Privacy Policy (Politique de Confidentialité)
1. Data Controller and Contact Information
The data controller is Sonnet Pay SAS, registered with the RCS of Strasbourg under number B 928 341 572, with registered office at 1 Rue du Rhin, 67630 Lauterbourg, Grand Est, France ("Sonnet Pay", "we", "us"). For any inquiry regarding your personal data, contact our Data Protection Officer (DPO) at [email protected] or [email protected].
2. Personal Data We Collect and Process
We process account identification (name, email, profile photo, Google OAuth identifier), authentication and security data (session tokens, IP addresses, access logs, multi-factor TOTP status), wallet and transaction metadata (wallet addresses, transaction hashes, ledger balances), merchant data (application parameters, API key hashes, callback delivery logs), and regulatory compliance data.
3. Purposes and Legal Bases for Processing
Data processing is conducted: (a) for contract execution (account management, ledger processing, merchant API delivery); (b) for legal and regulatory compliance (anti-money laundering AML/CFT, accounting, sanctions screening under French and EU law); and (c) for legitimate interests (fraud prevention, infrastructure stability, system security).
4. Data Recipients and Disclosures
Personal data is strictly accessible to authorized Sonnet Pay personnel and verified technical service providers (cloud infrastructure, database hosting, node operators) acting as processors under binding GDPR Article 28 agreements. We never sell personal data.
5. International Data Transfers
Personal data is stored and processed within the European Union. In the event of transfers outside the European Economic Area, we implement Standard Contractual Clauses (SCCs) approved by the European Commission or rely on adequacy decisions.
6. Data Retention Periods
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory retention obligations (notably 5 years for AML/CFT records pursuant to Article L.561-12 of the French Monetary and Financial Code, and 10 years for commercial accounting records under Article L.123-22 of the French Commercial Code).
7. Your Rights under the GDPR and French Law
Pursuant to Articles 15 through 22 of the GDPR and the French Data Protection Act, you have the right to access, rectify, erase, restrict processing of, and request portability of your personal data, as well as the right to object to processing. Under Article 85 of the French Data Protection Act, you also have the specific right to define directives regarding the conservation, erasure, and communication of your personal data after your death. To exercise these rights, email [email protected].
8. Security Measures
We implement technical and organizational security measures, including encryption at rest and in transit (TLS/HTTPS), key wrapping via KMS, role-based access controls, and rate limiting.
9. Protection of Minors
The Service is not intended for individuals under 18 years of age. We do not knowingly collect or solicit personal data from minors.
10. Complaints to the Supervisory Authority (CNIL)
If you believe that your personal data is not being processed in compliance with applicable law, you have the statutory right to lodge a complaint with the French supervisory authority: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France · Telephone: +33 (0)1 53 73 22 22 · cnil.fr.