Last update :
Preamble
This section informs you of the manner in which E Retail Development – SAS RCS de Lyon n°751 652 934 – 6 Cours André Philip – 69100 Villeurbanne (acting under the trade name Smart Traffik) processes, as subcontractor, and, in some cases, as joint controller with its Retail customers, Media agencies or Advertising agencies, your personal data collected jointly with its Retail customers in the context of the oKube statistical measurement solution; of the purpose of this processing, the responsibilities of the parties involved and the way in which you may, if you so wish, object to it.
Smart Traffik is a specialist in the development of omnichannel solutions that it offers to various brands, retailers, media agencie or advertising agencies enabling them to improve and maintain the relationship with consumers throughout the purchasing process. Through its oKube solution, Smart Traffik models the entire online and offline consumer journey and gives the real ROI of marketing campaigns.
Purpose of processing oKube
We use oKube to help our customers measure the effectiveness of their online or offline advertising on in-store visits.
They can:
- Measure the impact of online and offline marketing levers on the performance of the brand/brand online and in-store
- Optimise marketing investment management with multi-touch attribution
- Visualise data on the basis of intelligible and accessible business indicators according to several levels of information
Smart Traffik relies on the correlation of pseudonymised or anonymised data from online interactions (which may take place on different browsers and devices) and/or offline interactions (such as campaigns displayed on street furniture, for example DOOH, Digital Out-of-Home, or OOH, Out-of-Home) and in-store interactions of end customers with its Retailer client, as well as data from Smart Traffik’s partners; all of which allows for the matching of data and/or (depending on the source of the data) the constitution of an omnichannel identifier (also known as an “omnichannel graph”) allowing for measurement.
It is therefore a question of producing global aggregated statistics, revealing no information relating to an individual, made available within a dashboard for Smart Traffik’s Retail Clients, Media agencies or Advertising agencies, to help them better manage their marketing investments.
As part of the construction of its omnichannel measurement graph, Smart Traffik may exchange data with its partners. When this is the case, we ensure that this exchange is done solely on the basis of consent and is governed by the signing of a DPA (Data Processing Agreement) with our partners detailing the responsibilities of each party as well as the organisational measures taken by Smart Traffik and the partner to ensure the security of your personal data and the respect of our privacy policy.
Purpose of geomarketing processing
In the context of geomarketing, which makes it possible to analyse consumer behaviour according to their geographical location, the purpose of the processing is to:
- Enable the retailer to develop a product offering, communication or location strategy combining local socio-economic criteria with its own sales data and knowledge of the market;
- Provide in-depth knowledge of potential customers, which can be used to target customers with messages that match their profile and habits.
Geomarketing is a skilful blend of cross-analysis of geographical, socio-behavioural and socio-demographic data. It uses geographical or location-based information to help companies implement marketing strategies and campaigns.
Purpose of processing audience segments
Smart Traffik analyses your travel habits to group you into categories of similar users (audience segments). These segments are made available to our clients and enable them to present you with advertising that is more relevant to your travel habits and interests.
For example, if you regularly visit gardening shops, you may receive offers related to this field rather than advertisements that have nothing to do with your areas of interest.
Joint Controllers
Smart Traffik is joint data controller with its customers. Thus, each of the co-controllers at the source of the collection of the processed data undertakes to inform the customer of the processing and to offer them the means to exercise their rights, in particular concerning the right to information, access and opposition (see below). The client Brand, Media agency or Advertising agency refers to Smart Traffik and provides a link to their page in their privacy policies and/or privacy management tools.
Access the outline of the Co-Liability Agreement.
Legal basis for oKube processing
The oKube platform attaches particular importance to the protection of personal data, and in view of its purpose of measuring the impact of advertising and marketing investments, only collects and processes pseudonymised or anonymised data. Given oKube’s low-intrusive purposes and the fact that the data is used neither for advertising targeting nor for sending commercial communications, Smart Traffik’s evaluations led it to consider that its oKube processing could be based on legitimate interest as a legal basis, while preserving and guaranteeing the rights and freedoms of individuals, in particular the protection of personal data. However, the collection of data by Smart Traffik and the transmission of data to Smart Traffik are done in several cases with your consent only.
