Version dated 20 October 2026

HeatCORE is a free mobile application published by Jacques’s SAS (“Jacques’s”, “we”, “us” or “our”). It enables users of compatible Furygan heated products to pair their gloves with the application, configure them and control their HeatCORE functions. This policy describes the processing of personal data in connection with use of the application on iOS and Android. Processing carried out by Apple or Google in connection with downloading or updating the application, or the operation of their own services, remains governed by their respective policies.

1. Data controller and role of MLD Design

Jacques’s SAS determines the purposes and means of the processing described in this policy and acts as the data controller. MLD Design develops, customises, configures, tests and fixes the application on behalf of Jacques’s SAS. It also prepares and carries out publication of the application on the App Store and Google Play, solely through developer accounts owned and controlled by Jacques’s SAS. When processing crash reports and authorised technical logs, MLD Design acts as a data processor, solely on Jacques’s SAS’s documented instructions and for no purposes of its own. Any question or request relating to data protection may be sent to: [email protected].

2. Data processed and sources of the data

No account is required to use the application. It contains no advertising, push notifications or audience measurement, and does not back up settings to any cloud storage operated by Jacques’s SAS or MLD Design. To detect compatible gloves, pair them with the phone, display their status and transmit the selected settings, the application communicates with them using Bluetooth Low Energy. The information and settings needed for these functions are processed locally on the phone for as long as the gloves remain paired with it. They are not transmitted over the Internet to Jacques’s SAS or MLD Design. Users may delete them by selecting Settings > Glove information > Reset, by clearing the application’s data, or by uninstalling the application. When the application is first opened, and depending on the operating system version, it may request permission to use Bluetooth and Nearby devices and, on certain Android versions, the location permission required by the system to detect Bluetooth devices. Refusing these permissions prevents the gloves from being paired with and controlled through the application. HeatCORE does not access, record or transmit the user’s geographical coordinates. If the application crashes, meaning that it stops or encounters a software error, the SmartBear BugSnag module, in the version actually deployed in the application, may generate a diagnostic report. The report may include a randomly generated report identifier, the date and time of the crash, the application and operating system versions, the device model, the stack trace and associated logs, technical status information and error codes, together with a pseudonymous installation or device identifier if enabled and necessary for diagnosis. This identifier does not, by itself, directly identify the user. The system may also generate technical logs that are essential to the security, availability and continuity of the service. Under the agreed configuration, diagnostic reports and technical logs exclude names, contact details, advertising identifiers, geolocation or journey data, health data or data relating to a real-world accident, audio, photographic or video content, contacts, communications and usage data unrelated to a crash. These data are not used for audience measurement, advertising, profiling or continuous monitoring of use. When a user contacts support, Jacques’s SAS processes the email address, the content of the request and any technical information the user chooses to provide. These data are collected directly from the user.

3. Purposes and legal bases

Pairing and controlling the gloves: local information required for Bluetooth and settings is processed to provide the functions requested by the user. To the extent that it constitutes personal data, this processing is necessary for the performance of the requested service (Article 6(1)(b) of the GDPR). Diagnostics, security and stability: processing of crash reports and authorised technical logs is based on Jacques’s SAS’s legitimate interests in ensuring the security and stability of the application and in diagnosing and fixing technical issues (Article 6(1)(f) of the GDPR). Support: data provided in connection with a request are processed to respond to the user and provide follow-up in relation to the product and application. Processing is based on the performance of a contract or steps taken at the user’s request where the request relates to the product or service and, in other cases, on Jacques’s SAS’s legitimate interest in responding to enquiries received. If the processing carried out through BugSnag is not strictly necessary to provide the requested service, the SDK is enabled only after valid consent has been obtained. Withdrawal of consent stops the relevant transmissions.

4. Mandatory or optional nature of the data

Bluetooth permission and, depending on the system, permission to access Nearby devices are required to pair and control the gloves using the application. Refusing or disabling these permissions prevents these functions from being used in the application. The diagnostic module is not required to pair or control the gloves. Where applicable law or the technical configuration requires consent, refusal of consent must not prevent use of HeatCORE’s core functions. The information requested by support is optional. However, if the information needed to identify or understand the issue is not provided, support may be unable to deal with the request.

