Privacy policy

Obhéa Editions respects your privacy. This page explains, simply, which personal data is collected when you use the website, why, how long it is kept and how to exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978.

Principle: we collect the minimum necessary. No non-essential cookie is set and no third-party measurement or video service is loaded before you agree.

Data controller

Obhéa Editions, simplified joint-stock company (SAS) (SIREN 922 205 422), whose registered office is given in the legal notice. For any question about personal data: Contact page or email: Information hidden; activate the button to show it. .

The data we process

Website operation and security

Data: IP address, date and time, pages requested, browser type (technical server logs). The IP address is also used, without being stored, to limit the number of requests sent to forms (protection against abuse).
Why: to operate and secure the website and detect abuse.
Legal basis: legitimate interest.
Retention: twelve months at most.

Audience measurement (Google Analytics)

Data: pages viewed, visit duration, device and browser type, origin, approximate location; IP address anonymised. Data sharing with Google for advertising purposes is turned off.
Why: to understand how the website is used so that we can improve it.
Legal basis: your consent. Nothing is loaded until you accept the “Audience measurement” category; you can withdraw your consent at any time.
Retention: cookies last thirteen months at most; measurement data is kept fourteen months at most.

YouTube videos

Data: when you accept the “External media” category, the YouTube player (Google LLC, in enhanced privacy mode) may set cookies and receive your IP address.
Legal basis: your consent, requested before the player is loaded.

Contact form

Data: name, email address, subject, content and language of the message; if you are signed in, the link with your account (you find your messages in “My account”). An internal notice reports that a message has arrived, without copying its content.
Why: to answer your request.
Legal basis: legitimate interest, or pre-contractual measures when your request precedes a purchase.
Retention: three years after the message was sent, then automatic deletion; the message is deleted earlier if you delete your account.

If you subscribe to our newsletter, we record your email address, the language of the subscription page, and the dates of your request and of your confirmation. This data is only used to send you the Obhéa Editions newsletter, about once a month, and to prove your consent. The processing is based on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

Your subscription only becomes active once you confirm it through the link sent to your address (double opt-in); this link is valid for 7 days. An address that is never confirmed is automatically deleted 30 days after the request. A confirmed address is kept for as long as you remain subscribed.

You can unsubscribe at any time, without an account and in one click, through the “Unsubscribe” link in every email, or from your account if you have one: your address is then removed from the list. If you turn the newsletter on or off in “My account”, your choice and its date are also noted in your consent log.

This data is stored on the server that hosts the website and is only accessible to authorised Obhéa Editions staff. Confirmation emails and newsletters are sent from Obhéa Editions’ own mail server, hosted by OVH SAS; no other sending provider is involved. It is never sold, rented or transferred.

You have the right to access, rectify, erase and object to the processing of your data, which you can exercise through the Contact page. You may also lodge a complaint with the CNIL (cnil.fr (opens in a new tab)), the French data protection authority.

Member account

Data: identifier provided by our identity service (Authentik), display name, language, email address (copy of the one on your sign-in account, updated at each sign-in), dates of first and last sign-in and of acceptance of the terms. If you fill them in or place an order while signed in: address book (name, postal address), phone numbers, favourite pick-up point, notification preferences and your consent log (the last 50 entries). The games you are a member of (groups assigned by the team, which give access to reserved files). Your password is never read or kept by the website: sign-in is handled by Authentik, and the website keeps no Google identifier.
Discord identifier: it is only recorded if your Discord account is linked to your sign-in (the website then keeps neither your avatar nor your Discord password). Today it is used to show in “My account” that your Discord account is linked; it is intended to link your answers to events to your account and, later, to grant the roles of your games on the Obhéa Editions Discord server (neither use is in service yet). It is never published.
Order while signed in: the delivery address and phone number entered at checkout are automatically added to your address book to prefill your next orders; you can change or delete them at any time in “My account”. Your email address is not copied into the address book: the account has its own.
Why: to let you sign in, find your messages and orders, prefill your next orders, sign up for events, access reserved files and, if you choose, receive emails.
Legal basis: performance of the service you request; your consent for notification emails (turned off by default).
Retention: as long as your account exists, and three years at most without signing in: an account unused for three years is deleted, and when your email address is known, an email warns you 30 days before the deletion. You can delete your record at any time from “My account”: your contact details, preferences, Discord identifier and contact messages are deleted with it, the link with your answers to events is removed (answers given through the Discord buttons follow their own retention period, see “Events and game sign-ups”) and you are unsubscribed from the newsletter. Order data follows its own retention period (see “Shop orders”).

Events and game sign-ups

Data: Discord nickname and identifier, language of your Discord client, the answer given (signed up, withdrawn, interested), waiting-list position. Never your email address or avatar.
Why: to organise games, manage seats and the waiting list, write to you by Discord private message (confirmation, promotion from the waiting list, reminder 24 hours and sometimes 2 hours before; these messages stop if you withdraw or close your private messages) and, once answers are anonymised, find out which games and event types people like.
Legal basis: Obhéa Editions’ legitimate interest.
Who sees what: the event organiser sees the nicknames of the registered, waiting-list and interested people; they may publish on Discord the list of selected players (nicknames only, no identifier). On the website, only the number of seats available is public: no nickname or identifier appears on a public page.
Retention: the identity of people marked “interested” or “not interested” is deleted 30 days after the event (only the numbers are kept); sign-ups, waiting lists and withdrawals are deleted twelve months after the event; a participant with no answer and no activity for twelve months is deleted.