Thus, for each of the subcontractors constituting oKube’s sources (see the section below on “oKube’s data sources and measures to protect your data” for more details):
- SmartBox: Legitimate interest of Smart Traffik and of the customer Sign, as it is an anonymised data at short notice.
- Audience: Consent to the data collected through the use of the Sign client’s cookie banner and/or their CMP (Consent Management Platform) forwarding proof of consent to Smart Traffik, as well as the use of disclosures in the Sign client’s T&Cs/user policies and under certain forms. In some cases, Smart Traffik’s Retail customers may share with Smart Traffik access to campaign data (e.g. via Google Analytics), to facilitate campaign identification and measurement.
- CRM Data: data collected lawfully from the Brand(s) of which you are a customer, generally collected by the Brand customer on the basis of your consent as part of a loyalty programme, or in some cases of the legitimate interest of the Brand customer, while preserving and guaranteeing the rights and freedoms of individuals, in particular the protection of personal data
- Data exchanged between Smart Traffik and its mobile data partners: this data is collected by Smart Traffik and its partners for measurement purposes on the basis of your consent.
- Data transmitted to Smart Traffik by advertising agencies for measurement of their campaigns: this data is collected by Smart Traffik’s partners and transmitted to Smart Traffik for measurement purposes on the basis of your consent.
- GPS data and advertising identifiers used for geomarketing purposes: this data is collected and processed on the basis of consent.
- Consent strings (TC Strings) collected and stored when the audience script is loaded or when data is exchanged between Smart Traffik and its partners or agencies: this data is collected by Smart Traffik and/or its partners on the basis of legitimate interest. Smart Traffik has conducted an analysis to determine that the rights and freedoms of the persons concerned do not take precedence over Smart Traffik’s legitimate interests. The chains of consent do not contain sensitive data and do not directly identify the persons concerned. Furthermore, the consent chains do not create a new “cross-site” tracking vector and contain only what is strictly necessary to encode users’ choices in terms of confidentiality. Finally, the collection and storage of consent strings enables Smart Traffik to demonstrate users’ choices in the event of an audit by the regulatory authorities under the GDPR.
Analysis and prediction based on user behaviour (profiling)
In order to enable our clients to optimise their marketing investments and in compliance with the purposes of the oKube processing, Smart Traffik may establish a profile on the basis of your behaviour.
While the profiling operations we implement involve fully automated decisions, they do not produce any legal effect or effect that could significantly affect you.
These operations allow us, for example, to identify the most effective marketing levers for generating a visit to a shop following an advertising exposure.
You have the same rights detailed in the section “How to exercise your rights” as well as the right to lodge a complaint with the CNIL (https://www.cnil.fr/fr/adresser-une-plainte).
oKube data source and measures to protect your data
The oKube service, when deployed in Smart Traffik’s retail customers, relies on several data sources to measure the interactions of the retailer’s customers and prospects with their digital (website(s)) and physical (shops equipped with Smart Traffik’s SmartBoxes) ecosystems.
The following subcontractors are therefore oKube’s data sources and enable the achievement of its purpose.
