Privacy Policy

Version in force as of 9 November 2026

Preamble

This Policy describes how GODARE SERVICES SASU, operator of GS Colis, collects, uses, shares, keeps and protects personal data in connection with the website www.gscolis.com, the « GS Colis » app (including the Carrier Space) and related interfaces.

It supplements the GTUS and is drawn up in accordance with Regulation (EU) 2016/679 (« GDPR ») and the amended French Data Protection Act (loi Informatique et Libertés).

1. Controller

The controller is GODARE SERVICES SASU, 44 Rue du Bel Air, 94170 Le Perreux-sur-Marne, France, RCS Créteil 910 144 153, SIREN 910 144 153.

Data protection contact: contact@godaregroup.com (address of the Godare group, which centralises the legal and administrative requests of its companies). No data protection officer has been appointed as of this version.

Special case of the Carrier Space. For the data of the customers a Carrier records in its Space (contact details, addresses, business documents) and for those of the Subcontractors to which it entrusts missions from its Space (§ 4.6), the Carrier is the controller and GODARE SERVICES acts as processor within the meaning of the GDPR: GS Colis hosts these data and provides the tools, on the Carrier's instructions. Data subjects exercise their rights with the Carrier; GS Colis forwards any request it receives to the Carrier.

2. Data subjects

The Policy applies to visitors, Customers, Account holders, Recipients whose details are entered, people contacting support, Carriers, Carriers' Agents, Carriers' customers, Carriers' Subcontractors (professionals to whom a Carrier entrusts a mission), Mission partners (partner drivers), customers of the former GS Colis app, GS Colis team members and business representatives whose data are needed for the relationship.

3. Sources of data

Data are collected directly from the user, generated when the Platform is used, provided by a Customer for a Recipient, provided by a Carrier for its own customers or its Subcontractors, sent by authorised providers (payment, notifications, transport), or carried over from the former GS Colis app for customers who used it: Account (identity, e-mail address, former customer number), complete Recipients, Credit notes still valid, past Orders and Orders in progress (§ 5.13).

4. Categories of data

4.1. Account and contact

At sign-up: title, first name, last name, date of birth, country of residence, e-mail address, e-mail verification code and status, mandatory phone number and contact preferences (SMS, WhatsApp), referral code used, Account identifier, password kept only in a secure derived form (hash), Account status, creation and login dates, app language, notification preferences and proof of acceptance of the GTUS. The Customer's phone number is not verified by code. Consent to marketing is collected separately. Login is only by e-mail address and password (no login by phone or SMS); the phone number is also used, for a former customer whose account had no e-mail address, to recover his or her history with a code sent by SMS (§ 5.13). When deletion of the Account is requested: reason chosen (optional) and any comment (§ 12).

4.2. Recipients and addresses

First and last name, phone (reachable by SMS or WhatsApp), address, municipality, city, country, optional e-mail, delivery or collection instructions, collection code and link with the Order. Addresses entered are completed by an autocomplete service (§ 8.10).

4.3. Quotes, parcels and Orders

Destination, origin/depot, Air, Express air or Sea mode, categories and products, weight, volume, dimensions, quantity, declared value (mandatory), packaging, options (VAT refund, home delivery, delivered packaging), frozen prices, customs flat fee, additional charges and their reason, statuses, dates, references, groupings into a combined shipment, Orders created by the team for the Customer (with the agent's name), main Order and Sub-orders per mode, discount codes used, cancellations and cancellation requests (date, reason, decision, outcome of the amounts paid), declared condition of each parcel (new or used), condition found by the team or changed by the Carrier in a Marketplace request, « Bill to » choice frozen in the Order (yourself, your company, or the name, address, country and any VAT number of another person you indicate), estimated then actual delivery date, outcome of the amounts paid for a cancelled Order, Wave refunds (amount, Wave reference, refund receipt, refund made automatically through Wave or by the team) and payments received at the shop counter (methods, amounts, money-transfer or bank-transfer reference) and, for the Shipment organised by GS Colis, data needed to select and track Performing carriers and Mission partners. Agency storage data: date made available, free period, daily fees, reminders, settlement. For a used item: purchase price declared by the Customer. For a relay-point drop-off: label, network (Chronopost or GLS), drop-off time limit, weight entered or estimated, cancellation of a label not dropped off. For an item described in « I buy, GS Colis forwards » or on receipt: suggested pricing category (by keywords or by the AI service of § 8.14) and category confirmed by the team.

