Skip to content
01 60 46 29 96
Back to the shop

Legal information

Privacy Policy

Last updated :

KONEXAUTO – Limited Liability Company (SARL) with a share capital of €1,000 – Registered in the Évry Trade and Companies Register under number 935 278 416
konexauto.com · konexauto.fr · konexauto.eu

This policy describes the personal data used by KonexAuto for the operation of the shop, customer accounts, orders and the Google services set out below.

Data Controller

KONEXAUTO, a limited liability company (SARL) with a share capital of €1,000, registered in the Évry Trade and Companies Register under number 935 278 416. Contact address: 158 boulevard Gabriel Péri, 91170 Viry-Châtillon. For enquiries regarding personal data: [email protected].

Data processed, purposes and retention periods

Order management, delivery, after-sales service

  • Data: Surname, first name, addresses, email, telephone number, order details, vehicle reference numbers or VINs where provided

  • Legal basis: Performance of the contract

  • Retention period: For the duration of the business relationship, followed by 5 years (limitation period)

Invoicing and accounting

  • Data: Invoices and order details

  • Legal basis: Legal obligation

  • Retention period: 10 years

Customer account

  • Data: Login details, order history

  • Legal basis: Performance of the contract

  • Retention period: Until the account is deleted, or 3 years of inactivity

Newsletter and offers

  • Data: Email address, first name

  • Legal basis: Consent; legitimate interest for customers (offers of similar products)

  • Retention period: 3 years after the last contact, or until you unsubscribe

Security and fraud prevention

  • Data: IP address, connection data, payment data provided by service providers

  • Legal basis: Legitimate interest

  • Retention period: 1 year for connection logs

Recipients

The data is intended for KONEXAUTO and, where relevant, is passed on to the following service providers:

  • OVH SAS (website hosting, in France).

  • Resend (sending of transactional emails relating to customer accounts and orders).

  • COLORISHA, SASU, SIREN 933 267 064 (development, technical administration and maintenance of the web application), acting as a data processor for KONEXAUTO. For the purposes of providing its services, COLORISHA may access personal data stored on the server, in the database, in the email system and in order records, as well as in associated technical systems.

  • Stripe, PayPal and Klarna (secure payment, instalment or deferred payment).

  • The carriers responsible for delivery.

  • KONEXAUTO’s chartered accountant.

Service providers acting as data processors only process personal data on behalf of KONEXAUTO, within the scope of their remit and in accordance with its documented instructions. COLORISHA’s access is limited to what is necessary for the provision of its services. Ownership of the rights to the software does not confer upon it any right to reuse personal data for its own purposes.

When you choose Klarna, your name, contact details and the order amount are passed on to them so they can assess your payment request. Klarna then acts as a separate data controller, in accordance with its own privacy policy. The newsletter is managed and sent directly by KONEXAUTO, without the use of any external service providers. Data is never sold.

Transfers outside the European Union

Certain service providers (Stripe, PayPal) may process data in the United States. These transfers are governed by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

The use of Google and Resend services may also involve data processing outside the European Union, in particular in the United States. Google describes its international data processing practices in its privacy policy. For the sending of transactional emails, Resend’s processing commitments and transfer safeguards are set out in its data processing agreement, which includes the standard contractual clauses for the relevant transfers.

Cookies

The website uses only the cookies necessary for its operation: shopping basket, account login, security and payment. These cookies are exempt from the requirement for consent. No audience measurement or advertising cookies are set.

Your rights

You have the right to access, rectify, erase, restrict the processing of, object to and request the portability of your data. You may also withdraw your consent at any time and set out instructions regarding the handling of your data after your death. To exercise these rights, please write to [email protected] or to 158 Boulevard Gabriel Péri, 91170 Viry-Châtillon. You will receive a response within one month. Each newsletter contains an unsubscribe link. If you feel that your rights have not been respected, you may lodge a complaint with the CNIL (www.cnil.fr).

Security

KONEXAUTO implements appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), restricted access, and payment processing handled by certified service providers.

Google services used by KonexAuto

KonexAuto uses Google services for two distinct features: the optional login to a customer account and, within the shop’s administration panel, the connection to Google Business Profile to display the business’s information and reviews. Permissions are requested during the process corresponding to each feature.

