1. Overview
Colpasso is based in France. We process personal data under the General Data Protection Regulation (GDPR) and French data protection law. This page explains the rights you have over your personal data and how to exercise them.
For what data we collect and why, see our Privacy Policy. For cookies and similar technologies, see our Cookie Policy.
2. Your rights
Where GDPR applies, you may have the following rights:
Right of access
You can ask whether we process your personal data and request a copy of the data we hold about you.
Right to rectification
You can ask us to correct inaccurate data or complete incomplete data. Retailers can update many account details directly in their dashboard.
Right to erasure
You can ask us to delete your personal data in certain circumstances, for example where it is no longer needed for the purpose it was collected or where you withdraw consent and no other legal basis applies.
Right to restriction
You can ask us to restrict processing in limited situations, such as while we verify the accuracy of data you have challenged.
Right to data portability
Where processing is based on consent or contract and carried out by automated means, you can ask for your data in a structured, commonly used, machine-readable format.
Right to object
You can object to processing based on legitimate interests, and you can opt out of direct marketing at any time.
Rights related to automated decision-making
We do not make decisions with legal or similarly significant effects based solely on automated processing.
3. How to make a request
To exercise your rights, contact us via the details on our About Colpasso page. Please describe your request clearly so we can help you efficiently.
We may need to verify your identity before responding — for example by confirming the email address used to unlock a route or operate a retailer account.
We aim to respond within one month. Complex requests may take up to an additional two months; we will let you know if an extension is needed.
4. Data controller
Colpasso is the data controller for personal data collected through this website and related services, except where a participating retailer processes customer data for its own in-store sale.
5. Complaints to the CNIL
If you believe your data protection rights have not been respected, you have the right to lodge a complaint with the French supervisory authority, the Commission nationale de l'informatique et des libertés (CNIL):
- cnil.fr
- 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
We encourage you to contact us first so we can try to resolve your concern.
6. International transfers
If your data is transferred outside the European Economic Area, we use appropriate safeguards such as Standard Contractual Clauses or other mechanisms recognised under GDPR.
7. Data retention and security
We retain personal data only as long as necessary for the purposes described in our Privacy Policy and apply appropriate technical and organisational security measures.
8. Changes to this page
We may update this page when our practices or legal requirements change. Material updates will be posted here with a revised "Last updated" date.