4.4. Photos, signatures and documents

Photos of the parcel, packaging or damage, handwritten signature on screen and name of the person handing over or receiving a parcel, approximate position of the device at the time of hand-over when the browser allows it, invoices, proofs of purchase, proofs of value, customs documents, pro forma invoices, hand-over slips and documents needed for a complaint. Photos of the loading of a consolidation (container, bags; ten at most), with the history of their additions and removals; documents attached to a mission (for example the photo of a signed mission order or pickup slip).

4.5. Shopping and deals

Shop, product link, reference, size, colour, quantity, merchant order number, amount, instructions and information needed for « GS Colis buys for me » or to identify a parcel ordered by the Customer. What the Customer enters on a merchant's site opened in the app is processed by the merchant alone; GS Colis has no access to it.

4.6. Marketplace and Carrier Space

Carriers: business, registrations, address, phone verified by SMS, logo, documents (Kbis, insurance, ID, transport licence), routes, prices, depots, departures, promotions, plan, statements and payments, reviews received, history of the relationship and of restrictions. Agents: name, e-mail, rights, linked personal Account, history of their actions (what, when), progress in the tutorials and reviews left on them (optional rating and comment), visible to the Space manager or his or her delegate. Carriers' Subcontractors (data processed on behalf of the Carrier, § 1): company name, address, business document (type depending on the country, and number), e-mail, phone, missions entrusted, mission orders (with the details frozen on the date of the order), mission documents, payments recorded by the Carrier and their cancellations, monthly statements; the Subcontractor has no access to GS Colis and receives its documents by e-mail. Carriers' customers (data processed on behalf of the Carrier, § 1): individual or business, name, contact details, delivery and billing addresses, company registration, quotes, invoices, credit notes, payments received (method, amount, money-transfer or bank-transfer reference), parcel statuses. When the e-mail address of a Carrier's customer is that of a verified GS Colis Account, GS Colis matches the two to display the documents in that Account's Tracking. Quote requests, quotes, decisions, reviews and reports. Invoicing of the Carrier by GS Colis: country of registration, address and VAT number of the company, invoices (FT-…) and credit notes (AT-…), due dates and payments; acronym chosen to number its own documents.

4.7. Payments

Amount, currency, exchange rate applied (CFA francs), payment method, transaction reference, status, refund, receipt, Credit notes, loyalty points, referral, and anti-fraud data sent by the provider. GS Colis does not keep the full bank card numbers processed by Stripe. Identifier of your customer record at Stripe, created at your first card payment; if you ask for it (tick box, never imposed), your bank cards are kept by our payment provider Stripe; GS Colis never has access to their full number.

4.8. Messaging and calls

Text messages, attachments, voice messages, conversation topics, call metadata (participants, dates, durations, status), audio or video recordings when both participants have accepted, proof of that consent and log of listenings.

4.9. Support and complaints

Requests, exchanges, references, incidents, decisions, supporting documents, compensation, Credit notes, goodwill gestures and handling history.

4.10. Technical data

IP address, technical identifiers, device notification token, device model and operating system, app version, logs, security events, errors, log of GS Colis team actions (with IP address and browser). For GS Colis team members: phone number receiving the login codes (entered by the administrator), recognised devices (hash of a token and expiry date), confirmations of sensitive actions.

4.11. Contractual proof

For each acceptance: document (GTUS, Privacy Policy, Carriers' intermediation agreement), version, date and time, IP address, device (app or browser), and circumstance (sign-up or new version). The full history of acceptances is kept; it can be viewed by authorised GS Colis team members on the Customer's or Carrier's record. Legal basis: performance of the contract and GS Colis's legitimate interest in proving the agreement given. Retention: during the relationship, then 5 years (limitation period).

4.12. Questions asked to Awa

Text of the question (500 characters at most) or topic tapped, topic recognised, intent, source of the answer, conversation identifier and, if the user is logged in, his or her Account or Carrier Space; for « Smart buy », the product searched for and the filters chosen.

