Last update 12/17/2025

ULULE PRIVACY POLICY

Last updated on December 17, 2025

When you browse Ulule ("the Site") and use the Services offered on it, personal data concerning you is collected and processed by our services.

The purpose of this data protection policy is to inform you about the essentials regarding the processing of your personal data in order to operate the Ulule service.

1. Who is the data controller?

The data controller is the person who determines the purposes and means of processing, i.e., the objective and the way to achieve it.

1.1. Ulule SAS: data controller for the use of the Site and the Services offered on it

Ulule SAS, a simplified joint-stock company with share capital of €293,478, registered under number 794 710 830 in the Paris Trade and Companies Register, with its registered office located at 10 rue Penthièvre 75008 Paris, France, publishes the Site.

In this context, we collect and process your personal data as data controller when you browse the Site and use the Services offered on it.

1.2. Ulule SAS and Creators: joint data controllers for managing your Contributions to Campaigns

Personal data concerning you, collected for the execution of your Contributions made to Campaigns carried out on the Ulule Site, are jointly processed by Ulule SAS, the company operating the Site, and by each Creator to whom you transfer funds via your Contribution.

2. Why do we process your data and on what legal basis?

In accordance with the regulations, any processing of personal data must, to be lawful, be based on one of the legal grounds set out in Article 6 of the GDPR or Article 9.2 of the GDPR if it concerns so-called sensitive data.

The table below sets out the various purposes that may be pursued when processing your data and the legal grounds on which the pursuit of each of these purposes is based.

Regarding the collection of payments made directly on the Ulule site, it is managed by our payment service providers (MANGOPAY and STRIPE), approved by the French Prudential Supervision and Resolution Authority (ACPR). MANGOPAY or STRIPE carry out personal data processing for which they are responsible, described in MANGOPAY's privacy policy and in Stripe's privacy policy.

As part of their legal obligations to combat fraud, money laundering and terrorist financing, Ulule and MANGOPAY carry out processing, including data combinations, to help their employees determine the level of fraud risk associated with a payment or Campaign. This processing may be used to justify Ulule's or MANGOPAY's or STRIPE's decision to refuse a payment.

3. What personal data do we process about you?

We collect and process:

• personal data that you have entered on our Site, particularly when creating your User Account (email, last name, first name, address, password, telephone, etc.);

• For users who take part in Campaigns presented on the Site:

  • personal data related to Campaigns you organize via the Site (presentation of your Campaign, identity information, bank details, etc.)

  • data relating to Contributions you make to a Campaign presented on the Site (reward chosen, amount paid, transaction number, delivery address, etc.)

• For users of the Training section of the Site:

  • data allowing us to process applications for training courses offered by our training organization: motivations to join the program, professional project, up-to-date CV, employment office certificate (for job seekers), highest diploma, etc.

• data relating to your browsing on the Site (pages viewed, date and time of connection, IP address, browser type, operating system, browsing history and composition of your cart, products and pages you have viewed or searched for), the URL of the destination page and the URL of the website from which you arrived;

• data relating to the viewing of emails we send you for statistical and commercial prospecting purposes;

• information you provide when you leave a review on the Site;

• information about our advertisements that you view;

• information you provide when participating in promotional operations, competitions or events that we organize.

All this data may be communicated to us by you when you fill in our forms or during our exchanges. It may also be collected through computer tools such as cookies. For more information on our use of these tools, we invite you to read the cookie policy accessible at the following address: Cookie Policy.

All the data we collect about you may be combined with each other in order to pursue the purposes described above.

4. Is the collection and processing of your data mandatory?

When browsing our Ulule.com website, access to certain features requires the creation of an account and therefore the communication of certain data. By creating an account, you become a user of the Ulule Site, allowing you, subsequently, to become a Creator or Contributor.

In order to create an account on the Ulule.com site, you must provide a last name, first name or pseudonym, your email address and a password. Otherwise, you will not be able to register.

As a simple visitor to the Ulule.com site, you will be able to view certain sections, but not create a project or campaign, or contribute to existing projects and campaigns.

To create a Campaign on the Ulule.com site, in addition to the data that must be entered when creating your account, you must provide your last name and first name, the name of your project, the category in which it falls, its description, your country of residence, your delivery address, your billing address, your objective, the amount and its currency, your bank details, and provide any proof of identity necessary for your identification depending on whether you are a natural person or a legal entity.

In order to contribute to a Campaign on the Ulule.com site, in addition to the data that must be entered when creating your account, you must provide your last name and first name, your nationality, your country of residence, your date of birth, your delivery and/or billing address if the Creator has made this information mandatory in order to deliver the chosen rewards to you, your credit card payment information and provide any proof of identity necessary for your identification depending on whether you are a natural person or a legal entity.

In order to take a training course through the Ulule training organization, you must provide information relating to your identity, your motivations, your academic and professional background, your professional situation, your level of education, etc.

If you do not provide this information, you will not be able to publish your Campaign on Ulule.com, or contribute to projects on the Ulule.com site, or subscribe to a training course offered by the Ulule training organization.