Smart Traffik is based on two types of data:
A. First” data, obtained directly from Smart Traffik’s retail customers (website, CRM program, shops):
- Online measurement solution Audience: a script placed on the Brand customer’s website allowing the placement of a cookie applicable to the Brand customer’s domain only (cookie-first) online, the collection of pseudonymised personal data (i.e. transformed, with no possibility of returning to the original data, unless the original data is available, which is not the case with Smart Traffik) submitted within forms, data contained within your browser (IP address, so-called fingerprint data) to which protective measures are also added, and GPS coordinates. The data collected via the Audience service is used to enrich oKube’s omnichannel graph for measurement and/or to establish direct matches with other data, for example from CRM data (linked to checkouts) of Smart Traffik’s retail customers. Details: oKube and privacy : Audience
- In-store measurement solution SmartBox: a device (sensor) installed in shops that generates anonymised data (called “offline cookie”) from the MAC address of your mobile phone at short notice. It is not possible to trace the original data (even if you are in possession of it). This anonymised data is placed in a dataset called a “filter” in which it has attributes in common with other data, thus generating a collision rate that further enhances anonymisation. This “offline cookie” is used to match other mobile data, obtained via Smart Traffik’s data partners (see below) based on your consent only (Smart Traffik does not seek to link to data you have not consented to), in order to enhance the accuracy and scope of the measurement of shop visits. Details: oKube and privacy : SmartBox
- Exchanges of data related to your in-store transactions and the sharing of your personal data known to the retailer customer (e.g. CRM loyalty programme), always in encrypted form with no possibility of returning to the original data. The amount (sometimes in the form of equivalence), product information, time and place of the transaction are transmitted in clear text. This information can be used by Smart Traffik to match data from its omnichannel graph and/or partners for measurement purposes. Details: oKube and privacy: CRM data exchange
B. Third party” data, obtained from Smart Traffik’s partners or advertisers on which the measurements are based:
As part of its oKube solution, Smart Traffik also receives so-called third-party data, from mobile advertising players and identification partners, such as FirstID. FirstID acts as a technology provider specializing in the pseudonymization of user identifiers, in compliance with the RGPD. Data provided or received via FirstID is systematically pseudonymized and subject to appropriate security measures, excluding any transfer or access to directly identifying data.
FirstID’s intervention ensures the reconciliation of journeys between different digital environments without ever processing clear identifiers, and in full respect of the rights of the persons concerned. Where necessary, processing is carried out on the basis of user consent or legitimate interest, always within a contractual and technical framework.
Details of the data partners and advertisers concerned.
Recipients of the data collected
E RETAIL DEVELOPMENT, a simplified joint stock company, whose registered office is located at 6 cours André Philip, 69100 Villeurbanne and registered under the number 751 652 934 RCS Lyon (“Smart Traffik”), is the recipient of this data.
In addition to Smart Traffik, certain technical partners may have access to pseudonymized data strictly for the purposes of providing measurement and analysis services. This is notably the case with FirstID, which may act as a recipient of pseudonymized data in order to facilitate the attribution or reconciliation of digital events, while guaranteeing the absence of directly identifying data. Relations with these partners are governed by specific agreements detailing security and compliance obligations.
Smart Traffik’s retail customers, media agencies or advertising agencies have access to a dashboard presenting the aggregated statistical measures but cannot in any case have access to the data shared and transformed by Smart Traffik once they have been transmitted, in order to avoid overlaps between encrypted data that will have been subject to statistical processing and unencrypted data without the authorisation of the persons concerned.
Certain partners and advertising companies (SFBX, Facebook, mentioned above) may also have access to Smart Traffik data, strictly in the context of the use of this data to meet Smart Traffik’s performance measurement objectives. It should be noted that Facebook Ireland has subscribed to the Standard Contractual Clause (https://www.facebook.com/help/566994660333381) validated by the European Commission, and related to the protection of data that would be transferred to its parent company outside the European Economic Area. Similarly, Pinterest Europe Ltd. will only transfer data from the EEA to a country that does not provide an adequate level of protection if adequate security measures are in place to protect your information, such as the standard contractual clauses (https://policy.pinterest.com/fr/privacy-policy#section-residents-of-the-eea).