5. Purposes and legal bases

5.1. Providing the Platform and managing the Account

Creating the Account, verifying the e-mail, authenticating, keeping journeys in progress, providing the features. Basis: performance of the contract or pre-contractual measures.

5.2. Issuing quotes and Orders

Calculating prices, recording Orders (including those created by the team at the Customer's request), organising hand-over, transport, missions, customs, delivery, storage and tracking. Suggesting to the team the pricing category of an item from its description (§ 8.14); the suggestion is always confirmed or corrected by a team member. Basis: performance of the contract and pre-contractual measures.

5.3. Shopping

Identifying purchases received, carrying out « GS Colis buys for me ». Basis: performance of the contract.

5.4. Marketplace and Carrier Space

Listing Carriers, checking their documents, enabling matchmaking, quotes, communications, reviews, tracking, providing the Carrier Space and invoicing plans and commissions. Displaying in a Customer's Tracking the documents issued for him or her by a Carrier, at the same verified e-mail. Providing the Carrier with the subcontracting tool (on its behalf, § 1) and the Space tutorials, with tracking of their progress. Basis: performance of the Customer/GS Colis and Carrier/GS Colis contracts; legitimate interest in operation, transparency for the Customer and security.

5.5. Payments, refunds and accounting

Collecting, refunding, preventing fraud, producing receipts, invoices and statements. Basis: performance of the contract, legal accounting and tax obligations, legitimate interest in fraud prevention.

5.6. Support, complaints and claims

Answering, investigating losses, breakages, delays, handling compensation and defending rights. Basis: performance of the contract, legitimate interest in managing disputes and legal obligations.

5.7. Messaging and calls

Enabling Customer-GS Colis, Customer-Carrier, Customer-Mission partner and GS Colis-Carrier exchanges. Basis: performance of the contract and legitimate interest in organisation. Recording a call is based on the consent of both participants; withdrawing consent stops the recording without affecting what has already been recorded.

5.8. Proof of hand-over

Signature, name, photos and position at the time a parcel is handed over. Basis: legitimate interest in proving Taking charge and delivery.

5.9. Security and abuse prevention

Protecting accounts, detecting fraud, intrusion, non-payment, abuse, fake reviews, prohibited goods; logging the actions of the team and of Agents. Basis: legitimate interest and security obligations.

5.10. Operational communications

Verification codes, confirmations, statuses, reminders (storage, payment, pickup, sea journey: 28, 21, 14 and 7 days before the estimated delivery date, completion of a Carrier sign-up that has been started), receipts, phone notifications and contractual information. Basis: performance of the contract and legal obligations.

5.11. Loyalty, Credit notes and referral

Calculating points, Credit notes, their expiry dates and referrals. Basis: performance of the contract.

5.12. Marketing

Offers, news and promotions. Basis: consent where required. Objection or withdrawal is possible at any time.

5.14. Audience measurement and advertising (with your consent)

Visit statistics (Google Analytics) and measurement of the effectiveness of our ads on Facebook, Instagram, TikTok and Google. Basis: consent, given or refused in the banner, category by category, withdrawable at any time (« Manage my cookies », Profile › Privacy). Data concerned: anonymous device identifier, events (sign-up, quote request, order created, order paid and amount, carrier sign-up, plan paid), hashed e-mail address, phone and Account identifier (SHA-256), IP address and browser at the time of the event. Only the data of the Customer himself or herself, when he or she has consented, are sent; never those of his or her Recipients. The advertising tools' automatic advanced matching (reading of page fields by the pixel) is disabled. Proof of choice: date, banner version, categories, anonymous device identifier and Account if logged in, kept as long as the choice is valid then 5 years.

