This is a translation provided for convenience. Only the French version is legally binding.
Version in force as at 2 November 2026.
This policy explains what personal data is collected on the joomanji.eu website, why, how long it is kept, and how to exercise your rights.
1. Data controller
Cyrille Poussin, entrepreneur individuel (French sole trader) trading under the business name Joomanji, Metz, France, SIRET 522 564 053 00018.
Contact for any question relating to personal data:
Given the size of the business and the nature of the processing, no data protection officer has been appointed, such an appointment not being mandatory within the meaning of article 37 of the GDPR.
2. Data collected and purposes
2.1 Client account
Creating an account is necessary in order to place orders and to access downloads.
Data: surname, first name, email address, password (stored in one-way encrypted form), and where applicable company name and intra-Community VAT number.
Purpose: creation and management of the account, access to files and to update keys.
Legal basis: performance of the contract (article 6.1.b of the GDPR).
Retention: the lifetime of the account, then three years from the last contact. An inactive account is deleted after that period, after prior notice.
2.2 Orders and invoicing
Data: billing address, order details, amount, date, transaction identifier from the payment provider.
Purpose: processing the order, issuing invoices, compliance with accounting and tax obligations.
Legal basis: performance of the contract and legal obligation (articles 6.1.b and 6.1.c of the GDPR).
Retention: ten years from the closing of the financial year, in accordance with article L123-22 of the Code de commerce (French commercial code).
2.3 Payment
Payments are processed by Stripe and PayPal. Bank card data is entered directly on the secure interfaces of these providers and never passes through the website's servers. The publisher receives only the payment confirmation and a transaction identifier.
These providers act as independent data controllers as regards fraud prevention and their own regulatory obligations. Their respective policies are available on stripe.com and paypal.com.
2.4 Declared domains
Data: the domain names on which the extensions are installed, transmitted by the update key.
Purpose: to check the validity of the subscription and to serve updates, to measure the number of installations covered by the plan taken out.
Legal basis: performance of the contract.
Retention: the duration of the subscription, then three years.
No data relating to the content, the visitors or the database of the client's site is collected.
2.5 Technical support
Data: email address, content of the exchanges, technical information voluntarily provided by the client (Joomla version, PHP version, error logs).
Purpose: to handle the support request and to keep a record of it.
Legal basis: performance of the contract.
Retention: three years from the closing of the request.
It is recommended never to send administration credentials or passwords by email. Where temporary access is essential for diagnosis, it is requested explicitly and must be revoked by the client as soon as the work is finished.
2.6 Website forms
The website forms are protected against automated submissions by three means internal to the site: a trap field invisible to visitors, a minimum delay before sending, and Joomla's "Proof of work" CAPTCHA, computed by the visitor's browser. No outside service is called, no tracker is set and no data is transmitted to a third party.
Purpose: form security, spam prevention.
Legal basis: the publisher's legitimate interest in protecting the website (article 6.1.f of the GDPR).
2.7 Server logs
The host keeps connection logs (IP address, date, time, page requested, user agent) for security and technical diagnosis purposes, as well as to meet the retention obligations laid down by law. These logs are not used for commercial purposes.
2.8 Audience measurement
The website uses no audience measurement tool that sets trackers, neither Google Analytics nor any equivalent.
The publisher uses only Google Search Console, which analyses the website's presence in search results from aggregated and anonymous data provided by Google. This tool sets no tracker on visitors' devices and allows no individual identification.
2.9 Newsletter
The website offers a newsletter, sent only to people who have signed up for it. Signing up is done through a form on the site and only takes effect after a click on the confirmation link received by email (double opt-in).
Data: email address, chosen topics, language, sign-up date and confirmation date.
Purpose: sending the new articles of the chosen topics.
Legal basis: consent (article 6.1.a of the GDPR), proven by the confirmation date.
Retention: until unsubscription, which erases the address and the topics. Every email contains a one-click unsubscribe link.
The other emails sent to clients concern their orders, the expiry of their subscription, security updates and replies to their support requests. They fall within the performance of the contract.
3. Cookies and trackers
The website sets only cookies strictly necessary for its operation:
| Tracker | Origin | Purpose | Duration |
|---|---|---|---|
| Session cookie | Site | Maintaining the connection to the client account and the basket | Session |
| Anti-CSRF token | Site | Form security | Session |
These cookies are exempt from prior consent within the meaning of article 82 of the loi Informatique et Libertés (the French data protection act), as interpreted by the CNIL (the French data protection authority).
No advertising cookie, third party audience measurement cookie, social network cookie or profiling cookie is set. The website displays no advertising and carries out no sale of data.
The browser makes it possible at any time to block or delete cookies, it being specified that blocking session cookies prevents access to the client account.
4. Recipients of the data
The data is neither sold, nor rented, nor exchanged. It is accessible to the publisher and, strictly within the limits of their assignment, to:
- the website host, PlanetHoster,
- the payment providers, Stripe and PayPal,
- where applicable, the publisher's chartered accountant and the tax authorities.
5. Transfers outside the European Union
The website is hosted within the European Union. Some of the providers mentioned above may process data outside the European Union. These transfers are governed by the appropriate safeguards provided for in chapter V of the GDPR, in particular the standard contractual clauses adopted by the European Commission.
6. Security
The publisher implements measures appropriate to the nature of the data processed: encryption of exchanges by HTTPS, hashing of passwords, restricted and protected administrator access, regular updates of the platform, periodic backups.
In the event of a data breach likely to result in a high risk to the rights and freedoms of individuals, the persons concerned will be informed under the conditions of article 34 of the GDPR.
7. Your rights
Every person has the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give directions concerning the fate of their data after their death.
These rights are exercised by email to
Certain data cannot be erased before its legal deadline, in particular invoices, which are subject to a retention period of ten years.
If the reply is unsatisfactory, a complaint may be addressed to the Commission nationale de l'informatique et des libertés (the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or online at cnil.fr.
8. Minors
The website is aimed at professionals and at private individuals of full age. No account may be created by a person under fifteen years of age without the authorisation of the holder of parental authority.
9. Amendment
This policy may be amended to take account of technical or regulatory developments. The applicable version is the one published on the website on the date of consultation. Any substantial change is brought to the attention of clients by email.