Logging in to a customer account with Google

When you choose to sign in with Google, KonexAuto receives your Google account ID, your verified email address and your name. This information is used to create or retrieve your customer account, to authenticate you and to populate your account’s identity details. KonexAuto does not receive your Google password and does not request access to your Gmail messages, Google Drive files, contacts or calendar during this process. Google may also include a public photo URL in the profile response; KonexAuto does not use this and does not store it in your customer account.

The Google ID and associated email address are stored in the customer account’s login details; the name and email address may also be recorded in the customer profile. The Google tokens generated during this process are not retained as a means of ongoing access to other Google services. Public browsing does not require a Google login.

Administrator login to Google Business Profile

An authorised administrator can log in to Google Business Profile via the KonexAuto admin panel to select the business listing to be displayed. The data viewed includes the list of accessible listings, details of the selected listing, its name, address or geographical coordinates where available, its Google Maps link, its average rating, the number of reviews and the associated reviews.

A review may include the reviewer’s Google ID, their public name, the URL of their public photo, their rating, their comment and the date it was updated. This data enables the shop’s information and reviews to be displayed on the website. The Business Profile connection is reserved for administrative use: customers do not need to authorise access to their own business to use their customer account.

The current integration reads information and reviews; it does not post replies to reviews, nor does it edit or delete reviews on Google. The refresh token required for this connection is stored in encrypted form on the server, to enable data to be retrieved again after the initial authorisation.

Retention and deletion of Google data

The Google login details associated with your customer account are subject to the account retention period set out in this policy. You may request their deletion by contacting KonexAuto. Any order and billing data remain subject to their own specific purposes and retention periods.

The temporary list of accessible records expires after ten minutes. Copies of the information and notifications from the selected record remain valid for a maximum of thirty days after they are retrieved. Expired data is removed from display and purged during read or synchronisation operations. Synchronisation replaces the stored information and reviews; a failed Google API call does not extend their expiry date.

Logging out of Google Business Profile via the admin panel deletes the refresh token, the selected listing and active copies of the information and reviews in the application database. This action does not delete the listing or the reviews hosted by Google.

The maximum retention period for content received via the Google Business Profile API is thirty calendar days from the date of retrieval. Including this content in a backup does not extend this period.

Withdrawing authorisation or exercising your rights

You can withdraw the access granted to KonexAuto via the login settings in your Google account. Withdrawing access and deleting your KonexAuto account are two separate actions: revoking Google access does not automatically delete orders or customer profiles already recorded by KonexAuto. To request access to, rectification of, or erasure of data held by KonexAuto, please write to [email protected] or to 158 Boulevard Gabriel Péri, 91170 Viry-Châtillon.

Recipients and data protection

Login details are accessible to authorised KonexAuto staff and to the technical service providers described in this policy, solely for the purposes of carrying out their duties. Information and reviews from the shop selected for publication are visible to visitors to the website. If the account’s personal details are subsequently used to place an order, the processing of that order will be carried out in accordance with the purposes and recipients described in the relevant sections.

The website uses HTTPS, restricted administrator access and encrypted storage of the Business Profile renewal token. Secret credentials and Google tokens are not transmitted on public pages. The database is hosted on the KonexAuto server at OVHcloud in France.

Displaying Google images and maps

When public photos of authors or the shop map are displayed, your browser may load these resources from Google’s services. Google then receives the technical information required for this request, including the IP address and the browser’s connection details. The maps and photos remain Google resources; Google’s privacy policy applies to these services.

Technical backups

Technical backups are intended to enable the site to be restored following a failure, error or security incident. The retention period is seven rolling days for daily server backups at OVHcloud and a maximum of thirty days for independent copies of the database, files and configuration. Access to these copies is restricted to authorised personnel; the independent copies are encrypted.

After data has been deleted from the application, previous copies may remain in the backups until they are replaced or deleted within the timeframes set out above. The specific rules applicable to temporary Google Business Profile content remain applicable to these copies.

Limited use of Google data

Data received from Google is used exclusively for the features described. It is neither sold nor used for targeted advertising or for training artificial intelligence models.

The use and transfer of information received via Google APIs comply with the Google API Services User Data Policy, including the restricted use requirements where applicable.

Amendments

This policy may be updated. The effective date is shown at the top of the page.