Privacy policy

1. Data controller

This policy applies to the websites zenit-group.fr and arko-web.fr, and to the Zenit account they share. The data controller is Aikoo SAS, the company that publishes the Zenit and Arko brands, whose registered office is at 433 allée de Larribere, 40380 Baigts, France.

• Contact: contact@aikoo.eu · 06 29 28 79 93
• No data protection officer has been appointed to date; requests concerning personal data are handled at the email address above.

When Arko opens, the data collected by a customer’s website (orders, bookings, enquiries, audience) will be the responsibility of that customer, as data controller; Aikoo SAS will process it on the customer’s behalf, as a processor, under the terms set out in the service contract.

2. Data collected

• Contact: your name, email address, company if any, and the content of your message when you write to us.
• Zenit account: email address, password stored in hashed form, signed-in devices (browser type, dates), recovery address if you add one, security log (sign-ins and settings changes) and display preferences (language, theme). If you choose “Continue with Google”, Google sends us your name, your email address and your Google account identifier — never your password. If you add a profile photo, it is visible to the members of the organisations you belong to.
• Newsletter, if you subscribe: email address, language, date and page of sign-up, version of the consent text accepted, device type (browser and operating system, without IP address), dates of confirmation and unsubscription.
• Subscriptions, once they open: billing information.
• Technical data: IP address, browser information, strictly necessary cookies and server logs.

An email address and a password are needed to create an account: without them, it cannot be created. No other data is required.

These websites set no analytics cookies, marketing pixels or advertising trackers. Their cookies are used for signing in, for security and to remember your choices; they are exempt from consent. Their list, purpose and duration are set out in the “Cookies” panel at the bottom of every page. The display choices you make in your account area (language, theme) are also kept in your browser’s local storage, on that device only.

3. Purposes and legal bases

• Responding to your requests — pre-contractual measures and our legitimate interest in replying to you.
• Providing your account, then your subscriptions, and sending you the emails they require (verification codes, security notices) — performance of the contract.
• Sending you the newsletter, if you have subscribed — your consent, which you can withdraw at any time.
• Securing the websites and preventing abuse — our legitimate interest in protecting the websites and their users.
• Keeping accounting records — legal obligation.

No fully automated decision producing legal effects is made on the basis of this data. No data is sold.

4. Recipients and processors

• Authorised staff of Aikoo SAS.
• OVH SAS — hosting of the websites, accounts and infrastructure, in France.
• Backblaze, Inc. — storage of our backup copies, in its European region (the Netherlands); they are encrypted on our servers before being sent, and Backblaze cannot read them.
• Cloudflare, Inc. — delivery and protection of both websites: requests pass through its network, which sees the IP address and the page requested.
• Google — only if you choose to sign in with your Google account; Google then processes your data under its own privacy policy.
• Stripe — payment and invoicing for subscriptions, when subscriptions are open. The payment form in our checkout and subscription pages is Stripe’s: your payment details go straight to Stripe, and Aikoo SAS neither receives nor stores your full card number or IBAN. When it is shown, Stripe sets two fraud-detection cookies, needed for the payment you ask for (“Cookies” panel, strictly necessary cookies).
• European Commission (VIES) — when you enter your organisation’s EU VAT number, our servers send it to the VIES service to check that it is valid, which decides the VAT on your invoices. The result (valid or not, and the name and address VIES returns) is kept with the organisation’s details.
• Proton AG — sending account emails (verification codes, security notices) and the newsletter sign-up confirmation, from Switzerland.
• Amazon Web Services (Amazon SES) — sending the newsletter itself, from its European region (Sweden), once the first issues go out.
• Address suggestions — when you enter your organisation’s address, our servers (not your browser) send the text typed and the country chosen to the Géoplateforme de l’IGN (Base Adresse Nationale) for France, or to Photon (OpenStreetMap data, a Komoot service) for other countries, in order to suggest addresses. No account identifier is sent, and we keep none of these entries.

5. Transfers outside the European Union

The websites, the accounts and their data are hosted in France. Cloudflare, Inc., which delivers the pages, may process IP addresses and requests in the United States: it participates in the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection. Once Stripe handles payments, some data may also be processed in the United States, under the same framework. Proton AG, which sends our emails, processes them in Switzerland, a country the European Commission also recognises as providing an adequate level of protection. Amazon Web Services, which will send the newsletter, will process it in its European region, in Sweden. Our backup copies stay in the European Union, in the Netherlands: Backblaze, Inc. is an American company, but it only receives encrypted copies, which it cannot read.

6. Retention periods

• Contact requests not followed up: up to three years after the last exchange.
• Account data: for as long as the account is open. If you ask for it to be deleted, it is closed immediately and erased 30 days later. You can cancel during that period using the link sent to you by email.
• Accounts whose address has never been confirmed: deleted 30 days after creation.
• Accounting records: ten years, as required by law.
• Account security log (sign-ins, settings changes): 180 days.
• Newsletter: an unconfirmed sign-up is erased after 30 days; a confirmed subscription lasts until you unsubscribe, and ends after three years without contact from you. Once the subscription has ended, only a hash of the address, from which the address cannot be worked out, and the history of the subscription are kept for three years, to prove your consent and its withdrawal, and are then erased.
• Display preferences: for as long as the account exists; those kept by your browser, until you clear them.
• Technical logs: for as long as strictly necessary for diagnosis and abuse prevention.
• Deletion register: after erasure, an entry without any email address is kept for five years.
• Backup copies: 60 days for the continuous copies of the databases, 13 months for the nightly copies. Erased data disappears from these copies when the last copy containing it expires; they are only used to restore the service after an incident.
• Cookies: from five minutes to 400 days depending on their purpose, as detailed in the “Cookies” panel.

7. Your rights

Under the General Data Protection Regulation, you have the right of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent and to set instructions about what happens to your data after your death.

To exercise them, write to contact@aikoo.eu. Proof of identity may be requested. We reply within one month, unless the request is particularly complex. You can also lodge a complaint with the CNIL, the French data protection authority.

You can unsubscribe from the newsletter at any time, without having to write to us: through the link in every email, from the newsletter page, or from your account.

You can export your data and ask for your account to be deleted from the Data section. The request also removes your newsletter subscription. If you prefer, you can write to us at contact@aikoo.eu from the account’s email address.

8. Security

Encryption of data in transit, passwords stored in hashed form, protected session cookies, protection against forged requests, traffic filtering by Cloudflare, and encrypted backups, one copy of which is kept off our servers.

9. Changes

This policy may change along with the websites, their service providers or regulations. The version that applies is the French version published on this site, as at the date shown at the top of the document.