This privacy policy explains how AlloParadise collects, uses, stores and protects the personal data of its users and customers, in accordance with the General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés) and other applicable provisions.
It applies in particular to the use of the website https://alloparadise.fr, account creation, orders, payments, exchanges with our customer service and identity verification procedures.
AlloParadise sells, among other things, gift cards, prepaid codes, video games, subscriptions and other digital products, including products issued by third-party companies.
We pay particular attention to the confidentiality and security of personal data, especially identity documents and supporting documents provided for fraud prevention purposes.
The controller of personal data is:
PADZUP EIRL – AlloParadise
10 rue Alexander Fleming
37000 Tours, France
Email address: [email protected]
Website: https://alloparadise.fr
For any question about the protection of your personal data or the exercise of your rights, you can contact us at this address.
Depending on the services used and the operations carried out, we may collect the following categories of data.
Depending on the options offered on the website, payment methods may include bank cards, mobile phone payments, payments on the Internet bill and cryptocurrencies.
Data collected directly by payment service providers is also subject to their own privacy policies and regulatory obligations.
As part of fraud prevention procedures, we may request:
When a verification is carried out with our provider Didit, photographs, selfies, video captures and biometric data may also be processed in order to check that the person's face matches the photograph on their identity document.
In our exchanges with customers, we may process:
These communications are centralised in particular through our ticket management tool, LiveAgent.
To operate and secure the website, we may collect:
Data is used to create and manage accounts, authenticate users, secure logins and provide the website's features.
Legal basis: performance of the contract or of pre-contractual measures (Article 6(1)(b) GDPR).
The information collected is used to process orders, deliver the digital products purchased, track payments, handle refunds and provide after-sales service.
Legal basis: performance of the contract (Article 6(1)(b) GDPR).
Some information is also kept in order to meet our accounting and tax obligations.
Additional legal basis: legal obligation (Article 6(1)(c) GDPR).
Given that it sells digital products, gift cards and prepaid codes issued by third-party companies, AlloParadise implements measures intended to prevent:
These checks help in particular to limit the risks associated with mobile payments, payments on the Internet bill and the sale of prepaid digital products.
Legal basis: AlloParadise's legitimate interest in preventing fraud, securing its transactions and protecting the persons concerned (Article 6(1)(f) GDPR).
Checks are carried out taking into account their necessity and proportionality with regard to the risks identified.
When the customer chooses identity verification by facial recognition, biometric data may be processed in order to confirm that their face matches the photograph on their identity document.
Biometric processing based on the user's choice relies on their explicit consent, in accordance with Articles 6(1)(a) and 9(2)(a) GDPR.
This consent is collected specifically before biometric data is captured.
An alternative verification method without facial recognition is offered to people who do not wish to use this system.
Refusing to consent to facial recognition does not, in itself, lead to the refusal of the request or transaction concerned.
Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.
Data is used to respond to support requests, process complaints, handle disputes, request additional information and resolve disagreements.
Legal bases: performance of the contract, legitimate interest in following up the customer relationship and preventing fraud, or legal obligation, depending on the nature of the processing.
We may send information about our products, new releases, commercial offers and promotions.
These communications rely on consent where it is required, or on the legal exceptions applicable to existing customers for similar products and services.
Recipients may object to these communications or unsubscribe at any time.
Some data may be used to analyse website traffic, measure its performance and improve the services offered.
Where this processing requires the use of trackers subject to consent, that consent is collected beforehand.
In certain situations, in particular to secure payments made through a mobile phone line or an Internet connection, AlloParadise may ask the customer to prove their identity and their ownership of the line used.
The aim is to check that the information of the person making the request is consistent with the information shown on the supporting documents from their operator.
The verification forms are provided by:
Deftform – ivy.mayhem GmbH
Hohe Bleichen 22
20354 Hamburg, Germany
Deftform acts as a technical processor for the collection, transmission, hosting and management of the responses and documents submitted.
Processing carried out on our behalf is governed by contractual provisions on the protection of personal data.
Provider's privacy policy:
https://deftform.com/privacy-policy
Depending on what the verification requires, the documents requested may include:
Providing the necessary supporting documents may be a condition for validating certain requests or transactions subject to a security check.
To limit the amount of personal data transmitted, we encourage users to favour a single-use proof of identity generated with France Identité, the official service of the French government:
https://france-identite.gouv.fr/
When a copy of an identity document is provided, we invite users to hide the numbers shown on the document, in particular the national identity card number and the CAN number.
Only the information needed for the check should remain visible, in particular:
Users may also hide irrelevant information on their telephone or Internet bills, in particular the amounts billed and usage details.
Documents submitted via Deftform are kept only for the time needed to process the request.
