Privacy Policy and Cookies

The data controller for personal data collected via the website onyxdriveparis.fr is:

Given the volume and nature of the data processed (transport bookings, no large-scale processing of sensitive data and no systematic monitoring), Onyx Drive Paris is not under a legal obligation to appoint a Data Protection Officer (DPO) within the meaning of Article 37 of the GDPR. For any question relating to the protection of your data, please contact the email address above directly.

a) Booking Form

When booking on the site, we collect:

b) Newsletter (Voluntary Subscription)

If you tick the dedicated box after making a booking, we collect your name and email address in order to occasionally send you our offers and news. This subscription is optional, not ticked by default, and separate from the booking confirmation email. You can unsubscribe at any time via the link included in every email, without having to give a reason.

c) Quote Requests via Messaging (WhatsApp, SMS, Email)

When you send us a quote request via instant messaging (WhatsApp, SMS) or email, we only process the logistical details strictly required to generate the quote (pickup and drop-off addresses, intermediate stops, date, time, passengers, luggage, flight). This processing may use automated syntax extraction tools provided by Google Cloud. The original message is never stored in any external database and is never used for algorithmic training.

d) Analytics and Audience Measurement

With your consent, we use Google Tag Manager and Google Analytics 4 (GA4) to measure site audience. This data is collected in an aggregated and anonymized way.

• Performance of a contract (Art. 6.1.b GDPR): processing of booking data (name, phone number, email, journey, luggage) necessary to carry out the transport service.
• Legitimate interest (Art. 6.1.f GDPR): website security, fraud prevention, improvement of service quality.
• Legal obligation (Art. 6.1.c GDPR): retention of billing data for 10 years (accounting and tax obligations).
• Consent (Art. 6.1.a GDPR): audience measurement cookies (Google Analytics 4), set only after your explicit agreement via the consent banner; newsletter subscription, carried out solely through a deliberate action on your part.

Onyx Drive Paris undertakes to never sell, rent, or transfer your data to third parties for commercial purposes. Your data may only be shared with the following technical processors strictly within the scope of the service:

Some of our processors (Google LLC, Stripe Inc., Zoho) are companies whose registered office is established outside the European Union (United States, India). These transfers are governed by the following safeguards:

• EU-US Data Privacy Framework: Google LLC and Stripe, Inc. are certified under the transatlantic framework recognised by the European Commission adequacy decision of 10 July 2023 (decision 2023/1795).
• Standard Contractual Clauses (SCCs): for transfers not covered by an adequacy decision, we rely on the SCCs approved by the European Commission (decision 2021/914).
• Telegram (Telegram FZ-LLC): a company established outside the European Union, not covered to date by the Data Privacy Framework nor by signed Standard Contractual Clauses. Used only for a minimal internal booking notification to our team.

In line with CNIL recommendations, we distinguish two categories of cookies:

Strictly necessary cookies (exempt from consent)

Cookies requiring consent

Managing your preferences: You can accept or decline non-essential cookies via the consent banner shown on your first visit. You can change your choice at any time by clearing your browser cookies or by contacting contact@onyxdriveparis.fr.

The "Club Onyx Privilège" program (loyalty and referrals, see onyxdriveparis.fr/fidelite) is processed separately from the booking data itself.

• Legal basis: consent (Art. 6.1.a GDPR) - joining the program and creating a loyalty profile results from a voluntary action by the client (scanning an in-car QR code, or earning points after a ride using the contact details already provided at booking).
• Data processed: phone number (profile identifier), name, email, number of completed rides, points balance, history of discount codes generated (with used/active status), number of referred contacts and ambassador tier reached.
• Referral link: your personal referral link (onyxdriveparis.fr?ref=...) contains your phone number in plain text, solely to compute the discount granted to your referees. This link is meant to be shared voluntarily by you; avoid posting it somewhere public if you do not want your number visible there.
• Referees: when someone books through your link, their phone number is stored in your referrer profile only to prevent the same referee being credited twice - it is not shown in the referrer's interface beyond the referral count.
• Secure access: viewing your loyalty profile (name, email, history, active discount codes) on the dedicated page requires a one-time verification code sent by email to the address already on file, so that someone who only knows your phone number cannot view this information.
• Retention period: loyalty profile data is kept while the program remains active for the account concerned, and deleted on request (see Section 9, Your Rights) or after 3 years of inactivity (no ride, no referral) from the last point earned.

Under the GDPR (Art. 15 to 22), you have the following rights:

• Right of access (Art. 15): obtain a copy of the personal data concerning you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"), except where retention is required by law.
• Right to restriction (Art. 18): request temporary suspension of the processing of your data.
• Right to object (Art. 21): object to the processing of your data on legitimate grounds.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to withdraw consent (Art. 7.3): withdraw your consent at any time for processing based on it (analytics cookies).
• Post-mortem directives (Art. 40-1, French Data Protection Act): issue instructions on what happens to your data after your death.

Proof of identity may be requested in order to verify who you are before the request is processed.

For any question regarding the processing of your personal data:

• Email: contact@onyxdriveparis.fr
• Phone: +33 6 02 56 56 80

If, after contacting us, you consider that your data protection rights have not been respected, you have the right to lodge a complaint with the French supervisory authority:

If you reside in another EU member state, you may alternatively lodge your complaint with the supervisory authority of your country of residence (GDPR, Art. 77).