5.13. Carrying over the customers of the former app

Allowing a former customer to keep using GS Colis in the new app, which replaces the old one: his or her Account is carried over (without a password), with complete Recipients, Credit notes still valid, past Orders (viewable, read-only) and Orders in progress, which the team keeps moving forward. He or she receives a new customer number; the old one is still recognised, in particular to assign a parcel arriving at the shop with that number. At the first sign-in, a code sent by e-mail to the known address lets the customer choose a password; if the address is already registered in the new app, the carried-over data are linked to it without overwriting anything. A former customer whose account had no e-mail address creates an Account with his or her e-mail address, then recovers his or her history by confirming the former phone number, first name and last name with a code sent by SMS (Twilio, § 8.4), valid for 10 minutes. Each carried-over customer receives an e-mail announcing the new app. For a customer with no activity for more than three years, this e-mail also serves as a warning: without a login within the month after it is received, his or her personal data are anonymised as for an inactive account (§ 10); invoices are kept, anonymised. Customers who had asked for their account to be closed in the former app are not carried over, unless they had an Order still in progress: that Order is then carried over, only so that it can be delivered. A customer carried over without an e-mail address and with no activity for more than three years cannot be warned: his or her personal data are anonymised one month after the announcement e-mails start being sent, as for an inactive account (§ 10). Basis: legitimate interest (continuity of service); legal accounting obligations for Orders and invoices.

5.15. Awa, the virtual assistant

Understanding the question, answering it with GS Colis texts and prices, suggesting the relevant screen or a team member, and monitoring the quality of the answers. A question is sent to the artificial intelligence service (§ 8.14) only after e-mail addresses, phone numbers, order numbers and addresses have been removed, without a name or Account identifier; an identical question already understood is reused for 24 hours without being sent again. Basis: legitimate interest (support) and pre-contractual measures (estimate).

6. Visible data and third-party data

GS Colis does not publicly display Customers' private contact details. On the Marketplace, a review is published under the author's first name and the initial of the last name, with the mode and date of the request, never its amount. For a Shipment organised by GS Colis, the strictly necessary data are communicated to the Performing carriers, Mission partners and logistics partners selected by GS Colis. For a Marketplace request, the necessary data are communicated to the Carrier chosen by the Customer; Customer-Carrier calls go through the Platform, without displaying numbers. The QR code on a label opens a public tracking page that shows no name, phone number, address, e-mail, amount or internal identifier: only the status, progress, mode, countries, date of the last update and the Carrier's trade name where applicable.

When a Customer enters a Recipient, or a Carrier records a customer, he, she or it must make sure it is authorised to communicate this information and that it is accurate.

7. Messaging, calls and recordings

Conversations are accessible to the participants concerned. Exchanges between a Customer and a Mission partner are also accessible to the GS Colis team, as evidence. Authorised GS Colis members may access other conversations when necessary for support, a report, a complaint, fraud or a legal request. Conversations between a Customer and a Carrier are not displayed by default in the back office: an authorised member (« Read Market discussions » right) must choose a reason (reported dispute, request from the Customer or the Carrier, suspicion of fraud, quality control), with an optional comment; each viewing is entered in the action log (member, date, conversation, reason). Discussions between colleagues of the same Carrier are not accessible to GS Colis.

A call is not recorded by default. The recording request must be accepted by the other participant within twenty-five seconds; recording is indicated during the call and either participant can stop it. Recordings are stored on the GS Colis server at OVHcloud, accessible to both participants and to authorised GS Colis members, each listening being logged.

8. Service providers and recipients

8.1. OVHcloud (France)

Hosting of the servers, database, files, backups and the audio/video call server (LiveKit software operated by GS Colis, without a third-party provider). Off-server copy of the backups in an OVHcloud Object Storage container dedicated to GS Colis, in Frankfurt (Germany, European Union): each copy is encrypted by GS Colis before it is sent and locked for thirty days (it can be neither deleted nor modified during that time). Each copy is kept for ninety (90) days, then deleted, except the end-of-month copy, kept for twelve (12) months.

8.2. Expo (United States) and Firebase / Google

Routing of phone notifications: the Expo service receives the device token, the title and the text of the notification, then sends them to Apple (iPhone) or to Google's Firebase Cloud Messaging (Android). Firebase is used only for these notifications; no Google measurement, diagnostics or advertising tool is integrated. App updates are distributed by Expo.

8.3. Resend

Sending of transactional and operational e-mails (verification codes, confirmations, documents, reminders). E-mails sent to a Carrier's Subcontractors leave from GS Colis's technical address under the name « via GS Colis »; replies go to the Carrier's contact e-mail.

8.4. Twilio

Sending by SMS of the verification codes for a Carrier Space phone and of the history recovery code of a former customer without an e-mail address (§ 5.13), from a Twilio sub-account specific to GS Colis (sender « GSColis »): phone number and text of the message. Twilio also sends the login and confirmation codes of GS Colis team members (§ 15).

