tranZition

Privacy Policy — shop.tranzition.fr

Last updated: 12 May 2026

1. Preamble

This Privacy Policy (the "Policy") describes how tranZition collects, processes and protects the personal data of Users and Clients of the website https://shop.tranzition.fr (the "Site" or the "Shop").

It applies to natural persons acting in the name and on behalf of professional entities that visit the Site, create an Account, order an Extension or interact with tranZition through the Site.

tranZition undertakes to process personal data in compliance with Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and French Law No. 78-17 of 6 January 1978, as amended ("French Data Protection Act").

This Policy forms an integral part of the Terms of Use of the Site and complements the Terms of Sale of the Extensions.

2. Data Controller

The controller for the data processing described in this Policy is:

tranZition

Simplified joint-stock company (Société par actions simplifiée)

Registered office: 149 Avenue du Maine, 75014 Paris, France

Paris Trade and Companies Register: 834 352 056

Represented by its President: SARL Généraction Service, itself represented by François Nanquette

Contact email: rgpd@tranzition.fr

3. Data Protection Officer (DPO)

tranZition has appointed an outsourced Data Protection Officer from the company DIPEEO.

Any request relating to the processing of personal data or the exercise of data subjects' rights may be addressed:

  • by email to: rgpd@tranzition.fr
  • or by post to the registered office address mentioned above

Requests will be forwarded to the DPO and handled within the timeframes set by the GDPR.

4. Scope of the Policy

This Policy covers:

  • the processing of personal data carried out in connection with browsing the Site, creating an Account, ordering Extensions, invoicing, support, and commercial communications;
  • the processing related to the Extension activation mechanism (management of Activation Codes).

This Policy does not cover:

  • processing of personal data carried out by the Client within their Zoho environment through the use of the Extensions, which falls under the Client's responsibility as data controller (see section 8);
  • processing carried out by Zoho Corporation Pvt. Ltd. in the context of providing its Zoho services, governed by Zoho's own privacy policy;
  • processing carried out by the publishers of third-party websites that may be linked to from the Site.

5. Data Collected and Purposes

5.1. Data collected when browsing

When simply browsing the Site, the following data may be collected:

  • IP address, browser type and version, operating system, pages viewed, duration of consultation, date and time of access, referring site;
  • data collected via cookies and trackers, under the conditions described in section 9.

5.2. Data collected when creating an Account

When creating an Account on the Site, the following data is collected:

  • first and last name of the professional contact;
  • professional email address;
  • professional telephone number (optional);
  • corporate name, SIREN/SIRET number or equivalent, professional address of the represented entity;
  • login credentials (email + password).

5.3. Data collected when ordering an Extension

When placing an order, the data collected additionally includes:

  • identifier of the Zoho Org concerned by the Licence;
  • chosen Subscription plan (monthly / annual);
  • billing data (corporate name, billing address, intra-Community VAT number if applicable);
  • order and invoice history.

Payment card data is collected and processed directly by payment service providers (Stripe via Zoho Billing — see section 7). tranZition has no access to full card numbers.

5.4. Data collected when using support

In the context of technical or commercial support, data exchanged by email or via Site forms is collected (request descriptions, any screenshots transmitted, correspondence).

5.5. Data processed in the context of Extension activation

To verify that an Extension installed in a Zoho Org has a valid Licence, the activation mechanism processes:

  • the Activation Code (unique alphanumeric key);
  • the identifier of the Zoho Org in which the Extension is installed and activated;
  • the activation date and the Licence status.

This technical data contains no business data of the Client (neither the INSEE data queried via the Extensions nor the Client's CRM data).

5.6. Purposes and legal bases

The table below summarises the purposes, legal bases and categories of data concerned:

| Purpose | Legal basis (GDPR) | Categories of data |

|---|---|---|

| Account creation and management | Contract performance (Art. 6(1)(b)) | Identification, professional contact details, login credentials |

| Order processing and delivery of Activation Codes | Contract performance | Account, order data, Zoho Org identifier |

| Invoicing and accounting | Legal obligation (Art. 6(1)(c)) | Account, billing data, order history |

| Verification of Licence validity (activation) | Contract performance | Activation Code, Zoho Org identifier |

| Support and customer relationship management | Contract performance | Account, content of exchanges |

| Fraud prevention and Site security | Legitimate interest (Art. 6(1)(f)) | Browsing data, Account data |

| Sending transactional emails (confirmation, expiry, update) | Contract performance | Professional email |

| Sending commercial information about tranZition products | Legitimate interest (existing clients) or consent (prospects) | Professional email, position |

| Audience measurement and Site improvement | Consent (non-strictly-necessary cookies) | Browsing data |

| Compliance with legal obligations and legal defence | Legal obligation / Legitimate interest | All categories depending on context |

6. Recipients of the Data

Personal data is processed by authorised personnel of tranZition (technical, support, sales and administrative teams).

