Privacy policy
What data Ekto processes about its visitors, buyers and community, why, for how long, and how to exercise your rights.
Version 2026-10-boutique, in force since 22 October 2026.
This English version is provided for convenience. Only the French version is legally binding: read it in French
Article 1Data controller
The controller of the processing described here is Yanis Benyacine EI, trading name Ekto, SIREN 934 172 735, 26 rue Bosquet, 75007 Paris, France (the “Provider”). Contact for any question about your data: [email protected].
Given its size and its processing activities, the Provider has not appointed a data protection officer.
Article 2Scope of the policy
This policy concerns visitors to the ekto.fr website, buyers from the shop, people who contact the Provider and members of Ekto’s Discord.
Article 3Data, purposes, legal bases and retention periods
| Processing | Data | Purpose | Legal basis | Retention period |
|---|---|---|---|---|
| Website visits | IP address, requested page, date and time, browser (web server logs) | Security, troubleshooting, combating abuse | Legitimate interest | 12 months maximum |
| Audience measurement | Pages viewed, referring website or campaign, country and region (derived from the IP address, which is not stored), language, device type, browser, operating system, screen size, loading time, clicks on the main buttons; visit identifier calculated without cookies and renewed every month | Anonymous traffic statistics, improvement of the website and of the ordering process | Legitimate interest (audience measurement exempt from consent) | 25 months |
| Shop | Order sent by Tebex: Cfx.re account identifier and name, product purchased, amount, transaction number, dates | Delivering the product, proving the licence, handling complaints, combating fraud | Performance of the contract and legitimate interest | 5 years after the purchase |
| Contact by email | Email address, name, content of the message | Answering questions and custom requests | Legitimate interest or pre-contractual measures | 3 years after the last contact |
| Ekto’s Discord | Discord identifier and username, messages, roles, moderation measures | Running the community, moderating it, answering questions | Legitimate interest | Messages: for as long as they remain published; moderation measures: 1 year |
At the end of these periods, the data is deleted or anonymised. It may be kept longer where it is necessary for the establishment, exercise or defence of legal claims, or at the request of an authority.
Payment takes place at Tebex: the Provider receives neither card details nor the billing address. It does not carry out any commercial prospecting by email, does not sell any data and does not take any automated decision producing legal effects concerning you; Tebex may automatically assess the fraud risk of a payment, under its own responsibility.
Article 4Recipients
The data is accessible to the Provider and only to those members of its team who need it for their duties. It is also processed by the following processors, on behalf of the Provider:
| Service provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Dedicated server hosting the website and the record of shop purchases | Germany (company), data centre in Finland |
| IONOS SE | Email and domain names | Germany |
The following service providers process the data on their own behalf, under their own privacy policies:
| Service provider | Role | Location |
|---|---|---|
| Tebex Limited | Reseller and payment collection for shop purchases, invoices, fraud prevention | United Kingdom |
| Cfx.re | Login to the shop with the Cfx.re account, assignment and download of products | See the Cfx.re privacy policy |
| Discord Inc. | Ekto’s Discord server | United States |
Finally, the data may be disclosed to authorities that request it within the framework of the law.
Article 5Transfers outside the European Union
Some service providers are established outside the European Union (United States, United Kingdom). These transfers are covered by an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified companies and the decision concerning the United Kingdom, or failing that by the Commission’s standard contractual clauses. The website and the record of purchases are hosted in the European Union.
Article 6Security
The Provider protects the data with appropriate measures: encryption of exchanges (HTTPS), restricted administrative access reserved for a private network, logging of sensitive actions. In the event of a personal data breach presenting a risk, it notifies the CNIL (the French data protection authority) and, where necessary, the data subjects, under the conditions laid down by the GDPR.
Article 7Cookies and local storage
The ekto.fr website does not place any cookies and does not use any advertising tool; its fonts are hosted on the website itself.
Traffic on the website is measured with Umami, free software installed on a server of the Provider (the script is served by quantum-studios.fr): no cookies, no data transmitted to a third party or cross-referenced with other websites, IP address not stored, statistical results only. This measurement is exempt from consent. It does not run if your browser sends the “Do Not Track” signal, and you can object to it here at any time (your choice is kept in the browser’s local storage, under the key umami.disabled):
Audience measurement on this browser: checking…
The website uses only this tracker, linked to your objection and exempt from consent:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| umami.disabled | Local storage | Remembering your objection to audience measurement (only if you object to it) | Until deleted by the user |
The Cfx.re login and the Tebex payment page place their own trackers, in particular for fraud prevention, under the responsibility of those service providers.
If an audience measurement tool requiring consent were added, your consent would be requested beforehand.
Article 8Your rights
You have the right of access, rectification, erasure, restriction, objection to processing based on legitimate interest, portability of the data you have provided under the contract, and the right to set out instructions regarding what happens to your data after your death.
Exercise them at [email protected], stating your Cfx.re account name or your Discord identifier. You will receive a reply within one month, which may be extended by two months for a complex request; proof of identity may only be requested from you in case of reasonable doubt. Erasure does not cover data that the law requires to be kept, nor proof of a current licence.
You may lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
Article 9Minors
Purchases from the shop are reserved for adults. Ekto’s Discord is open in accordance with the minimum age set by Discord. The Provider does not knowingly collect data about minors beyond what their participation in this Discord server requires.
Article 10Changes to the policy
This policy may change, in particular as the services and the regulations evolve. The version in force is the one published on this page; a significant change is announced on Ekto’s Discord.