Privacy Policy

English translation of the French Politique de confidentialité.

jenvoie is committed to protecting and respecting your privacy.

We want you to know how we work and why we need your data. This privacy policy explains when and why we collect personal data about the people who visit our website or use our services, how we use it and the conditions under which we may disclose it to others.

This privacy policy applies to the website https://jenvoie.fr (jenvoie), to the jenvoie app for Shopify and to the games and emails delivered by means of the jenvoie services. Its purpose is to explain to the users of the site how their personal data is collected and processed.

Personal data means any data that can identify a user, in particular first and last name, age, postal address, email address, location or IP address.

This policy also sets out the rights of the persons concerned by this data collection, who the controller of the personal data collected and processed is, to whom the data is transmitted and the site’s policy on “cookies”. It supplements the legal notice and the Terms of Service, available at https://jenvoie.fr/terms.

In accordance with article 5 of European Regulation 2016/679, the collection and processing of users’ data comply with the following principles:

• Lawfulness, fairness and transparency towards the data subject.
• Specified, explicit and legitimate purposes: data is collected and processed to meet one or more specified purposes in connection with the use of the site or the placing of an order.
• Data minimisation: only the data needed to achieve the purposes pursued by the site is collected.
• Limited retention: data is kept for a period of which the user is informed. Where this information cannot be given, the user is informed of the criteria used to determine the retention period.
• Integrity and confidentiality: the controller undertakes to guarantee the integrity, confidentiality and appropriate security of the data collected.

To be lawful, in accordance with article 6 of European Regulation 2016/679, personal data may only be collected and processed if at least one of the following conditions is met:

• the user has expressly consented to the processing;
• the processing is necessary for the performance of a contract;
• the processing is necessary to comply with a legal obligation;
• the processing is necessary to protect the vital interests of the data subject or of another natural person;
• the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority;
• the processing is necessary for the purposes of the legitimate and private interests pursued by the controller.

1. Controller

The controller of personal data is the company Gravity5 (a French simplified joint-stock company (société par actions simplifiée) with variable share capital of €150, RCS Créteil 931 799 860, 6bis, rue Jean Mermoz, 94450 Limeil-Brévannes, France), which can be contacted by email at privacy@jenvoie.fr.

The controller determines the purposes and means of the processing of personal data. The controller undertakes to protect the personal data collected, not to transmit it to third parties without the user being informed, and to respect the purposes for which it was collected. The site has an SSL certificate to secure the information and data transmitted through it. In addition, the controller undertakes to notify the user of any rectification or erasure of data, unless this would involve disproportionate formalities, costs or steps. Should the integrity, confidentiality or security of the user’s personal data be compromised, the controller undertakes to inform the user by any means.

However, where the Services allow the Client to collect personal data from the participants in promotional operations, the Client remains the controller of the data collected for its own purposes.

Gravity5 acts as a technical provider when the data is processed on the Client’s behalf as part of the provision of the Services.

The Client is responsible for informing the participants, respecting their rights and ensuring that the collection methods used in its operations comply with the law.

The same applies to the recipients of the Client’s emails and, for the jenvoie app for Shopify, to the store’s customers: the Client is the controller and Gravity5 acts as its processor within the meaning of article 28 GDPR, under the Data Processing Agreement (DPA). If you played a game or received an email from a business or store that uses jenvoie, please contact it first to exercise your rights; if you write to us, we will forward your request to it and help it answer.

2. Data collected, processing and legal bases

• The personal data collected on the jenvoie site, a marketing games and email solution, is: last name, first name, email, phone number, company name.

  This data is collected when the user:

  • creates an account or installs the jenvoie app for Shopify;
  • contacts Gravity5 (support, booking a meeting);
  • subscribes to the newsletter.

  This processing is carried out for the commercial management of the contract, the management of prospecting operations and the production of commercial statistics, on the legal basis of the controller’s legitimate interest and of the performance of the contract or pre-contractual measures, except for newsletter subscriptions, which are based on the data subject’s consent.

• When services are ordered or subscribed to, the following personal data is also collected:

  legal information about the company, business contact details, bank and billing details.

  This data is processed to manage the contractual relationship and billing, on the legal basis of compliance with the controller’s legal and accounting obligations.

  Bank details are processed by Stripe for customers who subscribe on jenvoie.fr and by Shopify for stores that use the jenvoie app for Shopify (Shopify billing); Gravity5 does not keep them and only receives the subscription status from Shopify.

• When the blockchain registration feature offered by the Platform is used, data relating to the contest campaigns created by users may also be processed to timestamp them and guarantee their integrity.

  This processing may relate in particular to the contest rules, the elements needed to identify them and their digital fingerprint (“hash”) recorded in the blockchain. No directly identifying data relating to contest participants is recorded in the blockchain. Where personal data is needed for this processing, it is anonymised beforehand.

  This processing allows users to benefit from a mechanism proving the existence, date and integrity of the elements recorded on the Platform. It is based on the performance of the contract or of pre-contractual measures taken at the user’s request.

• When the Services are used through third-party technical environments or partner platforms, some data may be processed to ensure the connection, integration and operation of the Services.

