device IP address (anonymized for audience measurement);
• date and time of access by the visitor;
• name and URL of the page visited by the visitor;
• website from which the visitor arrives on the Site (referrer URL);
• the browser and operating system of the visitor's device, and the name of the visitor's access provider.

Processing of this personal data is justified under Article 6.1.f) GDPR. Made In Tracker has a legitimate interest in processing the data in order to:

• quickly establish a connection with the Site;
• allow a user-friendly use of the Site;
• recognize and ensure system security and stability;
• facilitate and improve Site administration.

Processing does not expressly aim to personally identify the visitor of the Site.

6.2 Retention period

In the context of your visit to the Site dm-atlas.fr / md-atlas.com and in accordance with applicable European regulation, Made In Tracker retains the data listed above for a period of 12 months, along with any other applicable legal periods.

6.3 Transfer and recipients of Personal Data

Personal data is transferred to third parties if:

• the data subject has expressly consented under Article 6.1.a) GDPR;
• disclosure is necessary to assert, exercise or defend legal claims under Article 6.1.f) GDPR and there is no reason to assume that the data subject has an overriding legitimate interest in not disclosing their data;
• a legal obligation to transmit the data exists under Article 6.1.c) GDPR; and/or
• it is necessary for the performance of a contractual relationship with the data subject under Article 6.1.b) GDPR.

In other cases, personal data is not transmitted to third parties.

6.4 Recipients of Personal Data

Personal Data may be communicated to Made In Tracker staff who need it for the performance of their duties, to services in charge of controlling Made In Tracker, and to authorities where Made In Tracker is legally required, or where such disclosure is necessary to enforce the general terms or other agreements, protect your rights, your property or those of Made In Tracker.

6.5 Your rights over your Personal Data

Under the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to decide what happens to your data after your death.

Exercise your rights by writing to contact@madeintracker.com. You may also file a complaint with the CNIL.

6.6 Cookies

Our Site uses “cookies”. They are small data packets exchanged between the Site's server and the visitor's browser. They are stored on the devices used (PC, laptop, tablet, smartphone, etc.) during the visit to the Site.

Cookies cannot harm the devices used. In particular, they contain no viruses or other malicious software. The information stored in cookies comes from the specific device used. Made In Tracker cannot, by these means alone, obtain direct knowledge of the identity of the Site visitor.

Cookies are used to:

• make the online service more practical to use (session cookies, automatically deleted after leaving the Site);
• improve Site usability (temporary cookies that recognize the visitor on a new visit so they do not need to repeat certain entries or settings);
• analyze Site visits for statistical purposes and improve the service (audience-measurement cookies automatically deleted after a defined period).

The data processed by cookies serves the purposes above to safeguard Made In Tracker's legitimate interests under Article 6.1.f) GDPR, or, where required by law, on the basis of your prior consent collected via the cookies banner.

Summary of cookies used on MD Atlas

You can prevent these cookies from being stored by selecting the appropriate settings in your browser, or by withdrawing your consent via the Site's cookies preferences module.

6.7 Google Analytics 4

We use Google Analytics 4on our Site, an audience-analysis service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA — “Google”).

Google Analytics 4 allows us to measure Site traffic and usage (pages viewed, session duration, traffic source, device type) to improve content and user experience. IP addresses are anonymized before any processing.

Processing is based on Made In Tracker's legitimate interest in measuring and improving Site audience, under Article 6.1.f) GDPR, or, where required by law, on your consent collected via the cookies banner.

The transfer of data to the United States, which cannot be excluded when using Google services, is based on EU Standard Contractual Clauses. Details are available here:
https://policies.google.com/privacy/frameworks
https://privacy.google.com/businesses/controllerterms/mccs/

You can opt out of Google Analytics tracking by installing the browser add-on Google provides for that purpose, or by refusing analytics cookies via the Site's cookies preferences banner.