Identity documents and proofs of line ownership are deleted within a maximum of 45 days after the verification is closed, unless further retention is duly justified, in particular in the event of documented suspicion of fraud, a dispute or a specific legal obligation.
Documents associated with abandoned, incomplete or unanswered requests are deleted no later than 60 days after the last activity on the file, unless there is a specific justified need.
These deletions are carried out as part of regular data management procedures, manually or automatically depending on the features available.
Any technical copies present in backups are subject to the protection, retention and deletion mechanisms applicable to those backups.
Only the information needed to trace the result of the checks may be kept separately, in accordance with section 7.
In certain situations, AlloParadise also uses the Didit service, which specialises in digital identity verification and fraud prevention.
This system is separate from the Deftform forms and is not used systematically.
Didit Identity Spain, S.L.
Carrer de Provença 385
08025 Barcelona, Spain
Didit acts as a processor for the checks carried out on our behalf, in accordance with a data processing agreement.
Depending on the flow used, Didit may in particular:
Facial recognition may involve creating digital representations of facial features, used to compare the person present with the photograph on their identity document.
These representations constitute biometric data within the meaning of the GDPR when they are used to uniquely identify a natural person.
Biometric processing is subject to a specific step providing information and collecting explicit consent before the face is captured.
The Didit flow used by AlloParadise includes this consent step.
The elements needed to prove consent, in particular its date and the version of the text presented, are recorded by the provider.
Refusing or withdrawing consent to facial recognition does not prevent the customer from requesting an alternative verification without biometrics.
People who do not wish to use biometric verification may request a manual verification from AlloParadise.
This method may in particular rely on:
This method does not require facial recognition and can be requested at the following address:
Choosing a manual verification does not involve any additional costs related to identity verification.
The retention period for verification data is set to 1 month.
This setting applies to the documents, photographs, selfies, videos and biometric data covered by the retention policy of the Didit application used by AlloParadise.
Biometric templates are not kept separately after the verification sessions are deleted.
Data is deleted according to Didit's technical mechanisms and contractual guarantees.
AlloParadise may separately keep a limited result of the verification, without systematically keeping copies of identity documents, facial photographs or biometric representations.
The use of AlloParadise's verification data for training and improving Didit's artificial intelligence models is disabled in our organisation's privacy settings.
Voluntary sharing of signals with Didit's cross-company anti-fraud network is also disabled.
Didit may however carry out certain separate processing operations as an independent data controller, in particular for the security of its platform, the prevention of abuse and compliance with its legal obligations.
This processing is subject to the applicable provisions of the GDPR and to the guarantees set out in the provider's contractual documentation.
Further information:
The Didit application used by AlloParadise is configured for verification data to be mainly stored and processed in the European Union, in Ireland.
Didit applies the technical and organisational security measures provided for in its data processing agreement, in particular encryption, access control and system protection mechanisms.
Any international transfers are subject to the guarantees provided for by the applicable regulations.
AlloParadise uses LiveAgent, a customer communication and support ticket management service published by:
Quality Unit, s.r.o.
Vajnorská 100/A
831 04 Bratislava, Slovakia
LiveAgent is used to centralise and process exchanges between AlloParadise and its customers.
LiveAgent is used in particular for:
LiveAgent is a tool for communication and for managing customer requests. It does not itself carry out the identity checks performed by AlloParadise.
Depending on the nature of the exchanges, the data may include:
As part of certain verification procedures, our teams may also request or receive additional supporting documents, in particular telephone or Internet bills, proofs of line ownership or identity documents.
These items are used only to the extent necessary to process the request concerned.
Exchanges with customer service and the processing of tickets rely, depending on the purpose:
Exchanges and support tickets are kept for the time needed to process and follow up requests and then, where justified, for the periods needed to handle disputes, comply with legal obligations or defend rights.
Keeping a ticket does not require systematically keeping the identity documents or other sensitive supporting documents attached to it.
Attachments containing identity documents or proofs of line ownership are subject to the same deletion objectives as documents collected via Deftform:
Further retention may be applied when it is necessary and justified by a dispute, a documented suspicion of fraud or a specific legal obligation.
Attachments may be deleted independently of the retention of the information needed to follow up the ticket.
Any technical copies and backups remain subject to the retention and deletion arrangements applicable to the provider's systems.
LiveAgent acts as a technical processor for managing communications and hosting the data related to support tickets.
The provider's data protection measures, security procedures and processing commitments are described in its contractual documentation and its GDPR compliance policy.
LiveAgent's European accounts are hosted on infrastructure located in particular in Germany and Ireland, depending on the hosting region of the account concerned.
