Privacy Policy

1. Data Controller

MY DATA PROGRAMMING (MDP-DSTE), a company established in Godomey, Abomey-Calavi, Benin. RCCM: RB/ABC/23 A 97974 — IFU: 0202112780780 Email: contact@mdp-dste.com — Tel: +229 01 67 31 16 64 Website: https://mdp-dste.com Data Protection Officer (DPO): Mr. Seou Toussaint Emmanuel Djidagbagba DPO contact: contact@mdp-dste.com By using Orbit, you accept the collection and use of your data as described in this policy.

2. Data Collected

3. Legal Basis for Processing

each processing operation is based on an explicit legal basis: • Performance of contract: account data, CVs, letters, portfolio, documents, service requests — necessary for providing the subscribed service. • Explicit consent: use of AI features (optimization, translation, ATS score, diagnostic), transfer to third-party AI services, non-essential cookies. You may withdraw your consent at any time without retroactive effect. • Legal obligation: payment data and receipts — retention required by Beninese tax and accounting regulations. • Legitimate interest: technical data (logs, IP) — for security and fraud prevention purposes, in strict respect of your rights.

4. Purposes of Processing

Your data is used exclusively to: • Create and manage your user account • Generate and download your documents (CV, letters, portfolio) • Operate AI features (optimization, translation, diagnostic, ATS score) • Process your payments and issue receipts • Manage subscriptions and affiliate withdrawal requests • Share your documents and portfolio with third parties via link (if you enable this) • Ensure platform security • Improve our services (aggregated and anonymized data) Your data is never sold, rented or transferred to third parties for commercial purposes.

5. Third-Party Sharing

Orbit uses the following service providers, to whom data may be transmitted strictly within the scope of the service provided: • FedaPay (Mobile Money payment processing, headquartered in Benin) — policy available at fedapay.com • 001 Africa / IT-NUM (hosting provider, headquartered in Benin) — data stored on Beninese territory • AI services (RodiumAI, processing CV content for optimization/translation/ATS score) — see section 6 below No other sharing is carried out without your explicit consent.

6. Transfers to Third Countries — AI Services

Some Orbit features (AI CV optimization, AI translation, ATS score, CV diagnostic) use artificial intelligence services whose servers may be located outside Beninese territory. These transfers are only made on the basis of your explicit and prior consent, collected at registration or before using each affected feature. Safeguards in place: • CV data transmitted is encrypted in transit (SSL/TLS) • AI providers are contractually bound not to retain or reuse your data • The transfer is limited to the content strictly necessary for the requested service • You may withdraw your consent at any time by ceasing to use these features You were informed of these transfers at registration and gave your explicit consent at that time.

7. Automated Processing — ATS Score and AI Optimization

Orbit offers features based on automated analysis of your data: • ATS Score: automatically evaluates your CV's compatibility with automated recruitment systems (Applicant Tracking Systems). This analysis produces a score and personalized recommendations. • AI Optimization: automatically reformulates and improves your CV content. • AI Translation: automatically translates your CV into the target language. None of these automated decisions has any definitive legal effect on you. These results are provided as assistance and advice — you remain the sole decision-maker regarding the final use of the content. You have the right to contest any automated result and request a human review by contacting contact@mdp-dste.com.

8. Retention Period

• Active account data: retained for the entire duration of service use • After account deletion: 24 h for active data, then permanent erasure (subject to legal obligations) • Technical logs: rolling 90 days • Authentication tokens: automatic expiry after 24 h of inactivity • Electronic contracts and service receipts: 10 years from the date of service provision • Payment receipts: 10 years (accounting and legal obligation) You may request early deletion of your data via contact@mdp-dste.com, subject to legal retention obligations.

9. Data Security

We implement the following measures to protect your data: • SSL/TLS encryption for all communications • Hashed passwords (bcrypt, salted) • Hashed authentication tokens (SHA-256) in the database • Data access restricted to authorized personnel • Regular and secure backups • Automatic session expiry (24 h)

10. Data Breach Notification

In the event of a security breach affecting your personal data, MY DATA PROGRAMMING undertakes to: • Promptly notify the Personal Data Protection Authority (APDP) of the breach identified • Inform you directly if the breach is likely to result in a high risk to your rights and freedoms • Describe the nature of the breach, the data affected, and the measures taken to remedy it This notification is made without undue delay upon discovery of the breach. In the event of a serious breach, the APDP may be consulted at: apdp.bj

11. Right of Withdrawal for Digital Services

For digital services provided instantly (AI CV optimization, AI translation, ATS score, document generation, CV download), execution of the service begins immediately after your order. As a result, you lose your right of withdrawal once the service is fully provided. By using these services, you expressly acknowledge: • That you are requesting immediate execution of the service • That you are informed of the loss of the right of withdrawal once the service is provided • That you give your prior express agreement for execution to begin before the end of the 15 business-day legal withdrawal period For subscriptions: the 15-day right of withdrawal applies from the day after subscription

12. Your Rights

You have the following rights: • Right of access: obtain a copy of your personal data — response within 60 days maximum • Right of rectification: correct inaccurate data — response within 45 days • Right to erasure: request deletion of your data (subject to legal retention obligations) • Right to portability: receive your data in a structured, machine-readable format • Right to object: object to certain processing on legitimate grounds • Right to withdraw consent: at any time, without retroactive effect on prior processing • Right not to be subject to automated decision-making: contest any AI result To exercise your rights: contact@mdp-dste.com The DPO will handle your request within the legal deadlines. Right to lodge a complaint with the APDP: If you believe that the processing of your data constitutes a violation of your rights, you may lodge a complaint with the Personal Data Protection Authority (APDP) of Benin: Website: apdp.bj — Cotonou, Republic of Benin

13. Cookies and Local Storage

Orbit uses: • Browser localStorage: authentication token, user preferences (theme, language) • Session cookies: server-side authentication (SameSite=Lax, Secure in production) No advertising, tracking or third-party profiling cookies are used. Disabling essential cookies prevents logging into the platform.

14. Minor Data

Orbit is intended for adults (18 years and older). Benin's Digital Code sets the digital age of majority at 16 — Orbit applies a stricter standard of 18. We do not knowingly collect data about minors. If you believe a minor has created an account, contact us at contact@mdp-dste.com for immediate deletion.

15. Changes to This Policy

We may update this policy at any time. The date of last update is shown at the top of the page. In the event of a material change, a notice will be displayed on the platform and you will be informed by email.

16. Contact — Data Protection Officer

MY DATA PROGRAMMING — Data Protection Officer (DPO) Email: contact@mdp-dste.com Address: Godomey, Abomey-Calavi, Atlantique — Republic of Benin Phone: +229 01 67 31 16 64 Supervisory authority: APDP Benin — apdp.bj