Privacy Policy

emyspot attaches great importance to protecting the personal data of its Users and of their visitors, members, subscribers and customers. This policy explains how we use and protect your personal data, and the reasons why we process it.

Last updated: 20 September 2024

Access to and protection of Users' personal data

We are the controller responsible for processing this data. The purpose of these provisions is to inform you of the way in which we use and protect your personal data, as well as the reasons for which we process it. As a reminder, the European General Data Protection Regulation of 27 April 2016, which entered into force on 25 May 2018, lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of such data.

1. Data collected by emyspot as data controller

emyspot acts as the controller of its Users' data and, as such, collects data for the purpose of providing its service. In accordance with Article 24 of Chapter 4, we implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is carried out in compliance with the GDPR, and to guarantee the security of this data. As controller, emyspot may collect all or some of the following data:

Information relating to the identification of the Service User

Company name
Status
Email address
First and last name
Username
Postal address
Country
Telephone
Fax
Website
Company registration (SIRET) number
Position held
Newsletter subscription
Google+ ID
Facebook ID

Information relating to Service registration

Plan
Plan expiry date
Price
Payment method

Usage information

Date of connection to the emyspot "Manager" tool
Date of an action
Scope of the action — "add / modify / delete" — performed on an emyspot item

This data is entered directly by the User upon registration or subsequently through the Manager interfaces. emyspot does not collect any personal data implicitly.

Purpose of the personal data collected

Registration with the tool
Communicating with Users
Billing purposes
Providing Users with action and audit history
Compiling internal statistics
Sending the newsletter to keep Users informed about the Service and any commercial or promotional offers
Any other purpose that emyspot may define at a later date and that it will then communicate to the User. The User will be asked for their consent where applicable. This may involve further processing of personal data for a purpose other than the one for which the data was collected; in such cases the controller first provides the data subject with information about that other purpose and any other relevant information (Chapter 3, Article 13(f) of the GDPR).

Disclosure of the User's personal data

emyspot may share the data collected with:

Its parent company, AWELTY SARL (SIRET: 491 400 214 00046 — registered office: 19 rue Lamartine, 80000 Amiens, France)
Its accounting firm, in order to meet its reporting obligations
Public authorities (police, courts, tax authorities, social services, etc.) upon official request, within the limits of and in compliance with the legal procedures applicable in France

emyspot does not provide or sell its Users' data to any other organisation or company, and does not have its Users' data processed by subcontractors.

How long this personal data is kept

Identification information: for the entire duration of the service, plus 3 years, so that a User can easily reactivate their service.
Service registration information: for the entire duration of the service, plus 10 years, in order to meet accounting obligations.
Usage information: for the entire duration of the service, plus 1 year, in order to comply with French legislation, in particular Article 3 of Decree No. 2011-219 of 25 February 2011 on the retention and disclosure of data enabling the identification of any person who has contributed to the creation of content posted online.

The User's rights

In accordance with the applicable regulations, the User has the following rights:

Right of access (Chapter 3, Article 15 of the GDPR)
Right to rectification (Chapter 3, Article 16 of the GDPR)
Right to erasure (Chapter 3, Article 17 of the GDPR)
Right to restriction of processing (Chapter 3, Article 18 of the GDPR)
Right to object (Chapter 3, Article 21 of the GDPR)
Right to withdraw consent (Chapter 2, Article 7 of the GDPR)

The User may exercise the rights listed above by email to dpo@e-monsite.com. The User is also entitled to lodge a complaint with the competent supervisory authority, such as the CNIL in France. These provisions may be updated by emyspot; the User will be informed of any change by email.

2. Data collected when processing on behalf of Users

When using the emyspot software, the User may make use of the tools provided to collect information about some of their visitors (customers, subscribers, members). emyspot is the processor of this data.

The User is responsible for the personal data of their Customers. Pursuant to Article 28 of the GDPR, the User is designated as the controller and provides emyspot, as processor, with their Customers' data. emyspot processes personal data on behalf of the controller. The User is hereinafter referred to as the controller, and emyspot as the processor. The processor will do its utmost to assist the controller in fulfilling its obligations (Chapter IV, Article 28(e)) and in responding to requests from data subjects (its Customers) seeking to exercise their rights under the GDPR.

