Supplier Code of Conduct

In accordance with the French law **Sapin II** (law no. 2016-1691 of **9 December 2016**), the supplier refrains from any form of corruption, active or passive, influence peddling, concussion and undeclared conflict of interest.

In particular, the supplier:

1. Does not offer or accept any **gift or invitation** likely to influence a decision, beyond reasonable professional practice (indicative ceiling: **€80** per person and per calendar year);
2. Does not pay or solicit any **kickback**;
3. Does not use **any intermediary or shell company** to circumvent anti-corruption rules;
4. Declares any **family, financial or capital ties** with an Stayinto employee or manager, as soon as he/she becomes aware of them;
5. Complies with **international sanctions** (EU, UN, OFAC) and restrictive measures to combat money laundering and the financing of terrorism.

The supplier who processes personal data on behalf of Stayinto does so in the capacity of **sub-processor** within the meaning of Article **28 of the RGPD**. To this end, it signs a **data processing agreement (DPA)**, appended to the contract, and undertakes to:

- Process data **only** on documented instruction from Stayinto;
- Implement appropriate **technical and organizational measures** (encryption in transit and at rest, access management by role, logging, restoration tests);
- Only use a **further subcontractor** with Stayinto's prior written authorization;
- **Locate** data, by default, within the European Union or in a country benefiting from an adequacy decision. Any transfer outside the EU is subject to a specific framework (**European Commission standard contractual clauses**, **BCR**, **Schrems II** analysis);
- **Notify** Stayinto within **48 hours** of any data breach concerning it, in accordance with Article **33 of the RGPD**;
- **Return or destroy** the data at the end of the contract, with proof of destruction on request.

The supplier who accesses Stayinto's information system, or who hosts Stayinto data, implements a level of security consistent with the state of the art (**ISO 27001** referential, **ANSSI** guide). It guarantees:

- An **access management** policy based on *least privilege* and **two-factor** authentication;
- A **separation** of development, acceptance and production environments;
- An active **monitoring** of vulnerabilities in the components used, and a documented patch cycle ;
- The **reversibility** of the service (data export in a standard format, schema documentation, transition period of at least **three months**);
- The **traceability** of administration actions and the retention of logs for the applicable legal period.

In accordance with the European **IA Act** regulation (Regulation (EU) 2024/1689), any supplier offering Stayinto artificial intelligence systems or foundation models undertakes to:

- Clearly document the **risk level** of its system within the meaning of the regulation;
- Provide, for **high-risk** systems, the technical documentation set out in Annex IV of the regulation;
- Prohibit any **prohibited** use (social rating, out-of-frame predictive policing, sensitive biometric categorization excluding exceptions);
- Inform Stayinto, **before commissioning**, of any material change in the training data or model architecture.

Stayinto reserves the right to audit, at least once a year, the controls implemented and, if necessary, to call in an independent auditor at the supplier's expense in the event of significant deviation.

In line with our **Sustainability** policy, the supplier undertakes to:

- Comply with the **environmental regulations** applicable to its activities;
- Reduce, as far as technically possible, energy consumption and waste related to the service provided to Stayinto ;
- Be able to **document**, on request, the origin of goods delivered (ores, wood, textiles, electronic components);
- Cooperate, within the framework of the **CSRD** and the **duty of care** (law no. 2017-399 of **March 27, 2017**), with investigations carried out by Stayinto on tier 1 and tier 2 suppliers.

Any person - Stayinto employee, supplier employee, third party - may report in good faith a breach of this Code or applicable laws, without fear of reprisal, via the following address:

- **Email**: Contact us

Reports are handled in a **confidential** manner by Stayinto's legal department (or by an external referent when the report concerns the department itself). The identity of the whistleblower is protected in accordance with French law **n° 2022-401 of March 21, 2022** and directive **(EU) 2019/1937**.

The supplier undertakes **not to sanction**, dismiss or discriminate against an employee or subcontractor for reporting a breach to Stayinto in good faith.

Stayinto may, at any time, verify compliance with this Code:

1. By sending a **written questionnaire** (self-assessment);
2. By requesting targeted **supporting documents**;
3. By an **on-site audit**, carried out by Stayinto or by a mandated third party, with reasonable notice of **fifteen (15) calendar days**.

In the event of a breach, Stayinto may, depending on the seriousness of the breach:

- Request a **remediation plan** with a precise timetable;
- **Suspend** all or part of current orders;
- **Break** the contract to the supplier's detriment, with immediate effect for major breaches.

For any questions relating to this Code, you can contact us:

- **Compliance and ethics**: Contact us
- **Legal department**: Contact us
- **Confidential reporting**:
Contact us
- **Postal address** : OPIDUN,
11 rue de Magdebourg, 75016 Paris, France

Acceptance of this Code is evidenced either by its **signature as an appendix** to the framework agreement, or by the **effective start of the service** after communication of the document to the supplier.