The French text prevails.
Data controller
Rachid AIT SELLAMET (EI), Rue de Saillagouse, 31100 Toulouse. Contact for any data question: contact@upapu.com.
Data processed and purposes
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, password (hashed), display name, language | Customer account, sign-in, security | Performance of the contract | Life of the account, then 3 years after last activity |
| Orders, timestamped consents, invoices, payment references | Sale, delivery, accounting | Contract and legal obligation (invoices kept 10 years) | 10 years |
| Download and administration logs, IP address | Security, proof of delivery, fraud prevention | Legitimate interest | 1 year |
| Email address and interest type (launch list) | Informing you when purchases or the referral programme open | Consent, withdrawable at any time | Until unsubscription, at most 3 years |
| Contact requests: email address, optional name, topic, message, language, and the attached account and order where applicable | Answering your question or your request for support, an invoice or a refund | Performance of the contract or pre-contractual measures when the request concerns a purchase; legitimate interest otherwise | 3 years after the last exchange (proposed period, to be validated) |
| Affiliates, payout file: first and last name, date of birth, address, country of residence, status (private individual or business), company name and SIRET of a business, date on which the affiliate acknowledged their duty to declare this income | Checking identity, age and country of residence before any payout; paying commissions; producing the annual statement and reporting the amounts paid where the law requires | Performance of the contract (referral programme terms) and legal obligation (tax reporting) | Duration of the relationship, then 10 years after the last payout for the data needed for accounting and tax obligations (proposed period, to be validated) |
| Affiliates, bank details: IBAN, account holder, BIC, IBAN fingerprint | Paying commissions by bank transfer; any change confirmed through a link sent to the account's email address, then a security delay of 7 days before any payout to a new account. A fingerprint of the IBAN, from which the IBAN cannot be read, is used to spot affiliate accounts linked to the same bank account, since the programme terms forbid multiple accounts (article 9); a match is reviewed by a person, with no automated decision | Performance of the contract; legitimate interest (fraud prevention) for the fingerprint | Duration of the relationship; the fingerprint follows the file's IBAN and is replaced with it; an IBAN entered but never confirmed is erased, with its fingerprint, no later than the day after the confirmation link expires (valid for 48 hours); the IBAN on a transfer order is kept with it for 10 years (proposed period, to be validated) |
| Affiliates, supporting documents: identity document, bank details (RIB), proof of address, business registration extract | Manual review of the payout file | Performance of the contract and legitimate interest (fraud prevention) | Content deleted 30 days after the decision on the file (verified or rejected). For a file left incomplete and never submitted, content deleted after 90 days without any activity on the file (proposed period, to be validated); the affiliate is told by email and uploads the documents again if they resume the file. A submitted file keeps its documents until the decision. In every case, only a record of the upload (type, date, size) is kept |
We collect no card data: payment is processed by our payment provider on its own pages.
Affiliates' bank details and supporting documents are encrypted before being stored: only the last four characters of the IBAN are readable in the database, and neither the full IBAN nor the content of a document appears in emails or logs. A document is decrypted only when an authorised person at Upapu views it to review the file; every viewing, like every display of the full IBAN, is recorded in the audit log. Affiliates cannot download a document they sent; they can withdraw it until their file is verified.
A request sent through the contact form is recorded on the Site and forwarded by email to contact@upapu.com, where only the people in charge of answering you read it. The IP address is not recorded with the request, and no automatic email is sent to the address entered: the answer comes from a person.
Recipients
Data is processed by Rachid AIT SELLAMET (EI) and by its strictly necessary processors: site host (OVH SAS), payment provider (Stripe), email delivery provider. To pay commissions, Upapu's bank receives the beneficiary's name, IBAN, amount and reference of each transfer; the tax authorities receive the amounts paid where the law requires them to be reported. No data is sold or transferred to third parties for commercial purposes.
Transfers outside the European Union
The payment provider may process data outside the EU under recognised contractual safeguards (standard contractual clauses). Other processing is hosted in the EU.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent for the launch list. Write to contact@upapu.com. You may also lodge a complaint with the French authority, the CNIL (cnil.fr).
Invoices and logs needed as evidence cannot be erased during their statutory retention period.
Cookies
The Site stores strictly necessary cookies, which require no consent: sign-in session, request forgery protection, language preference, and a record of the choice described below.
A referral cookie attributes a sale to the affiliate whose link you followed, for thirty days. It is not necessary for the Site to work: it is stored only after your consent, requested through a notice shown when you arrive through such a link. Refusing has no effect on your browsing, on prices or on your purchase; the referral code then stays visible and editable at checkout. Your choice is remembered for six months and can be changed at any time from the "Cookies" page, reachable from every page of the Site.
Clicking a referral link is also recorded server-side (date, target page, a fingerprint of the IP address, never the address itself) for attribution and fraud prevention. That record stores nothing on your device.
Security
Hashed passwords, encrypted connections, encrypted affiliate bank details and supporting documents, sold files in private storage accessible only to entitled users, audit log of sensitive actions, encrypted backups.
Changes
This policy may evolve; the version in force is the one published on the Site, identified by its number.