Details of the data processed on behalf of the User:

First and last name
Email address
Postal address
Username
Password
Date of connection
Telephone
Name of the products ordered
Product price
Product quantity
Order date
Payment method
Name and quantity of the products placed in a shopping cart

Processing personal data on behalf of the User is solely for the purpose of providing a service to the User. This list is not exhaustive, as it may be modified by the customer themselves, using the tools provided by emyspot, without emyspot being aware of it.

Processing: emyspot does not carry out any processing identifying individuals on its own behalf using the data processed for Users. The only processing identifying individuals carried out on behalf of the customer is the abandoned-cart recovery tool (sending a reminder email to an already-identified User to invite them to complete a purchase abandoned during the order process). The only processing carried out on emyspot's own behalf is non-identifying and consists of calculating order aggregates in order to determine total revenue generated, revenue per store, and order averages (number/value) by product type (physical or digital products).

How long this data is kept: for the entire duration of the service, plus one year, emyspot being required to comply with French legislation, in particular Article 3 of Decree No. 2011-219 of 25 February 2011 on the retention and disclosure of data enabling the identification of any person who has contributed to the creation of content posted online.

The controller's rights over this data

Deletion of all personal data, or its return to the controller, at the end of the processing services, and destruction of existing copies, unless EU or Member State law requires the personal data to be retained (Chapter IV, Article 28(g)).
Right of audit to ensure that the processor complies with the GDPR (Chapter IV, Article 28(h)) — specifically, making available to the controller all information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR.

As set out in the GDPR, the processor undertakes to handle personal data with the utmost care. The processor must implement internal mechanisms and procedures to guarantee an appropriate level of security for personal data in accordance with the GDPR (Chapter 4, Article 28). The processor will ensure that the persons within its organisation authorised to process this data for the purposes of the service undertake to respect the confidentiality of the controller's and its Customers' data (Chapter IV, Article 28(1)). The processor does not engage other processors to manage the services and, as such, is not concerned by Chapter 4, Article 28(4) of the GDPR.

3. How to exercise your rights

In accordance with the General Data Protection Regulation (GDPR), set out below is a full description of your rights and of the practical means available to you for exercising them. If you wish to contact the Data Protection Officer (dpo@e-monsite.com) responsible for protecting your data, please state the email address linked to your emyspot customer account (or use it to write to us), together with your first and last name. Should you be unable to find the email address linked to your emyspot customer account, or in the event of serious doubt as to your identity, additional information relating to your identity may be requested in accordance with Article 12 of the GDPR. We will send you a reply within a maximum of one (1) month from the date your request is received. This period may be extended by a further two (2) months given the complexity and number of requests.

For the sake of transparency, the table below summarises your rights according to the different processing activities.

Your rights	Conditions for exercising them	Processing
Right of access		All processing of personal data.
Right to rectification		All processing of personal data.
Right to object	You have the right to object to processing carried out for direct-marketing purposes. More generally, you may object at any time to the processing of your data by emyspot for direct-marketing purposes by sending an email to dpo@e-monsite.com. More specifically, where you are concerned by email marketing, you may click the "Unsubscribe from the newsletter" link in the emails sent by emyspot.	Processing based on our legitimate interest.
Right to withdraw consent	Please note that withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.	Processing based on our legitimate interest.
Right to erasure	You have the right to ask emyspot to erase personal data concerning you in the following cases: your data is used for marketing purposes; the data is no longer necessary for the purposes for which it was initially collected or processed; you withdraw your consent or object to the processing of your data; your data is being processed unlawfully; your data was collected when you were a minor in the context of online services (blog, forum, social network, website, etc.); your data must be erased to comply with a legal obligation. Where you request erasure, emyspot will nonetheless be required to keep your data in intermediate archive form for as long as necessary to meet its legal, accounting and tax obligations. You can submit your erasure request by sending an email to dpo@e-monsite.com.	Processing based on: performance of the contract; your consent; our legitimate interest.
Right to lodge a complaint	You may, at any time, lodge a complaint with the competent supervisory authority (in France, the CNIL: www.cnil.fr).	All processing of personal data.
Right to restriction	This right applies only if: you contest the accuracy of your data, for the period needed to verify it; you consider that we are processing your data unlawfully and you require restriction of its use rather than erasure; we no longer need your data for the purposes set out above but you still need it for the establishment, exercise or defence of legal claims; or you have exercised your right to object, for the period needed to verify whether our legitimate grounds override yours.	Processing based on: performance of the contract; legal obligation; our legitimate interest.

4. Third-party privacy policies

emyspot uses external services whose privacy policies you can find below.

Google / YouTube: https://policies.google.com/privacy