FR EN
TBSO Updated version as of 14 May 2026

Privacy Policy

This Privacy Policy aims to inform users of the TBSO website ("Site") about how TBSO, a public limited company with a board of directors, headquartered at 10 Rue de la Bourse, 75002 Paris, registered with the Paris Trade and Companies Register under number 562 076 026, acts as the controller of personal data processing.

This Privacy Policy describes the information collected, the purposes for processing, retention, user rights, and measures taken to ensure the protection of personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French law.

1. Information We Collect

We may collect and process the following personal data:

1.1 Information You Provide Directly to Us

This information notably includes the following personal data:

Data necessary for registering for the service we provide on our site. This data includes your first and last name, postal address, date of birth, email address, and a password. These are mandatory.

Without these, TBSO will be unable to provide you with the offered service and you will not be authorized to create an account on our site;

1.2 Cookies Usage Policy

The various Cookies likely to be deposited on the browsing client's browser (Internet Explorer, Google Chrome, Firefox, Safari, Opera, etc.) are:

User session cookies, which allow information entered in all forms provided by the data controller to be retained,

User authentication cookies, which track information related to the client's identifiers,

Personalization cookies, intended to adapt the site's presentation according to the client's preferences,

Statistics cookies, which allow understanding of the use and performance of the data controller's site, notably to improve content,

If the client refuses the depositing of cookies, they will no longer be able to access or use all the services offered on the Site.

2. Legal Bases and Purposes of Personal Data Processing

We collect and process your data in order to pursue the following objectives:

  • Provide you with our services, under the execution of a subscription contract you have entered into;
  • Give you access to and allow you to use our sites;
  • Operation and security of the Site: we process your data to adapt the Site's presentation to your device, your preferences and browsing behaviours, and to improve the Site's features. These processes are necessary for our legitimate interests, which consist of offering you a personalised and optimal Site experience as well as ensuring its proper operation and security;
  • Respond to your information requests and complaints: our legitimate interest in responding to your requests concerning the Company's services and/or those of the Group companies as set out in the Site's general terms of use;
  • Send newsletters: our legitimate interest in retaining and informing our clients about the latest news of the Company and/or Group companies as detailed in the Site's general terms of use;
  • Communicate on updates, features and special offers;
  • Create a client and prospect file: our legitimate interest to develop and promote our business and that of the Group companies;
  • Manage requests to exercise GDPR rights: comply with our legal and regulatory obligations.

3. How Long Do We Keep Your Data?

Except for categories of personal data referred to in sections 3.2 and 3.3 below, your personal data is archived after the following periods:

5 years after your last use of our site, if you have not closed your account;

1 year after closing your account, unless you have received a report, in which case your personal data will be retained for 2 years following the last report received, if this duration is longer.

Financial data (e.g. payments, refunds, etc.) will be retained for the duration required by applicable tax and accounting laws.

If your account has been suspended or blocked, we retain your personal data for a period varying from 2 to 10 years from the suspension to prevent any circumvention of applicable rules on our site.

Personal data relating to a prospect, non-client, may be retained for 3 years from collection or the last contact from the prospect.

At the end of this 3-year period, we may contact you again to ascertain whether you wish to continue receiving commercial solicitations.

4. Where Are Your Data Processed?

As of the update date of this privacy policy, your personal data is processed within the European Union.

However, since some of our service providers (notably Circle or Stripe for online payments) are located outside the European Union ("third countries"), we transfer some personal data to third countries.

This may include third countries for which the European Commission has not issued an "adequacy decision." In such cases, we ensure that this transfer is performed in compliance with applicable regulations and guarantees a sufficient level of protection of privacy and fundamental rights of individuals (notably through the European Commission's standard contractual clauses).

5. What Are Your Rights Regarding Your Data?

You have the following rights concerning your personal data:

Right to information: this is precisely why we have drafted this policy. This right is provided by Articles 13 and 14 of the GDPR;

Right of access: you have the right to access all your personal data at any time, under Article 15 of the GDPR;

Right of rectification: you have the right to correct your inaccurate, incomplete, or outdated personal data at any time in accordance with Article 16 of the GDPR;

Right to restriction: you have the right to obtain restriction of the processing of your personal data in certain cases defined in Article 18 of the GDPR;

Right to erasure: you have the right to request the deletion of your personal data and forbid any future collection for the reasons stated in Article 17 of the GDPR;

Right to lodge a complaint with a supervisory authority (in France, the CNIL) if you consider that the processing of your personal data constitutes a violation of applicable texts (Article 77 of the GDPR);

Right to define directives concerning the retention, deletion, and communication of your personal data after your death, under Article 40-1 of the French Data Protection Act;

Right to withdraw consent at any time: for purposes based on consent, Article 7 of the GDPR states that you may withdraw your consent at any time. This withdrawal will not affect the lawfulness of processing performed before the withdrawal;

Right to data portability: under certain conditions specified in Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a machine-readable standard format and to request their transfer to a recipient of your choice;

Right to object: pursuant to Article 21 of the GDPR, you have the right to object to the processing of your personal data. However, note that we may continue processing despite this objection for legitimate reasons or in the defense of legal rights.

You may exercise these rights by writing to us at the contact details below. We may request additional information or documents to verify your identity.

We have a maximum response time of one month from the receipt of the request. If the request cannot be satisfied immediately, a dated acknowledgement of receipt will be provided.

If the request is incomplete (e.g., missing identity document), we are entitled to request further information: the deadline is then suspended and restarts once these elements are provided.

Access to these rights is free of charge. In some cases, reasonable fees related to processing your file may be requested, for example, in case of a request for an additional copy or if the request is particularly complex.

In accordance with applicable regulations, you have the right to file a complaint with the CNIL (Commission nationale de l’informatique et des libertés) in case of unsatisfactory resolution of your rights exercise in France. You can access the complaint form by clicking here.

6. Contact Point for Personal Data

Email contact of our Data Protection Officer: society [at] tbso [point] com

  • Company name: TBSO
  • Trade and Companies Register: Paris Trade and Companies Register
  • RCS number: 562 076 026
  • Head office: 10 Rue de la Bourse, 75002 Paris
  • Contact email: society [at] tbso [point] com

7. Amendments

We may modify this policy at any time, notably to comply with regulatory, jurisprudential, editorial, or technical developments. These modifications will apply from the effective date of the modified version. You are therefore encouraged to regularly consult the latest version of this policy. Nonetheless, we will inform you of any significant changes to this privacy policy.