6 bis. Processing of your bank details for referral cashback payouts

6 bis.1 Purpose, legal basis and Personal Data processed

Where you take part in our referral program and ask to be paid your cashback in cash, we process the bank details you provide so that we can send you that money. The Personal Data processed is your account-holder name, your IBAN, your BIC/SWIFT (where you provide it), the country derived from your IBAN, and a record of your consent (date and version of the consent text). The legal basis is your consent (Article 6(1)(b)/(a) GDPR), given when you save your bank details; saving them is optional and is required only if you choose to receive a cash payout.

6 bis.2 Retention period

We keep your bank details for as long as you take part in the referral program, and afterwards for the legal accounting and tax retention period applicable to payment records, after which they are deleted. You may withdraw your consent and request erasure at any time (subject to any payout records we must retain to comply with a legal obligation or to establish, exercise or defend legal claims).

6 bis.3 Security, transfer and recipients of Personal Data

Your IBAN is stored encrypted at rest and is never displayed back to you in full (we show only the last digits). Your bank details are used solely to execute your referral payouts. The SEPA transfers are run in-house by Made In Tracker; we do not sell, share or transfer your bank details to a third-party payment processor, beyond the bank that executes the transfer. Your details are not transferred outside the European Union.

6 bis.4 Your rights over your Personal Data

You have the rights of access, rectification, erasure, restriction, portability and objection described elsewhere in this Policy, as well as the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, contact us at contact@madeintracker.com.

6 ter. Hosting of user-submitted manuals — lawful basis, retention and erasure

Where a registered user uploads a product manual or instructions-for-use document (a PDF), that file may incidentally contain personal data (for example, the name, professional contact details, or signature of an author, technical contact, or signatory). We process this personal data on the basis of our legitimate interests under Article 6(1)(f) GDPR. Our balancing assessment is as follows. Purpose: to operate a searchable third-party archive of medical-device documentation, so that healthcare professionals, regulators, and the public can locate technical documentation already published or supplied to us. Necessity: hosting the document as submitted is necessary to provide this service; we do not seek consent from each individual named in a third-party document because doing so is impossible at scale and would defeat the archival purpose. Balancing: the personal data involved is typically limited, professional-context, and was already disclosed by its author in a document intended for circulation; we apply storage limitation, access controls, a notice-and-action channel, and an erasure path to keep the impact on data subjects proportionate. You may object to this processing at any time on grounds relating to your particular situation (Article 21 GDPR), and request erasure as described below.

Retention.We apply the storage-limitation principle (Article 5(1)(e) GDPR) to uploaded documents. A manual submitted for review but not approved for publication is held only as long as needed to assess the submission and is automatically purged no later than 90 days after upload if it has not been approved. Manuals that are approved and published are retained for as long as they remain part of the searchable archive, and are removed on a valid erasure or notice-and-action request, on the uploader's withdrawal, or when we cease to host the archive.

Requesting removal (right to erasure). If a hosted manual contains your personal data, or you are otherwise entitled to its removal, you may request erasure under Article 17 GDPR by contacting us at contact@madeintracker.com identifying the document and the personal data or grounds at issue. We also operate a dedicated notice-and-action channel for reporting unlawful or infringing documents on our DSA point-of-contact page, which you may use instead. We will review your request, remove or anonymise the document where the request is well-founded, and notify you of the outcome with a statement of reasons. Erasure may be limited where we must retain the document to comply with a legal obligation or to establish, exercise, or defend legal claims. You also retain the right to lodge a complaint with your supervisory authority (in France, the CNIL).

Automated validation of manufacturer-declared manual links (processing purpose eudamed-manual-link-validation). Separately from hosting uploaded files, we automatically fetch and validate the public manual links that manufacturers have declared in the EU EUDAMED database, so that we can display a working link to the manufacturer's own document. For this purpose we store only the declared URL, a content checksum, and the date the link was last validated — we never store a copy of the file itself. This processing relies on our legitimate interests under Article 6(1)(f) GDPR (maintaining an accurate, non-broken directory of publicly-declared regulatory documentation); it involves no personal data beyond what the manufacturer chose to publish in EUDAMED, and the objection right (Article 21 GDPR) and the notice-and-action channel above apply to these links in the same way.

