Information
Privacy Policy
This Privacy Policy describes how Arashev SARL (NomoPhone) collects, uses and protects your personal data when you use our website www.nomophone.com, in accordance with the General Data Protection Regulation (GDPR - EU 2016/679) and the amended Data Protection Act.
Contents
- 1. Data controller and contact details
- 2. Categories of personal data collected
- 3. Purposes of processing and legal bases
- 4. Recipients of personal data
- 5. Data transfers outside the European Union
- 6. Data retention period
- 7. Safety measures
- 8. Your rights concerning your personal data
- 9. Profiling and automated decision-making
- 10. Cookies and similar technologies
- 11. Changes to this policy
- Useful links and resources
- Contact
1. Data controller and contact details
The person responsible for processing personal data is:
If you have any questions about the processing of your personal data or if you wish to exercise your rights, you can contact us at the above e-mail address.
2. Categories of personal data collected
We collect and process the following categories of personal data, depending on your interactions with our site:
A. Identification and contact details
- Surname and first name (required for account creation and orders)
- Email address (mandatory, used as login)
- Telephone number (optional but recommended for delivery)
B. Professional data (for professional customers)
- Company name (if you are a business customer)
- SIRET number (if you are a business customer)
- VAT number (if applicable)
C. Address data
- Delivery address (mandatory for orders)
- Invoice address (mandatory for orders)
- You can save several addresses in your account
D. Payment and financial data
- Credit card information: processed exclusively by PayPal, we never store credit card numbers on our servers.
- IBAN/RIB: for payment of telephone trade-ins (if you are selling a handset)
- Transaction information and payment history
E. Order and transactional data
- Order history (order number, products, prices, dates)
- Order status and modification history
- Delivery tracking numbers
- Invoices and transaction documents
- Customer notes and delivery instructions
F. Data relating to trade-in requests
- Type of appliance, make, model, condition
- Description of the device and photos
- Copy of identity document (requested before payment of any trade-in, stored with restricted access)
- IBAN for the trade-in payment
G. Authentication data
- Password (stored encrypted and hashed, never in clear text)
- Date and time of last connection
- Account status (active, inactive, suspended)
H. Navigation and technical data
- IP address
- Browser type and version
- Operating system
- Pages visited and navigation path
- Length of visit
- Source of traffic (search engine, direct link, etc.)
- Cookies and similar technologies (see ourCookie Management Policy)
I. Communication data
- Email correspondence
- Messages via the contact form
- Customer support requests
- Customer reviews and product evaluations
- Email tracking data (a tracking pixel that measures whether our emails are opened and which links they contain are clicked)
- Conversation with an advisor from a product page: email address, first name, content of your messages, product viewed (reference, condition, displayed price), language, originating page and technical data (IP address, browser). If you are logged in, the conversation is linked to your account. If you turn on reply notifications, the subscription address provided by your browser and its encryption keys are kept with the conversation until you turn them off or the conversation is deleted.
- Site notifications (if you turn them on): the subscription address provided by your browser and its encryption keys, language, country and time zone, device and browser type, the topics you choose and, if you are signed in, the link to your account so you can follow your orders and trade-ins. Legal basis: your consent, which you can withdraw at any time (‘Manage’ in each notification, or your browser settings). Notifications are delivered in encrypted form by your browser’s push service (Google, Apple, Mozilla or Microsoft). Data deleted no later than 90 days after you turn them off; sending history kept for 13 months.
- Kept offers, alerts and requested emails (if you click “Keep my offer”, “Notify me if the value goes up”, “Email me this product” or “Email me my cart”): the email address you enter, the declared device and the guaranteed price or desired amount, or the items sent, the language and the date. It is used only to send you what you asked for and, for a kept offer, a single reminder before the guarantee ends (pre-contractual step taken at your request, Art. 6.1.b GDPR). Without consent to our deals, the address is deleted 30 days after the guarantee ends or after sending; a value alert is kept until it is sent or you unsubscribe. Your browser also keeps, without any personal data, the token of your latest offers so they can be offered to you again for 15 days.
