v2.1 · 7 October 2026
Effective date: 20 September 2026
This Notice is for you — a person who holds a Shatale account and asks Shatale to buy goods or services on your behalf. It is the document referred to in the End User Terms (§8.2), the End-User Purchasing Mandate (§6.2) and the Card on File Consent (§10.3).
If you operate a Publisher account, a different document applies to that relationship: the Shatale Privacy Policy.
The data controller for the personal data described here is:
Shatale SASU
SIREN 105 278 964 · RCS Montpellier 105 278 964 · TVA FR54105278964
623 Rue du Devois, 34160 Saint-Drézéry, France
Email: privacy@shatale.com
("Shatale", "we", "us")
Shatale is the controller of your data within the meaning of Article 4(7) GDPR. We decide the
purposes and the means of this processing, and we answer your requests under Articles 15–22
ourselves. We are not acting on anybody else's instructions when we process it.
You instruct us to buy something. We buy it in our own name and on your account
(commissionnaire à l'achat), we pay the merchant with our own payment instrument, and we
authorise the corresponding amount on your card so that you reimburse us for that purchase.
Two consequences follow, and both concern your data:
details as the buyer. Your name reaches a merchant only where delivery or the nature of the
service requires it, and only to the extent required.
balance and no payment account held for you.
| Purpose | Legal basis |
|---|---|
| Operating your account and carrying out the purchases you instruct | Art. 6(1)(b) — performance of a contract |
| Authorising and settling the amount on your card | Art. 6(1)(b) — performance of a contract |
| Identity verification and AML/CTF screening | Art. 6(1)(f) — legitimate interests (see note) |
| Fraud prevention and IT security | Art. 6(1)(f) — legitimate interests |
| Accounting, tax and record-keeping obligations that bind us directly | Art. 6(1)(c) — legal obligation |
| Marketing communications | Art. 6(1)(a) — consent |
Note on AML/CTF screening. Shatale SASU is not itself an authorised payment or electronic money
institution. We carry out identity verification and AML/CTF screening to protect the service and to
assist the licensed financial partners we work with in meeting their statutory obligations. We
therefore rely on our own legitimate interests under Art. 6(1)(f), not on a statutory duty of our
own. A balancing assessment of those interests against your rights is available on request.
Name, email address, telephone number, date of birth, country of residence, and the credentials and
sessions used to sign in.
Identity documents and the results of the checks carried out on them, where identity verification
is required.
Card tokens and the last four digits, expiry month and year, held so that a purchase you instruct
can be authorised. We do not store your full card number or the card security code (CVV/CVC).
Card data is handled by our PCI DSS-compliant payment partners; see Section 7.
What was bought, from which merchant, the amount and currency, the time, the outcome of the
authorisation, the policy or limit applied, and any approval you gave.
IP address, user agent, device identifiers and app or site interaction records, used for security,
fraud prevention, identification and support. IP addresses are kept in full, not anonymised.
The content and metadata of messages you send us, and your support history.
| Data | Purpose |
|---|---|
| Account and identity data | Creating and operating your account, verifying who you are, meeting AML obligations |
| Payment data | Authorising and settling the purchases you instruct, handling refunds and disputes |
| Purchase and authorisation data | Carrying out your instructions, giving you a record, audit and accounting |
| Device and usage data | Security, fraud prevention, identification, diagnosing problems you report |
| Communications | Answering you, and improving the service |
We do not sell personal data.
Automated decisions are made when a purchase is authorised or declined against the limits and
policies set on your account. You can ask for a human to review such a decision, express your point
of view and contest it (Art. 22(3) GDPR) by writing to privacy@shatale.com.
Where you use our website, we use strictly necessary cookies for session management and security,
and analytics and marketing cookies only with your consent. You can manage your preferences through
our cookie tool or your browser. Withdrawing consent for non-essential cookies does not affect the
service.
The merchant you asked us to buy from receives what the purchase requires. Because we buy in our own
name, that is our data as the buyer; your data reaches a merchant only where delivery or the nature
of the service requires it.
Card issuance, acquiring and settlement are carried out by licensed financial partners, including
the issuing partner, the acquiring bank and the BIN sponsor. They receive the transaction data they
need to perform and record the payment, and they act as independent controllers for that data
under their own regulatory obligations. Their own privacy notices apply to it.
Authorisation requests are submitted to Visa/Mastercard as part of payment processing. Those
networks have their own data processing terms.
Cloud hosting, email delivery, fraud screening and identity verification providers act as our
processors, bound by data processing agreements with appropriate guarantees under GDPR.
We may disclose data to regulatory authorities, law enforcement or courts where applicable law
requires it, including AML reporting obligations.
