Privacy Policy

Mis à jour : 26 janvier 2026

Introduction

TresorXpedition is committed to protecting your privacy and personal data. This privacy policy explains how we collect, use and protect your information in accordance with the General Data Protection Regulation (GDPR).

1. Data Controller

The data controller is:

TresorXpedition
[Address to be completed]
contact@tresorxpedition.fr
Data Protection Officer: [To be appointed]

2. Data Collected

We collect the following data:

Account Data

Email address (required for registration)
Pseudonym (optional, editable)
Password (securely stored via hashing)

Technical Data

IP address (anonymized)
Browser type (User-Agent)
Login dates and times

Usage Data

Treasure hunt participations
Scores and rankings
Game preferences

3. Purposes and Legal Bases

Your data is processed for the following purposes:

Purpose	Legal Basis	Duration
Account creation and management	Contract performance (Art. 6.1.b GDPR)	Duration of relationship + 3 years
Authentication and security	Contract performance (Art. 6.1.b GDPR)	Session duration
Marketing newsletters	Consent (Art. 6.1.a GDPR)	Until consent withdrawal
Security and fraud prevention	Legitimate interest (Art. 6.1.f GDPR)	14 days (logs)
Service improvement	Legitimate interest (Art. 6.1.f GDPR)	Anonymized data

4. Retention Period

We retain your data for the following periods:

Active account: throughout your use of the service
Inactive account: automatic deletion after 3 years of inactivity
Deleted account: complete erasure within 30 days of your request
Unverified accounts: automatic deletion after 30 days
Security logs: 14 days
Expired authentication tokens: daily deletion

5. Your Rights

Under the GDPR, you have the following rights:

Right of access

Obtain a copy of your personal data

Right to rectification

Correct inaccurate or incomplete data

Right to erasure

Request deletion of your data

Right to portability

Receive your data in a structured format (JSON)

Right to object

Object to the processing of your data

Right to withdraw consent

Withdraw your consent at any time (e.g., newsletters)

To exercise your rights, log into your profile or contact us at: privacy@tresorxpedition.fr

You may also file a complaint with the supervisory authority (CNIL - www.cnil.fr).

6. Data Security

We implement technical and organizational measures to protect your data:

Password encryption (bcrypt)
Secure HTTPS connection
Secure authentication tokens (JWT, httpOnly cookies)
Restricted data access (principle of least privilege)
Access logging
Regular backups

7. Cookies

We only use technical cookies necessary for the service:

Authentication cookie (refresh_token): necessary to maintain your session
Language preference cookie: necessary to display the site in your language

These cookies are exempt from consent as they are strictly necessary for the service (Art. 82 French Data Protection Act).

8. Data Sharing

We never sell your data. We may share it with:

Our technical hosts (servers, database)
Google (if you use Google OAuth login)
Competent authorities (legal obligation)

Your data is hosted in the European Union. In case of transfer outside the EU, we ensure appropriate safeguards (standard contractual clauses).

9. Changes

We may modify this privacy policy. In case of substantial changes, we will inform you by email or via a notification on the site.

10. Contact

For any questions regarding this policy or your personal data:

privacy@tresorxpedition.fr

Loading…