- Unfinished order: if you click “Pay” and the payment does not go through, or if you tick “Remind me of my order by email if I don’t finish it”, we send you a single reminder email about an hour later, with no commercial offer and with a link to stop receiving them. Legal basis: pre-contractual steps taken at your request (Art. 6.1.b GDPR) or your consent (Art. 6.1.a), which you can withdraw at any time.
- Recent trade-ins and trade-in reviews: once your trade-in has been paid, our site may show your first name and the initial of your surname with the traded-in model, the estimated and received amounts and the payment date (“Camille estimated their iPhone 13 at €300 and received €300”). A review you publish appears as “Sophie D.” (first name and initial of the surname), with your country and, where applicable, that model and those amounts. Never your full name, your town, your address, your email or your phone number. Legal basis: our legitimate interest in showing real trade-ins (Art. 6.1.f GDPR). Duration: a story only appears among the latest paid trade-ins and disappears as new trade-ins are paid; a review stays published until you ask for it to be removed. You can object at any time, without having to give a reason: the “Do not show my first name” box when you make your trade-in request, the “My first name in recent trade-ins” setting in your account settings, or an email to contact@nomophone.com. Your first name is then removed from the stories; a review is removed on request.
- “Live from the workshop” feed: some pages may show our workshop’s activity, taken from the orders and trade-ins of all our online shops (this site and the marketplaces where we sell): a device’s model, capacity and condition, rounded time of day, the amount paid and payment time for a trade-in on this site, or daily and weekly totals, including by delivery country. These events contain no name, town, address, email or phone number; only published reviews carry a first name and initial. Legal basis: our legitimate interest in showing real activity (Art. 6.1.f GDPR). Duration: an order or trade-in is only shown on the same day, totals cover 7 days at most, and a published review may appear for 60 days. If you no longer want your orders, trade-ins and reviews on this site to appear in it, write to contact@nomophone.com.
J. Preferences and consents
- Language preference
- Newsletter subscription (yes/no)
- Consent to marketing (yes/no)
- Cookie preferences
K. NomoPhone mobile app (iPhone and Android)
- Your phone’s model and storage capacity: read by the app to value it for a trade-in, they are not stored and do not identify you.
- Device notification token (if you turn notifications on): used only to send you the notifications you chose; you can turn them off at any time in your phone’s settings.
- Face ID, Touch ID or fingerprint (if you turn on the lock): the check is done by your phone, NomoPhone receives no biometric data.
- Camera and photos: only for the images you choose to attach (photos of the device, ID document) or to scan a bank card at checkout.
- No advertising tracking in the app: no advertising cookies and no device advertising identifier.
Mandatory or optional
Certain data is mandatory for the execution of a contract (order, account): surname, first name, email address, delivery address and billing address. Refusal to provide this data will make it impossible to place an order or create an account.
Other data is optional (telephone, newsletter, marketing) and can be refused without any impact on the use of the site.
3. Purposes of processing and legal bases
Your personal data is collected and processed for the following purposes, with their respective legal basis:
A. Performance of the contract (Art. 6.1.b of the RGPD)
- Managing and processing your orders
- Managing your customer account
- Management of telephone take-back requests
- Delivery of products ordered
- Payment processing (via PayPal)
- Management of returns and refunds
- Invoicing and issuing accounting documents
- Communication relating to your orders (confirmations, dispatches, deliveries)
Data concerned: Identification data, addresses, order data, payment data, delivery data
B. Consent (Art. 6.1.a of the RGPD)
- Sending commercial communications (newsletters, promotions, special offers)
- Personalised marketing and targeted advertising
- Analysis of your browsing behaviour and audience measurement (analytics cookies)
- Profiling to improve your user experience
Data concerned: Email, marketing preferences, browsing data, purchase history (for personalisation)
Existing customers: if you have already bought a device from NomoPhone or sold one to us, we may email you offers and price alerts about similar products and services (Article L34-5 of the French Postal and Electronic Communications Code). You can object at any time, free of charge, using the unsubscribe link in every email.
Accounts without a purchase: if you have created a NomoPhone account, or started an order or a buyback estimate without completing it, we may also email you our offers and price alerts. You can object at any time, free of charge, using the unsubscribe link in every email.