5. Recipients and data sharing

We do not sell or rent personal data. Settings and Bluetooth exchanges that remain local have no recipient outside the user’s phone and gloves. For diagnostic and incident resolution purposes, the strictly necessary data may be accessed by authorised personnel at Jacques’s SAS, MLD Design, SmartBear (the BugSnag service) and any sub-processors engaged by SmartBear for hosting, backup or support, within the limits of their respective tasks. Support requests are accessible to authorised teams at Jacques’s SAS. If MLD Design’s technical expertise is required, only the technical information needed to resolve the issue, after direct identifiers have been removed, may be sent to it under the current agreement. Data may also be disclosed to competent administrative or judicial authorities where required by law.

6. Transfers outside the European Economic Area

Bluetooth exchanges that remain local are not subject to any international transfer by Jacques’s SAS or MLD Design. Depending on the infrastructure and sub-processors used by SmartBear (BugSnag), diagnostic reports may be hosted in, or accessed from, the European Economic Area or third countries. Where a transfer outside the European Economic Area is necessary, it is governed by an adequacy decision or appropriate safeguards under the GDPR, including SmartBear’s data processing agreement and, where applicable, the standard contractual clauses adopted by the European Commission, together with any required supplementary measures.

7. Retention periods and deletion

Local data and settings: these are stored on the phone for as long as the gloves remain paired with it, until they are reset via Settings > Glove information > Reset, the application’s data are cleared or the application is uninstalled. They are not backed up to any cloud storage operated by Jacques’s SAS or MLD Design. Diagnostic reports: crash reports are retained for one month. Technical logs that are essential to the security, availability and continuity of the service are retained for three months. Support requests: related exchanges and information are retained while the request is being handled and for two years from the last exchange. At the end of these periods, active data are deleted or, where applicable, irreversibly anonymised. If the diagnostic service ends, the data are exported for Jacques’s SAS and then deleted from active environments no later than one week after the export or termination of the service. Residual copies may remain in isolated backups for no more than 90 days, without being used for routine purposes, before being permanently deleted.

8. Security

Jacques’s SAS and its service providers implement technical and organisational measures appropriate to the risks to protect data against destruction, loss, alteration, unauthorised disclosure or access. The measures include, in particular, encryption of data in transit, access restricted on a strict need-to-know basis, strong authentication for administrative access, segregation of environments, access logging, vulnerability and secrets management, and backup and deletion procedures.

9. Your rights

Depending on the processing concerned and the conditions laid down by the GDPR, users may request access to, rectification or erasure of their data, restriction of processing and data portability. They may object to processing based on legitimate interests and may withdraw their consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, users may write to [email protected], specifying their request. Jacques’s SAS will respond within one month of receipt. This period may be extended by two months where necessary because of the complexity or number of requests; users will then be informed within the initial period. Additional proof of identity will be requested only where there is reasonable doubt and on a proportionate basis. For data stored only locally, users may delete them via Settings > Glove information > Reset, by clearing the application’s data or by uninstalling the application. Diagnostic reports are not directly identifiable by name, but may contain a pseudonymous identifier; they are therefore not necessarily anonymous. To help locate a report, users may provide the approximate date and time of the crash, the phone model and the application and operating system versions. Jacques’s SAS will then assess whether the relevant report can be identified and will inform the user if it cannot be located reliably. Users may also lodge a complaint with the French Data Protection Authority (Commission nationale de l’informatique et des libertés – CNIL): www.cnil.fr.

10. No automated decision-making or profiling

HeatCORE does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them. The application does not carry out profiling.

11. Updates to this policy

The effective date appears at the top of the published version, which remains accessible in the application. In the event of a material change, users will be informed by an appropriate means in the application before the new version takes effect, where required.

12. Contact details and identity of the data controller

Jacques’s SAS Nîmes Trade and Companies Register no. 690 200 894 French simplified joint-stock company (SAS) with share capital of €510,000 Registered office: 845 rue Étienne Lenoir, 30900 Nîmes, France Postal address: BP 20039, 30023 Nîmes Cedex 1, France Data protection contact: [email protected]