Some technical sub-processors may operate from other countries, in accordance with the guarantees applicable to international transfers.
For more information:
https://www.liveagent.fr/respect-du-rgpd-par-liveagent/
To avoid requesting new supporting documents unnecessarily and to secure future transactions, AlloParadise keeps a limited history of the identity checks carried out.
This history may include:
The information needed to trace the checks is kept for the entire duration of the contractual relationship, as long as the customer account remains active and its retention remains necessary for fraud prevention and transaction security.
After the account is closed, the necessary information may be kept for a further period of up to 12 months, when this retention remains justified.
Copies of identity documents, telephone bills and biometric data are subject to separate, shorter retention periods.
The verification status may be reviewed when circumstances require it.
A successful identity verification does not constitute permanent proof of ownership of a telephone or Internet line.
The solutions used to prevent fraud and verify identity may involve automated processing.
This processing may in particular produce results relating to:
These results may be used by AlloParadise when reviewing verification requests.
When a verification is refused or an anomaly is identified, the customer may contact our customer service to obtain explanations, request a review or provide additional information.
When a fully automated individual decision produces legal effects or significantly affects the person concerned, the specific guarantees of Article 22 GDPR apply.
Personal data is accessible to authorised persons at AlloParadise, within the limits of their duties.
It may also be processed by the service providers needed to operate our services.
Collection and management of the forms, responses and documents submitted as part of identity checks.
Digital identity verification, document analysis, facial recognition and fraud prevention.
Management of emails, support tickets, customer communications, complaints and exchanges relating to identity checks.
Hosting and technical infrastructure services for the website and the associated data.
Management of consent to cookies and other trackers, and of the privacy preferences expressed by users.
Website: https://www.concord.tech/
Tracking of referrals and management of the affiliate programme.
Processing of payments, refunds, disputes and security operations related to transactions.
Some payment service providers act as independent data controllers for processing that falls under their own obligations.
Providers may be involved in maintenance, support, communications, security and the operation of the services.
The data communicated to these parties is limited to what is necessary to perform their services.
Data may also be transmitted to the competent administrative or judicial authorities when a legal obligation or a legally founded request justifies it.
Personal data is kept for periods suited to its purposes and to the applicable legal obligations.
The data needed to manage the account is kept during the contractual relationship, as long as the account remains active and the information remains necessary.
After the account is closed, some data may be archived when its retention is justified by a legal obligation or by the need to establish, exercise or defend rights.
The information needed to manage orders is kept while they are being processed and followed up, then archived when this is legally justified.
Accounting documents and supporting records subject to a legal retention obligation are kept for 10 years from the end of the financial year concerned.
Identity documents, France Identité proofs and telephone or Internet bills are deleted:
Exceptions may be applied when further retention is necessary and justified, in particular in the event of a dispute, documented fraud or a specific legal obligation.
Deletions are carried out according to a regular procedure, manual or automatic.
Verification data covered by Didit's retention settings is kept for 1 month.
Biometric templates are deleted with the sessions and are not kept separately for later recognition purposes.
Processing carried out by Didit for its own security and compliance purposes may be subject to separate periods, specified in its documentation.
The statuses and limited information needed to trace the checks are kept for the entire duration of the contractual relationship, as long as this retention remains necessary.
After the account is closed, they may be kept for a further period of up to 12 months, when this is justified.
Customer communications and support tickets are kept for the time needed to process requests and follow up the business relationship.
Some information may be kept longer when a legal obligation, a dispute or the need to defend rights justifies it.
Sensitive personal documents sent as attachments are subject to the shorter retention rules described in this policy.
The information needed to handle complaints and disputes is kept while the files are being processed.
When some data must be kept in order to establish, exercise or defend rights, its retention period is determined according to the applicable statutory limitation periods.
Data archived for this purpose is subject to restricted access.
Data used for marketing to customers may be kept during the business relationship, then for a maximum of 3 years from the end of that relationship, subject to the applicable legal exceptions.
For prospects who have never been customers, data may be kept for a maximum of 3 years from its collection or from their last active contact.
The information needed to honour objections to marketing may be kept separately in order to avoid further solicitations.
Connection and security logs are kept for a limited period proportionate to the needs of operation, maintenance, incident detection and fraud prevention.
The applicable periods depend on the nature of the logs concerned, the risks identified and any legal obligations.
When the applicable periods expire, data is deleted or anonymised, unless further retention is legally justified.
AlloParadise uses cookies and similar technologies to operate the website, secure transactions, measure its traffic and, subject to the user's consent where it is required, offer personalisation or advertising features.
Some cookies are essential to the operation of the website, in particular for:
These cookies may be used without prior consent when they are strictly necessary to provide the service requested.
