DEVIALETPrivacy Policy

We pay the utmost attention to your personal data and take great care of it. Please read this Privacy Policy carefully to understand our practices regarding your information and how we process it. By using our Products and Services, or by providing information through them, you acknowledge that you have been informed of this Privacy Policy and accept it.

This Privacy Policy describes how Devialet, the data controller, its subsidiaries and branches (“Devialet”, “we”, “us”, “our”) collect, use, store and share information collected from users of its websites, mobile applications, products, retail outlets, as well as during online or offline interactions with its services (collectively referred to as “Products and Services”).

Our data protection approach is based on a few simple principles:

• use data only to better serve users of our Products and Services,
• collect only the data necessary for this purpose,
• ensure maximum protection for the data collected.

Our Privacy Policy may change over time (see below, “Changes to the Privacy Policy”). We therefore recommend that you check it regularly.

For convenience, our Privacy Policy is available in several languages. In case of any difference in interpretation, the French version shall prevail.

Who does this Privacy Policy apply to?

• all visitors to our websites,
• all visitors to our stores and points of sale,
• users of our mobile applications,
• customers and users of our products,
• participants in our events or demonstrations,
•  anyone interacting with our customer service, social networks, or partners.

What Information Do We Collect?

We may collect the following information about you (collectively, “Collected Information”):

Identification Information:

• name, surname,
• email address,
• postal address,
• phone number,
• country of residence,
• language of communication,
• age range.

Product Information:

• serial number,
• product name,
• model,
• software version,
• number and type of products owned,
• product registration date.

Usage Information:

• browsing data on the website or app,
• personalized settings,
• interactions with customer service,
• daily usage duration for each type of source or music service,
• volume level information,
• use of stereo mode.

Technical Information:

• IP address,
• device identifiers,
• browser type, operating system,
• internet service provider,
• device locale (e.g. fr-FR / en-US),
• last app login date,
• anonymous household IDs,
• local network performance data, only upon your explicit action or request (“send technical data / bug report”), 
• the technical log of the device’s internal status and actions performed.

Information from Third-Party Sources:

• data from business partners (distributors, payment platforms, etc.).

Social Media Data:

• if you interact with us via Facebook, Instagram, LinkedIn, Twitter or others, we receive the information you agree to share with us.

All Collected Information, its processing, purpose, legal basis and retention period are summarized in the Summary annexed to this Privacy Policy.

Why Do We Collect Information and On What Legal Grounds?

We collect and process Collected Information for the following purposes and only when we have a legal basis:

• creation and management of your user account – legal basis: performance of a contract or pre-contractual measures,
• product delivery and order processing – legal basis: performance of a contract or pre-contractual measures,
• customer service and technical support management – legal basis: performance of a contract or pre-contractual measures,
• marketing operations (newsletters and personalized offers) – legal basis: Devialet’s legitimate interests or your consent,
• improvement of our products and services – legal basis: Devialet’s legitimate interests,
• compliance with our legal, administrative, financial and accounting obligations – legal basis: legal or regulatory obligations,
• protection or defense of our interests – legal basis: Devialet’s legitimate interests,
• organization and follow-up of our events and demonstrations – legal basis: performance of a contract or pre-contractual measures.

For further details, please consult the Summary.

Specifics Regarding Account Creation

The initial setup and continued operation of our Products and Services require the creation of a Devialet account. This registration links your Products to your profile, activates connected features, enables software updates, synchronizes your settings, and provides personalized support if needed.

We only collect the data strictly necessary for these purposes, as listed in the Summary. Your data is retained as long as your account is active. You may exercise your rights of access, rectification, erasure, and objection at any time through the app settings or by writing to privacy@devialet.com.

Specifics Regarding Devialet Mobile Applications

Using our mobile apps may require:

• creating or signing in to a user account to activate products, apply updates, and synchronize settings,
• granting, with your consent, access to certain device features (Bluetooth, location, notifications) to enable specific interactions or services.

The list of data permissions we request, whether mandatory or optional, and their purposes will be presented clearly and intelligibly at the time of request. You can consent specifically to each permission when different purposes are pursued. We will inform you of any potential consequences if information is not provided. We are committed to minimizing data collection and selecting, among the permissions made available by your operating system, only those strictly necessary. You can change your permissions at any time in your device settings.

Cookies

Our website and applications may use cookies or similar technologies such as pixels, tags, or anonymous mobile tracking identifiers (“Cookies”) for operational, analytics, and personalization purposes.

Types of Cookies used:

• Functional: essential for website or app operation,
• Analytics: audience measurement, user experience improvement,
• Marketing: personalization, advertising retargeting (with consent).

For more details or to withdraw your consent, please refer to our Cookie Policy.

Unless a cookie is strictly necessary, you can withdraw your consent at any time. If you refuse functional cookies, some Products and Services may not operate properly.

Social Media

If you participate in our activities on social media such as Twitter, Facebook, or Instagram, it is your responsibility to review their respective privacy and security rules, as well as their terms of use.

How Do We Protect Collected Information?

We have implemented appropriate technical and organizational controls to safeguard Collected Information against unauthorized or unlawful processing and accidental loss, destruction, or damage.

Our service providers are also required to apply adequate security measures. In the event of a personal data breach likely to entail a high risk to your rights and freedoms, we will inform you as soon as possible.

Who Are the Recipients of Collected Information?

To achieve the purposes described above, Collected Information is shared with our internal teams and certain processors handling billing, sales, IT support, advertising, analytics, research, customer service, product support, logistics, storage, payment processing, fraud prevention, and legal services.

Do We Share Collected Information with Third Parties?

