Supplier Code of Conduct

This Code applies to any natural or legal person who supplies OPIDUN, for consideration:

- goods (computer hardware, office furniture, goodies, consumables...);
- services (software publishing, consulting, agency, cloud infrastructure, intellectual services, logistics, security...);
- intermediation services (freelancers, ESNs, tier 1 and tier 2 subcontractors).

It applies **as soon as the supplier is onboarded** and continues throughout the contractual relationship, as well as after its termination for obligations surviving the contract (confidentiality, data protection, return of assets).

The supplier undertakes to comply with the following international standards:

- **Universal Declaration of Human Rights** and **fundamental conventions of the ILO**;
- **Prohibition of child labor** (minimum age of **15 years**, or 18 years for hazardous work);
- **Prohibition of forced labor**, debt bondage and confiscation of identity documents;
- **Freedom of association** and right to collective bargaining ;
- **Non-discrimination** based on origin, gender, marital status, sexual orientation, physical appearance, patronymic, state of health, disability, age, political opinions, trade union activities or religious beliefs;
- **Occupational health and safety** complying, as a minimum, with applicable local law and international standards.

The supplier shall pay its employees, as a minimum, the legal or contractual salary in force in the country where the service is provided. It complies with local legislation on working hours and overtime.

In accordance with the French law **Sapin II** (law no. 2016-1691 of **9 December 2016**), the supplier refrains from any form of corruption, active or passive, influence peddling, concussion and undeclared conflict of interest.

In particular, the supplier:

1. Does not offer or accept any **gift or invitation** likely to influence a decision, beyond reasonable professional practice (indicative ceiling: **€80** per person and per calendar year);
2. Does not pay or solicit any **kickback**;
3. Does not use **any intermediary or shell company** to circumvent anti-corruption rules;
4. Declares any **family, financial or capital ties** with an Stayinto employee or manager, as soon as he/she becomes aware of them;
5. Complies with **international sanctions** (EU, UN, OFAC) and restrictive measures to combat money laundering and the financing of terrorism.

The supplier who processes personal data on behalf of Stayinto does so in the capacity of **sub-processor** within the meaning of Article **28 of the RGPD**. To this end, it signs a **data processing agreement (DPA)**, appended to the contract, and undertakes to:

- Process data **only** on documented instruction from Stayinto;
- Implement appropriate **technical and organizational measures** (encryption in transit and at rest, access management by role, logging, restoration tests);
- Only use a **further subcontractor** with Stayinto's prior written authorization;
- **Locate** data, by default, within the European Union or in a country benefiting from an adequacy decision. Any transfer outside the EU is subject to a specific framework (**European Commission standard contractual clauses**, **BCR**, **Schrems II** analysis);
- **Notify** Stayinto within **48 hours** of any data breach concerning it, in accordance with Article **33 of the RGPD**;
- **Return or destroy** the data at the end of the contract, with proof of destruction on request.

The supplier who accesses Stayinto's information system, or who hosts Stayinto data, implements a level of security consistent with the state of the art (**ISO 27001** referential, **ANSSI** guide). It guarantees:

- An **access management** policy based on *least privilege* and **two-factor** authentication;
- A **separation** of development, acceptance and production environments;
- An active **monitoring** of vulnerabilities in the components used, and a documented patch cycle ;
- The **reversibility** of the service (data export in a standard format, schema documentation, transition period of at least **three months**);
- The **traceability** of administration actions and the retention of logs for the applicable legal period.

In accordance with the European **IA Act** regulation (Regulation (EU) 2024/1689), any supplier offering Stayinto artificial intelligence systems or foundation models undertakes to:

- Clearly document the **risk level** of its system within the meaning of the regulation;
- Provide, for **high-risk** systems, the technical documentation set out in Annex IV of the regulation;
- Prohibit any **prohibited** use (social rating, out-of-frame predictive policing, sensitive biometric categorization excluding exceptions);
- Inform Stayinto, **before commissioning**, of any material change in the training data or model architecture.

Stayinto reserves the right to audit, at least once a year, the controls implemented and, if necessary, to call in an independent auditor at the supplier's expense in the event of significant deviation.

In line with our **Sustainability** policy, the supplier undertakes to:

- Comply with the **environmental regulations** applicable to its activities;
- Reduce, as far as technically possible, energy consumption and waste related to the service provided to Stayinto ;
- Be able to **document**, on request, the origin of goods delivered (ores, wood, textiles, electronic components);
- Cooperate, within the framework of the **CSRD** and the **duty of care** (law no. 2017-399 of **March 27, 2017**), with investigations carried out by Stayinto on tier 1 and tier 2 suppliers.

Any person - Stayinto employee, supplier employee, third party - may report in good faith a breach of this Code or applicable laws, without fear of reprisal, via the following address:

- **Email**: [email protected]

Reports are handled in a **confidential** manner by Stayinto's legal department (or by an external referent when the report concerns the department itself). The identity of the whistleblower is protected in accordance with French law **n° 2022-401 of March 21, 2022** and directive **(EU) 2019/1937**.

The supplier undertakes **not to sanction**, dismiss or discriminate against an employee or subcontractor for reporting a breach to Stayinto in good faith.

Stayinto may, at any time, verify compliance with this Code:

1. By sending a **written questionnaire** (self-assessment);
2. By requesting targeted **supporting documents**;
3. By an **on-site audit**, carried out by Stayinto or by a mandated third party, with reasonable notice of **fifteen (15) calendar days**.

In the event of a breach, Stayinto may, depending on the seriousness of the breach:

- Request a **remediation plan** with a precise timetable;
- **Suspend** all or part of current orders;
- **Break** the contract to the supplier's detriment, with immediate effect for major breaches.

For any questions relating to this Code, you can contact us:

- **Compliance and ethics**: [email protected]
- **Legal department**: [email protected]
- **Confidential reporting**:
[email protected]
- **Postal address** : OPIDUN,
11 rue de Magdebourg, 75016 Paris, France

Acceptance of this Code is evidenced either by its **signature as an appendix** to the framework agreement, or by the **effective start of the service** after communication of the document to the supplier.