C. Legitimate interest (Art. 6.1.f of the RGPD)
- Improving our services and your user experience
- Fraud prevention and secure transactions
- Customer relations and technical support management
- Claims and after-sales service management
- Anonymised statistical analysis of traffic (without personal identification)
- Managing site security and preventing abuse
- Measuring engagement with our email communications (open and click rates via a tracking pixel)
- Showing our workshop’s real activity: recent trade-ins, trade-in reviews and the “Live from the workshop” feed (see section 2, I)
Data concerned: Browsing data, IP address, connection logs, transaction data, communication data
D. Legal obligation (Art. 6.1.c of the RGPD)
- Keeping invoices for 10 years (accounting and tax obligations)
- Retention of transaction data for traceability purposes
- Compliance with payment security and traceability obligations
- Communication to the relevant authorities in the event of a legal obligation (tax authorities, customs authorities, etc.)
Data concerned: Order data, invoices, payment data, identification data
4. Recipients of personal data
Your personal data may be communicated to the following recipients, in strict compliance with the RGPD:
A. Authorised internal staff
Only authorised Arashev SARL (NomoPhone) staff who need to access your data to carry out their duties (order management, customer service, etc.).
B. Service providers (sub-contractors)
- Site hostData and website hosting. Data is stored on secure servers located in the European Union.
- PayPal (payment processing)Secure processing of card payments and PayPal account payments by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), a PCI-DSS certified provider that processes this data under its own privacy policy.Data transmitted: Payment information, transaction amount, name, email address, phone number, billing and delivery addressesWith PayPal express checkout, PayPal sends us, with the consent you give in PayPal, your name, email address, phone number and delivery address, to create and deliver your order.PayPal privacy policy: https://www.paypal.com/fr/legalhub/paypal/privacy-full
- Klarna (paying with Klarna, Sign in with Klarna)If you choose to pay with Klarna, we pass your contact details and order details to Klarna Bank AB (publ) (Sweden) so that Klarna can assess whether you qualify for its payment methods, tailor them to you and prevent fraud. Klarna processes this data as a controller, under its own privacy notice.Payment with Klarna goes through Mollie B.V. (Amsterdam, the Netherlands), a payment institution that handles it on our behalf: Mollie receives this data to pass the request on to Klarna, collect the payment and pay it out to us, and processes it under its own privacy notice.Data shared: name, email address, phone number, billing and delivery addresses, order items and amount; if you are signed in to your account, the age of the account and your purchase history with NomoPhone (number, amount, dates), as well as account security indicators (verified email, devices used, declined payments, fraud observed), for fraud prevention (legitimate interest).With “Sign in with Klarna”, Klarna shares with us, with the consent you give in Klarna, your name, email address, phone number, addresses and a Klarna identifier, to create your account or sign you in and pre-fill your order.With Klarna express checkout, Klarna sends us, with the consent you give in Klarna, your name, email address, phone number and delivery address, to create and deliver your order.Klarna privacy notice: https://www.klarna.com/international/privacy-policy/Mollie privacy notice: https://www.mollie.com/legal/privacy
- Carriers (delivery)Transmission of data required for delivery (name, address, telephone number) to carriers (Chronopost, DHL, etc.) for delivery of your orders.
- Stripe (payments made up to 9 October 2026)Payments made up to 9 October 2026 (card, Apple Pay, Google Pay, Klarna…) were processed by Stripe Payments Europe Ltd. (Ireland), which keeps the data for these transactions and processes it for any refunds and disputes, under its own privacy policy. For Klarna payments, Klarna Bank AB (Sweden) also received this data, which it processes under its own privacy policy.
- Audience measurement and advertising: Google, Meta, OpenAI, Microsoft Clarity, AhrefsSubject to your consent: Google (Analytics and Ads — audience and conversion measurement), Meta (advertising pixel), OpenAI (ChatGPT Ads pixel — measurement of our ads shown in ChatGPT), Microsoft Clarity (usability analysis via session replay) and Ahrefs (audience statistics) receive pseudonymised browsing data.
