Pyxistime
Privacy Policy
In force as of 1er juin 2026 — in accordance with the GDPR (EU 2016/679) and the French Data Protection Act.
1. Data controller
The controller for the processing described in this policy is NDA Conseil (SASU), publisher of Pyxistime, whose registered office is at 5 allée des volubilis, 26000 Valence, France. Contact: contact@nda-conseil.com.
2. Two distinct roles
Pyxistime acts in two different capacities:
- Controller for partner account data and the management of the service described below.
- Processor for the data of end customers and contributors collected through the boxes: in that case the partner is the controller. Such processing is governed by Annex 1 (data processing agreement) of the Partner Terms.
3. Data processed (Pyxistime as controller)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Partner account identity (company name, trade name, SIRET, address) | Creation and management of the account, verification of professional eligibility | Performance of the contract (Art. 6.1.b) | Lifetime of the account + legal obligations |
| Contact details (surname, first name, email, telephone, role) | Communication, support, service notifications | Performance of the contract (Art. 6.1.b) | Lifetime of the account |
| Credentials and security (hashed password, 2FA secret, session tokens) | Authentication and securing of access | Performance of the contract / legitimate interest (security) | Lifetime of the account; sessions purged automatically |
| Audit log (sensitive actions, IP address, user agent, timestamp) | Traceability, security, abuse prevention | Legitimate interest (Art. 6.1.f) | 12 rolling months |
| Messages received via the contact form of a partner storefront | Forwarding the request to the relevant partner | Legitimate interest / pre-contractual step | For the time needed to process the request |
| Billing data for box purchases | Issuance and retention of accounting records | Legal obligation (Art. 6.1.c) | 10 years (Art. L.123-22 of the French Commercial Code) |
4. Recipients and sub-processors
Data are never sold or transferred for commercial purposes. They are accessible only to authorised staff of the Publisher and to its technical sub-processors:
- OVH SAS — hosting (France / EU);
- Stripe — processing of partner payments;
- Brevo (Sendinblue SAS) — delivery of transactional emails (EU);
- INSEE (Sirene API) — verification of the partner SIRET.
Data are hosted within the European Union. Any transfer outside the EU would be governed by a GDPR-compliant mechanism.
5. Security
The Publisher implements appropriate technical and organisational measures: encryption of communications (HTTPS/TLS), hashed passwords, two-factor authentication, logging of sensitive actions, removal of EXIF metadata from photos, partial anonymisation of IP addresses, and regular backups.
6. Your rights
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability over your data. For data processed through a box (end customers, contributors), the request must first be addressed to the relevant partner, the controller for that processing; the Publisher will assist as needed.
To exercise your rights, write to contact@nda-conseil.com. You may also lodge a complaint with the CNIL (www.cnil.fr).
7. Data protection officer
NDA Conseil is not required to appoint a DPO (Art. 37 GDPR). Your questions may be addressed directly to the controller at the address above.
8. Cookies
Pyxistime uses only cookies that are strictly necessary for the operation of the service:
- session cookie (keeping you signed in);
- security cookie linked to two-factor authentication (“remember this browser”);
- anti-spam token (ALTCHA) on public forms.
No advertising, tracking or profiling cookie is placed. These technical cookies do not require prior consent.
9. Fate of data after death
In accordance with Article 85 of the French Data Protection Act, you may set directives regarding the retention and communication of your data after your death by contacting the Publisher.
9b. Archiving of undownloaded boxes
When a box is delivered to its recipient, the generated files (PDF, ZIP) remain available for download for 30 days. After that period, if no download has been recorded, client access is automatically suspended. The files are then placed under the sole responsibility of the partner who ordered the box, who must either download them for archiving or request their deletion. This mechanism is set out in Article 12 of the Partner Terms.
10. Changes to this policy
This policy may be updated to reflect legal or technical developments. The effective date appears at the top of the document.