PERSONAL DATA MANAGEMENT POLICY
This Data Management Policy applies to Mytraffic. It describes how Mytraffic collects, uses, shares and secures personal data. It also describes your options, as a user of mobile applications, regarding the use, access and correction of your data.
Version 2.0 – 19/10/2026
1. PREAMBLE
Mytraffic is a company specialising in the production of marketing studies, in the form of statistical data, footfall analyses and catchment-area potential, for players in real estate, retail and the public sector, in particular cities. Note that the entirety of Mytraffic's activity targets a professional clientele.
Example of statistical data produced:
- Average number of visitors passing each day in front of 48 rue de Béthune in Lille,
- % of visitors to the Pigalle district coming from the Nation district in Paris.
- Change in the monthly number of visitors in the Condé-sur-Sarthe retail activity zone.
- Heat map of pedestrian footfall in the Amiens city centre.
- Averaged socio-demographic profile (based on INSEE data) of footfall in the Bordeaux Saint-André district.
This data is aggregated data, i.e. several data of the same type brought together in order to produce so-called aggregated data that retains the desired information but makes it impossible to identify the share of aggregated information corresponding to a given individual. None of it makes it possible, directly or by cross-referencing, to identify and, a fortiori, to target an individual user.
This Policy reflects a commitment to transparency and fairness towards our customers and the users of our solutions (the “Users”), and to compliance with data protection regulations.
Below you will find all the information relating to the collection, processing and protection of the rights and the Data of the User.
Personal data means any information relating to an identified or identifiable natural person.
In the course of its activities, Mytraffic uses two types of data of a personal nature:
- Certain data produced by Mytraffic for its customers, post-processing statistical data, is derived from the processing of so-called “raw” data (geolocation tracks) of a personal nature within the meaning of the GDPR (definitions below),
- In the context of the use of its solutions (software or studies), Mytraffic may collect and process the personal data of its users, in order to manage its commercial relationship with them and ensure the proper functioning of its Products & Services.
2. DEFINITIONS
Smartphone geolocation data, vehicle-flow data or Raw data : Smartphone or vehicle geolocation data (point tracks). This data may be of a personal nature under the GDPR. It is treated as such by Mytraffic.
Post-processing statistical data (or enriched / qualified data): Statistical data, derived from the processing of raw data, in order to analyse footfall in a zone or in front of a commercial address, so as to display information such as
“2,520 people passed in front of 32 rue de Clichy, in Paris, on 15 June 2018”. This data is anonymous by nature.
3. CONTROLLER OF PERSONAL DATA PROCESSING
The company Mytraffic, registered with the Paris Trade and Companies Register under number 814 849 113, acts as controller of personal data.
4. CATEGORIES OF DATA USED BY MYTRAFFIC
In the context of its various solutions and services, MYTRAFFIC offers statistical analyses to players in retail real estate, in order to support them in their expansion or in the management of their points of sale.
The added value of our service lies in the production and analysis of statistical data, from several data sources.
4.1 Smartphone geolocation data
In order to analyse the flows of passers-by in a geographical area, Mytraffic acquires from data partners and/or via its own SDK (Software Development Kit), then uses, smartphone geolocation data (called “raw data”), at European scale.
The raw data includes the following elements:
- Advertising identifier of the mobile device (IDFA for iOS and GAID for Android)
- Geolocation data (latitude / longitude) / Date
- Operating system
- App ID
- Setting - Geolocation in background / foreground
- Setting - Approximate geolocation
Even though Mytraffic has no other information that would allow identification of the smartphone holder (name, email, telephone, address, etc.), this data is considered, within the meaning of the GDPR, as potentially personal data, and will therefore be treated as such by Mytraffic.
Mytraffic thus ensures that the Data partner, and/or Mytraffic's SDK, has collected the raw data with the consent of the smartphone user, for the purposes “Marketing and Commercial Studies” and “Store and/or access information on a device” described below.
The user may at any time disable the geolocation function of their mobile device, in the system settings (see below)
Geolocation data is used with an advertising identifier.
The advertising identifier is the identifier of a mobile device. It can be reset, at any time, by the user, as follows:
- iOS: go to “Settings”, then “Privacy”, then “Advertising”, then “Reset advertising identifier”.
- Android: go to “Settings” then “Google”, then “Ads”.
