Privacy policy
Controller
REP·Pro — Bachir Djebaili, sole trader, 2 rue du Cabernet, 34500 Béziers, France, SIREN 108 271 586. Contact for data matters: [email protected].
What is processed, and why
| Processing | Data | Legal basis | Processor and location |
|---|---|---|---|
| Payment of the plan | company name, e-mail, billing address, VAT number, payment method (held by Stripe, never by us) | performance of the contract | Stripe Payments Europe, Ltd., Ireland; Stripe's sub-processors under its own terms |
| Acceptance of the mandate | brand, Stripe session and subscription identifiers, e-mail, company, country, categories, plan, mandate version; IP address and timestamp of the mandate acceptance, kept for the duration of the mandate | performance of the contract; proof of acceptance | Supabase (database, European Union region); the row is written by our server, no public access |
| Documents (registration extract, tax number, contact) | the files you upload or send by e-mail | performance of the contract (registration with the eco-organisations) | Cloudflare R2 (object storage) when enabled, otherwise our e-mail |
| Registration with the eco-organisations | company identity, products, volumes, contact | performance of the mandate | the eco-organisation of each category (France) and ADEME (the national register) |
| Measuring the site | an aggregate count per page and per day, no cookie, no identifier, no IP stored | legitimate interest (knowing which pages are read) | Cloudflare Workers KV |
| Serving the site | technical logs of the host | legitimate interest (security) | Cloudflare, Inc., United States and EU points of presence, under its data processing terms |
What is not done
No advertising cookie, no tracker, no sale of data, no profiling. The site sets no cookie and uses no local storage. The counter stores a number per page and per day, nothing per visitor.
Retention
Mandate acceptances: for the duration of the mandate and ten years after its end (French accounting and evidence rules). Documents: for the duration of the mandate and three years after. Payment records: held by Stripe under its terms; our invoices ten years. Aggregate counters: thirteen months.
Your rights
Access, rectification, erasure, restriction, portability and objection, under the GDPR: write to [email protected]. You may lodge a complaint with the French supervisory authority (CNIL, cnil.fr). Where the mandate is in force, erasure of the data needed to perform it takes effect at the end of the mandate.
Transfers outside the EU
Cloudflare and Stripe may process data in the United States under the EU-US Data Privacy Framework and standard contractual clauses, as published in their terms. Supabase is configured in a European Union region.