The data controller is Néo Lebouteiller, sole trader (Digikart), 52 boulevard Villebois-Mareuil, 35000 Rennes, France. Contact:
contact@digikart.fr.
2. Data collected
Concerning the merchant (Client)
Email, business name, town, address (optional).
The business’s phone number, if provided.
The paid features they opened in their account without having access to them, and our notes of our exchanges with them.
Their rating and review of Digikart, if they give one, and whether or not they agree to its publication.
The links in our offer emails they opened.
The questions they ask the support in their account, and its answers.
Their answer to the question “Why are you leaving?”, if they delete their account.
Password (stored encrypted, never in clear text).
Subscription data handled by Stripe (Digikart does not store the bank card).
About a business we approach that is not a customer
The business’s name, address, SIRET number and activity, taken from the French government’s company directory (Sirene data), except for businesses that have objected to their publication.
The business’s professional phone number, taken from its shop window, its website or during a visit.
The history of our contacts: date, call, visit or text message, and their outcome.
Concerning the end customer
A card identifier (anonymous), the number of stamps or points, the date of visits, the wallet used (Apple or Google) and, if the merchant awards points based on the amount spent, the amount of each visit.
A first name, a phone number and a date of birth, only if the customer chooses to enter them.
The device registration needed to send the card’s notifications, deleted along with the card.
No banking or sensitive data is collected.
3. Purposes
Provide the loyalty card service and count visits.
Manage accounts, authentication and security.
Manage billing and the subscription.
Understanding why merchants delete their account, in order to improve Digikart.
Send the notifications requested by the merchant.
Offer merchants who ask for it notification texts written by an AI assistant, which they review and send themselves.
Contact the merchant about their account and our offers, by phone, text message or email, choosing whom to contact based on how they use their account (visits, rewards given, paid features viewed) and the links in our offer emails they opened. They can object to this at any time. Outside France, we do not approach them with offers without their consent.
Prepare these calls: an AI assistant drafts a sales script for us from the same information, the state of their subscription and our notes of past exchanges. We review it; it decides nothing and never writes to the merchant.
Answer the merchant's questions in their account, at any time, with an AI support assistant, and pass on to Néo those it cannot handle.
Presenting Digikart to businesses that are not yet customers, by phone, text message or visit, only in France and about their professional activity.
Publish on the website the review they give of Digikart, unless they have refused its publication: rating, comment, business name and town.
4. Legal bases
Performance of the contract (providing the service), legitimate interest (security, improvement, contacting the business about our offers, approaching businesses), legal obligation (invoicing) and, where applicable, consent.
5. Recipients and processors
OVH : server hosting (France).
Stripe : payment processing.
Apple and Google : generation of Wallet cards.
Anthropic : the AI assistant. To suggest notification texts to the merchant, it only receives the idea written by the merchant and the name, town, card type, reward and card language of their business. To prepare our calls, it also receives their card settings, their plan and the state of their subscription, the usage figures of their account (customers, visits, rewards, notifications sent), the paid features they viewed, their review of Digikart and the reason they left if they gave one, the history of our contacts and our notes of past exchanges, without any phone number or email address. For the support in their account, it receives their questions and the current conversation, with their plan, their card settings and the usage figures of their account, without contact details. Never their customers' data. Processing outside the European Union, including in the United States, governed by the European Commission's standard contractual clauses, included in Anthropic's terms (copy on request at contact@digikart.fr).
An independent sales agent who runs sales for Digikart: they have access to business accounts (contact details, account and subscription status, exchanges with Digikart, messages sent through the contact form), never to their customers’ data, and keep the file of the businesses they prospect.
No data is sold to third parties.
6. Retention period
Account data is kept while the account is active, then deleted if the account is deleted. Billing data is kept in accordance with legal obligations (10 years).
Deleting an account also erases the images it uploaded, except an image another account still uses, and the messages its address wrote to us. What remains: invoices and the customer record, with us and with Stripe; commission records if a sales agent brought in the account; emails exchanged with us; cards already installed on customers' phones, with their copy at Google; and the log of our actions, which keeps neither the business name nor its email address. Backups and technical logs disappear as they rotate.
Conversations with the support in the merchant account are deleted twelve months after their last message, and with the account.
When a merchant deletes their account, their answer to the question “Why are you leaving?” is kept with no link to their account, along with the day of deletion, the plan and subscription status, and the account's country, age and number of customers and visits, so that we can understand what we need to improve. The business name, emails, phone numbers, websites and social media accounts are automatically removed from their comment when we recognise them; the rest is kept as written. If they prefer not to answer and write nothing, only that choice and the day are kept. All of this is deleted after three years.
The data of a business we have approached is deleted three years after our last exchange, even if it opened and then deleted an account. If that business has asked not to be approached any more, only a hash of its phone number, its SIRET, and its name with its postcode is kept, in order to honour that request.
7. Your rights
Under the GDPR, you have rights of access, rectification, erasure, restriction, objection and portability. Merchants can delete their account themselves from their account area. To exercise your rights: contact@digikart.fr.
To stop being contacted about our offers, just say so during a call or a visit, reply STOP to a text message, or write to
contact@digikart.fr. The request takes effect immediately and has no effect on the service.
A review published on the website is removed on request, at the same address.
You may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).
8. Cookies and local storage
The Service uses the browser's local storage (localStorage) to: keep the sign-in session, remember a trusted device (2FA, 30 days) and link an end customer to their loyalty card. No advertising or third-party tracking cookie is used.
8 bis. Audience measurement
We measure traffic to our public pages with an in-house tool, hosted on our own servers (no third-party service, no Google Analytics). Your IP address is never recorded, and no data allowing you to be identified is stored.
This measurement uses a single cookie, set by digikart.fr and named
dk_v. It contains a random value, with no information about you, whose only role is to avoid counting you twice when you come back to the site, and to know through which channel you found us. Its lifetime is
13 months and it is never extended automatically: it is only set again if it has disappeared.
This cookie serves only to produce aggregated traffic statistics. It cannot be read by JavaScript, is never passed to a third party, allows no cross-referencing with another site, and is used for no advertising purpose. In line with the CNIL's recommendations, audience measurement limited in this way is exempt from consent : which is why you see no banner on this site.
If your browser sends a do-not-track signal (Global Privacy Control, or Do Not Track), no cookie is set and the measurement falls back on a non-reversible technical identifier, regenerated every day and stored nowhere on your device. You can also delete this cookie at any time from your browser settings, with no consequence for your use of the site.
9. Security
Communications are encrypted (HTTPS), passwords hashed, access protected by two-factor authentication and a firewall. Daily backups are made.