- Technical tools: Cloudflare, OpenAI, Google Gemini, DeepL, Capitole, IONOSCloudflare (CDN and website security), OpenAI (conversational assistant — content of your messages to the chatbot), Google (Gemini — helps our team draft replies, based on the content of your messages to customer service), DeepL (content translation), Capitole (sending transactional SMS — phone number) and IONOS (routing our emails) process only the data strictly necessary for their service. If you turn on advisor reply notifications, your browser's notification service (Google, Apple, Mozilla or Microsoft) delivers them in encrypted form.
- Marketplaces: Back Market and RefurbedFor orders placed via these marketplaces, order and delivery data is exchanged with Back Market or Refurbed in accordance with their respective policies.
C. Competent authorities
In the event of a legal obligation, your data may be communicated to the competent authorities (tax services, customs, law enforcement agencies, etc.) as part of their legal duties.
5. Data transfers outside the European Union
Some of our service providers may transfer data to servers located outside the European Union. In this case, we ensure that these transfers are carried out in compliance with the RGPD.
PayPal
PayPal may transfer certain payment data outside the European Union, in particular to the United States (PayPal, Inc.), to process transactions and prevent fraud. These transfers are governed by:
- The PayPal group’s Binding Corporate Rules (BCRs), approved by the competent data protection authorities, for transfers between its companies
- The European Commission’s standard contractual clauses, for other transfers
- PCI-DSS certification for payment data security
For more information on the safeguards put in place by PayPal, please consult its privacy policy. https://www.paypal.com/fr/legalhub/paypal/privacy-full.
Some providers process data in the United States. Google, Meta, Microsoft, OpenAI and Cloudflare are certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), as is Stripe for payments made up to 9 October 2026. Transfers made by PayPal rely on the safeguards described above.
For non-certified providers or transfers to other third countries, we rely on the European Commission's standard contractual clauses, supplemented where necessary by additional measures.
6. Data retention period
Your personal data will be stored for the following periods, determined according to the purpose of the processing and legal obligations:
- Customer account details
Duration: For the lifetime of the account, then 3 years after the last activity (last connection or last order).
Legal basis: Performance of the contract + legitimate interest (customer relationship management)
- Order data and invoices
Duration: 10 years from the date of the transaction (legal obligation to retain accounting and tax records - Art. L123-22 of the French Commercial Code).
Legal basis: Legal obligation (accounting retention)
- Payment details
Duration: Full credit card details are never stored on our servers. Only transaction references are kept for 10 years (legal obligation).
Legal basis: Legal obligation (traceability of payments)
- Browsing data and analytics cookies
Duration: 13 months maximum for analytics cookies (CNIL recommendation). The data is anonymised after this period.
Legal basis: Consent (analytics cookies)
- Marketing data and newsletter
Duration: Until consent is withdrawn or unsubscription requested. If you unsubscribe, your data will be deleted within 30 days.
Legal basis: Consent
- Copy of identity card (trade-ins)
Duration: Until the trade-in transaction is fully closed, then retained for 5 years for traceability purposes (legal obligation to combat fraud and money laundering).
Legal basis: Legal obligation + performance of contract
- Communication data (support, after-sales)
Duration: For the duration of handling your request, then 3 years for customer service traceability. Associated technical data (IP address, browser) is anonymised after 13 months.
Legal basis: Legitimate interest (customer relationship management)
Deleting data
Once the retention periods have expired, your data will be securely and permanently deleted from our systems, unless there is a legal obligation to retain it for a longer period (e.g. invoices for 10 years).
You may also request the early deletion of your data in compliance with our legal obligations (see "Your rights" section).
7. Safety measures
We implement all appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration.
Technical measures
- SSL/TLS encryption for all data transmissions
- Password hashing with secure algorithm (bcrypt)
- Secure authentication and access control
- Secure data storage on servers hosted in the EU
- Regular, secure back-ups
- Regular updating of security systems
- Protection against attacks (firewall, anti-virus)
Organisational measures
- Access to data restricted to authorised personnel only
- Data protection training for staff
- Security incident management procedures
- Regular safety audits
- Compliance with security standards (RGPD, PCI-DSS for payments)
- Confidentiality agreements with all service providers
8. Your rights concerning your personal data
In accordance with the RGPD, you have the following rights regarding your personal data:
A. Right of access (Art. 15 RGPD)
You have the right to obtain confirmation that your personal data is being processed and, where appropriate, to obtain a copy of this data and information about its processing.