We may share certain Collected Information with third parties as permitted by law or a judicial/administrative decision, including:

• authorized dealers or third-party sellers,
• event partners,
• streaming music providers (where required),
• third parties involved in Devialet mergers or restructurings,
• any other third party for which you have provided consent.

These third parties are bound by confidentiality and data protection obligations and may only process your information for the specified purposes.

Where Is the Information Stored?

Collected Information is generally stored and processed within the European Economic Area (EEA). When data must be transferred outside the EEA, such transfers are made with appropriate safeguards in accordance with applicable data protection laws, including Standard Contractual Clauses.

How Long Do We Keep Your Data?

We keep Collected Information for no longer than necessary for the purposes for which it was processed. Retention periods are detailed in the Summary.

Your Rights

In accordance with the GDPR and French Data Protection Act, you have the right to:

• access, rectify, or erase your data,
• data portability,
• restrict or object to processing,
• withdraw consent at any time,
• define post-mortem instructions for your data,
• file a complaint with the CNIL.

To exercise these rights: privacy@devialet.com. We may verify your identity before fulfilling any request.

Children Under Sixteen (16)

Our Products and Services are not directed at children under sixteen (16).

If we become aware that we have collected data from such a child, we will delete it immediately.

Do Not Track

“Do Not Track” is a browser privacy setting that signals websites not to track a user’s activity. At this time, we do not respond to such signals.

Changes to This Privacy Policy

We may update this Privacy Policy at any time and at our sole discretion. Substantial updates will be indicated by a revised date and published on our website. You will be notified of such changes by email or through the updated date on our site.

Data Controller

Devialet, a French simplified joint-stock company (SAS), registered with the Paris Trade and Companies Register under number 502 155 682, with its registered office at 10 Place Vendôme, 75001 Paris, France, is the data controller.

Contact

For any questions regarding this Privacy Policy or your interactions with Devialet, please contact:

Devialet – Legal / Privacy
16 Rue Henri Regnault, 92400 Courbevoie, France
privacy@devialet.com

1. Category / Processing Activity : Creation & Management of User Account

• Data Concerned (examples) : Name, surname, email, encrypted password, country, product serial number
• Purpose(s) : Linking products, activation of connected features, software updates, user support
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract
• Retention Period : Duration of the contractual relationship + 5 years (legal archiving)

2. Category / Processing Activity : Order Management & After-Sales Service

• Data Concerned (examples) : Contact details, delivery address, purchase history, order ID, product serial number
• Purpose(s) : Billing, delivery, statutory warranties, after-sales service
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract
• Retention Period : 10 years (accounting obligations) / in accordance with general policy

3. Category / Processing Activity : Responding to Customer Requests

• Data Concerned (examples) : Message content, account ID, contact metadata
• Purpose(s) : Support, complaint handling, ticket follow-up
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract
• Retention Period : Ticket duration + 3 years

4. Category / Processing Activity : Recording of Customer Service Calls

• Data Concerned (examples) : Voice, caller number, ticket ID
• Purpose(s) : Quality improvement & proof of exchanges
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract + Art. 6(1)(f) – Legitimate interest (service quality)
• Retention Period : 6 months (unless in litigation)

5. Category / Processing Activity : Software Updates & Improvement Suggestions

• Data Concerned (examples) : Firmware version, product settings, anonymous logs, product serial number
• Purpose(s) : Propose updates, optimize devices
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract
• Retention Period : Product lifetime + 5 years

6. Category / Processing Activity : Technical Data Collection & Bug Reports

• Data Concerned (examples) : Audio sources, sound levels, error logs and actions, network performance, product serial number
• Purpose(s) : Diagnostics, bug fixing, performance improvement
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract + Art. 6(1)(f) – Legitimate interest
• Retention Period : 12 rolling months (then anonymized)

7. Category / Processing Activity : Personalization of User Experience

• Data Concerned (examples) : App usage history, sound preferences, settings
• Purpose(s) : Customize interface, product recommendations
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(f) – Legitimate interest (UX optimization)
• Retention Period : Session duration + 3 years

8. Category / Processing Activity : Marketing & Commercial Communications

• Data Concerned (examples) : Email, purchase history, newsletter interactions
• Purpose(s) : Sending Devialet or partner offers
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(a) – Explicit consent
• Retention Period : Until consent withdrawal or 3 years of inactivity

9. Category / Processing Activity : App Usage Statistics (via third-party SDKs)

• Data Concerned (examples) : Advertising ID, app events, OS version
• Purpose(s) : Audience measurement, app optimization (aggregated statistics)
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(f) – Legitimate interest → Consent required if non-anonymous identifiers (Art. 82 French Data Protection Act)
• Retention Period : 13 months (CNIL recommendation)

10. Category / Processing Activity : Protection of Vital Interests & Security

• Data Concerned (examples) : Security logs, attempted fraudulent logins Purpose(s) : Fraud prevention, user security
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(d) – Vital interests + Art. 6(1)(f) – Legitimate interest
• Retention Period : 12 months (logs) unless incident continues

11. Category / Processing Activity : Dispute Resolution & Legal Compliance

• Data Concerned (examples) : Any relevant client file data
• Purpose(s) : Pre-litigation, litigation management, legal obligations
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(c) – Legal obligation + Art. 6(1)(f) – Legitimate
  interest
• Retention Period : Duration of procedure + statutory limitation (5 years)

12. Category / Processing Activity : Events and Demonstrations

• Data Concerned (examples) : Name, surname, email, phone number, product serial number, country, postal address
• Purpose(s) : Organization and monitoring of events and demonstrations
• Legal Basis (Art. 6 GDPR) : Art. 6(1)(b) – Performance of a contract
• Retention Period : Until consent withdrawal or 3 years of inactivity