It may also be shared with the following recipients, on a need-to-know basis:

  • tranZition's technical providers: Site host, support providers, email management providers;
  • Payment providers: Stripe, via the Zoho Billing platform, for payment processing (see section 7);
  • Zoho publisher: for features related to billing management and email sending via the Zoho services used by tranZition;
  • External advisors of tranZition (accountant, legal counsel, outsourced DPO), bound by confidentiality obligations;
  • Public and judicial authorities, upon legal requisition or court order.

tranZition undertakes to allow access to data only to authorised persons and to contractually frame the activities of its subcontractors in accordance with Article 28 GDPR.

7. Hosting and Data Location — Transfers outside the European Union

7.1. Hosting of the Site and activation platform

The Site and the Extension activation functions are hosted on the Google Cloud Platform / Firebase infrastructure of Google Cloud EMEA Limited (registered office: Dublin, Ireland). Data is hosted in a European region.

Google may transfer data to the United States in the course of operating its services. Such transfers take place under the EU-US Data Privacy Framework or, failing that, on the basis of standard contractual clauses approved by the European Commission.

7.2. Zoho services

tranZition uses Zoho services (in particular Zoho Billing for subscription and invoicing management) to process certain personal data. Zoho Corporation Pvt. Ltd. is established in India and offers European hosting for European customers.

Any transfers to India or the United States (depending on the Zoho components used) are governed by the European Commission's standard contractual clauses and by Zoho's GDPR commitments, accessible in Zoho's documentation.

7.3. Payments via Stripe

Card payments are processed by Stripe Payments Europe Ltd. (Dublin, Ireland), with possible transfers to Stripe Inc. in the United States governed by standard contractual clauses and the EU-US Data Privacy Framework.

8. Distinction between Shop-related Processing and Processing via the Extensions

It is important to distinguish two levels of data processing:

8.1. Processing related to the Shop commercial relationship (covered by this Policy)

For all processing related to Account management, ordering, invoicing, support and Licence activation, tranZition acts as data controller within the meaning of Article 4 GDPR.

8.2. Processing related to the use of the Extensions (not covered by this Policy)

The Extensions sold via the Shop are software programs installed and run in the Client's Zoho environment. They process data in that environment (for example: CRM record enrichment, automation, etc.) under the Client's responsibility as data controller.

As of the date of this Policy, the Extensions available on the Shop do not transit any of the Client's business data through tranZition's servers. The only data exchanged between the Extension and tranZition concerns Licence activation and verification (see section 5.5).

Specifically regarding the "Recherche Entreprise France" extension:

  • it queries the official public API of the French government https://recherche-entreprises.api.gouv.fr via Zoho's HTTP proxy (`ZOHO.CRM.HTTP.get`);
  • the INSEE data returned (legal company information) is processed directly in the Client's Zoho environment, without transit through tranZition;
  • legal company data (corporate name, SIREN number, head office address, NAF code, etc.) does not, for the most part, constitute personal data; where it concerns sole proprietorships or named directors, it falls under the Client's responsibility as user.

If a future Extension were to modify this architecture (for example by routing business data through tranZition), a dedicated product fact sheet and, where applicable, a GDPR data processing addendum (DPA) would be made available to the Client in accordance with section 13 of the Terms of Sale.

9. Cookies and Trackers

9.1. Cookies used

The Site uses cookies and trackers to:

  • ensure the technical operation of the Site (strictly necessary cookies: Account authentication, security, cart, language preference);
  • measure audience and improve the Site (audience-measurement cookies), where applicable;
  • personalise certain content or facilitate the use of features (preference cookies).

As of the date of this Policy, the Site does not use third-party audience-measurement tools or marketing tracking tools. Should such tools be deployed, this Policy and the consent banner will be updated accordingly.

9.2. Consent management

On the first visit, a consent banner allows the User to:

  • accept all non-strictly-necessary cookies;
  • reject all non-strictly-necessary cookies;
  • customise their choices by category.

