YOUR DATA, YOUR CHOICES
Understand the information used for your exchanges and how to exercise your rights.
Updated on · Troc-echange.com
Your surname, first name and registration email are not automatically displayed in listings or messages.
Optional newsletters, adjustable message notifications and cookie preferences are separate choices.
Access, correction, erasure: contact CODIWEB with a request about your data.
This policy provides information. Reading it or accepting the terms does not constitute consent to the newsletter or optional trackers.
CODIWEB, the operator of Troc-echange.com, determines the purposes and means of the processing described in this policy. In that capacity, the company is the data controller.
You may also write to us at this postal address, marked “Personal data”. Information about the operator and hosting provider is in the legal notice.
When you use the site, connection information may be recorded: IP address, connection date, device type, operating system, browser and technical session identifiers. Device information comes in particular from details sent by your browser.
IPinfo may supplement the IP address with an estimated country, associated organisation or network and hostname. This is information about the connection: it does not prove your identity or home address. This check does not use your device's GPS location.
We may also receive information about you from another member, for example in a conversation or report. Do not send sensitive data, identity documents, banking details or information about third parties unless necessary for your request.
Managing accounts, authentication, listings, favourites and messaging; sending activation and account recovery emails and message notifications according to your setting.
Legal basis: performance of the contract for use of the service.
Limiting abusive attempts, detecting spam, reviewing reports, moderating content and handling support requests.
Legal basis: CODIWEB's legitimate interest in maintaining a safe and usable service, taking your rights into account.
Handling requests to exercise rights and responding to valid requests from authorities, within the limits of applicable legislation.
Legal basis: legal obligation, particularly under the GDPR for the exercise of rights.
Sending site news if you choose to subscribe. You can unsubscribe using the link in emails or by contacting the team.
Legal basis: your consent, which can be withdrawn at any time.
Using analytics tools and, depending on the services enabled, advertising or advertising measurement tools. Trackers that are not exempt require prior consent.
Legal basis: consent for optional trackers; any audience measurement exemption depends on specific conditions.
New message notifications are enabled by default. “Notify me by email” in “My messages” lets you disable them. This does not stop essential account activation or recovery messages or change your newsletter subscription.
Your username, listings, their location and published photos can be viewed by visitors and indexed by search engines. Your approved profile photo may accompany your posts. If you add a phone number to a listing, visitors can reveal it using the relevant button.
The surname, first name and email provided at registration are not automatically displayed. However, information you write in a listing or leave visible in a photo becomes visible with that content. Avoid publishing your exact address or unnecessary contact details.
A conversation is accessible to its participants. They see the other person's username and available profile photo. The email notification invites them to read the new message on the site; it does not reproduce its full text.
Authorised administrators may view exchanges when necessary for support, security, moderation or a legal obligation. Messaging is not end-to-end encrypted. The other person can still copy anything you send them.
In addition to the people mentioned above, technical providers help operate the site. The data concerned depends on their role:
City suggestions use Google Maps.
Our server sends the city text, country and language to Google to suggest places. Selecting a place triggers a check of its coordinates and country. This feature does not send member names, emails or your device’s GPS position. Google suggestions display the Google Maps logo. After selection, the site uses its own directory of localities for listings and distances; Google responses are not stored in this database. Place identifiers can only be reused for selection for ten minutes; they are removed on the next search after expiry or with the session.
Information may also be disclosed to competent authorities on a legal basis, or to authorised advisers where a dispute warrants it. Such disclosure must be limited to what is necessary.
Using service providers may involve processing outside the European Economic Area. IPinfo states that its services are hosted in the United States. Crisp reports its main infrastructure in the Netherlands; that does not mean all its providers operate only in Europe. Google services may also involve international transfers.
Transfers subject to the GDPR must rely on a valid mechanism: an adequacy decision applicable to the recipient or appropriate safeguards, such as standard contractual clauses with additional measures where necessary. Merely using a service does not demonstrate that these conditions are met.
To find out which countries and safeguards apply to processing concerning you, or to request a copy of safeguards that can be disclosed, contact CODIWEB. Contact details also appear at the top of this page.
Retention must be proportionate to the processing purpose. In assessing it, CODIWEB considers account use, listing availability, follow-up of exchanges or reports, and the existence of a legal obligation or dispute.
Specific retention periods for inactive accounts, messages and connection logs have not yet been set. No automatic deletion at a specified deadline is announced for this data. You can already request erasure; your request must be assessed under the conditions below.
A link expiring does not mean all associated records are immediately deleted. Likewise, disabling an account or removing a listing from display does not by itself erase data from the database or backups.
Information necessary for an obligation or the defence of a right may be retained for a limited, justified period with restricted access. Erasure requests therefore do not always allow immediate, complete deletion; any limitation must be explained to you.
Depending on the processing and legal conditions, you may request access to your data, correction, erasure, restriction of use and portability. You may object to processing based on legitimate interests for reasons relating to your situation; objection to direct marketing is possible at any time.
Consent can be withdrawn without affecting lawful processing carried out beforehand. You may also give instructions for your data after your death, under the conditions provided by French law.
Provide your username or account email, the request you wish to make and a way to reply. Never share your password.
A response must be provided within one month of receipt of the request. If complexity or the number of requests warrants it, this period may be extended by two months; you must then be informed of the reasons within the first month.
Further information to verify identity should only be requested where there is reasonable doubt. An identity document copy is not always necessary. Exercising rights is generally free, subject to statutory exceptions for manifestly unfounded or excessive requests.
You may lodge a complaint with the CNIL, particularly if you believe your rights are not being respected, and use the remedies provided by law.
The site uses access controls, hashed password storage and rate limits for certain actions. These measures reduce risk without guaranteeing absolute security. Notify the team if you suspect fraudulent access to your account.
Automatic rules may refuse an action or connection based on attempt frequency, estimated country or a network associated with abuse. This information may be inaccurate, particularly with a VPN or shared connection. You may request a review by the team and submit your comments through the Contact page.
This policy covers the listing service, accounts, messaging and support described here. It does not replace information specific to another service or an external site you access through a link.
The service is for adults only, in accordance with the terms of use. If an account appears to belong to a minor, you can report it to the team.
This page must evolve with the site's practices, particularly once retention periods are determined. Significant changes must be brought to your attention and, where fresh consent is necessary, be subject to a separate choice.