Data storage periodes
- Advertising identifiers (IDFA / GAID) collected from our data partners: 13 months. Please note that this information is hashed and stored on encrypted servers;
- Identification data (title, first name, last name, telephone numbers, postal code, city, vehicle registration number): 24 months from the last interaction between the user and the Enseigne customer. Please note that this data is ingested encrypted, so it is not stored unencrypted in the Smart Traffik database;
- Transaction data (e-commerce amount): 24 months from the last interaction between the user and the Enseigne customer;
- Connection data (Smart Traffik cookie and session cookie): 13 months from the last interaction between the user and the Enseigne customer;
- Fingerprint data: 13 months from the last interaction between the user and the Enseigne customer. Please note that most of this information is ingested encrypted;
- Location data (IP location, hashed IP address + salt, HTML5): 13 months from the last interaction between the user and the Enseigne customer;
- Google Analytics data (if applicable): 24 months from the last interaction between the user and the Ensigne customer (this data is not personal data, but rather campaign configuration data);
- The anonymized MAC address is kept for 24 months from the last interaction between the user and the Sign customer.
How to exercise your rights
As oKube is a processing operation that relies on several subcontractors to which users are not systematically exposed and which have different practical procedures for exercising their rights, especially with regard to opposition, these measures are detailed for greater clarity within each subcontractor, so please refer to the previous section “oKube’s data sources and measures to protect your data“.
Note that regardless of the source of oKube data, you have the right to exercise the following rights:
- Right of access: the right to request information about the processing we carry out and a copy of your processed data.
- Right of rectification: you have the right to rectify, correct and update your data at any time.
- Right of objection: you also have the right to object to the processing of your information through the right of objection.
- Right to restrict processing: you may also ask us to restrict processing operations to the storage of your data under certain conditions, under the right to restrict processing.
- Right to erasure: You may ask us to erase your data in certain cases.
- Right to portability: you have the right to request the recovery of your data or its transfer to another provider.
We remind you that the vast majority of the data collected by Smart Traffik is ingested in an encrypted manner or protected by other means. We will therefore be obliged to ask you for clear data in order to be able to retrieve clear data and proceed with your request.
The exercise of these rights is free of charge and can be done at any time, subject to proof of identity, by writing to gdpr@smart-traffik.io.
Your data and transfers outside the EU/EEA
Smart Traffik does not at any time transfer data outside the EU/EEA area in the context of its current oKube solution. However, the service providers, partners and any subcontractors we use may transfer data outside the EU/EEA. Where this is the case, we ensure that such transfers are made on the basis of appropriate safeguards to ensure the security of your data.
How do we ensure the security of your data?
In addition to the pseudonymisation and anonymisation measures detailed above, and in order to ensure and guarantee the security of your data, we have put in place all the technical and organisational measures at our disposal to prevent your data from being unintentionally and accidentally lost, used, altered, or made available to the public without your authorisation. The data collected by Smart Traffik is stored on servers that protect it by encryption.
Should an event of this nature occur, we have implemented measures to react promptly and to inform you and the CNIL when necessary.
When data is shared with partners such as FirstID, all the security and confidentiality guarantees described in the present policy are also applicable to them. Exchanges are protected by secure protocols, and partners undertake to use only pseudonymized data, in compliance with industry standards.
Data ownership
The data collected and processed via our software solutions remain at all times the exclusive property of our customers, the co-processors, and Smart Traffik acting as co-processor for its customers, and acting in accordance with the contractual terms and conditions set out in the defined co-processing agreements.
With the consent of our clients, we reserve the right to publish aggregate data about all sites using Smart Traffik solutions. This aggregated data is used for the promotion of our solutions but does not contain any personal data or commercial information.
Data of minors
We do not knowingly collect or request information from minors (date of birth or age of users is not collected. It is not possible to determine age). If we discover that we have collected personal data from a minor, we will delete it as soon as possible.
Contact us
If you have any questions or complaints about the protection of your personal data, you can contact us at the following address
- Paris
41-43 rue Paul Bert – 92100 Boulogne-Billancourt
Tel : +33 (0)1 46 55 55 24
- Lyon
6 cours André Philip – 69100 Villeurbanne
Tel : +33 (0)1 45 32 32 71
You can also contact Smart Traffik’s Data Protection Officer (DPO) at the following address:
Smart Traffik
6 cours André Philip – 69100 Villeurbanne
Phone: +33 (0)1 45 32 32 71