  This data may include information about the user account, the technical parameters of the integration, the configuration of promotional operations and the data needed for the widgets deployed on the Client’s sites to work.

  For the jenvoie app for Shopify, Gravity5 receives from Shopify at installation: the store’s myshopify domain, its name, contact email, country and currency, the permissions granted and an access token that lets the app act on the store. The app only requests permission to create discount codes: it does not read the store’s customers, orders or products.

• When the terms of service are accepted, Gravity5 keeps the account identifier or the Shopify store domain, the date and time of acceptance and the version accepted, on the legal basis of its legitimate interest in keeping evidence of the contract.

• For the security of the Services and the prevention of fraud and abuse (including monitoring of sending quality), Gravity5 processes technical data (IP address, browser, connection dates, logs of sensitive actions), on the legal basis of its legitimate interest.

• On behalf of its Clients (Section 1), Gravity5 processes:

  • game entries: the email address and the other fields the Client chose to ask in the game form (for example a first name, a phone number, an answer or a prediction);
  • consent choices: whether the marketing consent box was ticked and, where offered, the open-tracking box, with their date;
  • plays: game, date, language, result, prize won, discount code issued, browser user agent and reference of the play’s certificate;
  • email activity: emails sent to the contact, delivery, bounces, unsubscribes, complaints, clicks and, unless the recipient refused it, opens.

  This data is used to run the game, determine and show its result, deliver the prize and, where applicable, create a unique discount code in the Client’s Shopify store; to add the participant to the Client’s contacts and, only if they ticked the marketing consent box, to its mailing lists; to send the Client’s emails; to show the Client its contacts and statistics; to certify draws and to protect the Services against abuse. The result of a game is determined by a random draw according to the Client’s settings; it is not based on any profiling of the participant and produces no legal effect within the meaning of article 22 GDPR.

3. Retention period

The controller will keep all the data collected, under reasonable security conditions, for three (3) years from the user’s last contact.

Some personal data may be kept longer to meet legal and accounting obligations or for evidence purposes (10 years).

Security logs are kept for twelve (12) months. Evidence of acceptance of the terms of service is kept for the term of the contract plus five (5) years.

Data processed on behalf of Clients is kept for as long as the Client keeps it in its account and, for the jenvoie app for Shopify, for as long as the app is installed. Gravity5 handles the privacy requests forwarded by Shopify: for a store customer’s access request (customers/data_request), Gravity5 emails the Client, at its store’s address, a file containing the data it holds about that person, the Client remaining in charge of answering them; for an erasure request (customers/redact), Gravity5 deletes the person’s contact record, answers and email history and anonymises their plays; forty-eight (48) hours after the app is uninstalled (shop/redact), Gravity5 deletes the personal data of all the store’s participants and contacts and its access credentials to the store. Game designs, which contain no personal data, are kept in case the store reinstalls the app, unless it asks otherwise. Residual copies in encrypted backups disappear as the backups rotate.

4. Subprocessing and transfers to third parties

In the course of our business and the provision of our services, we may subcontract some of our tasks, in part or in full, to technical subcontractors bound to us by contract (in particular subcontractors in charge of maintaining our platform, information security, hosting, our communication and direct marketing tools, or our help centre and online technical support). We formally require our subcontractors to strictly comply with the GDPR and data protection law, by objectively providing sufficient guarantees as to the implementation of appropriate technical and organisational measures, so that the processing of your data involves no risk or threat, thereby guaranteeing the protection of your rights.

When using our platform, in particular to share game campaigns on social networks, you may choose to interact with third-party services such as Facebook, Instagram, TikTok, Twitter or Pinterest. If you provide account information or log in to these services from our platform, some data (such as your activity or content) may be accessible on these social networks and added to your profile, depending on your privacy settings. Please note that these interactions are optional and based on your consent. You can limit or prevent this data sharing by logging out of the social networks concerned before using our site or applications, or by adjusting your privacy settings directly on these platforms. We recommend that you read the privacy policies and terms of each social network to learn in detail about their personal data collection and processing practices.

Data may be transmitted to the following third parties:

• Hetzner Online GmbH — hosting of all servers, databases and backups, and of Gravity5’s email sending servers — Germany (EU);
• Shopify — for stores that use the jenvoie app for Shopify: installation, authentication, billing (Shopify Billing), forwarding of privacy requests and creation of discount codes in the store, under Shopify’s own terms;
• Stripe — payment of customers who subscribe directly on jenvoie.fr (not through Shopify) — European Union and United States;
• OpenAI — optional automatic translation of game texts, only when the Client uses it; only the texts of the game are sent, never the data of participants or contacts — United States.
• Crisp IM SAS — live chat of the jenvoie.fr website, only if the visitor opens the conversation (“Got a question?” button): messages exchanged and any data the visitor chooses to share — France (EU);

The site https://jenvoie.fr (jenvoie) – a solution for creating marketing games and sending emails – is hosted by Hetzner Online GmbH, whose registered office is at Industriestr. 25, 91710 Gunzenhausen, Germany. Data is hosted in the European Union (Germany). Emails (login codes, notifications, games, newsletters) are sent by Gravity5’s own mail servers (mail.jenvoie.fr), hosted by Hetzner in Germany; no third-party emailing provider is involved.

