PRIVACY POLICY & COOKIES
1. Data Controller
NOCES is the data controller within the meaning of the GDPR. NOCES is a simplified joint-stock company (SAS) registered at 139 Rue du Faubourg de Paris, 59500 Douai, France, under SIREN number 931 718 399. Any question or request: contact@nocesholistiques.com
2. Data Collected
We may collect email address, first name, last name, sign-in method, usage data (listening activity, device, language), the access code you entered and what it unlocks, the consent choices you make, the application version, technical data (IP address, device identifiers and error reports used by the tools listed in section 4). Your IP address is never stored in clear form by us: we keep only an irreversible hash, to protect the service against abuse and as part of the records proving your consents.
If you listen during a session guided by the staff of an establishment, that staff records your first name, last name, email address and your newsletter choice so that we can send you the post journey email. You have no account, and the rights described in section 9 apply to you in full.
3. Purpose of Processing
Data is collected to provide access to audio experiences, send transactional emails (post-experience), manage user accounts, improve services, send newsletters only if consent is given.
Each purpose relies on a legal basis: giving you access to your account and to the audio journeys, and sending account emails: performance of our contract; sending the post journey email and the newsletter, and measuring their opening and clicks: your consent; measuring audience and monitoring stability and performance with the third party tools listed in section 4: your consent (“Experience & Performance”, section 6); producing our own aggregate usage statistics from the listening data we already hold, reporting those aggregate figures to the establishment that issued your code, and protecting the service against abuse: our legitimate interest. These internal statistics are produced even if you decline “Experience & Performance”, but no data is then sent to the third party tools, and the establishment only ever receives aggregate figures, never your individual activity.
Only the account data is necessary to use the application. Everything else is optional, and refusing it does not restrict your access to the journeys.
4. Who Receives Your Data
We never sell your data. It is processed on our behalf by:
| Provider | Purpose | Hosting |
|---|---|---|
| Google (Firebase, Google Analytics, BigQuery, Crashlytics, Performance Monitoring) | Accounts, application data, audience measurement, crash and performance reports | European Union and United States |
| Sentry GmbH | Error monitoring | European Union (Germany) |
| Brevo (Sendinblue SAS) | Sending emails | France |
| Amazon Web Services | Delivery of the audio and video files | Files stored in France, delivered via a worldwide CDN |
| Apple, Google | The sign-in method you choose, and protection against fraudulent use of the application | United States |
Transfers to the United States are governed by the EU-US Data Privacy Framework, to which Google LLC and Amazon Web Services adhere, and by the European Commission’s standard contractual clauses for Apple. The establishment that issued your access code receives statistics on the use of its journeys; it has no access to your account.
5. Data Concerning Minors
NOCES does not knowingly collect personal data from minors without parental consent. If data relating to a minor has been collected unintentionally, a parent or legal guardian may request deletion at any time by contacting: contact@nocesholistiques.com
6. Cookies
The application uses no cookies. It relies on components and identifiers stored on your device, in two categories that you control from the “Cookie Preferences” screen. Essential components, which keep you signed in, protect the application against fraudulent use and store your progress and preferences on your device, are always active and strictly necessary. The “Experience & Performance” category covers Google Analytics, Firebase Crashlytics, Firebase Performance Monitoring and Sentry; these tools stay inactive and collect nothing until you accept them in the popup shown when you first open the application. You may change your choice at any time from your account, and refusing changes nothing to your access.
7. Data Retention
Personal data is retained only for the duration necessary for its purpose, unless a longer retention period is required by law.
Your account, access and listening data are kept for as long as your account exists. When you delete your account, your identity and your contact details are erased, including from our emailing provider, and your listening data is detached from your account: it is kept for aggregate statistics and can no longer be linked to you by name or email. Records proving your consents are kept for as long as needed to demonstrate that they were given. Audience measurement data is kept for 14 months. Error and performance reports are kept for 90 days.
8. Deleting Your Account
You can delete your account yourself from the application, in the Account screen. You can also request the deletion from the web, without opening the application, at https://account.nocesholistiques.com/delete-account: enter your email address and we send you a sign-in link that lets you confirm the deletion. Both routes run the same operation, described in section 7, and are immediate: we keep no manual queue. If you would rather write to us, contact@nocesholistiques.com works too.
8. User Rights
In accordance with GDPR, users have the right to: access, rectify or delete their data, port their data, restrict processing, withdraw consent at any time, object to processing. Requests can be sent to: contact@nocesholistiques.com
Withdrawing a consent does not affect what was lawfully done before. You may also delete your account yourself as described in section 8, or lodge a complaint with the CNIL (www.cnil.fr).