The data partners from whom Mytraffic may collect geolocation data are registered with the IAB, whose list of members is available at this link. For more information on the list of our partners, write to us at contact@mytraffic.fr.
4.2 Vehicle-flow data
Mytraffic uses vehicle-flow data. This data is statistical data that is, by nature, non-identifying and does not fall within the scope of the GDPR.
4.3 Data on our prospects / customers and on the visitors to our Mytraffic.io website
Mytraffic operates with professionals in the retail industry. In order to carry out its commercial prospecting, manage the relationship with its customers and allow its customers to access its software, Mytraffic is led to use contact data on its Prospects and Customers (with surname / first name / position / company / email address / mobile phone / postal address).
4.4 Public data
To carry out its analyses, Mytraffic uses various public data sources, in particular INSEE, BODACC, Commercial Court Registries, Open Data (transport, cinema admissions, administrative locations, etc.) or the retailers' websites (with, for example, the addresses of their points of sale). This data is, by nature, statistical data, most often public.
4.5 Data entrusted to us by our customers
In certain cases, our customers entrust us, for the proper performance of their contracts, with some of their data on the commercial activity of their points of sale. This data is transmitted in accordance with the GDPR, and it is processed by MYTRAFFIC only within the limits of the performance of the contract, to produce statistical analyses, without any attempt to identify natural persons, and for the sole benefit of the customer. MYTRAFFIC undertakes to delete all this data as soon as the contractual relationship with the customer ends.
5. PURPOSES OF PERSONAL DATA PROCESSING
We process your personal data in compliance with the General Data Protection Regulation 2016/679 of 27 April 2016 (“GDPR”) and under the conditions set out below.
5.1 Smartphone and vehicle-flow geolocation data
Mytraffic uses and processes raw geolocation data in order to convert it into statistical data and marketing studies, offered to players in real estate and retail, such as retailers, independent shops or public players such as cities.
Mytraffic undertakes to use only raw data for which users have given their consent to the purpose carried out. Neither our SDKs nor our Data partners collect geolocation for applications targeting minors.
Example of statistical data produced:
- Average number of visitors passing each day in front of 48 rue de Béthune in Lille,
- % of visitors to the Pigalle district coming from the Nation district in Paris.
- Change in the monthly number of visitors in the Condé-sur-Sarthe retail activity zone.
- Heat map of pedestrian footfall in the Amiens city centre.
- Averaged socio-demographic profile (based on INSEE data) of footfall in the Bordeaux Saint-André district.
This data is aggregated data. None of it makes it possible, directly or by cross-referencing, to identify or, a fortiori, to target an individual user.
5.2 Data on our prospects / customers and on the visitors to our Mytraffic.io website
Mytraffic processes User Data to manage the commercial relationship with its (professional) prospects and customers, to ensure the proper functioning and improvement of the Solution and to ensure the proper performance of the services under the conditions set out in the General Terms and Conditions of Sale and Use.
Thus, User Data is stored and processed mainly to:
- Manage and ensure the proper access and navigation of visitors on the Mytraffic website,
- Send a newsletter to customers who have signed up for this service on the site,
- Manage Mytraffic's commercial interactions with its prospects and customers,
- Manage the registration, access and performance of the Mytraffic SaaS platform,
- Ensure online payment (via our provider Stripe) for access to certain products,
- Manage the preferences and searches made by the User on the platform.
6. LEGAL BASIS FOR PERSONAL DATA PROCESSING
6.1 Smartphone geolocation data
Mytraffic acquires, from its Data partners, only geolocation data that has obtained users' consent for the purposes“Marketing and Commercial Studies”, and “Store and/or access information on a device” The user's consent is stored in the Consent Management Platform of the partner and/or publisher carrying out the collection.
Each user may withdraw their consent at any time, in accordance with the procedures indicated by the publisher of the application used or in Mytraffic's cookie manager, in which case their personal data will no longer be collected.
6.2 Data on our prospects / customers and on the visitors to our Mytraffic.io website
Like most websites, Mytraffic and its partners use cookies or similar technologies in order to analyse trends, manage cookies or similar technologies to track the use and performance of its site. This information may include the IP address (Internet Protocol), the browser type, the Internet service provider (ISP), the referring/exit pages, the pages viewed on our site (HTML pages, graphics, etc.), the OS, the date (time stamp), and/or the path (clickstream) to observe / measure site usage and help us improve it.
