Effective date: 20 September 2026
This Notice is for you — a person who holds a Shatale account and asks Shatale to buy goods or services on your behalf. It is the document referred to in the End User Terms (§8.2), the End-User Purchasing Mandate (§6.2) and the Card on File Consent (§10.3). If you operate a Publisher account, a different document applies to that relationship: the Shatale Privacy Policy.
The data controller for the personal data described here is:
Shatale SASU SIREN 105 278 964 · RCS Montpellier 105 278 964 · TVA FR54105278964 623 Rue du Devois, 34160 Saint-Drézéry, France Email: privacy@shatale.com
("Shatale", "we", "us")
Shatale is the controller of your data within the meaning of Article 4(7) GDPR. We decide the purposes and the means of this processing, and we answer your requests under Articles 15–22 ourselves. We are not acting on anybody else's instructions when we process it.
You instruct us to buy something. We buy it in our own name and on your account (commissionnaire à l'achat), we pay the merchant with our own payment instrument, and we authorise the corresponding amount on your card so that you reimburse us for that purchase.
Two consequences follow, and both concern your data:
details as the buyer. Your name reaches a merchant only where delivery or the nature of the service requires it, and only to the extent required.
balance and no payment account held for you.
| Purpose | Legal basis |
|---|---|
| Operating your account and carrying out the purchases you instruct | Art. 6(1)(b) — performance of a contract |
| Authorising and settling the amount on your card | Art. 6(1)(b) — performance of a contract |
| Identity verification and AML/CTF screening | Art. 6(1)(f) — legitimate interests (see note) |
| Fraud prevention and IT security | Art. 6(1)(f) — legitimate interests |
| Accounting, tax and record-keeping obligations that bind us directly | Art. 6(1)(c) — legal obligation |
| Marketing communications | Art. 6(1)(a) — consent |
Note on AML/CTF screening. Shatale SASU is not itself an authorised payment or electronic money institution. We carry out identity verification and AML/CTF screening to protect the service and to assist the licensed financial partners we work with in meeting their statutory obligations. We therefore rely on our own legitimate interests under Art. 6(1)(f), not on a statutory duty of our own. A balancing assessment of those interests against your rights is available on request.
Name, email address, telephone number, date of birth, country of residence, and the credentials and sessions used to sign in.
Identity documents and the results of the checks carried out on them, where identity verification is required.
Card tokens and the last four digits, expiry month and year, held so that a purchase you instruct can be authorised. We do not store your full card number or the card security code (CVV/CVC). Card data is handled by our PCI DSS-compliant payment partners; see Section 7.
What was bought, from which merchant, the amount and currency, the time, the outcome of the authorisation, the policy or limit applied, and any approval you gave.
IP address, user agent, device identifiers and app or site interaction records, used for security, fraud prevention, identification and support. IP addresses are kept in full, not anonymised.
The content and metadata of messages you send us, and your support history.
| Data | Purpose |
|---|---|
| Account and identity data | Creating and operating your account, verifying who you are, meeting AML obligations |
| Payment data | Authorising and settling the purchases you instruct, handling refunds and disputes |
| Purchase and authorisation data | Carrying out your instructions, giving you a record, audit and accounting |
| Device and usage data | Security, fraud prevention, identification, diagnosing problems you report |
| Communications | Answering you, and improving the service |
We do not sell personal data.
Automated decisions are made when a purchase is authorised or declined against the limits and policies set on your account. You can ask for a human to review such a decision, express your point of view and contest it (Art. 22(3) GDPR) by writing to privacy@shatale.com.
Where you use our website, we use strictly necessary cookies for session management and security, and analytics and marketing cookies only with your consent. You can manage your preferences through our cookie tool or your browser. Withdrawing consent for non-essential cookies does not affect the service.
The merchant you asked us to buy from receives what the purchase requires. Because we buy in our own name, that is our data as the buyer; your data reaches a merchant only where delivery or the nature of the service requires it.
Card issuance, acquiring and settlement are carried out by licensed financial partners, including the issuing partner, the acquiring bank and the BIN sponsor. They receive the transaction data they need to perform and record the payment, and they act as independent controllers for that data under their own regulatory obligations. Their own privacy notices apply to it.
Authorisation requests are submitted to Visa/Mastercard as part of payment processing. Those networks have their own data processing terms.
Cloud hosting, email delivery, fraud screening and identity verification providers act as our processors, bound by data processing agreements with appropriate guarantees under GDPR.
We may disclose data to regulatory authorities, law enforcement or courts where applicable law requires it, including AML reporting obligations.
