Privacy

Privacy Policy

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the French Data Protection Act (Loi Informatique et Libertés) is:

Tyrolium
SIRET : 91027536100012
252 Avenue Jean Jaurès - 69150 Décines-Charpieu, France
Contact: juridique@tyrolium.fr

Tyrolium has not designated a Data Protection Officer (DPO), as this is not required for a structure of its size and the nature of the data processed. All data protection requests are handled directly by juridique@tyrolium.fr.

2. Data collected & purposes

User accounts (Useritium)

When creating an account on Useritium (our single sign-on system), we collect: email address, username, encrypted password, account creation date and last connection date. This data is used to manage authentication and provide access to Tyrolium services.

Purchases & subscriptions

For purchases and subscriptions, we collect: email address, billing details (name, address), purchase history and invoices. Payment depends on the type of purchase:
- Services (websites, training, server setup, support): paid by bank transfer. Tyrolium only receives the payer's details that appear on the transfer.
- Online stores (goodies, in-game items, online subscriptions): paid by card through our payment provider Stripe, which processes card data exclusively.
Tyrolium never stores any payment card information.

Hosting data - SolidServ

SolidServ stores the data and files uploaded by clients to their servers (game servers, VPS, dedicated servers). This data remains the exclusive property of the client. Tyrolium acts as a data processor on behalf of the client for this data.

CRM data - NexiumiaCRM

Data entered by the client into NexiumiaCRM (contacts, interactions, notes, etc.) is processed by Tyrolium strictly in the context of providing the service. This data belongs to the client. Tyrolium acts as a data processor.

Contact forms

When you use our contact form, we collect: your name, email address and the content of your message. This data is used solely to respond to your request and is not used for any commercial prospecting.

Site browsing

Tyrolium does not use any web analytics tool (Google Analytics, Matomo, etc.). No browsing data is collected or shared with third parties for advertising or statistical purposes.

3. Legal basis & retention periods

All personal data processed by Tyrolium is based on the performance of a contract (Article 6.1.b GDPR): data is collected and processed because it is necessary for the provision of the requested service.

Contact form data is processed on the basis of legitimate interest (Article 6.1.f GDPR): responding to a request submitted by the user.

Retention periods

• User accounts: duration of the account, then 3 years after deletion (legitimate interest for potential disputes)
• Invoices & purchase history: 10 years from the date of issue (French Commercial Code, Article L123-22)
• SolidServ / NexiumiaCRM hosted data: duration of subscription, then 30 days before permanent deletion
• Contact form data: 3 years after last contact
• Server logs: 12 months (Legal obligation - LCEN Article 6)

4. Sub-processors & recipients

Tyrolium uses only one external sub-processor, for payments made on its online stores:

Stripe is certified PCI-DSS and GDPR-compliant. Tyrolium never has direct access to your payment card details. For more information on how Stripe handles your data, please consult their privacy policy at stripe.com/privacy. Service payments by bank transfer go through the payer's bank and ours, which act as independent data controllers under banking regulations; they are not sub-processors of Tyrolium.

Infrastructure hosting is provided by SolidServ, Tyrolium's own subsidiary. All servers are located in France. No other third party has access to personal data processed by Tyrolium.

5. International transfers

Tyrolium does not transfer personal data outside the European Union. All data is hosted on servers located in France (SolidServ). Our only external sub-processor, Stripe Payments Europe Ltd., is established in Ireland and therefore subject to the GDPR, with no transfer outside the EU for data collected by Tyrolium.

Binding commitment: Tyrolium will never sell or rent your personal data, and hosts the data it collects exclusively in France (payment data processed by Stripe in the EU excepted). These commitments are also written into our General Terms of Sale and are contractually binding.

6. Data security

Tyrolium implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or unauthorised access, in accordance with Article 32 of the GDPR. These measures include in particular:

• Encryption of passwords (hashing with bcrypt or equivalent)
• HTTPS encryption for all data in transit
• Restricted access to data on a need-to-know basis
• Daily automatic backups retained for 7 days (SolidServ)
• Servers located in secure data centres in France

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, Tyrolium undertakes to notify the CNIL within 72 hours in accordance with Article 33 of the GDPR, and to inform affected individuals without undue delay if the breach presents a high risk to them.

7. Cookies

Tyrolium uses only strictly necessary cookies, i.e. those essential for the operation of the services. No advertising, tracking or third-party analytics cookies are deposited on your device. In accordance with Article 82 of the French Data Protection Act and the guidelines of the CNIL, strictly necessary cookies do not require prior consent.

8. Your rights

In accordance with the GDPR (Articles 15 to 22) and the French Data Protection Act, you have the following rights over your personal data:

• Right of access (Art. 15): obtain a copy of the personal data we hold about you
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data, subject to legal retention obligations
• Right to restriction (Art. 18): limit the processing of your data in certain situations
• Right to portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to lodge a complaint (Art. 77): lodge a complaint with the CNIL if you consider that your rights have not been respected

To exercise any of these rights, send your request to juridique@tyrolium.fr. We undertake to respond within one month of receipt of the request (Article 12 GDPR). In the event of a complex or high-volume request, this period may be extended by two additional months, of which you will be informed.

9. Contact & CNIL

For any question relating to this privacy policy or to exercise your rights, contact us at: juridique@tyrolium.fr

If you consider, after contacting us, that your rights have not been respected, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés), the French supervisory authority:

CNIL
3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07
Website: cnil.fr
Online complaint: cnil.fr/fr/plaintes

© 2017-2026 Tyrolium. All rights reserved.