Privacy policy
What data is processed, why, who receives it, how long it is kept and how to exercise your rights. This page describes the processing the site actually carries out.
Privacy policy
Data controller
- Name
- Find Your Driver
- Operator
- Yacine YOUNES BOUACIDA — Entrepreneur individuel (EI)
- SIREN
- 523986529
- SIRET
- 52398652900031
- REVTC
- EVTC006166124
- Intracommunity VAT
- FR06523986529
- Address
- 54 Route de Canta Galet
06200 Nice
France - Publication director
- M. Yacine YOUNES BOUACIDA
- Phone
- +33 6 64 72 04 01
- contact@findyourdriver.fr
- Insurer
- MFA
- Policy number
- F/344/528632-000003
Consumer mediation
CM2C
49 rue de Ponthieu, 75008 Paris, France
01 89 47 00 14
litiges@cm2c.net
https://www.cm2c.net/declarer-un-litige.php
Who processes your data
The data controller is the operator of the Find Your Driver service, whose identity and contact details appear above. No data protection officer has been appointed: requests about your data are handled directly by the operator, at the contact address shown above.
What is processed, depending on what you do
A quote covers the pick-up and arrival addresses, the date, the time, the number of passengers, the type of journey and the options chosen; no account is created. A booking adds your name, email address and a phone number and, if you provide them, the company name, SIREN number, VAT number and billing address; it also keeps the journey, the time, the flight number where the pick-up is at the airport, your comments and your payment preference. A message sent from the contact form contains your name, email address, phone number if you give one, the subject and the text of the message. Finally, the site’s technical logs are used to detect errors, abuse and abnormal access attempts; email addresses, phone numbers and access tokens are masked in them and are never stored there in clear.
Why the data is processed, and on what legal basis
Performance of the contract covers everything needed for the booking, the transport and the exchanges around them: handling the request, arranging the pick-up, sending the confirmation, answering your questions. A legal obligation covers invoicing, the retention of invoices and the prior-booking proof a VTC business must be able to produce. The operator’s legitimate interest covers the security of the site, the limitation of abusive use, fraud prevention and the defence of its rights in a dispute. Consent, lastly, is the only basis for audience measurement and advertising measurement: nothing is measured before you agree, and you can withdraw your consent at any time from the cookies page. No automated decision producing legal effects is taken about you, and no data is used for advertising profiling.
Who receives your data
Your data is neither sold nor transferred. It is processed by the operator and by the technical providers that deliver the service, each for what it operates: Hostinger International Limited for website hosting and the business mailbox; Supabase for the database and document storage; Stripe for online card payment; Google for address resolution and route calculation and, only if you have agreed to it, for audience and advertising measurement. The information needed for the pick-up may also be given to the driver carrying out the journey.
Online payment
Where online payment is offered and chosen, card details are entered directly on Stripe’s secure pages. The operator does not receive or keep the full card number; it keeps the payment reference, its amount and its status, which are needed to follow the booking and to invoice it.
Transfers outside the European Union
Data is hosted in the European Union. Some providers may nevertheless process data outside it — in particular Google, for address resolution and routes and, where they are enabled and accepted, for audience and advertising measurement. These providers publish the safeguards that frame those transfers, notably the European Commission’s standard contractual clauses and, for those certified under it, the EU–US Data Privacy Framework.
Retention periods
Invoices and credit notes are kept for ten years from the close of the accounting period, and the prior-booking proof for one month from the journey: that last period is a Find Your Driver choice, keeping the document long enough to be able to produce it if it is ever checked. Bookings and customer data stay in our active database for twelve months after the journey ends, is definitively cancelled, or the customer does not appear; at the end of those twelve months they are anonymised — the name, contact details, journey addresses and flight number are replaced — while the booking and its invoice are kept, because they remain necessary for accounting and for defending our rights. Messages received through the contact form arrive in the operator’s business mailbox, where they are identifiable by their subject, and are not stored in the site’s database: they are kept for twelve months after the last exchange and then deleted. Rate-limiting counters are deleted automatically when their window expires, which ranges from a few minutes to one hour depending on the operation. Your cookie choice is kept for six months. Administration sessions expire after two hours of inactivity and twelve hours at the latest.
Security
The site is served over HTTPS only. Administration sessions are time-limited and protected by two-step verification. The tokens that open a booking are stored only as a digest, and the site’s public endpoints are rate-limited to prevent abuse. Access to the data is reserved to the operator.
Cookies and trackers
The site stores a small number of items on your device, and none of them is used to follow you without your agreement. The cookies page describes them one by one, states how long each lasts and explains how to accept, refuse or change your choice.
Your rights
You have the right to access, correct, erase, restrict and object to the processing of your data, as well as a right to portability of the data you provided. Write to the contact address above, stating your request; a reply is given within the periods set by the GDPR. Where retention is imposed by law — an invoice, for example — an erasure request cannot take effect before that obligation ends, but the other data can be deleted. If you consider that your rights have not been respected, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.