The data collected and processed by the site is only transferred outside the European Union to the United States, for the processing entrusted to Stripe (direct customers’ payments) and to OpenAI (texts submitted for translation), covered by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. A copy of these safeguards can be obtained at privacy@jenvoie.fr.

5. Data protection officer

Gravity5 has a Data Protection Officer (DPO), who can be contacted by email at privacy@jenvoie.fr. The DPO’s role is to ensure the proper implementation of national and supranational provisions on the collection and processing of personal data.

6. Rights of data subjects

Under the applicable data protection rules, in particular Regulation (EU) 2016/679 (“GDPR”), you have the following rights over your personal data:

• Right of access: obtain confirmation that data about you is processed and, where applicable, a copy of it;
• Right to rectification: ask for your data to be corrected or updated when it is inaccurate or incomplete;
• Right to erasure (“right to be forgotten”): obtain the deletion of your data within the limits provided by law;
• Right to restriction of processing: ask for the processing of your data to be temporarily suspended;
• Right to object: object to certain processing, in particular processing based on the company’s legitimate interest or carried out for commercial prospecting;
• Right to data portability: receive your personal data in a structured, commonly used and machine-readable format, or ask for it to be transferred to a third party where technically possible;
• Right to withdraw your consent: at any time, for processing based on consent, without affecting the lawfulness of the processing carried out before the withdrawal;
• Right to lodge a complaint with a supervisory authority: in particular the CNIL (www.cnil.fr), if you believe your rights have not been respected.

To exercise your rights, contact us at privacy@jenvoie.fr. For the controller to act on the request, the user must provide their first and last name and email address, and must be able to prove their identity by any means. The controller has thirty (30) days from receipt of the request to answer.

Participants in a Client’s games and recipients of its emails exercise their rights with that Client (Section 1). Every campaign email contains an unsubscribe link and, when it contains an open-tracking pixel, a link to refuse that measurement (Section 10). A complaint may also be lodged with the supervisory authority of the EU country where the person lives or works.

7. Minors

In accordance with article 8 of European Regulation 2016/679 and the French Data Protection Act, only minors aged 15 or over may consent to the processing of their personal data. If the user is a minor under 15, the consent of a legal representative is required for personal data to be collected and processed. The site publisher reserves the right to check by any means that the user is over 15, or has obtained the consent of a legal representative, before browsing the site. You are informed of the existence of the French telephone canvassing opt-out list “Bloctel”, on which you can register: https://conso.bloctel.fr.

8. Changes to this privacy policy

This privacy policy can be read at any time at https://jenvoie.fr/privacy (French version: https://jenvoie.fr/confidentialite). The site publisher reserves the right to change it to ensure its compliance with the law in force. Users are therefore invited to read it regularly to stay informed of the latest changes. This privacy policy was last updated on October 24, 2026.

9. Cookies

When you browse our site, cookies and other trackers may be placed or read on your device. The cookies used, their purposes and how users can change their preferences at any time are described below.

• On jenvoie.fr: only strictly necessary cookies and storage — session and authentication (for the duration of the session), security, chosen language, selected team, display and theme preferences. No advertising cookies and no third-party trackers. These cookies do not require consent; they can be deleted or blocked in the browser settings, which may prevent logging in.
• Audience measurement: jenvoie.fr counts its visits with Umami, a tool hosted by Gravity5 at Hetzner in Germany. It sets no cookie, uses no persistent identifier, does not keep the IP address and shares no data with any third party: statistics are aggregated (page views, referrers, device type).
• Website chat: the Crisp chat is only loaded when the visitor clicks “Got a question?”; only then does Crisp set the cookies needed for the conversation (chat session identifier). No Crisp cookie is set until the chat is opened.
• In the Shopify admin: the jenvoie app authenticates with Shopify session tokens and does not set third-party cookies.
• On a site or store that displays a game: the game widget may store a value in the visitor’s browser (local storage) to remember that the game was already played or closed, so it is not shown again. It is not used for advertising or to follow the visitor from site to site.

10. Emails and open tracking

Emails sent by means of jenvoie contain tracked links and, unless the recipient refused it, an individual open-tracking pixel, so that the sender can measure its campaigns. Every email that contains this pixel includes a link to refuse open tracking; after such refusal, the emails sent to the recipient no longer contain a pixel. Automated opens (mailbox prefetching, security scanners) are detected and excluded from statistics. Every newsletter also contains an unsubscribe link; unsubscribed and permanently bouncing addresses never receive emails from the sender concerned again.

Gravity5 itself sends its customers transactional emails (login codes, invoices, security alerts), which are essential to the Services, service emails (technical information, important changes), sent on the basis of its legitimate interest, and, with their consent or on the basis of its legitimate interest towards business customers, product news, which they can opt out of at any time.

11. Contact

• Email: privacy@jenvoie.fr
• Post: Gravity5 — Data protection — 6bis, rue Jean Mermoz, 94450 Limeil-Brévannes, France