If Shatale SASU is involved in a merger, acquisition or asset sale, personal data may be transferred as part of that transaction. We will notify you in advance.
We are an EU-based company and primarily process data within the European Economic Area. Where we transfer data outside the EEA — for example to a cloud provider — we rely on a European Commission adequacy decision or on Standard Contractual Clauses under Article 46(2)(c) GDPR, supplemented by the technical measures in Section 11. You may request a copy of the applicable safeguards from privacy@shatale.com.
| Data | Retention period |
|---|---|
| Accounting and financial records (invoices, ledger entries, accounting books) | 10 years from the close of the financial year (Art. L123-22 French Commercial Code) |
| Authorisation logs | 10 years — they are supporting accounting documents (pièces justificatives) under Art. L123-22 French Commercial Code; the PSD2 record-keeping minimum of 5 years is shorter, and the longer period applies |
| Identity verification and AML documents | 5 years after the end of the business relationship (Art. L561-12 French Monetary and Financial Code) |
| Account data | Duration of the relationship + 5 years |
| Purchase history | Duration of the relationship + 5 years, and 10 years where it forms part of the accounting records above |
| IP address and user agent | In request logs: 13 months. Where recorded as evidence of a consent or authorisation you gave (for example a card-on-file consent or a purchasing mandate): kept, in full, for as long as that record is kept |
| Support communications | 3 years |
| Marketing opt-ins | Until withdrawal of consent + 3 years |
Once the applicable period has expired and no other legal obligation requires us to keep the data, it is deleted or irreversibly anonymised. That review is carried out by our compliance team; it is not an automatic process, and we will tell you the expected date on request.
Some of your data is deleted straight away; some of it is bound by the accounting, tax and anti-money-laundering periods set out above and cannot be destroyed as soon as a relationship ends. We set out below which is which, so that you know what to expect.
Deleted or revoked on request:
Retained in an archived state: your account record — including name, email address, telephone number and date of birth — together with the purchase, accounting and identity/AML records covered by the retention periods in Section 9. Active processing stops: the account is closed, access is revoked and recurring charges end. This is a restriction of processing within the meaning of Article 18 GDPR — the data is no longer used for any operational purpose and is kept only to satisfy the obligations that require it, until those periods expire.
Because part of the request is closed by archiving rather than deletion, an erasure request is reviewed by a member of our staff and is not completed automatically. We are working to shorten the list of what has to be archived; where that changes, this Notice will be updated and reissued under a new version number.
| Right | What it means |
|---|---|
| Access (Art. 15) | Ask for a copy of the personal data we hold about you |
| Rectification (Art. 16) | Ask us to correct data that is wrong or incomplete |
| Erasure (Art. 17) | Ask us to delete your data — see 10.1 for how we carry this out |
| Restriction (Art. 18) | Ask us to restrict processing in certain circumstances |
| Portability (Art. 20) | Receive your data in a structured, machine-readable format |
| Objection (Art. 21) | Object to processing based on legitimate interests |
| Withdraw consent (Art. 7(3)) | Withdraw consent at any time, without affecting processing already carried out |
To exercise any right, write to privacy@shatale.com. We will respond within one month of receiving your request. Where a request is complex, or where we have received several from you, that period may be extended by a further two months; we will tell you within the first month that we are extending it and why (Art. 12(3) GDPR). We may need to verify your identity before acting.
You may ask us to erase your personal data at any time, and we carry the request out in two parts.
Data not covered by a statutory retention obligation is deleted or revoked: marketing and notification preferences, marketing contact records, device tokens, sessions and access credentials.
Records covered by our accounting, tax and anti-money-laundering obligations — including your account record and your purchase history — cannot be destroyed while those obligations run. Complete destruction of them is restricted by law under Article 17(3)(b) GDPR. We close the account, stop the processing and place those records in the archived state described in Section 9.2, restricted under Article 18 GDPR, until the applicable period expires.
Because of that split, an erasure request is reviewed by a member of our staff rather than completed automatically. We will tell you which categories were deleted, which were archived, the legal basis for keeping each archived category, and when its period ends.
You may lodge a complaint with your national data protection authority. In France this is the Commission Nationale de l'Informatique et des Libertés (CNIL): www.cnil.fr.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction, including:
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the CNIL within 72 hours and affected individuals without undue delay, as required by Articles 33–34 GDPR.
The service is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have, we will delete it promptly.
We may update this Notice. Where changes are material, we will notify you by email at least 30 days before the effective date. The current version is always available at GET /v1/legal/privacy.
Data protection queries: privacy@shatale.com
Postal: Shatale SASU — Data Protection 623 Rue du Devois 34160 Saint-Drézéry France