Terms and conditions: Contact us by email with proof of identity. Response within 1 month (extendable by 2 months if complex).
B. Right of rectification (Art. 16 RGPD)
You have the right to request the correction of inaccurate or incomplete data.
How: You can change most of your details directly in your customer account, or contact us to make the necessary changes.
C. Right to erasure (Art. 17 RGPD) - "Right to be forgotten
You have the right to request the deletion of your personal data in the following cases:
- The data is no longer necessary for the purposes for which it was collected.
- You withdraw your consent and there is no other legal basis
- You object to the processing and there is no compelling legitimate reason for it
- The data has been processed unlawfully
Exception: This right does not apply if storage is necessary to comply with a legal obligation (e.g. storage of invoices for 10 years).
D. Right to limit processing (Art. 18 RGPD)
You have the right to request that the processing of your data be restricted in the following cases:
- While we are processing your request for rectification
- Where processing is unlawful and you object to erasure
- When we no longer need the data but you need it for a dispute
E. Right to portability (Art. 20 RGPD)
You have the right to retrieve your personal data in a structured, commonly used and machine-readable format and to transfer it to another controller, where the processing is based on your consent or the performance of a contract.
Format: We will supply your data in JSON or CSV format, depending on your preference.
F. Right to object (Art. 21 RGPD)
You have the right to object to the processing of your personal data if:
- Processing is based on legitimate interests
- For reasons relating to your particular situation
- For commercial canvassing (opposition without cause)
Exception: We may continue processing if there are compelling legitimate grounds which override your interests.
G. Right to withdraw consent (Art. 7.3 RGPD)
Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal.
Terms and conditions: You can unsubscribe from the newsletter from your account or by clicking on the unsubscribe link in each email. You can also change your cookie preferences at any time.
H. Right to define post-mortem directives (Art. 85 RGPD)
You have the right to define directives concerning the fate of your personal data after your death. In the absence of directives, your heirs may exercise certain rights (access, rectification, deletion if necessary).
How to exercise your rights
To exercise any of these rights, you can:
- By email: contact@nomophone.com
- By post: Arashev SARL (NomoPhone), 19-21 RUE DENIS PAPIN, 51100 REIMS, France
- Via your customer account: Some data can be changed directly in your account
Documents required: For security reasons, a copy of an identity document may be requested to verify your identity before your application is processed.
Response time: We undertake to respond to your request within 1 month of receiving it. This period may be extended by a further 2 months depending on the complexity and number of requests.
Right to lodge a claim
If you believe that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged breach.
In France: Commission Nationale de l'Informatique et des Libertés (CNIL) (French Data Protection Authority)
Address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Telephone: 01 53 73 22 22
Website: https://www.cnil.fr/fr/plaintes
9. Profiling and automated decision-making
We use data to improve your user experience, in particular:
- Personalised content: Display of products likely to be of interest to you based on your browsing and purchase history.
- Product recommendations: Suggestions based on your preferences and behaviour
- Behavioural analysis: To improve our services and the ergonomics of the site
Paying with Klarna: Klarna, as a separate controller, may decide by automated means whether to accept a payment (credit and fraud risk assessment), under its own privacy notice, which describes your rights (including obtaining human intervention from Klarna). NomoPhone does not make this decision.
11. Changes to this policy
We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, our services, or for other operational, legal or regulatory reasons.
Any substantial modification will be communicated by a notice on this page with an updated "Last updated" date. We encourage you to check this page regularly for any changes.
Useful links and resources
For more information on the protection of personal data:
Contact
If you have any questions about this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact us at:
Email: contact@nomophone.com
Postal address: Arashev SARL (NomoPhone), 19-21 RUE DENIS PAPIN, 51100 REIMS, France
We undertake to respond to all your requests as quickly as possible, in accordance with the obligations of the RGPD.