Skip to Content

Privacy policy of the ieyes.fr website

Version: 1.0 (English translation) Last updated: 1 October 2026 (French original). Translation prepared: 6 November 2026.

This page is an English translation of our French privacy policy, for visitors and customers who read English. The French text is the original. We have kept the same structure and numbering.

1. In brief

This page explains what we do with your personal data when you use the ieyes.fr website.

The essentials:

  • We do not sell your data.

  • We do not run targeted advertising.

  • We do not use any advertising trackers. The website does not need a cookie banner: the only cookies are those the website needs to work, and our audience measurement sets no cookie.

  • We never store your bank card numbers. Payment goes through Stripe or PayPal.

  • You can ask at any time to see, correct or delete your data by writing to .

  • This policy covers the ieyes.fr website only. Our mobile apps (JustTag, JustSee, ICane) each have their own policy.

If you just want to know how to exercise your rights, go straight to section 11.

2. Who is responsible for your data

The data controller is:

  • IEYES, a simplified joint-stock company (SAS) and social and solidarity economy (ESS) business

  • Registered office: 28 rue Rochambeau, 33000 Bordeaux, France

  • Company number (SIREN): 929 510 238

  • President: Kévin Derome

  • Email:

IEYES has not appointed a data protection officer, as this is not mandatory for an organisation of our size. For any question about your data, write to .

3. What this policy covers

This policy covers the ieyes.fr website and its services:

  • browsing the website,

  • the contact form,

  • the newsletter,

  • the online shop and customer accounts,

  • booking a telephone appointment.

It does not cover:

  • the JustTag app, which has its own policy at ieyes.fr/justtag/confidentialite;

  • the JustSee and ICane apps, which have their own policies, available from their page in the app stores;

  • the third-party websites we link to (Stripe, PayPal, La Poste, FedEx, etc.), which have their own rules.

4. The rules that apply

We comply with:

  • the General Data Protection Regulation (GDPR, EU Regulation 2016/679);

  • the French “Informatique et Libertés” law of 6 January 1978, as amended;

  • article L. 34-5 of the French Postal and Electronic Communications Code, for email marketing;

  • the recommendations of the CNIL (the French data-protection authority), in particular its guidance on managing commercial activities and its cookie guidelines.

5. What we do with your data, processing by processing

Each sub-section states: why we process your data (the purpose), which data, on what legal basis, for how long, and who has access.

5.1 Browsing the website (technical logs)

Why: to run the website, keep it secure, and detect attacks and outages.

Data: IP address, date and time, pages requested, browser type. These are the standard logs of a web server.

Legal basis: our legitimate interest in keeping the website secure (article 6.1.f GDPR).

Retention: 12 months at most.

Who has access: IEYES and its host OVH (see section 7).

5.2 Audience measurement

Why: to know how many people visit the website and which pages are read, so we can improve it.

Tool: Plausible Analytics, a European tool whose data is hosted in the European Union. This tool sets no cookie and builds no individual profile. Statistics are aggregated and anonymous.

Legal basis: our legitimate interest in measuring website traffic (article 6.1.f GDPR). Because this tool cannot track you individually, it falls within the cases where the CNIL does not require your consent.

Retention: aggregated statistics cannot identify you; they are kept for as long as we need them to follow how the website evolves.

5.3 Contact form

Why: to answer your request and, if you are interested in our products, to follow up commercially.

Data: your name, your email address, your message, and the other form fields you choose to fill in.

Legal basis: steps taken at your request before a contract, that is, answering your enquiry (article 6.1.b GDPR), and our legitimate interest in following up the requests we receive (article 6.1.f).

Where the data goes: your message is recorded as a “lead” in our customer relationship management software (Odoo), installed on our own server.

Retention: 3 years after our last exchange, in line with the CNIL guidance. If you become a customer, see section 5.5.

Advice: do not give information about your health or disability in the contact-form message. If your request needs this information, we will talk about it during an appointment (see section 5.6).

5.4 Newsletter

Why: to keep you informed of our news, products and updates.

Data: your email address and the date you subscribed. Our sending tool may also record whether you open our emails and which links you click, to measure interest in our mailings.

Legal basis: your consent (article 6.1.a GDPR), given when you subscribe yourself using the newsletter form on the website. We do not subscribe anyone without this step.

Unsubscribing: every email contains an unsubscribe link. You can also write to . Unsubscribing takes effect immediately.

Retention: until you unsubscribe, or 3 years after your last active contact with us (opening an email, a click, a reply, an order). After you unsubscribe, we keep your address on a suppression list, only so that we no longer write to you.

