Last updated: 23 October 2026.
This policy explains what personal data Konfian processes, why, with whom it is shared, how long it is kept and how to exercise your rights. It applies to the konfian.com site, the client area and the professional area.
Data controller: BALESS, a simplified joint-stock company (SAS) with share capital of €500, registered office at
91210 Draveil (France), registered with the Évry Trade and Companies Register under number 852 923 556, publisher of Konfian.
Contact regarding your data: contact@konfian.com — or by post to the registered office.
It supplements the legal notice, the General Terms of Use, the General Terms and Conditions of Services and the General Terms and Conditions of Subscription.
Konfian neither collects nor stores your card numbers or your IBAN. Payments, refunds and payouts to professionals are processed by our payment service provider Stripe: your banking details are entered in its interface and stored by it alone. Konfian keeps only the technical identifiers of transactions (Stripe customer and payment identifiers), which are needed for tracking, refunds and accounting.
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, authenticating you | Performance of the contract (CGU) |
| Processing your bookings, payments, refunds and payouts to professionals | Performance of the contract (CGS) |
| Passing on to the professional the information needed for the service | Performance of the contract (CGS) |
| Calculating and crediting cashback | Performance of the contract (CGS) |
| Sending messages relating to your bookings (confirmation, reminder the day before by e-mail and, where applicable, by SMS, modification, cancellation) | Performance of the contract |
| Collecting and publishing reviews; inviting you to leave one after the service | Performance of the contract and legal obligation (Article L. 111-7-2 of the French Consumer Code) |
| Managing professionals' subscriptions and invoicing | Performance of the contract (CGA) and accounting obligations |
| Supporting professionals: activation messages, reminders about an unfinished sign-up, professional newsletter | Legitimate interest (contractual or pre-contractual relationship) — you may object at any time |
| Sending you our newsletter | Consent (voluntary sign-up), which may be withdrawn at any time |
| Synchronising a professional's calendar with Google Calendar | Consent of the professional (voluntary activation) |
| Verifying that a business exists and that a VAT number is valid | Legitimate interest (trust in the marketplace) and tax obligation |
| Securing the site, preventing fraud and abuse (including protecting forms against bots) | Legitimate interest |
| Measuring site audience | Consent (cookie banner) |
| Complying with our accounting and tax obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interest |
Konfian does not sell, rent or transfer your data. No decision producing legal effects concerning you is taken solely on the basis of automated processing, and we do not carry out advertising profiling.
Some of the profile pages published on Konfian were compiled from public sources, without the professional concerned having signed up. They contain business data (trading name, activity, address of the establishment, public contact details) which, for a professional operating as a sole trader, are personal data.
Legal basis: Konfian's legitimate interest in offering a directory of professionals, and that of professionals in being able to claim their profile page.
Any professional may, at any time and without giving reasons: claim their profile page, have it corrected, or object to its publication and obtain its removal — via the “Remove this profile page” link on the profile page, or at contact@konfian.com. The request is handled within one month at most; removal is free of charge.
When you make a booking or send a request, the professional concerned receives the necessary information: your name, your contact details, the service, the date and, where applicable, the address where the service is performed. The professional becomes the controller of that data for their own business. Your review is published under the display name you have chosen.
| Service provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the site, the database and the sending of certain e-mails | France |
| Stripe (Stripe Payments Europe, Ltd.) | Payments, refunds, subscriptions, payouts to professionals | European Union (Ireland), possible transfers to the United States |
| Mailjet (Sinch Mailjet SAS, France) | Sending e-mails | European Union (Google Cloud hosting in Germany and Belgium); occasional access from the United States by its support sub-processors, governed by the standard contractual clauses and the Data Privacy Framework |
| Capitole Mobile (Capitole Mobile SAS, France) | Sending reminder and notification SMS messages | France (OVH hosting); delivery by the recipient's mobile operator |
| Google (Google Ireland Ltd.) | Audience measurement (Google Analytics) if you consent; protection of forms against bots (reCAPTCHA); Google Calendar synchronisation if the professional activates it | EU, transfers to the United States |
| Geolocation services: Base Adresse Nationale (French national address database, French State), Photon (komoot), OpenStreetMap / Nominatim, OpenRouteService | Suggesting and locating the addresses entered, calculating ride routes | France, Germany, United Kingdom (country recognised as adequate) |
| Annuaire des entreprises (French business directory, French State) and VIES (European Commission) | Verifying a business number and a VAT number | France, European Union |
| Content delivery networks (the site's libraries and style sheets, map tiles) | Technical display of pages; they receive your IP address | EU and United States |
Where data is transferred to the United States (Google, Stripe, certain delivery networks), these transfers are governed by the EU–US Data Privacy Framework for certified companies and, failing that, by the European Commission's standard contractual clauses. If you refuse audience measurement cookies, no browsing data is sent to Google Analytics.
