Privacy Policy
Updated on October 28, 2026
1. PREAMBLE
2. WHO IS THIS POLICY INTENDED FOR?
This policy applies to:
visitors to ENLAPS websites (corporate website and online store);
ENLAPS customers and prospects;
users of the MyTikee web platform and the Tikee Remote mobile application;
ENLAPS partners (ambassadors, influencers).
3. WHO IS RESPONSIBLE FOR PROCESSING YOUR DATA?
4. PROCESSING OPERATIONS CARRIED OUT BY ENLAPS
4.1. Purposes and Legal Bases of Processing
Purposes
Legal Bases
Commercial prospection
Prospect potential professional clients - Trade shows - LinkedIn - Website form (e.g., Downloading a business case - white paper)
Legitimate interest when prospection is addressed to professionals due to their function. Express and prior consent when prospection is addressed to individuals.
Pre-sales exchanges
Responding to information requests from a potential client - pre-contractual exchanges - establishing quotes
Legitimate interest and pre-contractual measures
Management of standard customer contracts
Negotiating, signing the contract, exchanges relating to the execution of the contract, invoicing, monitoring of services, customer loyalty
Execution of customer contracts - legitimate interest
Management of the online store
Online order management - Maintenance, hosting and security of the site - Tracker management (GA statistics, social network Pixels, marketing retargeting, cart abandonment recovery) - Chat
Execution of customer contracts - legitimate interest - Consent for trackers
Management of the showcase website
Subscription to the commercial newsletter - Contact form - Other forms (business case, etc.) - Chat - Display of team members - Becoming a partner - Tracker management (GA statistics, social network Pixels, marketing retargeting, cart abandonment recovery)
Legitimate interest - Consent for trackers
Management of the MyTikee platform
User account management: creation, management, deletion - Subscription order management - Platform security and maintenance - User services (e.g., camera location) - Tracker management (statistics, social network Pixels, marketing retargeting, cart abandonment recovery)
Legitimate interest - Execution of contracts - Consent for trackers
Management of the Tikee remote mobile application
User services (e.g., camera location)
Consent to geolocation (acceptance if from the mobile and specific camera setting). On the camera, the user can deactivate geolocation at any time.
Management of after-sales service and technical requests (customers)
Support service - incident management - responses to technical requests from clients - Camera returns
Execution of contracts - Legitimate interest
Sending of the technical newsletter
Providing information about the platform, the application (technical, new features, maintenance, etc.)
Legitimate interest - Execution of contracts
Sending of the commercial newsletter
Providing commercial information to customers and prospects
Legitimate interest - Execution of contracts
Statistics on the use of the platform and applications
Producing statistics on platform usage data (e.g., number of clients using a certain feature, which countries, etc.)
Legitimate interest
Testing, performance optimization, and improvement of the platform and mobile application, including using modeling and/or machine learning methods, including for continuous improvement
Testing, performance optimization, and improvement of the platform and mobile application, including using modeling and/or machine learning methods, including for continuous improvement
Legitimate interest
Partnership management
Management of partnerships with ambassadors and influencers
Execution of contracts
4.2. Personal Data Collected
Processing
Categories of personal data collected
Commercial prospection
Last name, first name, job title, email, phone number, professional address
Pre-sales exchanges
Last name, first name, job title, email, phone number, professional address, identified needs, notes
Management of standard customer contracts
Last name, first name, job title, email, phone number, professional address, SIRET (for sole proprietorships), relevant order, exchanges
Management of the online store
For technical management of the site (maintenance, hosting), the data processed are those stored on the site as well as connection data (IP address, logs, identifiers, terminals, etc.)
For orders: address, VAT number, order content, order number, phone number
For trackers, the data processed are connection data (IP address, terminals, etc.)
Management of the showcase website
For technical management of the site (maintenance, hosting), the data processed are those stored on the site as well as connection data (IP address, logs, identifiers, terminals, etc.)
For trackers, the data processed are connection data (IP address, terminals, etc.)
Management of the MyTikee platform
User account data: last name, email, employer's name, country, customer account
Order data: address, VAT number, order content, order number, phone number
Operational data: access logs and IP address
Usage data (e.g., number of cameras, number of projects, etc.)
Camera usage data: camera geolocation (from the mobile device or from the camera)
For trackers, the data processed are connection data (IP address, terminals, etc.)