Consent is stored for a maximum period of 6 months, in accordance with the CNIL's recommendations. After that period, the banner is shown again.

The User may at any time change their preferences via the "Manage my cookies" link in the footer of the Site.

Strictly necessary cookies for the operation of the Site (authentication, security) cannot be disabled without severely degrading the use of the Site.

9.3. Disabling via the browser

The User may also configure their browser to refuse all or part of the cookies. The configuration procedures vary by browser and are accessible in the relevant help sections (Chrome, Firefox, Safari, Edge, etc.).

10. Retention Periods

Personal data retention periods are set according to the purposes pursued and the applicable legal obligations:

| Category | Retention period |

|---|---|

| Account data (no active Subscription) | For the duration of registration, then deletion after 24 months of inactivity (with prior notice) |

| Data related to active Subscriptions | For the entire duration of the contractual relationship |

| Accounting and billing data | 10 years from the end of the financial year (Article L.123-22 of the French Commercial Code) |

| Tax data (invoices) | 6 years (Article L.102 B of the French Book of Tax Procedures), extended to 10 years for accounting consistency |

| Activation Codes and activation history | For the entire duration of the Licence, then archived for 3 years for evidentiary purposes |

| Support data / correspondence | 3 years from the last contact |

| Commercial prospecting data (prospects) | 3 years from the last contact |

| Cookies and trackers | 13 months maximum (CNIL recommendation) |

| Data collected in the event of a dispute | Until the limitation period of the action concerned |

At the end of these periods, the data is either deleted, anonymised, or archived under a restricted-access archiving procedure for mandatory legal periods.

11. Data Security

tranZition implements appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access, in particular:

  • encryption of communications via HTTPS/TLS;
  • access control to systems through individual authentication;
  • separation of environments (development, staging, production);
  • use of hosting and payment providers recognised for their security levels (ISO 27001, PCI-DSS certifications);
  • staff awareness training on data protection;
  • incident management procedure and notification of breaches within the timeframes set by the GDPR.

In the event of a personal data breach likely to give rise to a risk to the rights and freedoms of the data subjects, tranZition undertakes to notify the incident to the CNIL within 72 hours and, where applicable, to inform the data subjects as soon as possible.

12. Rights of Data Subjects

In accordance with Articles 15 to 22 GDPR, any person whose data is processed has the following rights:

  • Right of access: obtain confirmation that data concerning them is being processed and obtain a copy thereof;
  • Right of rectification: have inaccurate data corrected or incomplete data completed;
  • Right of erasure ("right to be forgotten"): obtain the erasure of data in the cases provided for by the GDPR;
  • Right to restriction of processing: obtain the temporary suspension of a contested processing operation;
  • Right to object: object to processing, in particular for the purposes of commercial prospecting, on grounds relating to their particular situation;
  • Right to data portability: receive the data provided in a structured, commonly used and machine-readable format, or request its transfer to another controller;
  • Right to withdraw consent at any time, where processing is based on consent;
  • Right to set guidelines regarding the fate of the data after their death.

These rights may be exercised by sending a request, accompanied by proof of identity where necessary:

  • by email to: rgpd@tranzition.fr (subject: "Exercise of rights")
  • or by post to the registered office address

tranZition undertakes to reply within one month from receipt of the request, extendable by two months in the case of a complex request or multiple requests.

In the event of disagreement with tranZition's reply, or in the absence of a reply, the data subject has the right to lodge a complaint with the French Data Protection Authority (CNIL):

CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

Telephone: +33 1 53 73 22 22 — Website: https://www.cnil.fr

13. Minors

The Site is exclusively intended for professionals acting in the course of their business. tranZition does not knowingly collect data concerning minors. If a parent or guardian discovers that data concerning a minor has been transmitted without authorisation, they are invited to contact tranZition at the details indicated in section 3 to obtain its deletion.

14. Changes to the Policy

tranZition reserves the right to amend this Policy to reflect changes in regulations, the Site's features or its practices.

The version in force is the one accessible on the Site at the date of consultation. Substantial changes will be subject to prior notice to Users with an active Account, by email, at least fifteen (15) days before they take effect.

15. Contact

For any question relating to this Policy or the processing of personal data:

  • email: rgpd@tranzition.fr
  • postal address: tranZition — 149 Avenue du Maine, 75014 Paris, France