Trackers may be used to measure website traffic and analyse its performance.
Where their use requires consent, they are only placed or read once it has been obtained.
Trackers used for advertising personalisation, commercial tracking or non-essential features are subject to prior consent where the regulations require it.
Cookie preferences and consent are managed by Concord:
Users can accept, refuse or change their choices regarding non-essential cookies from the consent manager available on the website.
Refusing non-necessary cookies is offered as simply as accepting them.
The detailed list of cookies and trackers, including their categories, purposes, providers and retention periods, is presented in the information accessible from the consent manager.
Users can change their preferences at any time from this tool.
Consent management by Concord also makes it possible to keep the information needed to trace the choices expressed by users.
AlloParadise may send information about its products, new releases, promotions and commercial offers.
These communications are carried out in accordance with the rules applicable to electronic marketing.
Where consent is necessary, it is collected before sending.
In the situations permitted by the regulations, communications about similar products or services may be sent to existing customers, provided that a simple way to object is offered.
Each commercial communication includes an unsubscribe mechanism.
Identity documents and biometric data collected as part of the checks are not used for marketing or advertising targeting.
AlloParadise offers an affiliate programme allowing partners to recommend its products and services.
The programme is tracked by:
Referly
https://referly.so
When a user creates an account or places an order after being referred by a partner, some data may be transmitted to Referly in order to identify eligible referrals and calculate commissions.
This information may include:
Legal basis: AlloParadise's legitimate interest in managing its affiliate programme, subject to the consent requirements applicable to any tracking technologies.
This data is not transmitted to partners for them to use for their own marketing.
The persons concerned may exercise their rights in the manner described in this policy.
AlloParadise implements technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, destruction or disclosure.
Depending on the systems concerned, these measures include in particular:
We encourage users to provide only the information needed for the checks and to hide non-essential items shown on their documents.
Security measures are adapted to the nature of the information processed, in particular when it concerns identity documents and biometric data.
Some technical providers or their sub-processors may process personal data outside the European Economic Area.
When such transfers take place, they are governed in accordance with the applicable provisions of the GDPR, in particular by:
The persons concerned may request further information about transfers and the associated guarantees at [email protected].
In accordance with the GDPR and the French Data Protection Act, the persons concerned have the following rights, under the conditions laid down by the regulations.
You may request information about the personal data concerning you and obtain a copy of the data processed.
You may request the correction of inaccurate or incomplete data.
You may request the deletion of certain personal data when the legal conditions are met.
Some information may however be kept when a legal obligation or the defence of rights justifies it.
You may request the temporary restriction of certain processing in the situations provided for by the regulations.
You may object to certain processing based on our legitimate interest, under the conditions laid down by the GDPR.
You may also object at any time to the use of your personal data for marketing purposes.
When the legal conditions are met, you may request to receive certain personal data in a structured, commonly used and machine-readable format.
When processing is based on your consent, in particular biometric verification or the use of certain trackers, you may withdraw that consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Under the conditions laid down by French law, you may set instructions regarding the retention, erasure and communication of your personal data after your death.
To exercise your rights, you can contact:
PADZUP EIRL – AlloParadise
10 rue Alexander Fleming
37000 Tours, France
Email address: [email protected]
We respond to requests within the time limits laid down by the regulations, in principle within one month of receiving them, subject to the extensions permitted by law.
A proportionate check of the applicant's identity may be carried out in case of reasonable doubt.
If you disagree with the way your personal data is processed, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL):
The use of AlloParadise's services by minors is subject to the age and authorisation conditions laid down in the website's terms and conditions and in the applicable regulations.
When the processing of a minor's personal data requires the consent of their legal representative, the specific applicable rules are followed.
Any identity verification procedures concerning minors are subject to appropriate precautions, in particular when they involve identity documents or biometric data.
AlloParadise may amend this policy to take account of regulatory, technical or organisational developments, as well as changes to its services and providers.
The date of the last update is shown at the top of the document.
In the event of a substantial change affecting the processing carried out or the rights of the persons concerned, appropriate information may be provided.
For any question about this policy:
We sent a verification code to your email address. Enter it to sign in.
A new code has just been sent. Previous codes are no longer valid. Remember to check your spam folder.
No account is linked to this address yet. Last step: check your username, accept the terms, and you're done.
The information collected on this form is stored in a computerized file by PADZUP for the management of the customer account and use of the site. It is kept for 5 years after the end of the contractual relationship and is intended for the various competent departments of the company. In accordance with the "Data Protection" law, you can exercise your right to access data concerning you and have it rectified by contacting us via : [email protected]
More information in our privacy policy.
Forgot your account password? To reset it, please enter your email address below.
