Privacy Policy
This translation is provided for information. In the event of a dispute, the French version prevails.
allogato attaches the utmost importance to the protection of your personal data. This policy explains which data is processed, for what purposes, on what legal bases, for how long, with whom it is shared, and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the Data Protection Act.
1. Data Controller
The data controller is Vendora, a sole proprietorship (SIREN 511 866 030), publisher of the site allogato.fr (full contact details in the legal notices). For any questions regarding your data, you can write to privacy@allogato.fr.
2. Data We Process
Depending on your use of the service, we process:
- Account data: first name, last name, email address, password (encrypted), phone number, and, for business accounts, company name.
- Order data: ordered creations, amounts, dates, pickup or delivery location, instructions and preferences (e.g., reported allergens).
- Payment data: the payment is processed by our approved payment service provider. allogato never stores your card number; we only keep non-sensitive elements (status, amount, transaction ID).
- Messaging: content of exchanges between the customer and the professional, processed for the proper execution of the order and fraud prevention.
- Vendor data: identification and registration documents, bank details for payments, verification elements (KYC).
- Technical and browsing data: IP address, device and browser type, pages viewed, session identifiers, and cookies (see the cookie policy).
3. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Account creation and management, connecting parties, order execution, secure payment and disbursements | Contract performance (art. 6.1.b) |
| Mediation and dispute management | Contract performance and legitimate interest (art. 6.1.b and 6.1.f) |
| Fraud prevention, messaging moderation, combating disintermediation | Legitimate interest (art. 6.1.f) |
| Identity verification of vendors (KYC), billing, accounting | Legal obligation (art. 6.1.c) |
| Sending emails related to your orders (confirmation, tracking, disbursement) | Contract performance (art. 6.1.b) |
| Audience measurement and service improvement, commercial communications | Consent and/or legitimate interest (art. 6.1.a / 6.1.f) |
4. Recipients and Subcontractors
Your data is never sold. It is accessible to authorized teams of allogato and shared with subcontractors acting on instruction, strictly to the extent necessary:
- the professional concerned by your order (to prepare and deliver it);
- our approved payment service provider (payment processing, escrow, disbursements, anti-fraud measures, KYC verification);
- our hosts (Railway, Neon, Cloudflare; European Union);
- our transactional email service provider;
- if necessary, audience measurement providers and our advisers (accountant, lawyer), or authorities when required by law.
5. Hosting and Transfers Outside the EU
Your data is hosted within the European Union. If a subcontractor were to process data outside the EU, such transfer would be governed by the safeguards provided by the GDPR (adequacy decision or standard contractual clauses).
6. Data Retention Periods
- Account: for the duration of use, then deleted or anonymized after a prolonged inactivity period.
- Orders and invoices: retained for the time necessary for management and then archived to meet accounting and tax obligations (up to 10 years).
- Messaging: retained for the time necessary for execution and proof in case of dispute.
- Prospecting data: up to 3 years after the last contact or withdrawal of consent.
- Cookies: see the cookie policy (detailed durations).
7. Security
We implement appropriate technical and organizational measures: password encryption, data encryption (HTTPS), access segregation, hosting in the European Union, logging, and data minimization.
8. Your Rights
In accordance with the GDPR, you have the rights to access, rectification, erasure, limitation, opposition, portability, the right to withdraw your consent at any time, and the right to make directives regarding the fate of your data after your death. You can exercise these rights by writing to privacy@allogato.fr, accompanied if necessary by proof of identity. You can also file a complaint with the CNIL (www.cnil.fr).
9. Minors
The service is not intended for minors under 15 years of age without the consent of the holder of parental authority. We do not knowingly collect data from children without this consent.
10. Changes
This policy may be updated to reflect changes in the service or regulations. The applicable version is the one published on this page.