5.5 Online shop, customer accounts and orders

Why: to create and manage your account, process your orders, deliver, invoice, handle after-sales service and guarantees, and meet our accounting and tax obligations.

Data:

  • identity: surname, first name, email address, telephone;

  • delivery and billing addresses;

  • order history, products bought, amounts;

  • account identifier and password (stored in encrypted form, unreadable by us);

  • payment information: only the method used, the status and the transaction reference. We never see or store your bank card number. These numbers are entered directly with Stripe or PayPal.

Legal basis:

  • performance of the sales contract (article 6.1.b GDPR) for the account, the order, delivery and after-sales service;

  • our legal obligations (article 6.1.c) for invoicing, accounting and electronic invoicing;

  • our legitimate interest (article 6.1.f) for fraud prevention.

Who receives your data:

  • Stripe and PayPal (payment);

  • Colissimo (La Poste) and FedEx (delivery): name, address, telephone and email for parcel tracking;

  • Qonto, an approved electronic-invoicing platform, which transmits our invoices and the transaction data that the law requires us to report, as part of business-to-business electronic invoicing;

  • our chartered accountant, to keep our accounts.

Retention:

  • customer account and commercial relationship data: for the whole duration of the relationship, then 3 years after your last order or last active contact;

  • invoices and accounting records: 10 years from the end of the financial year, as the French Commercial Code requires;

  • data needed for the guarantee: until the end of the product’s legal or contractual guarantee period;

  • inactive account: you can ask us to delete your account at any time; we then keep only what the law requires us to keep (invoices).

5.6 Booking a telephone appointment

Why: to arrange a call with you to present our products, answer your questions, or help you with a funding application (PCH, MDPH).

Data:

  • name, email address, telephone number;

  • the profile you choose: “For yourself”, “For a relative”, “As a professional” or “Other”;

  • the appointment type you chose and the time slot;

  • your free-text message, if you write one;

  • your IP address, only to limit abuse (at most 5 bookings per IP address per day).

What we ask you not to write. The form reminds you not to give medical information in the free-text message. We do not need this information to arrange the appointment.

Information about your situation mentioned during the call. During a “Help with a funding application” appointment, you may talk to us about your disability or your funding applications. This information is data concerning health within the meaning of article 9 GDPR. We process it only on the basis of your explicit consent, which we ask for orally at the start of the call. We keep no notes about your health situation unless you ask us to do so to follow up your file. In that case, these notes are accessible only to the people who handle your file, and you can ask for them to be erased at any time by writing to us, without affecting what was done before.

Legal basis:

  • for identity, contact and appointment data: steps taken at your request before a contract (article 6.1.b GDPR);

  • for health-related information mentioned during the call: your explicit consent (article 9.2.a GDPR);

  • for the IP address: our legitimate interest in preventing abuse (article 6.1.f).

Where the data goes:

  • a “lead” is created in our customer relationship management software (Odoo), on our server. It contains all the information from the form;

  • an event is created in our calendar, hosted by Google (Google LLC, United States). This event contains only your name, the type of appointment and your telephone number. Your email address, the profile chosen and your message are not copied there;

  • a confirmation email is sent to you.

Retention:

  • contact and follow-up data: 3 years after our last exchange;

  • IP address: 7 days;

  • Google calendar event: deleted no later than 3 months after the appointment date;

  • notes about your situation kept at your request: until your file is closed, and at most 3 years; immediately if you withdraw your consent.

6. Cookies and trackers

We use only the cookies strictly necessary for the website to work. They are exempt from consent under article 82 of the French “Informatique et Libertés” law and the CNIL guidelines. That is why the website shows no cookie banner.

List of cookies:

  • session_id: keeps your session (account login, basket). Duration: 7 days.

  • frontend_lang: remembers the display language you chose. Duration: 1 year.

  • tz: remembers your time zone so that appointment times are shown correctly. Duration: 1 year at most.

We do not use:

  • any advertising cookie;

  • any social-network cookie;

  • any audience-measurement tool that sets a cookie (no Google Analytics).

If we ever add a tracker that needs your consent, we will ask for your consent before it is set and will update this page.

You can delete these cookies in your browser settings. Without the session cookie, you will not be able to stay signed in to your account.

7. Who has access to your data

7.1 Internally

Only the people at IEYES who need it for their work have access to your data: order handling, customer service, accounting.

7.2 Our processors

These companies process your data on our behalf, following our instructions:

  • OVH SAS (France): hosting of the website, the database and our email. Servers located in France, in the Hauts-de-France region.

