Privacy policy
Last updated: 20 May 2026
This policy describes how DIGITAL TRUFFLE ("we") collects, uses and protects your personal data when you use the BingoShow service. We comply with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
1. Data controller
DIGITAL TRUFFLE — Association loi 1901 — à but non lucratif
RNA W595043751
41 Rue Vauban, 59100 Roubaix, France
Contact : hello@mybingoshow.com — or contact form
2. Data we collect
- Account : e-mail, full name, password (hashed with argon2, never stored in plain text), preferred language.
- Billing profile (optional) : company name, legal name, VAT number, postal address, phone.
- Payment : we never store your card details. They are handled exclusively by Stripe (a PCI-DSS Level 1 certified processor). We only keep transaction IDs and accounting records.
- Technical logs : IP address, user agent, timestamps of sign-ins and sign-in attempts. Used for security (brute-force detection, anti-fraud).
- Content you create : bingos, prizes, sponsors, sessions, uploaded images.
- Communications : support tickets, e-mail exchanges, attachments.
3. Purposes & legal basis
| Processing | Legal basis |
|---|---|
| Account creation and management | Performance of contract (GDPR art. 6.1.b) |
| Billing and accounting | Legal obligation (art. 6.1.c) |
| Sign-in / security logs | Legitimate interest (art. 6.1.f) |
| Anonymised audience measurement | Consent (art. 6.1.a) |
| Transactional e-mails (invoices, alerts) | Performance of contract |
4. Recipients & processors
Your data is never sold. It is accessible only to our team and to the following processors, contractually bound by a DPA (Data Processing Agreement):
- Stripe Payments Europe (Ireland) — payment, invoicing. Data: e-mail, transaction IDs.
- Brevo or designated SMTP server — sending transactional e-mails.
- Hosting provider — encryption at rest, daily backups. Hosting address provided on request.
- Matomo (self-hosted, EU) & Ahrefs Web Analytics — aggregated, cookieless audience measurement.
- Google (Google Ireland / Google LLC) — advertising conversion measurement (Google Ads, enabled only after your consent) and "Sign in with Google" if you use it.
Google tools involve a transfer to the United States, framed by the EU–US Data Privacy Framework and Standard Contractual Clauses approved by the European Commission. No other transfer outside the EU is performed.
5. Retention periods
- Active account : for as long as you use it.
- Deleted account : fully erased within 30 days (except accounting data, see below).
- Inactive account : deleted after 36 months without sign-in; a reminder email is sent 30 days before deletion.
- Invoices and accounting data : 10 years (French legal obligation, art. L.123-22 C. com.).
- Sign-in logs : 6 months (French LCEN Act no. 2004-575).
- Sent e-mails : 3 months in the outbox.
- Support tickets : 3 years after closure.
- Audience measurement cookies : 13 months at most.
6. Your GDPR rights
You can exercise the following rights at any time, free of charge:
- Access and rectification — directly from your Account area (once signed in).
- Portability — full data export as a ZIP (JSON) from the "Data & GDPR" tab.
- Erasure ("right to be forgotten") — "Delete my account" button. Deletion is final within 30 days.
- Restriction and objection — on request to hello@mybingoshow.com.
- Withdrawing consent for audience measurement — via the cookie policy.
If you believe your rights are not being respected, you may file a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, 75007 Paris).
7. Security
- HTTPS encryption across the board (TLS 1.2+).
- Passwords hashed with argon2id, unique salts.
- Sign-in attempt throttling (anti-brute-force).
- Daily encrypted backups, kept for 30 days.
- Audit logs for administrator access.
8. Changes
This policy may evolve. Any substantial change will be notified by e-mail at least 15 days before it takes effect. The current version is the one in force from the update date shown at the top of the page.