Skip to main content
Click & Collect is temporarily unavailable

Privacy policy

Last updated: 25 October 2026

This page explains what data we collect on pausenuage.fr, why, how long we keep it and how to exercise your rights.

1. Who is responsible for your data?

PAUSE NUAGE, Société par actions simplifiée (SAS) with a share capital of €5 000,00, RCS 102 918 158 R.C.S. Créteil, registered office 16 rue Danielle Mitterrand, 94380 Bonneuil-sur-Marne, which runs the café Pause Nuage, 99 rue Monge, 75005 Paris.

Contact for any question about your data: pause-nuage@outlook.fr, or by post at the café’s address. The café managers handle questions about personal data.

2. What data, and why?

Data
Verified email, technical identifier and role. No name, telephone number or postal address is requested. Passwords are managed by Amazon Cognito.
Purpose
Sign-in, your order history for the last 30 days, and transactional order and refund emails
Legal basis
Performance of the requested service (Art. 6.1.b)
Retention period
Account: until deletion is requested from the café. Orders: 30 days after pickup, then expiry. Physical TTL deletion may occur later.
Data
On our site: language, products, options, quantities, prices, pickup slot, order status and history, technical references of the SumUp payment, without name or email. These references make it possible to find the payment in our SumUp account: the order is therefore pseudonymised data, not anonymous
Purpose
The same. We send you no email: you follow the order from the page shown after payment
Legal basis
Performance of the contract (Art. 6(1)(b))
Retention period
Order: 30 days after the pickup date, then automatic deletion. Payment data: kept by SumUp, under its policy
Data
Account email, message type, content and date
Purpose
Receive your feedback and answer questions; only café administrators can read these messages
Legal basis
Legitimate interest in answering you and improving the café (Art. 6.1.f)
Retention period
90 days after submission, then expiry and automatic TTL deletion, or sooner if the café purges the messages.
Data
Data of the orders above
Purpose
Monitor activity over the last 30 days. Results are aggregates without individual profiles.
Legal basis
Legitimate interest in running the café (Art. 6(1)(f))
Retention period
Same as the orders
Data
Payments and refunds recorded by SumUp: date, amount, order reference, details of the items paid
Purpose
Keep the accounts and answer audits
Legal basis
Legal obligation (Art. 6(1)(c); French Commercial Code L123-22)
Retention period
On our site: like the order (30 days after the pickup date). At SumUp: according to its policy. Accounting data is kept for 10 years by the café’s accountant using Pennylane.
Data
Your card details are typed on SumUp’s payment page: we neither see nor keep them. We send SumUp the amount and reference of the order, with a description giving the pickup time; no name and no email. SumUp sends us the result of the payment
Purpose
Secure payment, refunds
Legal basis
Performance of the contract (Art. 6(1)(b))
Retention period
With us: same as the order. At SumUp: under its policy
Data
Email address, name, message content, order reference if any
Purpose
Answer your question or complaint
Legal basis
Legitimate interest in answering you (Art. 6(1)(f))
Retention period
3 years after the last exchange. Requests to exercise your rights: 5 years (proof of our answer)
Data
IP address, date and time, address of the page or service requested, response code
Purpose
Site security, prevention of abuse and fraud, troubleshooting
Legal basis
Legitimate interest in securing the service (Art. 6(1)(f))
Retention period
90 days, then automatic deletion
Data
Your browser connects to OpenStreetMap, which receives your IP address
Purpose
Show the map of the neighbourhood
Legal basis
Your request (click on “Show the interactive map”)
Retention period
We receive no data. OpenStreetMap applies its own policy
Data
Email, role, technical identifier, order status change author and date, and sign-in logs
Purpose
Secure access to the café’s management, traceability
Legal basis
Legitimate interest (Art. 6(1)(f))
Retention period
While in office. Order history: 30 days; logs: 90 days

Passwords are managed by Amazon Cognito and cannot be accessed by the café team. Database backups are retained for up to 35 days. Physical TTL deletion may happen after expiry; expired orders are hidden by the site.

Accounts are optional. Guest orders request no name or email and receive no email. For account orders, Amazon SES sends confirmations and refund notifications to your verified email. We send no newsletter or marketing emails and do not sell or rent your data.

3. Who receives your data?

  • The Pause Nuage team (owners and authorised staff), to prepare and hand over the orders.
  • Our technical providers, who act only on our instructions and under contract (Art. 28 GDPR):
    • aoni studio: design, operation and maintenance of the site;
    • Amazon Web Services EMEA SARL (Luxembourg): hosting of the site and the database, the managers’ accounts (Amazon Cognito), account management emails (Amazon SES);
    • Microsoft (Outlook mailbox): receipt of the emails you send us.
  • SUMUP LIMITED (an Irish company, company no. 505893, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, D02 A9N9, Ireland, electronic money institution authorised by the Central Bank of Ireland under reference C195030, French SIREN 852 307 487), our payment provider. SumUp processes the payment on our behalf and also acts as a controller for its own obligations (fight against fraud and money laundering).
  • OpenStreetMap Foundation (United Kingdom), only if you display the interactive map.
  • The competent authorities, on legal request.

4. Where is your data stored?

Your data is stored in the European Union, in the Europe (Paris) region of Amazon Web Services. Public pages and menu photos are cached by the AWS content delivery network (CloudFront), worldwide, so they display faster. Pages and responses that contain personal data are not cached. The firewall of this network is operated by AWS from the United States: it may briefly process parts of requests there (IP address, headers).

Amazon Web Services and Microsoft belong to US groups. Their possible access from outside the European Union is governed by the European Commission’s standard contractual clauses and, where applicable, by the Data Privacy Framework (EU-US). The United Kingdom (OpenStreetMap) benefits from an adequacy decision of the European Commission.

SumUp Limited is established in Ireland; any transfer of data outside the European Union by SumUp is described in its privacy policy.

5. Security

The site is served over HTTPS. Data is encrypted at rest and in transit. An application firewall filters attacks and limits the number of sign-in and order attempts. Access to the data is limited to authorised people, and the administration area is protected by a password. An order without an account only opens with the personal tracking link shown after payment: it contains a key signed by our server, do not share it. The database is backed up continuously. In the event of a data breach that puts you at risk, we will inform you as provided by the GDPR (Art. 33 and 34).

6. Cookies and local storage

The site uses no advertising, social network or audience measurement cookies. It sets no cookie: only strictly necessary items are kept in your browser’s storage (cart, order in progress and, for managers, the sign-in to the management area). They do not require your consent. The details are on the Cookies and trackers page.

7. Your rights

You have the following rights over your data:

  • access: know what data we hold and get a copy;
  • rectification: correct inaccurate data;
  • erasure: ask for your data to be deleted;
  • restriction: temporarily freeze the use of your data;
  • objection: object to processing based on our legitimate interest;
  • portability: receive the data you gave us in a common format;
  • post-mortem instructions: decide what happens to your data after your death.

We know neither your name nor your email, so there is no self-service area. Write to us with your order number (#XXXXXXXX, on the tracking page), its date and amount, and the last four digits of the card used: we find the order through our SumUp account. Payment data remains kept by SumUp for its own legal obligations.

For any other request, write to pause-nuage@outlook.fr or to the café, stating your request. We answer within one month. We may ask you for proof of identity in case of reasonable doubt about your identity.

If, after contacting us, you consider that your rights are not respected, you can lodge a complaint with the CNIL (French data protection authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

8. Changes

We may update this policy, for example when we change provider. The date of the last update is shown at the top of the page.