Privacy policy

1. Identity and contact information of the Data Controller

Within the meaning of Article 4(7) of the GDPR:

2. Personal Data Collected

We collect only the data that is strictly necessary for the provision of our services and the proper functioning of the Site. The principle of data minimization (Article 5(1)(c) of the GDPR) is applied.

2.1 Data Collected Through the Reservation/Contact Form

• Title (Mr./Ms.)
• Last Name and First Name
• Email address
• Phone number
• Pickup location (airport, train station, hotel, etc.)
• Destination Address
• Date and time of the race
• Number of passengers, quantity and type of baggage
• Preferred vehicle type (Eco, Sedan, Van, VIP Van)
• Requested options (child seat, welcome sign with name, pet, etc.)
• Free text / Special instructions
• Billing information (last name, first name, address, company name, and VAT number for business customers)

The reservation form sends this data first to the fleet platform API, which is accessible at app.vtc-bordeaux-chauffeur.com/api/site/demande. If this API is technically unavailable, the same request is sent to the Web3Forms API to ensure the request is not lost. The custom quote form uses Web3Forms directly.

2.2 Data Collected During Payment

Stripe is not loaded on the public website or when a reservation request is submitted. If you choose to pay online, you will receive a separate secure payment link, processed by Stripe Payments Europe Ltd (1 Grand Canal Street Lower, Dublin, Ireland).

The banking information entered on the Stripe payment page does not pass through the static website. VTCBORDEAUX receives the information necessary to track the transaction, including its status, amount, and reference number.

2.3 Data Collected via WhatsApp / Phone

If you contact us via WhatsApp or by phone:

• Phone number (visible in the interface or via the caller ID)
• Information Provided during the exchange (name, itinerary, date, etc.)
• WhatsApp chat history, stored within the app

2.4 Automatically Collected Data — Cookies and Trackers

2.4.1 Server Logs

• IP address (potentially pseudonymized)
• Browser type and version, operating system
• Pages Visited and Referrer URLs
• Date and time of the request
• Technical information required for the operation and security of the Site

2.4.2 Google Analytics 4 (GA4) — subject to consent

Before any selection is made, Consent Mode is initialized with analytics_storage: denied and the file gtag.js is not loaded. Google Analytics 4 (Google LLC, United States) is enabled only after explicit consent is given. It can then collect data via cookies _ga and _ga_58028P09D8 :

• GA4 client ID;
• Page views, events, interactions
• Source and acquisition channel (organic, referral, direct, social)
• Approximate geographic data (country, region, city — derived from the IP address)
• Time spent on the site and number of pages viewed
• Device information (category, brand, model)

The GA4 configuration requires IP addresses to be anonymized and limits the duration of cookies to 13 months. Opting out does not affect any functionality.

2.4.3 Consent Options

The required cookie vtc_consent contains only the value accepted or refused. It is retained for 180 days and is not used for any other purpose.

2.4.4 Summary Table

The comprehensive, up-to-date list is available via our cookie management banner at the bottom of the page.

2.5 Data Collected in Connection with the Business Relationship

• Race History (dates, routes, amounts)
• Billing and Accounting Data
• Email Correspondence
• Claims and Potential Disputes
• Travel Preferences (for frequent travelers)

3. Purposes of Data Processing and Legal Bases

In accordance with Article 6 of the GDPR, each processing activity is based on a specific legal basis.

3.1 Reservation Management and Contract Performance

3.2 Billing Management and Accounting Requirements

3.3 Communication and Customer Relations

3.4 No Automated Prospecting

The Site does not offer a newsletter subscription or a checkbox for consent to receive marketing communications. The contact information entered in a form is used to respond to the request, arrange the service, and manage the corresponding customer relationship.

3.5 Audience Measurement (Google Analytics 4)

3.6 Security and Fraud Prevention

3.7 Dispute and Litigation Management

4. Retention Periods

In accordance with the principle of retention limit (Art. 5(1)(e) of the GDPR):

Upon expiration, the data is permanently deleted or irreversibly anonymized.

5. Recipients and Subcontractors

5.1 Authorized Internal Personnel

Adrien Moreno (President + driver) is the sole business recipient of the data, strictly within the scope of his responsibilities. The technical service providers listed below may access the data solely for the purposes of providing their services.

5.2 Technical Subcontractors

The technical service providers listed below process data only to the extent necessary to provide their services:

Cloudflare, Inc. — Cloudflare Pages

Google LLC — Google Analytics 4

Google LLC — Maps, Places, and Routes APIs

The estimation modules use Google Maps services to search for an address and calculate a route. Google receives the technical information from the request, as well as the addresses, location identifiers, or coordinates needed for the calculation. This functionality is separate from GA4. Google Privacy Policy.

Stripe Payments Europe Ltd

ETRANSPORTS / Nebulea — Main Booking API

Web3Creative / Web3Forms — Form API and fallback

5.3 Authorities and Legally Authorized Third Parties

Your data may be disclosed to the relevant authorities (judicial, administrative, tax) upon legal request.

5.4 Transfer of Business Operations

In the event of a total or partial sale of the business, your data may be transferred to the new owner, provided you are notified in advance.

6. Data Transfers Outside the EU

6.1 Legal Framework

Since the ruling Schrems II (CJEU, July 16, 2020), transfers to the United States are based on the Standard Contractual Clauses (SCCs) (EU Decision 2021/914).

The EU-U.S. Data Privacy Framework (DPF), adopted on July 10, 2023, allows certified U.S. companies to receive data from the EU.

6.2 Breakdown by Subcontractor

6.3 Your Rights

You can obtain a copy of the Standard Contractual Clauses (SCCs) by contacting us at contact@vtc-bordeaux-chauffeur.fr.