These data provision requirements have a contractual and/or regulatory nature (particularly for your proof of identity).

In order to exercise your rights, as recalled in point 8 of this Privacy Policy, the communication of proof of identity will be required. Failure to communicate may prevent us from responding to your requests.

This data provision requirement has a regulatory nature here.

The collection of other data may be mandatory. All data whose collection is mandatory, the contractual or regulatory nature of this provision obligation, as well as the consequences of not providing the data concerned are then brought to your attention directly during collection.

5. Sensitive and third-party data - Important

5.1. Sensitive data

By using the Site to make comments, present your project, your user profile, etc., you could publicly reveal information about yourself, sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health status, etc.).

We therefore invite you to be careful when using the Site in order to protect your privacy.

• Within your user profile: the following fields of your user profile are optional and intended to allow you to personalize your public user profile on Ulule: last name, first name, city, description, full description, social networks and websites. Through these fields you could publicly reveal information about yourself, sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health status, etc.). Once the form is validated, this information will become public and accessible to all. We therefore invite you to be careful when describing your user profile to protect your privacy.

• Within the presentation of your Campaign or news related to your Campaign: when you describe a Campaign or publish news on your project page, you could reveal information about yourself, sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health status, etc.). If your project is published online or your news is published, this sensitive information will become public and accessible to all. Ulule therefore invites you to be careful when describing your project and writing your news, to protect your privacy.

• Contribution to a Campaign: by default, contributions are public and visible from the list of contributors to a Campaign or the user profile of the contributing member. Contributing to a Campaign can sometimes reveal sensitive or very personal information (your religious or philosophical beliefs, your sexual orientation, your political opinions, etc.). For example, by contributing to a Campaign with a political dimension, you indirectly reveal your political opinion. If you do not want your support to be public, Ulule allows you to make your contribution "anonymous" by going to your user profile / "my contributions" / "modify address and preferences". Your identity will then only be known by Ulule and by the Creator concerned. To make all your contributions "anonymous", go to your user profile / "preferences" / "privacy".

• Comments on campaigns or publications: when you write a comment on a Campaign or publication, you could reveal information about yourself, sometimes sensitive or very personal (religious or philosophical beliefs, sexual orientation, political opinions, health status, etc.). Once the comment or publication form is validated, this sensitive information will become public and accessible to all. Ulule therefore invites you to be careful when writing your comments or publications, to protect your privacy.

5.2. Third-party data

When writing the presentation of a Campaign, or news, you may be required to communicate to us and publicly communicate information concerning third parties (your collaborators, a person your project aims to help, etc.).

The processing of this data must be done in compliance with the regulations.

You must verify that you have the right to communicate this data to Ulule and to the public (for example by having the written consent of these third parties) and communicate to them the information on the processing of their data by Ulule contained in this Privacy Policy.

6. How long do we keep your personal data?

We keep your personal data only for the time necessary for the purposes for which it was collected, in compliance with applicable regulations.

6.1. Users without financial transactions

For users who have not made any financial transactions on the Ulule platform (neither contribution to a project, nor fundraising as a project owner), we apply the following retention periods:

• Inactivity period: 3 years from the last activity on your account (last login, last contact with Ulule, or last action on the platform)

• Notification before deletion: Before deleting your data, we will send you an email notification informing you of the inactivity of your account and giving you the opportunity to log back in to keep your account active

• Complete deletion: At the end of this 3-year inactivity period, and in the absence of reactivation of your account, all of your personal data will be permanently deleted, including:

  • Your user profile information (last name, first name, email, postal address, telephone, etc.)

  • Your account preferences and settings

  • Your browsing and connection history

  • Your comments published on projects or articles

  • Your possible project proposals or collection pages that have not received any transactions

  • Your data with our subcontractors (Mangopay, Mailjet, etc.)

6.2. Users with financial transactions

For users who have made at least one financial transaction on the Ulule platform (contribution to a project or fundraising as a project owner), we apply the following retention periods:

• Inactivity period: 5 years from the last activity on your account (last login, last contact with Ulule, or last action on the platform)

• Legal basis: This 5-year retention period is imposed by our legal obligations regarding anti-money laundering and counter-terrorism financing (Article L 561-12 of the French Monetary and Financial Code)

• Notification before deletion: Before deleting your data, we will send you an email notification informing you of the inactivity of your account and giving you the opportunity to log back in to keep your account active

• Partial deletion and anonymization: At the end of this 5-year inactivity period, and in the absence of reactivation of your account:

  • Your identification data (last name, first name, email, postal address, telephone, etc.) will be deleted

  • Your transaction data will be anonymized in order to preserve statistics and the history of funded projects

  • In project owners' data exports (list of contributors), your name will be replaced by the mention "Contributor deleted for inactivity", with only contribution data (amount, date, reward chosen) retained

6.3. Other specific retention periods

The following retention periods also apply:

6.4. Notification in case of account inactivity

In order to allow you to keep your account and your data, we have set up an automatic notification system:

• Daily detection: We check daily for inactive accounts approaching the thresholds of 3 years (users without transactions) or 5 years (users with transactions)

• Email notification: Before any data deletion, we will send you an email to the address associated with your account to inform you of the inactivity and offer you to reactivate your account

• Response time: You will have a reasonable time to log back in and keep your account active

• Logging: Data deletions are logged and kept for 1 year for traceability purposes

6.5. Reactivation of your account

At any time before your data is deleted, you can reactivate your account by logging back into the Ulule platform or by contacting us. This action will interrupt the deletion process and reset the inactivity period.

