Translation provided for information only: only the French version is legally binding.
Privacy policy
Last updated: 04/11/2026. This page explains what data we collect, why, how long we keep them and how to exercise your rights, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
LEDoMATIC — Plevoo SASU - 60 Rue François 1er 75008 PARIS, France — SIRET: 990 246 266 000 11
Contact for any question about your data: hello@ledomatic.com.
2. Data collected, purposes and legal bases
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Process and deliver your orders, send you confirmation and tracking emails | First name, last name, email, phone, delivery address, order content | Performance of the contract | Duration of the business relationship, then 10 years for accounting records (legal obligation) |
| Manage your customer account | Identity, email, phone, address, password (encrypted, never readable) | Performance of the contract | Until the account is deleted; deletion after 3 years of inactivity |
| Online payment | Bank details, processed only by Stripe: we never have access to them | Performance of the contract | Kept by Stripe according to its legal obligations |
| Reply to your messages (contact form) and study your custom requests | Name, email, phone (optional), message, project description, attached files (sketches, photos) | Your consent and pre-contractual measures taken at your request | Sent by email, not stored on the website; emails kept for 3 years after the last exchange |
| Reset your password | Email, reset token | Performance of the contract | 1 hour (link validity) |
| Audience measurement (Google Analytics) | Pages viewed, type of device and browser, origin of visits, cookie identifier | Your consent | Cookies: 13 months maximum; statistics: 14 months |
| Website security and fraud prevention | IP address, technical logs | Legitimate interest | 12 months maximum |
Mandatory form fields are indicated: without them, we cannot process your order. We do not carry out any automated decision-making or profiling, and your data are never sold.
3. Connected device data
To display timetables in real time, your device regularly exchanges with our servers. These exchanges involve a limited amount of technical data. Some of them, such as the IP address and the device identifier, may be linked to a person: we therefore treat them as personal data, in accordance with the GDPR and the French Data Protection Act.
Data processed.
- the public IP address of your Internet connection, sent automatically with each request;
- the unique device identifier (hardware serial number);
- the lines, stations and directions you have configured;
- the installed internal software version (firmware);
- the date and time of requests.
The device collects no identity, location (GPS) or voice data: it has no microphone and no camera. The name and password of your Wi-Fi network stay stored in the device and are never sent to us.
Purposes and legal bases. These data are used exclusively to:
- run the service: retrieve the next departures for the chosen lines and send them to the device (performance of the contract, article 6.1.b GDPR);
- update the device software and ensure it works properly (performance of the contract);
- secure the service: authenticate devices, detect abusive use or copied identifiers (legitimate interest, article 6.1.f GDPR).
They are never resold, never used for profiling and never used to analyse your movements. Transport operators receive neither your IP address nor your device identifier: our server queries their services.
Hosting. Our servers are hosted by IONOS SE in the European Union. No device data is transferred outside the European Union.
Retention periods. Technical logs (IP address, request, date and time) are automatically deleted after 14 days. Details of the periods are given in article 16 of the terms and conditions of sale.
Reset and deletion. On the device, the “Settings › Disconnect from Wi-Fi” menu erases the saved Wi-Fi credentials, and choosing another stop replaces the previous configuration. On our servers, you can at any time request access to your data, their deletion or restriction, or object to their processing, by writing to hello@ledomatic.com and giving the device's serial number. We reply within one month. Deleting the data stops the service for the device concerned.
4. Recipients
Your data are intended for LEDoMATIC only. They are passed on, strictly as necessary, to:
- IONOS SE (website and email hosting) — servers located in the European Union;
- Stripe Payments Europe Ltd (secure payment) — Ireland;
- the carrier (La Poste / Colissimo or equivalent) — name, address and phone number for delivery;
- Google Ireland Ltd (Google Analytics) — only if you have accepted audience measurement cookies.
5. Transfers outside the European Union
Stripe and Google may transfer certain data to the United States. These transfers are governed by the EU–US Data Privacy Framework, under which these companies are certified, and by the European Commission's standard contractual clauses.
6. Cookies and trackers
A cookie is a small file stored on your device. Cookies necessary for the website to work are stored without consent; all others are stored only with your agreement, given via the banner displayed on your first visit. Refusing is as easy as accepting and has no consequence on your use of the website.
| Name | Role | Issuer | Duration | Consent |
|---|---|---|---|---|
shop_session | Cart, login to your account, form security | LEDoMATIC | Session (browser closed) | Not required (essential) |
ledomatic-consent | Remember your cookie choice (browser local storage) | LEDoMATIC | 6 months | Not required (essential) |
__stripe_mid, __stripe_sid | Fraud prevention during payment (payment page only) | Stripe | 1 year / 30 minutes | Not required (payment security) |
_ga | Distinguish visitors for audience measurement | Google Analytics | 13 months | Yes |
_ga_P4QG7PSH1X | Keep the state of the audience measurement session | Google Analytics | 13 months | Yes |
Your choice is kept for 6 months, after which the banner is shown again. You can change it at any time: manage my cookie preferences. If you withdraw your consent, the Google Analytics cookies are deleted and measurement stops immediately.
To display the website, your browser also downloads fonts (Google Fonts) and animation libraries (jsDelivr): these services technically receive your IP address, but do not store any cookie. You can also set your browser to block cookies; some features (cart, login) will then no longer work.
Language. When you choose a language with the flag at the top of the page, a lang cookie (1 year, essential) remembers this choice.
7. Security
The website is only accessible over HTTPS. Passwords are stored in encrypted form (hashing) and are never readable, even by us. Payment is entirely handled by Stripe, which is PCI-DSS certified. Access to the administration area is protected and restricted to authorised persons.
8. Your rights
You have the following rights over your data:
- access: obtain a copy of your data;
- rectification: correct inaccurate data (also possible from your account);
- erasure: request deletion of your data, subject to legal retention obligations;
- restriction of and objection to processing;
- portability: receive your data in a structured format;
- withdrawal of consent at any time, for audience measurement;
- instructions on what happens to your data after your death.
To exercise these rights, write to us at hello@ledomatic.com. We reply within one month. Proof of identity may be requested if there is reasonable doubt about your identity. If you believe your rights are not being respected, you can lodge a complaint with the CNIL: www.cnil.fr/fr/plaintes.
9. Changes
This policy may change, in particular when a new service is introduced. The date of the last update is shown at the top of this page.