If Shatale SASU is involved in a merger, acquisition or asset sale, personal data may be transferred
as part of that transaction. We will notify you in advance.
We are an EU-based company and primarily process data within the European Economic Area. Where we
transfer data outside the EEA — for example to a cloud provider — we rely on a European Commission
adequacy decision or on Standard Contractual Clauses under Article 46(2)(c) GDPR, supplemented by
the technical measures in Section 11. You may request a copy of the applicable safeguards from
privacy@shatale.com.
| Data | Retention period |
|---|---|
| Accounting and financial records (invoices, ledger entries, accounting books) | 10 years from the close of the financial year (Art. L123-22 French Commercial Code) |
| Authorisation logs | 10 years — they are supporting accounting documents (pièces justificatives) under Art. L123-22 French Commercial Code; the PSD2 record-keeping minimum of 5 years is shorter, and the longer period applies |
| Identity verification and AML documents | 5 years after the end of the business relationship (Art. L561-12 French Monetary and Financial Code) |
| Account data | Duration of the relationship + 5 years |
| Purchase history | Duration of the relationship + 5 years, and 10 years where it forms part of the accounting records above |
| IP address and user agent | In request logs: 13 months. Where recorded as evidence of a consent or authorisation you gave (for example a card-on-file consent or a purchasing mandate): kept, in full, for as long as that record is kept |
| Support communications | 3 years |
| Marketing opt-ins | Until withdrawal of consent + 3 years |
Once the applicable period has expired and no other legal obligation requires us to keep the data,
it is deleted or irreversibly anonymised. That review is carried out by our compliance team; it is
not an automatic process, and we will tell you the expected date on request.
Some of your data is deleted straight away; some of it is bound by the accounting, tax and
anti-money-laundering periods set out above and cannot be destroyed as soon as a relationship ends.
We set out below which is which, so that you know what to expect.
Deleted or revoked on request:
Retained in an archived state: your account record — including name, email address, telephone
number and date of birth — together with the purchase, accounting and identity/AML records covered
by the retention periods in Section 9. Active processing stops: the account is closed, access is
revoked and recurring charges end. This is a restriction of processing within the meaning of
Article 18 GDPR — the data is no longer used for any operational purpose and is kept only to
satisfy the obligations that require it, until those periods expire.
Because part of the request is closed by archiving rather than deletion, an erasure request is
reviewed by a member of our staff and is not completed automatically. We are working to shorten
the list of what has to be archived; where that changes, this Notice will be updated and reissued
under a new version number.
| Right | What it means |
|---|---|
| Access (Art. 15) | Ask for a copy of the personal data we hold about you |
| Rectification (Art. 16) | Ask us to correct data that is wrong or incomplete |
| Erasure (Art. 17) | Ask us to delete your data — see 10.1 for how we carry this out |
| Restriction (Art. 18) | Ask us to restrict processing in certain circumstances |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interests |
| Withdraw consent (Art. 7(3)) | Withdraw consent at any time, without affecting processing already carried out |
To exercise any right, write to privacy@shatale.com. We will respond within one month of
receiving your request. Where a request is complex, or where we have received several from you, that
period may be extended by a further two months; we will tell you within the first month that we
are extending it and why (Art. 12(3) GDPR). We may need to verify your identity before acting.
You may ask us to erase your personal data at any time, and we carry the request out in two parts.
Data not covered by a statutory retention obligation is deleted or revoked: marketing and
notification preferences, marketing contact records, device tokens, sessions and access credentials.
Records covered by our accounting, tax and anti-money-laundering obligations — including your
account record and your purchase history — cannot be destroyed while those obligations run.
Complete destruction of them is restricted by law under Article 17(3)(b) GDPR. We close the
account, stop the processing and place those records in the archived state described in
Section 9.2, restricted under Article 18 GDPR, until the applicable period expires.
Because of that split, an erasure request is reviewed by a member of our staff rather than completed
automatically. We will tell you which categories were deleted, which were archived, the legal basis
for keeping each archived category, and when its period ends.
You may lodge a complaint with your national data protection authority. In France this is the
Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.
We implement appropriate technical and organisational measures to protect personal data against
unauthorised access, loss or destruction, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify
the CNIL within 72 hours and affected individuals without undue delay, as required by Articles 33–34
GDPR.
The service is not directed at individuals under 18. We do not knowingly collect personal data from
minors. If we become aware that we have, we will delete it promptly.
We may update this Notice. Where changes are material, we will notify you by email at least 30
days before the effective date. The current version is always available at
`GET /v1/legal/privacy`.
Data protection queries:
privacy@shatale.com
Postal:
Shatale SASU — Data Protection
623 Rue du Devois
34160 Saint-Drézéry
France