Depending on the CNIL's recommendations, these cookies may or may not be exempt from consent.
For cookies exempt from consent:
You can control the use of cookies through your browser, but if you disable certain cookies, this may affect or limit access to certain features of our site.
For cookies subject to consent:
The user's consent is stored in Mytraffic's cookie manager.
Each user may withdraw their consent at any time by accessing the cookie manager.
On the website
In managing visitors to its website, Mytraffic uses the following types of cookies:
For all these cookies, as soon as they access the website, the user is offered the option to refuse to store these cookies on their device. The user may then, at any time, by going to the cookie manager, configure their browser software to object in part or in full to the storage of cookies on their device.
The MonLocalCommercial.fr website, published by Mytraffic, is subject to a specific data management policy, accessible at the link: https://www.monlocalcommercial.fr/rgpd/.
On the SaaS platform
In order to offer the best service to users of its SaaS platform, Mytraffic uses the following types of cookies:
The Crisp chatbot cookie is used to respond to platform users' requests, i.e. after their consent (and the sending of their email in order to be able to respond to their request).
The Amplitude software analyses the behaviour (pages visited, clicks, time spent) of visitors (Mytraffic customers) on the SaaS platform (anonymising their data).
The Hotjar software also analyses the behaviour (mouse movement) of visitors (Mytraffic customers) on the SaaS platform (anonymising their data).
On the website and the platform, in any event, the cookies placed on your browsing device are destroyed 13 months after they are placed on your device.
We decline all responsibility for the consequences linked to the degraded functioning of our services resulting from the impossibility of recording or reading the cookies necessary for their functioning that you have refused or deleted.
For more information on cookies, you can consult the CNIL's website:
https://www.cnil.fr/fr/site-web-cookies-et-autres-traceurs
7. DATA RECIPIENTS
7.1 Smartphone and vehicle-flow geolocation data
Smartphone geolocation data, known as “raw” data, is strictly reserved for internal use by Mytraffic.
This raw data is then processed and converted into post-processing statistical data, which no longer has a personal nature. This is offered to Mytraffic's (B2B) customers, players in real estate and retail, in the form of software and/or bespoke Marketing studies.
7.2 Data on our prospects / customers and on the visitors to our Mytraffic.io website
Mytraffic processes all of this Data on its own behalf and confidentially. In the context of the Data processing carried out via the Mytraffic platform, Mytraffic may use technical service providers, in particular for hosting, security, maintenance or the provision of specific services. The User accepts that Data concerning them may be transmitted to these providers. Apart from these specific cases, we do not transmit it to unauthorised third parties.
Furthermore, when you accept the “Meta (Facebook/Instagram)” purpose in the cookie banner of the mytraffic.io website, MyTraffic shares certain data (online identifiers in hashed form such as the email address and the account identifier, browsing information including the IP address, and Meta cookie identifiers _fbp/_fbc) with Meta Platforms Ireland Ltd., for advertising measurement and optimisation purposes. This sharing takes place via the Meta Pixel and directly from MyTraffic's servers (Conversions API). For the collection and transmission of this data, MyTraffic and Meta act as joint controllers (Article 26 of the GDPR); Meta is an independent controller for its subsequent processing. The legal basis is consent (Article 6.1.a of the GDPR; Article 82 of the French Data Protection Act). The details of this processing are set out in the Cookie Management Policy.
8. DATA LOCATION
8.1 Smartphone and vehicle-flow geolocation data
The raw smartphone geolocation data is stored on Amazon Web Services servers located in the European Union, in Germany.
The post-processing statistical data is also hosted on Amazon Web Services servers, in Germany.
8.2 Data on our prospects / customers and on the visitors to our Mytraffic.io website
This data (contact details) is kept in the HubSpot CRM solution, which hosts its data with Google Cloud, on servers based in Frankfurt (European Union).
The provider of the Amplitude software processes the data collected (tracking the behaviour of Mytraffic SaaS users) on servers located in the United States.
The data collected via Google Analytics is hosted in the United States.
Apart from these specific cases, none of the Data processed and collected by Mytraffic is transferred to servers hosted in a third country located outside the European Union.