8.5. Stripe

Payments by bank card, Google Pay and Apple Pay, fraud prevention, refunds and the provider's own obligations. If you ask for it, your bank cards are kept by our payment provider Stripe, on your Stripe customer record linked to your Account; GS Colis never has access to their full number. You can delete them from the payment window. When your GS Colis account is deleted, your customer record at Stripe, and with it the cards you saved there, is deleted; the history of your past payments is kept by Stripe and by GS Colis for the periods required by law.

8.6. Wave

Mobile Money payments in CFA francs depending on countries and availability; the Customer is redirected to the Wave payment page. A Wave payment may be refunded automatically by GS Colis through Wave (payment refunded in full); otherwise, the GS Colis team refunds it manually from its Wave account (GTUS art. 11.10). For this refund, GS Colis sends Wave the reference of the original payment and the amount refunded.

8.7. Chronopost and GLS

Creation of shipping labels and choice of relay points for handing over a parcel: sender's name, address, phone and e-mail, parcel weight and references (weight entered by the Customer or, failing that, an estimated weight, later corrected when the parcel is weighed at the GS Colis shop).

8.8. Performing carriers, Mission partners and logistics partners

Data needed for taking charge, transport, customs, tracking and delivery. For partners located outside the EEA, see section 9.

8.9. Shops and sellers

When a Customer opens or uses a merchant's site, the merchant processes his or her data under its own policy. In « GS Colis buys for me », the information needed for the purchase is communicated to the seller.

8.10. Mapping and address services

Address autocomplete and geolocation by Photon (komoot, Germany, OpenStreetMap data): the text of the address entered is sent, without any Customer identifier. Round maps display OpenStreetMap base maps; a route is opened in Google Maps only if the user asks for it.

8.11. Translation

When the user asks for a support message to be translated (« Translate » button), the text of that message is sent to Google Cloud Translation (Google), used by GS Colis under contract, with the requested language. The text is sent exactly as written: no data is removed or masked from it. Nothing is kept: GS Colis stores neither the text sent nor the translation. No message is sent without such a request.

8.14. Google Gemini (Awa assistant)

Understanding of the questions asked to Awa through Google's Gemini API, used by GS Colis under contract: the cleaned question (§ 5.15), the list of topics and countries offered, and the audience concerned (visitor, customer, carrier, driver). No name, Account, e-mail address or phone number is sent. Item classification: when the catalogue keywords are not enough, the text describing an item (« I buy, GS Colis forwards » or receipt of a parcel), stripped of e-mail addresses, phone numbers, order numbers and addresses, is sent with the list of active pricing categories, to suggest a category. No name, contact details or order number is sent. Only the suggested category is kept, under a fingerprint of the text, so that the same description is not sent again; a team member always confirms or corrects the suggestion.

8.15. SerpApi (« Smart buy » search)

Price search on Google Shopping for « Smart buy »: the product searched for, without any user identifier.

8.16. E-invoicing platform (upcoming)

From the legal obligation to issue e-invoices (1 September 2027 according to the timetable in force), invoices sent by GS Colis to Carriers established in France will go through an approved platform, which will receive the invoicing data of the Carrier's company (platform specified in this policy before that date).

8.13. Measurement and advertising tools (only with your consent)

Google Ireland Limited (Google Analytics, Google Ads), Meta Platforms Ireland Limited (Facebook, Instagram), TikTok Technology Limited. They receive the data described in § 5.14, from the website pixel or from our servers, only for the accepted categories. No dedicated Google Ads tag is installed at launch: the conversions of our Google ads are imported into Google Ads from Google Analytics. They act as joint controllers with GS Colis for collection and transmission, then as separate controllers for their own processing; transfers to the United States may take place (§ 9).

8.12. Advisers, insurers, authorities and courts

Data communicated when necessary for the defence of rights, insurance, a legal obligation, an investigation, proceedings or a decision of an authority.

Depending on the processing, providers act as processors of GODARE SERVICES or as separate controllers for their own obligations. GS Colis does not sell or rent personal data.

