Privacy Policy Applicable to Users of Volta Medical's Information System

The purpose of this Privacy Policy is to describe the processing of personal data that may be implemented by Volta Medical in the context of the use of its Information System."Information System" refers to all the technical means implemented by the company for the processing, management and security of information. It includes Volta Medical's computer network, as well as the equipment made available to users of the Information System, such as computers, tablets, smartphones or any other equipment allowing access to this System.
In this context, processing of personal data may be implemented when:

you use Volta Medical's network, whether such use takes place from the company's premises or remotely;
and/or you use computer equipment or applications or networks made available by Volta Medical.

For complete information on the characteristics of the processing operations we carry out, as well as on your rights and how to exercise them, please also read the information contained in Volta Medical's General Personal Protection Policy.

What categories of personal data may we collect and process as a Data Controller?

When you use our Information System, the personal data that we may collect and process are as follows:

When using Volta Medical's network:

Indirect identification data: user ID (login), professional email address associated with the network session;
Authentication data: connection logs (date, time, success/failure), associated IP address, information related to authentication mechanisms (including MFA if applicable);
Service access logging data: access logs to applications and information system resources (timestamp, type of access, actions performed);
Data from network security tools and SOCs: security events, anomaly detection, indicators of compromise, technical metadata associated with analyzed flows;
Supervision and traceability data: information relating to the use of network resources,allowing the monitoring, detection and remediation of security incidents.

In the event of the use of computer equipment made available by Volta Medical:

User identification data: surname, first name, internal identifier, professional email address
Technical data ofthe equipment: machine name, hardware identifier, operating system version,compliance status (updates, antivirus, encryption);
Data from security tools: security events, alerts, detections of suspicious behavior, information about the files or processes analyzed;
Usage log data: access to applications, actions performed on the workstation, timestamp of operations;
Data related to IT support: information contained in incident or request tickets, intervention histories, exchanges with IT teams.

If Volta Medical makes software or applications available:
As part of Volta's provision of software or applications to users of the company's information system, personal data may be processed, in particular identification data (such as surname, first name, professional identifier), connection and usage data (logs, timestamps, IP addresses) as well as technical data related to the use of the solutions. For more information on the categories of data processed, the purposes and the methods of this processing, please refer to the privacy policy applicable to each solution, as defined and made available by the publisher of the solution concerned.
This data may be recorded and stored for limited periods of time in accordance with the retention rules defined below.

What are the uses we make of this data? What are our objectives?

This processing of personal data is implemented in order to enable Volta Medical to ensure the optimal functioning and security of its Information System. This is the main purpose of the processing.
In addition, the sub-purposes of the processing are as follows:

The protection of Volta Medical's information assets, in particular against any security incident and breach of personal data that undermines the confidentiality, availability and/or integrity of the same;
The prevention, detection and resolution of technical malfunctions and incidents, as well as the determination of their origin;
The management, traceability, monitoring, control of network flows;
Detecting and blocking anomalous flows, threats, or malware;
The implementation of short-, medium- and long-term remedial measures;
Documentation of events and management of evidence in the context of pre-litigation and litigation actions, particularly in court, as well as in the context of controls or notifications from the authorities.

What are the legal basis for our processing?

The legal basis for the processing and all the sub-purposes listed is Volta Medical's legitimate interest in ensuring the security and proper functioning of its Information System as well as the preservation of its information assets.

To this end, an analysis of Volta Medical's legitimate interest and the interests, freedoms and fundamental rights of the persons concerned by the processing of their data has been carried out. This analysis can be sent to the persons concerned, at any time and on request.

Who are the data recipients?

The categories of persons likely to be recipients of the data are as follows:

The authorized personnel of Volta Medical's subcontractors involved in the security of the company's Information System;
Authorized personnel within Volta Medical's security or remediation unit, whether they are employees or external service providers;
The competent judicial or administrative authorities and their authorised staff in the event of an investigation or inspection;
Any agent or subcontractor authorized by Volta Medical in the context of establishing evidence of an offence (lawyer, bailiff, IS security service provider, particularly in the event of a forensic analysis).

How long do we keep your data?

The data is stored only for as long as is necessary to achieve the relevant sub-purpose. In the event of an alert, it may be kept for a period of five years, in particular for the purpose of preserving evidence in the context of the management of any possible litigation. If you would like to know more about the retention periods applicable to the processing of your data, you can contact our DPO via the dpo@volta-medical.com address.

Are the collection and processing of your data mandatory?

The use of Volta Medical's Information System is not mandatory. However, in the event of use of our Information system, the collection and processing of the personal data listed in this Policy is mandatory.

How do we collect your data?

The personal data concerned is collected directly from the data subjects each time the Volta Medical information system is used.

Do we transfer your Data outside the EU ?

We may transfer data to a country outside the European Union in the course of our activities. In this case, we take all appropriate measures to ensure compliance with the regulations applicable in the European Union. You can obtain a copy of these guarantees from our Data Protection Officer (“DPO”) whose contact details can be found in the “Contact” section of Volta Medical’s General Data Protection Policy.

Does the processing implement an automated decision?

No automated decision-making procedures, including profiling, that would produce legal effects with regard to data subjects or that would be likely to significantly affect them in a similar way shall be implemented.

Can we change this Policy?

We may modify the content of this Policy at any time, in line with the evolution of our activities and/or in order to comply with our legal obligations.
If we make any changes, they will be made on the pages relating to this Policy on our website and we recommend that you refer to them each time you visit. However, in the event of substantial changes to the characteristics of the processing, we draw your attention to this by publishing a warning on our website.