COVENISPrivacy policy
Covenis takes the protection of your personal data seriously, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. Courtesy translation; the French version prevails.
Data controller
COVENIS, 35 rue des Écureuils, 34170 Castelnau-le-Lez, France — contact: [email protected].
Data collected and purposes
| Customer account | Name, email, mobile phone, date you accepted the terms, news preference, sign-in history, saved projects. We verify your email (and your phone at sign-up) with one-time codes sent by email and SMS. Purpose: creating and securing your account, letting you find and change your projects and follow your requests. Legal basis: pre-contractual steps / performance of the contract; news: your consent (optional, withdrawable at any time). |
|---|---|
| Contact form | Name, email, phone (optional), postcode, message. Purpose: answering your request. Legal basis: pre-contractual steps / legitimate interest. |
| Quote request (configurator) | Same data plus project composition, property characteristics (area, rooms, heating) and estimate. Purpose: preparing a personalised quote. Legal basis: pre-contractual steps taken at your request. |
| Photos (quote request) | Optional photos of your switches, electrical panel and heating equipment, and technical answers. Purpose: checking feasibility and preparing the quote. Legal basis: pre-contractual steps. Please do not photograph people. |
| Technical logs | IP address and access logs kept briefly. Purpose: security and proper operation. Legal basis: legitimate interest. |
Purchases, confirmation emails and Google services
Covenis runs an internal automation, the Google application “Covenis N8N”, to process purchases paid through Stripe: after a payment, it emails the customer a confirmation containing the purchased content, then records the sale in a log.
Data processed: first name, last name, email address, phone number and billing address (when provided at checkout), product purchased, amount, date and the text of the email sent. Purpose: fulfilling the order and keeping the sales log. Legal basis: performance of the contract and accounting obligations.
Access to Google data: the application is not open to the public; only Google accounts managed by Covenis authorize it. It uses:
- Gmail, only to send the confirmation emails (it does not read, delete or analyse any inbox message);
- Google Drive, only to read the Google Docs that contain the email texts;
- Google Sheets, only to read the product list and add rows to the sales log.
Storage and sharing: the data is kept in a Google Sheet owned by Covenis and in the execution log of the automation tool (n8n), hosted on Covenis infrastructure. It is not sold, not used for advertising or to train artificial-intelligence models, and not shared with third parties, except Stripe (payments) and Google (email and storage) acting as processors, or where the law requires it. A person accesses Google data only to provide support, ensure security, or comply with a legal obligation.
Retention and deletion: data is kept for as long as needed to manage orders and meet legal retention obligations (see “Retention”). You can ask for deletion at [email protected], subject to those obligations. The application’s access to a Google account can be revoked at any time at myaccount.google.com/permissions.
Google policy: Covenis's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Retention
Your account is kept until you delete it, which you can do at any time from “My account” (your personal data is then erased); an account inactive for 3 years is deleted. Prospect data is kept for 3 years from the last contact. If a contract is concluded, data is kept for the duration of the relationship, then archived for legal periods (accounting: 10 years).
Recipients
Data is processed by Covenis on its own servers (self-hosted site and automation). Emails and SMS (notifications, confirmations, verification codes) pass through our messaging providers (Brevo, a French company, and Google Gmail), and Cloudflare, Inc. acts as technical processor (network, security, attack protection). We never sell or rent your data.
Transfers outside the EU
Google, Stripe and Cloudflare may process data in the United States; such transfers are covered by the EU–US Data Privacy Framework and/or standard contractual clauses.
Your rights
You have the rights of access, rectification, erasure, objection, restriction and portability. From “My account” you can download your data and delete your account. For anything else, write to [email protected]. You may lodge a complaint with the CNIL (cnil.fr).
Security
Encrypted connection (HTTPS), segmented hosting, backups, restricted access and regular updates.
Cookies and trackers
This site uses no advertising or analytics cookies; only cookies strictly necessary to sign in to your account are used. See the cookies page.
Last updated: 2026-10-11