9. Hosting and transfers outside the EEA

GS Colis data are hosted in France by OVHcloud. The France-Africa activity nevertheless involves international flows: Wave, Performing carriers, Mission partners and freight, customs clearance, delivery or collection partners located in Africa, as well as certain technical or financial providers established in the United States (Expo, Google/Firebase, Apple for notifications, Resend, Twilio, Stripe, Google Cloud Translation when a translation is requested, Google Gemini for Awa, SerpApi for « Smart buy »; Google, Meta and TikTok only with your consent). An encrypted copy of the backups is kept at OVHcloud in Frankfurt (Germany), within the European Union: this is not a transfer outside the EEA.

For US providers certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of 10 July 2023; otherwise, on the European Commission's Standard Contractual Clauses. As of the date of this Policy, no African country in which GS Colis operates benefits from an adequacy decision: transfers to these countries are based on the Standard Contractual Clauses where possible and, where the situation strictly meets the conditions of article 49 GDPR, on the necessity of the transfer for the performance of the contract concluded with the data subject or in his or her interest (routing and delivery of his or her parcel). GS Colis limits each transfer to the necessary data and keeps the list of its main transfers up to date.

10. Retention periods

The periods below are applied automatically: a daily run erases or anonymises what has exceeded its period, and each run is entered in the log. GS Colis may adjust these periods in its settings. A legal obligation, a dispute, a requisition, fraud or the defence of a right may justify longer, targeted retention.

Data Period Status
Account and profile For the life of the Account. Deletion requested: personal data erased 30 days after the request if the Customer has not logged in again; Orders, receipts and invoices kept anonymised for the legal period. applied
Inactive account No order (including in the former app), login or exchange for 3 years: warning e-mail 1 month before, then anonymisation as for a requested deletion applied
Customer carried over from the former app, with no activity for more than 3 years The e-mail announcing the new app serves as the warning; without a login within the month after that e-mail, anonymisation as for a requested deletion applied when the announcement is sent
Customer carried over without an e-mail address, with no activity for more than 3 years No warning possible: anonymisation as for a requested deletion, one month after the announcement e-mails start being sent to be applied (decided on 28/10)
Verification codes (e-mail, SMS) 24 hours (the code itself is valid for only a few minutes) applied
Questions asked to Awa 12 months; a question already understood (without personal data) is kept for 24 hours so as not to send it again to the AI service applied
Recognised devices of GS Colis team members 30 days, after which a new SMS code is requested; revocable at any time applied
Journeys started on the device 30 days at most, on the device only applied
Login logs (sessions) and call log (without recording) 12 months applied
Written messages and attachments (support, Marketplace, missions, exchanges with the Carrier or its team, Carrier's documents) 3 years after the last activity of the Customer or Carrier concerned; the message is replaced by the note « Message deleted (retention period exceeded) » applied
Voice messages 90 days, then the sound is erased (the message remains with a note that it has been deleted) applied
Call recordings 90 days, then deletion; proof of consent kept for as long as necessary applied
Photos, signatures and position at taking charge or delivery 3 years after delivery (last proof for the parcel); the record of the hand-over remains, without image or position applied
Photos of the loading of consolidations; documents attached to missions (GS Colis and Carriers' Subcontractors) 3 years after delivery of the consolidation or end of the mission, then deletion; accounting documents (mission orders, receipts, statements) are kept 10 years to be applied (decided on 28/10)
Invoices, receipts, credit notes, Orders, quotes and payments 10 years (accounting obligation), never automatically erased before then applied (retention)
Carriers' documents (Kbis, ID, licence) During the relationship, then 5 years after it ends (Space deactivated or deleted) applied
Log of GS Colis team actions The action remains; IP address and device are erased after 1 year applied
Choice in the consent banner 6 months on the device, then asked again; proof kept 5 years applied
Sends to measurement and advertising tools (technical log) 13 months applied
Supporting and customs documents Legal period (at least 3 years), up to 5 years in case of complaint kept with the Order
Carriers' customers According to the Carrier's instructions; deleted when the Space is deleted, except legal obligations according to the Carrier
Carriers' Subcontractors According to the Carrier's instructions; a Subcontractor who has received a mission can only be deactivated (its missions and documents remain viewable); deleted when the Space is deleted, except legal obligations according to the Carrier
Marketing 3 years after the last contact no marketing to date
Backups Encrypted daily backups, kept 14 days on the server; encrypted copy at OVHcloud in Frankfurt, locked for 30 days; each Frankfurt copy is kept 90 days then deleted, except the end-of-month copy, kept 12 months. A deletion becomes effective in the backups at the end of this cycle. applied (production); deletion of the Frankfurt copies to be set up (decided on 28/10)

11. Intermediate archiving

When data are no longer needed for current use but must be kept for a legal obligation or the defence of a right, they are separated from the active database, with restricted access.

