Privacy policy

Last update: August 2026

SECTION 01

PURPOSE

This policy describes how CYKERO collects, uses, retains, and protects the personal data of site visitors, retail customers, business customers, and individuals who sell equipment to the company as part of its buyback operations.
It is established in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data, known as the "GDPR," and French Law No. 78-17 of January 6, 1978 as amended.

SECTION 02

DATA CONTROLLER

The data controller is CYKERO, a simplified joint-stock company (SAS), with its registered office located at 672 rue du Mas de Verchant, 34000 Montpellier, France, registered under SIREN number 912 663 598.
Contact for any questions relating to personal data: bichoi@cykero.eu.

SECTION 03

DATA COLLECTED AND PURPOSES

3.1 Management of Orders and Customer Account

Collected data: surname, first name, delivery and billing address, email address, telephone number, order history, and payment-related data.
Purpose: performance of the sales contract, delivery, billing, after-sales service management, warranties, returns, and withdrawals.
Legal basis: performance of the contract to which the data subject is party (Article 6.1.b of the GDPR), and compliance with legal obligations regarding the retention of accounting records (Article 6.1.c).

3.2 Equipment Buyback and Trade-In

Collected data: identity of the seller, contact details, bank details for payment, characteristics of the device sold, and, where required by regulations applicable to movable property, an identity document.
Purpose: conclusion and performance of the transfer contract, payment of the price, traceability of incoming equipment, and prevention of receiving stolen goods.
Legal basis: performance of the contract and compliance with legal obligations.
Data contained in sold devices: Each incoming device undergoes data erasure using a protocol compliant with the HMG Infosec Standard 5. This erasure is irreversible. However, CYKERO recommends that anyone selling equipment perform a data backup beforehand, deactivate activation lock services, and factory-reset the device.

3.3 Professional Business Relationship

Collected data: professional identification data, job title, professional contact details, company registration data, exchange and order history.
Purpose: management of the partner program, quotes, stock offers, the DaaS offer, and professional commercial communications.
Legal basis: performance of the contract or pre-contractual measures, and CYKERO's legitimate interest in developing and maintaining its business relationship.

3.4 Marketing Communications

Collected data: email address, telephone number where applicable, and interaction data regarding messages sent.
Purpose: sending commercial information, newsletters, and offers.
Legal basis: consent for individual prospects; legitimate interest for existing customers and business contacts solicited for products similar to those already ordered, with each message including an immediate and free opt-out mechanism.

3.5 Audience Measurement, Personalization, and Advertising

Collected data: browsing data, IP address, device and session identifiers, pages viewed, and conversion events.
Legal basis: consent collected via the cookie management module, except for trackers strictly necessary for the website's operation.

3.6 Customer Reviews

Reviews published on the site are collected and controlled by a third-party provider. The collection, moderation, and publication procedures are detailed in Article 8 of the General Terms of Use.

3.7 Job Applications

Data transmitted as part of a spontaneous application or in response to a job posting is processed for recruitment management purposes, based on pre-contractual measures and CYKERO's legitimate interest.

SECTION 04

RETENTION PERIOD

Processing Duration
Customer account Duration of the contractual relationship, then 3 years from the last contact
Order and billing data 10 years from the close of the financial year (accounting obligation)
Warranty and after-sales service data Duration of the commercial warranty, extended by the applicable limitation period
Equipment buyback files Period required under regulations applicable to movable property
Commercial prospecting 3 years from the last contact originating from the data subject
Cookies and trackers subject to consent Maximum 13 months; data from trackers retained for a maximum of 25 months
Proof of cookie consent 6 months from collection
Unsuccessful applications 2 years from the last contact, barring objection

SECTION 05

RECIPIENTS

Data is accessible to authorized internal departments of CYKERO, as well as the following categories of processors and partners, strictly within the limits of what is necessary for their missions:

  • Hosting and operation of the e-commerce platform

  • Payment service providers

  • Carriers and logistics service providers

  • Email and professional messaging providers

  • Audience measurement tools and advertising networks, subject to consent

  • Customer review collection and moderation platform

  • Affiliate platform

  • Consultants, chartered accountants, statutory auditors, and legal officers

  • Administrative and judicial authorities upon formal requisition

Data is never sold or rented to third parties for commercial purposes.

SECTION 06

TRANSFERS OUTSIDE THE EUROPEAN UNION

Certain service providers are established outside the European Union, notably in Canada and the United States. These transfers are governed by one of the mechanisms provided for in Chapter V of the GDPR: European Commission adequacy decision, standard contractual clauses, or adherence of the recipient to a recognized protection framework.
A copy of the applicable safeguards can be obtained upon request from the address indicated in Article 2.

SECTION 07

RIGHTS OF DATA SUBJECTS

Any data subject has the right of access, rectification, erasure, restriction of processing, objection, and portability of their data, as well as the right to withdraw their consent at any time when processing is based thereon, without affecting the lawfulness of prior processing.
Any person may also define directives regarding the fate of their data after their death.
These rights can be exercised by contacting bichoi@cykero.eu. CYKERO responds within one month of receiving the request, a period that may be extended by two months due to the complexity or number of requests. Proof of identity may be requested in case of reasonable doubt regarding the applicant's identity.
In the event of an unsatisfactory response, any person may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

SECTION 08

SECURITY

CYKERO implements appropriate technical and organizational measures to preserve the confidentiality, integrity, and availability of data: flow encryption, access management based on the principle of least privilege, access logging, backups, employee awareness training, and contractual supervision of subcontractors.

SECTION 09

MINORS

The site is not intended for persons under the age of fifteen. No data is knowingly collected from a minor under fifteen without the consent of the holder of parental authority.

SECTION 10

MODIFICATIONS

CYKERO may modify this policy to reflect legal, technical, or organizational changes. The applicable version is the one published on the site on the date of consultation.