6 quater. Processing of publicly-registered contact data for our claim-outreach campaign

6 quater.1 Source, purpose, legal basis and Personal Data processed

To let the organisations listed in the EU EUDAMED database claim and verify their MD Atlas company page, we run a claim-outreach campaign that contacts the regulatory or economic-operator representative by email. The Personal Data processed is limited to the professional name and professional email address of that contact. These data were not obtained from you directly: their source is the public EUDAMED register published by the European Commission (ec.europa.eu/tools/eudamed), where they are already publicly available. We therefore provide you this information under Article 14 GDPR(information to be provided where the data have not been obtained from the data subject). The purpose of the processing is to invite the operator to claim and verify its company page (business-to-business prospection). The legal basis is Made In Tracker's legitimate interest in reaching out to a professional contact whose details are already public in an official register, under Article 6(1)(f) GDPR.

6 quater.2 Retention period

We keep these contact data for the duration of the claim-outreach campaign and for up to three years from our last contact with you (or from the date we collected the data), after which they are deleted, unless you object or ask for their erasure sooner. Where you claim your page or subscribe, the data are then retained under the account-related terms described elsewhere in this Policy.

6 quater.3 Transfer and recipients of Personal Data

These contact data are accessed only by Made In Tracker staff who need them to run the campaign, and by our email-sending service provider, Resend (Resend, Inc., United States), which delivers the outreach messages on our behalf. The transfer of data to the United States, which cannot be excluded when using this provider, is based on EU Standard Contractual Clauses. We do not sell your contact data or share them with any other third party for their own purposes.

6 quater.4 Your rights, opt-out and page removal

You have the rights of access, rectification, erasure, restriction, portability and objection described elsewhere in this Policy. In particular, because this processing relies on our legitimate interest, you have the right to object to it at any time on grounds relating to your particular situation (Article 21 GDPR). Every outreach email also carries a one-click unsubscribe link that stops all further campaign emails to you. Separately from the emails, you may ask us to remove your company page from the Site: our page-removal policy is that, on a request sent to contact@madeintracker.com, we will remove or de-index the page built from the public EUDAMED record (subject to any data we must retain to comply with a legal obligation or to establish, exercise or defend legal claims). You also retain the right to lodge a complaint with your supervisory authority (in France, the CNIL).

7. Security of Personal Data

In line with the state of the art, Made In Tracker has put in place physical, electronic, organizational and technical safeguards to prevent any loss, misuse, unauthorized access or disclosure, alteration or destruction of your Personal Data. These measures include:

• password hashing;
• encryption of communications via HTTPS/TLS;
• database hosting within the European Union (Supabase, EU region – Frankfurt);
• access controls limiting data access to authorized personnel only;
• use of reputable providers offering sufficient guarantees of security and GDPR compliance.

8. Links to websites not controlled by Made In Tracker

The Site may offer links to third-party websites that may be of interest to you.

Made In Tracker has no control over the content of third-party sites or over the personal data protection practices of those third parties. Accordingly, Made In Tracker declines all responsibility for the processing of your Personal Data by such third parties on those sites.

It is your responsibility to inform yourself about those third parties' personal data protection policies.

9. Data controller and contact

The data controller is:

MADE IN TRACKER
Email: contact@madeintracker.com

For any question concerning this Policy, or to request exercise of rights over your Personal Data, you can contact us at the email address above.

10. Evolution of the personal data protection policy

This Policy may be modified or amended at any time, in particular in the event of legal, judicial or regulatory developments, CNIL decisions or recommendations, or evolving practices.

Any new version of this Policy will be brought to your attention by any means chosen by Made In Tracker, including electronic means (distribution by email or online notice published on the MD Atlas Site).

We invite you to consult the Policy regularly for updates.