Where the user has consented, the data shared with Meta for advertising measurement (see the “Data recipients” section) is transferred to the United States. This transfer is framed by Meta's certification under the EU–U.S. Data Privacy Framework and, as a complementary safeguard, by the European Commission's standard contractual clauses. Meta retains this data for a period of up to 2 years.
9. RETENTION OF PERSONAL DATA
9.1 Smartphone and vehicle-flow geolocation data
Smartphone geolocation data (or raw data) and vehicle-flow data is kept by Mytraffic for a maximum period of 12 months, at the end of which this data is irreversibly overwritten.
The post-processing statistical data has no retention limit.
9.2 Data on our prospects / customers and on the visitors to our Mytraffic.io website
Mytraffic keeps this Data only for as long as necessary to achieve the purposes of the processing. Retention periods are calculated according to the purpose for which Mytraffic keeps the data, and in accordance with legal and contractual requirements.
10. USERS' RIGHTS OVER THEIR PERSONAL DATA
Within the limits set by data protection regulations, and in particular Articles 15 to 22 of the General Data Protection Regulation 2016/679, Users have rights over the Data concerning them. Thus, each User has, in particular, the right to request the withdrawal of their consent if they had previously consented, access to the Data concerning them, the rectification or erasure thereof, the right to obtain the restriction of the processing of the Data, the right to object to this processing, as well as the right to data portability. These rights may be exercised with our Data Protection Officer (“DPO”).
With regard to the data shared with Meta for advertising purposes (see the “Data recipients” and “Data location” sections), you may exercise your rights — including withdrawal of consent and erasure — both with MyTraffic and directly with Meta. When you send us such a request, MyTraffic stops any further sending to Meta and forwards your request to Meta. MyTraffic cannot, however, guarantee the immediate deletion of the copy held by Meta, which is retained for up to 2 years; where applicable, we invite you to also exercise your rights directly with Meta.
For smartphone geolocation data (raw), during the 12-month retention period, the user may exercise their rights directly with the mobile application publishers and/or with the Data partners (list available from our DPO).
Should the user wish, during this same period, to exercise their rights directly with Mytraffic, the user must provide Mytraffic with the advertising identifier (IDFA or GAID) of their smartphone, by retrieving it as follows:
- For iOS: download an application allowing you to retrieve the IDFA, which will give you access to your identifier by following the link below:
https://itunes.apple.com/us/app/the-identifiers/id564618183?mt=8;
- For Android: access your identifier in your phone settings, by clicking on the “Ads” section.
The user may withdraw their consent at any time, without this withdrawal affecting the lawfulness of the processing based on the consent carried out before the withdrawal.
Any request requires the requester's email address.
We will respond to any request within a reasonable time.
If you no longer wish to receive our newsletters, you can update your preferences by sending us an unsubscribe email.
11. SECURITY
Mytraffic undertakes to ensure the best level of security for the processing and storage of personal data.
We have established organisational and technical measures to manage risks and protect personal data.
In particular, we apply specific security rules to protect our systems: multi-factor authentication, encryption, restriction of access rights, logging, anti-virus software.
Mytraffic's premises are secured and employees are made aware of security measures and personal data protection rules (Data Management Charter & internal rules, etc.).
12. CONTACT AND COMPLAINTS
In order to exercise the rights set out above, or for any question concerning Mytraffic's management of personal data, you can contact us at the following address: Mytraffic, Lot 3 – 12, rue Vivienne 75002 Paris, or by email at:
Mytraffic has appointed as DPO Me Yaël COHEN-HADRIA (ERNST & YOUNG AVOCATS). For any more specific question relating to your Data, or for any complaint about the processing of this Data, the User may contact our DPO at the following address: yael.cohen.hadria@ey-avocats.com.
For any request concerning the United Kingdom, Mytraffic has appointed Mr Deepak Chadha as UK Data Protection Representative (email: uk-gdpr@mytraffic.co.uk)
In the absence of resolution of their request, the User may lodge a complaint with the CNIL: https://www.cnil.fr/fr/agir
or by post to the following address: Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy - TSA 80715, 75334 PARIS CEDEX 07 - France.
13. AMENDMENTS / UPDATES TO THIS DATA MANAGEMENT POLICY
We may update this Data Management Policy. In the event of a substantial change, we will indicate this by a note on our website. We advise you to consult this policy regularly in order to access our latest information and practices on this matter.