Shop orders

Data: first and last name, delivery and billing addresses, email address, phone number (optional, useful to the carrier), chosen pick-up point, content and amount of the order, payment reference (never your card number), sign-in identifier if you order while signed in; for a digital file, the date on which you ask for immediate delivery and waive your right of withdrawal (proof), and the number of downloads made.
Why: to process, ship and invoice your order (numbered invoice, and credit note in case of a refund), deliver digital files, provide after-sales service and write to you about your order (confirmation, shipment, refund).
Legal basis: performance of the contract; accounting and tax obligations.
Retention: during the order, then ten years for accounting records (invoices and credit notes). The personal download link is valid for 365 days, for 50 downloads at most; the tracking link of an order placed without an account, two years. Unfinished basket: kept for 24 hours after its last change, then deleted.
Order and account: if you order while signed in, the order is linked to your account by your sign-in identifier: you find it in “My orders”, with its invoices and files. Deleting your account (or having it deleted after three years without signing in) does not delete your orders: they are kept for accounting obligations (see the retention period above), and this identifier remains recorded on the order.
Payment: depending on the payment methods offered at checkout (SumUp for bank cards, PayPal), it takes place on the provider’s secure pages, to which you are redirected; none of these providers’ scripts is loaded in our pages. Obhéa Editions never sees or keeps your card number or your PayPal account credentials. We pass them only the amount, the currency and a technical order reference: neither your name, nor your email address, nor your delivery address is passed on by us. In return, we only keep the payment status and the technical references of the transaction; the name and email address of your PayPal account are not kept. As payment service providers, SumUp and PayPal process your payment data on their own behalf, under their own privacy policy, which we invite you to read.
Phone: your number is only used for delivery. Obhéa Editions does not cold-call you; without your prior consent, no commercial call may be made to you (Article L.223-2 of the French Consumer Code).
Delivery to Switzerland (outside the European Union): for the customs declaration, the delivery details (name, address, phone) and the description, value and weight of the items shipped are passed to the carrier and to customs; the declaration is drawn up from your order, with no other personal data.
Basket cookie: a technical cookie (24 hours) remembers your basket; it is described on the Cookies page.

Social network content shown on the website

Posts from Instagram, Facebook or Discord shown on the website are fetched by our servers and then displayed as website content: your browser does not contact these services when you visit our pages and none of their scripts is loaded. When you click a link to these networks, you leave the website and their own rules apply.

Who receives your data

Your data is neither sold nor handed over. It is accessible only to the people at Obhéa Editions who need it and to our service providers, within the limits of their task:

the website host: OVH SAS (see the legal notice);
Google (Google Analytics, YouTube), only after your consent;
Discord, for events and reminders;
Google and Discord, if you choose to sign in with your account with them: they receive the sign-in request made by our identity service and pass it your identifier, your name and your email address;
SumUp and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), for order payment, depending on the payment methods offered at checkout;
La Poste (Colissimo) and Mondial Relay, to deliver parcels: they receive the name, address, phone number and email address needed for delivery; for Switzerland, the carrier and Swiss customs also receive the information in the customs declaration;
our mail server, which sends the confirmation, order and newsletter emails, and our identity service (Authentik), both hosted by OVH SAS;
our accountant, to keep the accounts (invoices and credit notes);
Cloudflare, whose network carries access to the sign-in page of our identity service.

Transfers outside the European Union

Some providers (Google, Discord, Cloudflare) may process data outside the European Union, notably in the United States. These transfers rely on the safeguards provided by the GDPR: a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. When you pay by PayPal or SumUp, these providers may themselves process your payment data outside the European Union, under the safeguards they describe in their own policy; Obhéa Editions does not pass them your name or your email address. Switzerland, the destination of some deliveries, benefits from a European Commission adequacy decision.

Backups

To be able to restore the website after an incident, the database (accounts, messages, orders, sign-ups) and uploaded files are backed up: the host (OVH SAS) makes an automatic backup every 24 hours, and Obhéa Editions also keeps a manual snapshot. Data that is deleted disappears from the website immediately, but remains in backups already made until they expire. Automatic backups are kept for 7 days (seven rolling copies); the manual snapshot is kept only as long as strictly necessary. They are protected by restricted access rights and only used for restoration.

Automated decisions

No decision about you is taken in a fully automated way and no profiling is carried out.

Security

The website is served over HTTPS; administration access is protected by dedicated authentication; logs and backups are limited in time; personal data is never written to application logs.

Data breach

In the event of a personal data breach that poses a risk to your rights and freedoms, Obhéa Editions notifies the CNIL within 72 hours of becoming aware of it (Article 33 GDPR); if the risk is high, we also inform you as soon as possible, in clear and plain language (Article 34 GDPR). Every breach is recorded in an internal register.

Your rights

You have the following rights over your data:

access, rectification and erasure;
restriction of processing and objection, notably on legitimate grounds;
portability of the data you provided to us;
withdrawal of your consent at any time, without affecting what took place before;
setting instructions about what happens to your data after your death.

To exercise them, write to us through the Contact page or by email to Information hidden; activate the button to show it. , stating your request; proof of identity may be requested if there is doubt. We reply within one month. From the “My account” page you can also export your data and delete the record the website keeps about you; the export does not contain your orders, which you find in “My orders” and a copy of which you can request through the Contact page; deletion of your sign-in account is requested through the Contact page.

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority, the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr (opens in a new tab).

Minors

The website is open to all audiences, but creating an account or subscribing to the newsletter is reserved for people aged 15 and over, or those whose parent or guardian has given permission.

Cookies

Cookies and other trackers, their lifetimes and how to manage your choices are described on the Cookies page.

Changes to this policy

This policy may change, for example when a new service is added. The date of the last update appears at the bottom of the page; in case of an important change, we will let you know on the website.