7. Who are the recipients of your personal data?

Your personal data is intended for Ulule's internal services and may be transmitted to the following third parties:

7.1. To payment service providers

We use payment service providers (PSPs) to manage financial transactions made on the Site. These PSPs are:

• MANGOPAY SA - Payment institution approved by ACPR (French Prudential Supervision and Resolution Authority)

• STRIPE - Approved payment service provider

These providers collect and process your payment data as data controllers. We invite you to consult their respective privacy policies for more information.

7.2. To subcontractors

We use subcontractors to help us provide our services. These subcontractors may have access to your personal data as part of their services, including:

• Data hosts

• Email sending providers (Mailjet, etc.)

• Analysis and statistics tools

• Customer support providers

• IT service providers

All our subcontractors are subject to strict contractual obligations regarding the protection of personal data and can only use your data for the purposes defined by Ulule.

7.3. To Campaign Creators

When you contribute to a Campaign, your personal data necessary for the execution of your Contribution is transmitted to the Creator of the Campaign concerned, including:

• Your last name and first name

• Your email address

• Your delivery address (if necessary for sending rewards)

• The amount of your contribution

• The rewards chosen

The Creator is joint data controller with Ulule for this data and must process it in compliance with applicable regulations.

Your email is provided to the Creators of Campaigns to which you subscribe as fans, particularly via the "coming-soon" feature, allowing you to be kept informed of the launch of an upcoming Campaign.

Personal data concerning you allowing the delivery of your Reward is also transmitted to the carrier selected by the Creator.

7.4. To commercial partners of operations in which you participate

In cases where you have expressed your wish to participate in a specific partner operation, for example as a Creator, if you apply for a prize or partner offer directly managed by Ulule, we must communicate your contact details to the partner so that they can give you the promised prize if you are a winner, or provide you with the promised offer if you are eligible.

7.5. To authorities

Your personal data may be disclosed to authorities in application of a law, regulation or pursuant to a decision of a competent regulatory or judicial authority.

In general, we undertake to comply with all legal rules that could prevent, limit or regulate the dissemination of information or data and in particular to comply with the French Data Protection Act and the GDPR.

8. What are your rights regarding your personal data?

In accordance with the regulations applicable to the protection of personal data, you have the following rights:

• Right of access: You have the right to obtain confirmation that data concerning you is or is not being processed and, when it is, access to said data

• Right of rectification: You have the right to obtain the rectification of inaccurate data concerning you

• Right to erasure: You have the right to obtain the erasure of data concerning you in certain cases provided for by the regulations

• Right to restriction of processing: You have the right to obtain the restriction of the processing of your data in certain cases provided for by the regulations

• Right to data portability: You have the right to receive the data concerning you that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another data controller

• Right to object: You have the right to object at any time, for reasons relating to your particular situation, to processing of data concerning you based on legitimate interest. You also have a right to object to the processing of your data for direct marketing purposes

• Right to define directives relating to the fate of your data after your death: You have the right to define directives relating to the retention, erasure and communication of your personal data after your death

• Right to withdraw your consent: When processing is based on your consent, you have the right to withdraw this consent at any time

• Right to lodge a complaint with the CNIL: If you believe that the processing of your data constitutes a violation of the regulations, you have the right to lodge a complaint with the French National Commission for Information Technology and Civil Liberties (CNIL). To learn more about your rights regarding your data, we invite you to visit the CNIL website: www.cnil.fr

9. How to exercise your rights?

For any request relating to the exercise of your rights, you can submit your request:

• by email by writing to [email protected]

• by mail (with a copy of your identity document) to the following address: Ulule Attention: Data Protection Officer (DPO) 10 rue de Penthièvre 75008 Paris FRANCE

Our services will get back to you as soon as possible and at the latest within one month of receipt of your request.

10. Is your personal data transferred outside the European Union?

Some processing operations that we entrust to our subcontractors are carried out outside the European Union. Agreements have been signed with each of these providers to ensure that transfers of your personal data are carried out securely and in compliance with the applicable regulations in force regarding data protection.

11. Contacting the Data Protection Officer

For any questions regarding the processing of your personal data or to exercise your rights regarding your data, the Data Protection Officer (DPO), appointed by Ulule SAS, can be contacted:

• by email by writing to [email protected]

• by mail (with a copy of your identity document) to the following address: Ulule Attention: Data Protection Officer (DPO) 10 rue Penthièvre 75008 Paris France