Our advisers (chartered accountant, lawyer) in the course of their engagement; administrative or judicial authorities where the law so requires; any acquirer in the event of a sale of the business, subject to compliance with this policy.
The professional area allows a professional to keep their client file (contact details, notes, consent to receive their communications) and to send e-mails to their clients. For this data, the professional is the controller and Konfian acts as processor: we host and process it solely to provide this service to them, without using it for our own purposes.
If you appear in a professional's file, please contact them first to exercise your rights; we will assist them. Every e-mail sent by a professional to their clients includes an unsubscribe link.
Cookies that are strictly necessary for the site to function are set without consent.Audience measurement cookies are set only after you agree, via the banner displayed on your first visit, where refusing is as easy as accepting. You can change your mind at any time with the “Manage cookies” link in the footer.
| Name | Purpose | Duration | Consent |
|---|---|---|---|
ci_session | Session: login, basket, navigation | End of session | Not required |
csrf_cookie_name | Form security | 2 hours | Not required |
konfian_consent | Remembering your cookie choice | 6 months | Not required |
kfa_lang | Remembering the language chosen | 1 year | Not required |
stripe_banner_… | Professional area: no longer displaying a banner that has been closed | Session / short duration | Not required |
| Stripe cookies | Security and fraud prevention on payment pages | As set by Stripe | Not required |
_ga, _ga_… (Google Analytics) | Audience measurement | 13 months at most | Yes |
The site also uses your browser's local storage to keep your basket and, in the professional area, your calendar display preferences. This information stays on your device.
| Data | Duration |
|---|---|
| Client account | Lifetime of the account, then 3 years after your last login or booking: the account is then anonymised |
| Professional account | Lifetime of the account; closure on request (invoicing data is kept for 10 years) |
| Bookings, payments, invoices | 10 years (accounting obligations, Article L. 123-22 of the French Commercial Code) |
| Cashback balance and history | Lifetime of the account; unused credit expires on 1 January in accordance with the CGS |
| Published reviews | For as long as the professional's profile page is online, or until you request deletion |
| Messages with professionals | Lifetime of the account; when it is deleted, they are kept without your identity (they also belong to the professional) |
| Unfinished professional sign-up | 3 months after the last reminder |
| Requests, contact form, profile page claims | 3 years after the request; the IP address is erased after 1 year |
| Newsletter | Until you unsubscribe; the sign-up IP address is erased after 1 year |
| IP addresses recorded with forms, anti-abuse logs | 1 year |
| E-mail sending history | 3 years, after which the recipient's address is erased |
| Imported professional profile pages | Until claimed or until a removal request |
| Audience measurement cookies | 13 months at most; your cookie choice: 6 months |
At the end of these periods, data is deleted or anonymised. Some data may be kept for longer, with restricted access, where the law requires it or for the defence of a legal claim.
In accordance with Regulation (EU) 2016/679 (GDPR) and French Law No. 78-17 of 6 January 1978, as amended, you have the rights of access, rectification, erasure, restriction,objection (including, at any time and without giving reasons, to direct marketing), portability,withdrawal of your consent, and the right to set instructions on what happens to your data after your death.
We reply within one month, which may be extended by two months for a complex request (you would be informed). If there is reasonable doubt as to your identity, proof may be requested; it is not kept.
You may lodge a complaint with the supervisory authority: in France, the CNIL (French data protection authority) (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 —www.cnil.fr); in Belgium, the Data Protection Authority (Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be); or the authority of your country of residence in the European Union. We invite you to contact us first: we will do what is necessary.
Konfian implements appropriate technical and organisational measures: encryption of communications (HTTPS), hashed passwords, banking data entrusted to an authorised payment service provider, protected session cookies, access to attachments restricted to the participants in the conversation, control of administrative access, hosting in France and backups.
In the event of a data breach likely to result in a high risk to your rights and freedoms, you would be informed without undue delay (Article 34 GDPR), and the supervisory authority within 72 hours (Article 33).
Konfian's services are reserved for adults. We do not knowingly collect data about minors. If you notice that an account has been opened by a minor, please report it tocontact@konfian.com: it will be deleted.
This policy may change, in particular when a new service is introduced or a service provider changes. The applicable version is the one online, dated at the top of the page. Any significant change (new purpose, new recipient, longer retention period) will be notified to you by e-mail before it takes effect, and your consent will be requested again where it is the legal basis.
