Privacy policy

Who is responsible for your data

The company TRAXO, a French simplified joint-stock company (SAS) whose registered office is at Bâtiment C Appartement 14, 40 avenue André Diligent, 59100 Roubaix, France, operating the Traxo service, is the controller of the processing described on this page.

No data protection officer has been appointed: the company exceeds none of the thresholds that would require one. Any request concerning your data is handled at contact@traxo.fr.

What we collect, and why

Each row corresponds to something you do. We build no file bought or enriched elsewhere.

No field marked as optional is needed to get an answer. We collect neither health data nor sensitive data within the meaning of the GDPR, and the service is not intended for minors.

We ask Google for no rights over your existing calendars. The authorisation you grant covers only the Traxo calendar the application creates inside your account: we can neither read, change nor delete anything else. If you disconnect, that calendar stays with you and we forget it.

Your Google Business Profile

If your plan includes it, you can entrust your Google Business Profile to Traxo: you add our Google address as a manager of the profile, then confirm in your workspace that it is indeed yours. We then act in your name, under the mandate of article 8 of the terms and conditions, with only the rights Google grants a manager. Google remains in control of the profile: what we write there is published under its own rules.

What we read: the profile's information — name, address, category, opening hours, contact details, links, services, photos, posts and the state of the profile — and your clients' reviews, with the public name of their author, the rating, the text, the date and your reply. Reviews are collected every night, so that you can see them in your workspace and, if you ask for it, be told of a new one. A review Google no longer returns, because its author or Google has removed it, is deleted from our servers at the next collection.

What we write in your name, each part behind its own switch, which you turn on or off at any time in your workspace: your opening hours; your exceptional closures and, if you turn it on, the status showing the business as temporarily closed during a long closure; the booking link; your website address; your services and, if you choose to display them, their prices; your own photographs; posts announcing your gift cards and your new services. Turning a switch off stops our writes on that part, without deleting anything from the profile. We never write the name of the business, its address or its category.

After every appointment that has taken place, we send your client an email inviting them to leave a review on your profile. For those emails you are the controller and we act as your processor, under article 12 of the terms and conditions: we use your client's address for that email alone, and keep a record of each sending so as never to write twice for the same appointment. Sending is on by default and you turn it off in your workspace. As Google's rules require, it goes to every client whose appointment took place, with no selection and no reward tied to the review. Every email carries an unsubscribe link: in one click, your client receives no further review request from your business.

Have you received such a request after an appointment? The business you had the appointment with is responsible for that email, and your rights are exercised with it; the unsubscribe link in the email is enough to stop receiving any more from that business. You may also write to us at contact@traxo.fr: we pass your request on to the business.

To withdraw the access you have given us, either of two steps will do: remove Traxo's address from the people who manage your profile, on Google — we can then neither read it nor write to it — or turn the switches off in your Traxo workspace, part by part. Review requests do not need that access: they stop with their own switch. At the end of the subscription, we remove our access to the profile ourselves.

Who else has access

Internally, only the people who need it in order to reply to you or to run the service. Externally, only the providers below, each bound by a processing agreement compliant with Article 28 of the GDPR:

The website and the service's data are hosted by ourselves, on our own servers, at our registered office: that hosting has no provider at all. Only the data and the processing entrusted to the cloud are held at Amazon Web Services, in Europe.

Audience measurement does not appear in this table because it has no recipient: the tool that produces it runs on our own servers, alongside the website, and that data is passed on to nobody.

We do not sell, rent or exchange any data. It may be disclosed to a third party in two cases only: a judicial or administrative order we are required to comply with, and the transfer of accounting records to our accountant.

Transfers outside the European Union

Your data is hosted in Europe, on our own servers and at Amazon Web Services. Three providers — Stripe, Cal.com and Google — may process certain data in the United States. Those transfers are governed by the European Commission's standard contractual clauses and, where applicable, by those companies' certification under the EU–US Data Privacy Framework.

Cookies and audience measurement

No consent banner is displayed on this website, and that is deliberate: we place no cookie that would require your agreement. So there is nothing to accept, nothing to refuse, and nothing to come back and change.

Our audience measurement, for its part, places nothing at all: the pages viewed are counted by our own server, hosted alongside the website, from your IP address and your browser — with no identifier written on your device, and without that data ever leaving us. No Meta pixel, no Google Ads tag, no advertising network.

If we have sent you the demonstration website prepared for your business, visits to that site and the visits that follow them on traxo.fr are linked to your business: that is what tells us what interested you before we call you back. This is business prospecting, based on our legitimate interest in presenting our service to professionals, and kept for 25 months. You can object at any time by writing to contact@traxo.fr, with no need to give a reason: we then stop the measurement and delete what concerns you.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over your data, as well as the right to withdraw consent already given and to give directions on what becomes of your data after your death.

A request to contact@traxo.fr is enough, with no formality. We reply within one month, extendable by two months if the request is complex, in which case we tell you so. Proof of identity may be requested where there is reasonable doubt as to who you are, and for that purpose alone.

If our answer does not satisfy you, you may refer the matter to the Commission nationale de l'informatique et des libertés, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or cnil.fr.

Security

Traffic encrypted over HTTPS, passwords stored as hashes, access to data limited to authorised staff, our team's interventions in your workspace logged and viewable by you, regular backups and hosting in Europe. In the event of a data breach likely to create a risk to your rights, we notify the CNIL within 72 hours and inform you directly where the risk is high.

Changes to this policy

This page is updated as soon as a processing activity or a provider changes. The date at the top of the page indicates the latest version. A change that concerns you directly — a new purpose, a new recipient — is notified to you by email if you are a client.