Legal
Privacy Policy
Last updated: 09/20/2026
At Territoire (EYL), we are committed to protecting your personal data and respecting your privacy. This policy explains, transparently, what data we collect, why, with whom we share it, and how you can exercise your rights, in accordance with the General Data Protection Regulation (GDPR — EU 2016/679).
1. Data controller
The controller of your personal data is: EYL — Sole Proprietorship (Entreprise Individuelle) M. Enzo de Carvalho 9 rue du Bât d'Argent, 69001 Lyon, France SIRET: 877 711 861 00014 Email: contact@territoire.me In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés) of 6 January 1978, as amended.
2. Data collected
We collect the following categories of data: • Identity data: first name, last name, email address, profile photo • GPS location data: run tracks, captured zones, positioning history • Sports health data: distance, duration, pace, heart rate (if a wearable is connected) • Navigation data: connection logs, device used, operating system • Financial data: subscription history (processed by Apple/Google, not stored by us) • Social data: username, rankings, community interactions We do not collect special-category data within the meaning of Article 9 GDPR (racial or ethnic origin, political opinions, biometric data) without explicit consent.
3. Purposes and legal bases
Each processing activity is based on a specific legal basis: • Performance of the contract (Art. 6(1)(b) GDPR): creating and managing your account, operating the application, territory conquest system, training plans • Legitimate interest (Art. 6(1)(f) GDPR): service improvement, IT security, fraud detection, aggregated usage statistics • Consent (Art. 6(1)(a) GDPR): push notifications, marketing emails, sharing your real-time location with the community • Legal obligation (Art. 6(1)(c) GDPR): retaining billing data, responding to judicial requests You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
4. Processing of GPS data
The application collects your GPS position in real time during your runs. This data is: • Used to trace your route and delimit captured territories • Shared with other users as captured zones (not your exact position outside of runs) • Stored in Firebase (Google Cloud Europe) • Retained for 3 years after your last activity • Deletable at any time from the application settings You can disable GPS collection in your device settings, but this will make the application non-functional.
5. Processors and third parties
We use the following processors, all bound by GDPR-compliant agreements: • Firebase / Google Cloud (Google LLC, Ireland): database, authentication, storage, notifications — Privacy Shield/Standard Contractual Clauses • RevenueCat Inc. (United States): in-app subscription management — Standard Contractual Clauses • Apple Inc. (United States): App Store payments, notifications — Standard Contractual Clauses • Google LLC (United States): Google Play payments — Standard Contractual Clauses • Vercel Inc. (United States): hosting of the territoire.me website — Standard Contractual Clauses Your data is never sold to third parties for commercial purposes.
6. Transfers outside the European Union
Some of our processors are established in the United States. These transfers are governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission, guaranteeing an adequate level of protection for your data. You may obtain a copy of these safeguards by contacting us at contact@territoire.me.
7. Security
We implement the following technical and organisational measures: • TLS encryption in transit and AES-256 at rest (Firebase) • Multi-factor authentication for access to internal systems • Strict access control to data (least-privilege principle) • Access logging and regular security audits • Incident-management and data-breach notification policy In the event of a data breach likely to result in a risk to your rights, we will notify the CNIL within 72 hours and inform you without undue delay if the risk is high.
8. Retention periods
We retain your data for the following periods: • Active account data: lifetime of the account + 3 years • Run and territory data: 3 years after the last activity • Billing data: 10 years (legal accounting obligation) • Connection and security logs: 12 months • Support data: 3 years after the ticket is closed • Anonymised/aggregated data: unlimited duration After these periods, your data is deleted or irreversibly anonymised.
9. Your rights
In accordance with the GDPR (Articles 15 to 22), you have the following rights: • Right of access: obtain a copy of your data (Art. 15) • Right to rectification: correct inaccurate data (Art. 16) • Right to erasure (“right to be forgotten”): delete your data under certain conditions (Art. 17) • Right to restriction: temporarily restrict processing (Art. 18) • Right to data portability: receive your data in a structured format (Art. 20) • Right to object: refuse certain processing based on legitimate interest (Art. 21) • Right to withdraw consent at any time (Art. 7) To exercise these rights, contact us at contact@territoire.me with proof of identity. We respond within 1 month (extendable to 3 months for complex requests). You may also lodge a complaint with the CNIL: cnil.fr — 3 place de Fontenoy, 75007 Paris.
10. Cookies and trackers
The territoire.me website uses technical cookies that are strictly necessary for the site to function (session, preferences). No advertising or third-party tracking cookies are placed without your consent. See our cookie policy for full details: territoire.me/cookies
11. Contact and complaints
For any question relating to your personal data: Email: contact@territoire.me Mail: EYL — M. Enzo de Carvalho, 9 rue du Bât d'Argent, 69001 Lyon If you are not satisfied after our response, you may refer the matter to the CNIL (cnil.fr) or any other supervisory authority of the Member State of your habitual residence.
This privacy policy may be updated periodically. In the event of a substantial change, we will inform you by email or via a notification in the application. The last-updated date appears at the top of this page.