7. Your Rights

In accordance with Articles 15 through 22 of the GDPR, you have the following rights. Response time: 1 month (Extendable by 2 months for complex applications).

7.1 Right of Access (Art. 15)

Obtain confirmation that your personal data is being processed, and access that data and related information:

• Purposes, Categories of Data, Recipients
• Retention period
• Your Rights (Correction, Deletion, etc.)
• Right to File a Complaint with the CNIL
• Source of data in the case of indirect collection
• Existence of Automated Decision-Making

A copy is provided to you. Reasonable fees apply for additional copies.

7.2 Right to Rectification (Art. 16)

Have inaccurate or incomplete data corrected.

7.3 Right to Erasure / Right to Be Forgotten (Art. 17)

Deletion in the following cases:

• Additional data required
• Withdrawal of Consent (Without Another Legal Basis)
• Legitimate opposition
• Unlawful processing
• Legal Requirement

Exceptions : retention for legal compliance, legal defense, public interest.

7.4 Right to Restriction (Art. 18)

Temporary suspension of processing (verification of accuracy, unlawful processing, legal defense, verification of an objection).

7.5 Right to Data Portability (Art. 20)

Receive your data in a a structured, commonly used, machine-readable format (CSV, JSON) and transfer them to another data controller, if the processing is based on consent or a contract AND is automated.

7.6 Right to Object (Art. 21)

For processing based on legitimate interests : You may object for reasons related to your specific circumstances. We will cease processing your data unless there are compelling legitimate grounds to continue.

7.7 Right to Withdraw Consent (Art. 7(3))

At any time, without retroactive effect:

• Analytics Cookies : cookie banner at the bottom of the page
• Other processing : contact@vtc-bordeaux-chauffeur.fr

7.8 Post-Mortem Guidelines (Art. 85 of the Data Protection Act)

Determine what will happen to your data after your death (retention, deletion, or transfer to a designated third party).

7.9 Exercise Procedure

By email : contact@vtc-bordeaux-chauffeur.fr By mail : VTCBORDEAUX — Attention: GDPR Officer — 9 Quai des Mouettes, 33290 Parempuyre, France

To be provided : - First and last name - Email address used for your interactions with us - Nature of the right exercised - Any relevant identifying information

Proof of Identity : We may ask for a copy of your ID (national ID card or passport)—which will be deleted after processing.

Deadline : 1 month (extendable to 2 months, with prior notice).

8. Right to File a Complaint with the CNIL

If your rights are not respected after you have contacted us, you may file a complaint with the CNIL :

You can also contact the supervisory authority in your Member State of residence if you live in another EU country.

9. Data Security

In accordance with Article 32 of the GDPR, we implement the appropriate technical and organizational measures.

9.1 Technical Measures

• HTTPS : Encryption of communications with the Site and the APIs being called
• Static Hosting : The public website does not contain a customer database, and the forms are submitted to the APIs listed in Section 5
• Analytics Consent : GA4 is blocked by default and is only loaded after explicit consent
• Updates : software components kept up to date

9.2 Organizational Measures

• Less privilege : Data access is limited to those who need it
• Awareness : best practices for data protection
• Service Providers : Limited use of the services identified in this policy and review of their contractual guarantees
• Incident Management : In the event of a breach that could pose a risk, notification to the CNIL under 72 hours (Art. 33) and notification of affected individuals in cases of high risk (Art. 34)

9.3 Limitations

No system is completely foolproof. In the event of an incident, we will take all necessary measures to minimize its impact.

10. Cookies — Additional Information

Reference: CNIL recommendation on cookies and other trackers, official source verified on July 24, 2026.

10.1 What is a cookie?

A cookie is a small text file stored on your device when you visit a website. Among other things, it is used to remember a selection or an identifier.

10.2 Categories Used

Strictly Necessary Cookie : vtc_consent, value accepted or refused, retained for 180 days.

Audience Measurement Cookies (subject to consent): _ga and _ga_58028P09D8, retained for no more than 13 months and submitted only with your consent.

10.3 Managing Preferences

Through our cookie banner : during your first visit. You can view this again at any time by clicking the “Manage My Cookies” link at the bottom of the page.

Through your browser : Chrome, Firefox, Safari, and Edge offer management options.

Disabling GA via an extension : Official Google Analytics opt-out tool.

For complete details, see our Cookie Policy.

11. Automated Decisions and Profiling

In accordance with Article 22 of the GDPR, We do not make any fully automated decisions that have legal effects or significantly affect.

GA4 data can generate aggregated and anonymous statistical profiles but are not used for automated individual decisions.

12. Data on Minors

Our services are intended for adults. We do not knowingly collect data from minors under the age of 15 without the consent of their legal guardians.

If you are a parent and believe your child has provided us with information without your consent, please contact contact@vtc-bordeaux-chauffeur.fr for immediate deletion.

13. Links to Third-Party Websites

Our Site contains links to third-party sites (social media, review platforms, etc.). We have no control over their data protection practices. We encourage you to review their privacy policies.

14. Changes

We may amend this policy to comply with regulatory changes or to reflect changes in our practices.

14.1 Notification Procedure

• Date Updated updated at the top of the document
• Visible notice on the Site for a reasonable period of time

14.2 Archiving

Previous versions are archived and provided upon request.

14.3 Effective Date

Any changes take effect upon publication, unless otherwise specified.

15. GDPR Contact

We are committed to processing your request within the required time frame.

Privacy Policy drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Law No. 78-17 of January 6, 1978, as amended.

© 2026 VTCBORDEAUX (SAS, SIREN 924 992 605, RCS Bordeaux) — Bordeaux Chauffeur private chauffeur service — All rights reserved.