12. Closing the Account

The Customer may deactivate his or her Account (reversible) or request its deletion from the profile. Deletion is refused while a shipment is in progress or an amount remains due. Thirty days after the request, if the Customer has not logged in again, his or her personal data (identity, contact details, password, recipients, devices) are erased; Orders, documents and conversations are kept in anonymised form for the applicable periods. Your customer record at Stripe and the cards you saved there are deleted at the same time (§ 8.5). The deletion reason, optional, is chosen from a list set by GS Colis; it is shown to the team, with the date and any comment, in a list of deletions that shows neither name nor customer number.

13. Marketing communications

Communications needed for the Service are distinct from marketing communications. Offers and news are sent only with the Customer's consent where required; he or she can unsubscribe at any time. The Customer can turn phone notifications off in his or her profile.

14. Cookies and trackers

The Platform uses strictly necessary trackers (session, security, preferences, payment), exempt from consent. Audience measurement (Google Analytics) and advertising (Meta, TikTok, Google Ads) trackers are activated only with your consent: banner on the first visit (« Refuse all », « Customise », « Accept all »), choice kept 6 months then asked again, changeable at any time. The mobile app contains no advertising kit: with your consent, events are sent from our servers; on iPhone, Apple also asks for your permission to track, only if you have accepted advertising. Details are given in the GS Colis Cookie Policy.

15. Security and data breaches

GS Colis implements measures proportionate to the risks: encryption of communications (HTTPS), passwords kept as hashes, session tokens in the phone's secure keychain, two-factor authentication for the GS Colis team by SMS code (on any new device, then recognised for 30 days, and for each sensitive action: refund, credit note, reading a Marketplace conversation, suspension), per-menu rights for the team and Agents, action log, signed time-limited document links, separation of environments, regular backups encrypted (AES-256), with an off-server copy locked for thirty days (kept 90 days, 12 months for the end-of-month copy), updates and incident procedures.

No system offers absolute security. In the event of a breach likely to create a risk for individuals, GODARE SERVICES notifies the CNIL and, where the GDPR requires it, the data subjects.

16. Rights of individuals

Subject to the legal conditions, any person may exercise: the right of access and to obtain a copy; to rectification (most information can be changed directly in the profile); to erasure (Account deletion from the profile); to restriction; to object to processing based on legitimate interest; to object to marketing; to portability; to withdraw consent; rights relating to automated decisions; and the right to set guidelines on what happens to his or her data after death.

Requests are sent to contact@godaregroup.com or by post to GODARE SERVICES — Data protection — 44 Rue du Bel Air, 94170 Le Perreux-sur-Marne, France. Answer within one month. Proportionate proof of identity may be requested in case of reasonable doubt. A complaint may be lodged with the CNIL (www.cnil.fr).

17. Minors

The Account and services are intended for persons legally capable of contracting; the date of birth is requested at sign-up. Data concerning a minor may be entered as a Recipient where lawful and necessary.

18. Automated decisions

Tools automate calculations of prices, customs, points and expiry dates, reminders, putting a Carrier profile on standby after an unpaid statement and the collection of deals. No decision producing significant legal effects is taken solely on the basis of profiling; any decision can be reviewed by the team on request. Awa uses an artificial intelligence service to understand a question; she takes no decision and does not act on any Order. The pricing category of an item may be suggested automatically (keywords or AI service, § 8.14); it is retained only after confirmation by a team member.

19. Changes to the Policy

The Policy may be updated to reflect a legal, technical, functional or provider change. In the event of a substantial change, the users concerned are informed appropriately.

20. Contact

GODARE SERVICES SASU — GS Colis 44 Rue du Bel Air, 94170 Le Perreux-sur-Marne, France Phone: +33 7 66 41 47 83 E-mail: contact@gscolis.com Website: www.gscolis.com