سياسة الخصوصية وملفات تعريف الارتباط

The data controller for personal data collected via the website onyxdriveparis.fr is:

Given the volume and nature of the processed data (transport bookings, no large-scale processing of sensitive data), Onyx Drive Paris is not legally obligated to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR.

a) Booking Form

When booking on the site, we collect:

b) Newsletter (Voluntary Subscription)

If you opt-in after booking, we collect your name and email to occasionally send you news and offers. This subscription is optional and not checked by default. You can unsubscribe at any time via the link in each email.

c) Analytics and Audience Measurement

With your consent, we use Google Tag Manager and Google Analytics 4 (GA4) to measure site audience. This data is collected in an aggregated and anonymized way.

• Performance of a contract (Art. 6.1.b GDPR): Processing of booking data necessary for the transport service.
• Legitimate interest (Art. 6.1.f GDPR): Site security, fraud prevention, service improvement.
• Legal obligation (Art. 6.1.c GDPR): Retention of billing data for 10 years (tax and accounting obligations).
• Consent (Art. 6.1.a GDPR): Analytics cookies and newsletter subscription.

Onyx Drive Paris undertakes to never sell, rent, or transfer your data to third parties for commercial purposes. Your data may only be shared with the following technical processors strictly within the scope of the service:

Some of our processors (Google LLC, Stripe Inc., Zoho) are based outside the EU. These transfers are governed by the EU-US Data Privacy Framework (decision 2023/1795) and Standard Contractual Clauses (SCCs).

Telegram (Telegram FZ-LLC): based outside the EU, not currently covered by the Data Privacy Framework or by signed Standard Contractual Clauses. Used only for a minimal internal booking notification to our team.

In line with CNIL recommendations, we distinguish two categories of cookies:

Strictly necessary cookies (exempt from consent)

Cookies requiring consent

Managing your preferences: You can accept or decline non-essential cookies via the consent banner shown on your first visit. You can change your choice at any time by clearing your browser cookies or by contacting contact@onyxdriveparis.fr.

The "Club Onyx Privilège" program (loyalty and referrals, see onyxdriveparis.fr/fidelite) is processed separately from the booking data itself.

• Legal basis: consent (Art. 6.1.a GDPR) - joining the program and creating a loyalty profile results from a voluntary action by the client (scanning an in-car QR code, or earning points after a ride using the contact details already provided at booking).
• Data processed: phone number (profile identifier), name, email, number of completed rides, points balance, history of discount codes generated (with used/active status), number of referred contacts and ambassador tier reached.
• رابط الإحالة: تستخدم روابط الإحالة الشخصية الجديدة رمزًا عشوائيًا، لذلك لا يظهر رقم هاتفك في الرابط. تبقى الروابط القديمة التي تتضمن الرقم صالحة؛ يُفضّل عدم نشرها علنًا.
• Referees: when someone books through your link, their phone number is stored in your referrer profile only to prevent the same referee being credited twice - it is not shown in the referrer's interface beyond the referral count.
• Secure access: viewing your loyalty profile (name, email, history, active discount codes) on the dedicated page requires a one-time verification code sent by email to the address already on file, so that someone who only knows your phone number cannot view this information.
• Retention period: loyalty profile data is kept while the program remains active for the account concerned, and deleted on request (see Section 9, Your Rights) or after 3 years of inactivity (no ride, no referral) from the last point earned.

Under the GDPR (Art. 15 to 22), you have the right of access, rectification, erasure ("right to be forgotten"), restriction, objection, and data portability.

If you believe your rights are not respected, you can file a complaint with the French Data Protection Authority (CNIL) at www.cnil.fr.