  • Plausible Insights OÜ (Estonia): audience measurement, data hosted in the European Union.

  • Qonto (Olinda SAS, France): electronic-invoicing platform.

  • Google LLC (United States): appointment calendar. We record there only your name, the type of appointment and your telephone number (see section 5.6).

7.3 Recipients that act on their own behalf

These companies and people receive some data but decide for themselves how to use it, under their own rules:

  • Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payment. They are bound by banking regulation and fraud-prevention rules.

  • La Poste – Colissimo (France) and FedEx: parcel delivery.

  • Our chartered accountant, bound by professional secrecy: invoices and accounting records.

  • Public authorities, when the law requires us to (tax authorities, courts).

We neither sell nor rent your data to anyone.

8. Transfers of your data outside the European Union

Most of your data stays in France or in the European Union.

Four cases may lead to a transfer outside the European Union:

  • Google (appointment calendar). Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing adequate protection. To limit this transfer, we record in the calendar only your name, the type of appointment and your telephone number.

  • Stripe. Our contract is with Stripe Payments Europe (Ireland). Some operations (fraud prevention, technical support) may involve Stripe, Inc. in the United States, which is certified under the Data Privacy Framework and applies standard contractual clauses.

  • PayPal. Our contract is with PayPal (Europe) in Luxembourg. Transfers within the PayPal group are covered by binding corporate rules (BCR) approved by the European authorities.

  • FedEx. When a delivery is entrusted to FedEx, in particular to a country outside the European Union, your delivery data is sent to the destination country, which is necessary to carry out your order (article 49.1.b GDPR).

You can obtain a copy of the applicable safeguards by writing to .

9. How we protect your data

We take technical and organisational measures suited to the size of our organisation and the nature of the data:

  • the website can be reached only over an encrypted connection (HTTPS);

  • passwords are stored in hashed form, which means we cannot read them;

  • bank card numbers never pass through our servers;

  • access to the management software is protected by individual accounts;

  • regular, encrypted backups are made;

  • the software and the server are kept up to date.

In the event of a data breach that presents a risk to you, we will notify the CNIL within 72 hours and will inform you if the risk is high.

10. No automated decisions

We make no decision about you based solely on automated processing, and we do not carry out profiling.

11. Your rights and how to exercise them

You have the following rights:

  • Access: to know what data we hold about you and to obtain a copy.

  • Rectification: to have inaccurate or incomplete data corrected.

  • Erasure: to ask for your data to be deleted, except what the law requires us to keep (for example invoices).

  • Restriction: to ask us to freeze the use of your data while a check or a dispute is under way.

  • Objection: to object to processing based on our legitimate interest, and to object at any time to direct marketing.

  • Portability: to receive the data you gave us in a machine-readable format, to pass it on elsewhere.

  • Withdrawal of consent: to withdraw at any time a consent you gave (newsletter, information about your situation mentioned during an appointment), without affecting what was done before.

  • Instructions after death: to tell us what to do with your data after your death.

How to do it

Write to us:

  • by email: , putting “Personal data” in the subject;

  • by post: IEYES, 28 rue Rochambeau, 33000 Bordeaux, France.

Tell us which right you want to exercise and on which data. If we have a reasonable doubt about your identity, we may ask you for something that lets us verify it. We will not ask for an identity document by default.

We reply within one month. This period may be extended by two months if the request is complex; we will then tell you. Exercising your rights is free of charge.

Our replies are written to be readable with a screen reader. If you need a particular format (plain text, braille, audio), tell us.

Complaint to the CNIL

If you think your rights are not being respected, you can contact the French data-protection authority, the Commission nationale de l’informatique et des libertés (CNIL):

  • online: www.cnil.fr/fr/plaintes

  • by post: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

  • by telephone: +33 1 53 73 22 22

If you live in another country, you can also complain to the data-protection authority of the country where you live or work (for example, in the United Kingdom, the Information Commissioner’s Office, www.ico.org.uk).

We would prefer, however, that you write to us first, so that we can sort the problem out directly.

12. Minors

Our shop and our services are aimed at adults. If you are under 15, ask a parent or guardian to take the steps for you. If we learn that we have collected data from a minor without authorisation, we will delete it.

13. Changes to this policy

We may change this policy, for example if we add a service or a processor. The update date is shown at the top of the page. For an important change, we will inform you by email if we have your address, or by a message on the website.

Previous versions are available on request at .

14. Version history

  • Version 1.0 — 1 October 2026: first publication.