Management of the Tikee remote mobile application
Camera usage data: camera geolocation (from the mobile device or from the camera)
Management of after-sales service and technical requests (customers)
User account data: last name, email, employer's name, country, customer account
Customer account data: last name, first name, job title, email, phone number, professional address, SIRET (for sole proprietorships), relevant order, exchanges
Sending of the technical newsletter
Emails of customers and/or users, platform usage data (e.g., those with an active camera)
Sending of the commercial newsletter
If customer: email, platform usage data (e.g., those with an active camera)
If prospect: email
If the prospect comes from a site form (e.g., business case): last name, first name, job title, email, phone number, professional address
Statistics on the use of the platform and applications
Usage data (e.g., number of cameras, number of projects, etc.)
Last name, email, country, subscription-related data
Testing, performance optimization, and improvement of the platform and mobile application, including using modeling and/or machine learning methods, including for continuous improvement
Images from cameras
Camera location
Partnership management
Person's identity data: first name, last name, email, phone number, job title, address
4.3. Data retention periods
Processing
Retention Period
Commercial prospection
3 years from the collection or the last click or contact from the person
Pre-sales exchanges
3 years from the last contact from the person
Management of standard customer contracts
Customer contract retained for the duration of the contract + 10 years
Management of the online store
For technical management of the site, data is only retained for the time necessary for the technical operation (a few months);
For trackers, data is retained for a maximum duration of 25 months. The lifespan of trackers is a maximum of 13 months. At the end of this period, consent is requested again
For orders: 10 years from the end of the contract
Management of the showcase website
For technical management of the site, data is only retained for the time necessary for the technical operation (a few months);
For trackers, data is retained for a maximum duration of 25 months. The lifespan of trackers is a maximum of 13 months. At the end of this period, consent is requested again
Management of the MyTikee platform
Account: Automatic data deletion if the account is inactive for 2 years and there is no active subscription: after one year of inactivity, a notification is sent to warn that the account will be blocked in 30 days; after one year of blocking, a notification is sent to warn that the account will be deleted in 30 days. Once the account is deleted, the data is deleted within a maximum period of 45 days max.
Order data is retained for the duration of the subscription + 10 years
IP addresses and logs for a maximum period of 12 months
Geolocation data is retained as long as the client keeps the images in their account
For trackers, data is retained for a maximum duration of 25 months. The lifespan of trackers is a maximum of 13 months. At the end of this period, consent is requested again
Management of the Tikee remote mobile application
Geolocation data is retained as long as the client keeps the images in their account
Management of after-sales service and technical requests (customers)
The duration of the contract + 10 years
Sending of the technical newsletter
As long as the contract is ongoing - 3 years from the end of the contract or the last contact (same)
Sending of the commercial newsletter
If prospect: 3 years from the collection or the last contact from the person
after this period, consent is required to continue sending the commercial newsletter
If customer: as long as the contract is ongoing - 3 years from the end of the contract or the last contact (same)
Statistics on the use of the platform and applications
As long as the account is active and the client is a client - 5 years from the deletion of the account
Testing, performance optimization, and improvement of the platform and mobile application, including using modeling and/or machine learning methods, including for continuous improvement
Processing is carried out as long as the images / camera location are available on the platform. The data is deleted once the customer account is deleted (45 days max)
Partnership management
The duration of the contract + 10 years
5. RECIPIENTS OF YOUR DATA
5.1. Categories of sub-processors
5.2. Authorities and jurisdictions
5.3. Joint Liability: Integration of the Trusted Shops Trustbadge / Other Widgets
Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g., the Trustmark, collected reviews) and to offer Trusted Shops services to buyers after they place an order.
This serves to safeguard our legitimate interests in the optimal marketing of our offerings by enabling secure purchases, which prevail when balancing the respective interests of the parties in accordance with Art. 6(1)(f) of the GDPR. The Trustbadge and the services it promotes are provided by Trusted Shops SE, headquartered at Subbelrather Straße 15C, 50823 Cologne, Germany (hereinafter “Trusted Shops”), with whom we are jointly responsible for data protection in accordance with Article 26 of the GDPR. As part of this privacy policy, we provide the following information regarding the key aspects of the agreement in accordance with Article 26(2) of the GDPR.
When interacting with the Trustbadge AI+, session cookies are created to record the login status and display the so-called “Welcome Layer,” which presents details about the relevant online store (company information, reviews, information about the availability of Buyer Protection) as well as the secret #trstd. A cookie is stored to recognize logged-in users and is retained for up to 400 days after login. In addition, session cookies are stored to send push notifications when using the app, provided the user has authorized them. This is necessary so that Trusted Shops can provide you with the digital service you have requested. Trusted Shops is responsible for data processing when interacting with the Trustbadge AI+.
In light of the joint responsibility between us and Trusted Shops, please contact Trusted Shops SE directly for any questions regarding data protection and to exercise your rights using the contact information provided in Trusted Shops’ privacy policy. Regardless of this, you may also always contact the data controller of your choice. Your request will then, if necessary, be forwarded to the other data controller for a response.
Data Processing Related to the Integration of the Trustbadge and Other Widgets
The Trustbadge is provided by a U.S.-based CDN (Content Delivery Network) provider.
An adequate level of data protection is ensured by an adequacy decision from the European Commission, which can be viewed here for the United States. Service providers in the United States are generally certified under the EU-U.S. Privacy Shield Framework. Further information is available here. Where service providers are not certified under the Privacy Shield Framework, standard contractual clauses have been entered into as an appropriate safeguard.
When the Trustbadge appears, the web server automatically creates a server log file that also contains your IP address, the date and time of the page view, the amount of data transferred, and the requesting provider (log file data), and which documents the page view. The IP address is anonymized immediately after collection, so that the stored data cannot be linked to you personally. The anonymized data is used, in particular, for statistical and error analysis purposes.
Data Processing Upon Completion of the Order
After the order is completed, the order information (order amount, order number, and product purchased, if applicable) as well as your email address, hashed using a one-way cryptographic function, is transmitted to Trusted Shops. The legal basis is Article 6(1)(f) of the GDPR.
This is used to verify whether you are already registered with Trusted Shops Services and is therefore necessary to fulfill our and Trusted Shops’ overriding legitimate interests in providing Buyer Protection related to the specific order and customer review services in accordance with Article 6(1)(f) of the GDPR. If this is the case, further processing is carried out in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the Services, you will then have the opportunity to do so for the first time. Further processing following registration is also governed by the contractual agreement with Trusted Shops. If you do not register, all transmitted data will be automatically deleted by Trusted Shops, and it will no longer be possible to establish a connection to you personally.
Trusted Shops uses service providers for hosting, monitoring, and logging. The legal basis is Article 6(1)(f) of the GDPR for the purpose of ensuring trouble-free operation. In this context, processing may take place in third countries (the United States and Israel).
An adequate level of data protection is guaranteed in each case by an adequacy decision from the European Commission, which can be viewed here for the United States and here for Israel. The U.S. service providers used are generally certified under the EU-U.S. Privacy Shield Framework. You can find more information here. If the service providers used are not certified under the EU-U.S. Privacy Shield, standard contractual clauses have been agreed upon as an appropriate safeguard.
6. SECURITY MEASURES
7. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION
The data controller may be required to transfer personal data outside the European Union through certain subcontractors.
The data controller undertakes that these transfers will be made to countries presenting an adequate level of protection, as defined by the European data protection authorities, and/or with appropriate safeguards pursuant to Article 46 of the GDPR (in particular the implementation of standard contractual clauses).
-----For MyTikee Services: the platform hosting is entrusted to AWS (Ireland Region - Dublin area) by the subcontractor Amazon Web Services EMEA SARL.
In accordance with Article 12 of the AWS DPA, transfers outside the EEA may exceptionally be carried out only: (a) when strictly necessary to provide the services requested by the Client, or (b) upon imperative legal obligation.
These transfers are framed by the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 and by the additional measures detailed in the document “DATA PROCESSING AGREEMENT” (DPA).
8. AUTOMATED DECISION-MAKING
No entirely automated decision-making is carried out.
9. YOUR RIGHTS REGARDING YOUR PERSONAL DATA
The data subject of a processing operation may define directives regarding the retention, erasure, and communication of their personal data after their death. These directives may be general or specific.
The data subject of a processing operation also benefits from a right of access, objection, rectification, erasure, portability, and limitation of processing concerning all of their personal data.
The request must indicate the first name and last name, email or postal address of the data subject, and be accompanied by a photocopy of an identity document bearing the holder's signature.
10. COMPLAINT
The data subject of a processing operation has the right to lodge a complaint with the competent supervisory authority (in France, the Commission Nationale de l'Informatique et des Libertés - CNIL) if they consider that the processing of personal data concerning them constitutes a violation of the General Data Protection Regulation.
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Telephone: 01 53 73 22 22
Website: www.cnil.fr
