Privacy Policy

In accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679), the French Data Protection Act of 6 January 1978 as amended, and the CNIL recommendations on cookies and similar trackers, this policy informs you of the personal data processing carried out by NOBILIS.

1. Data controller

The controller of the personal data collected on this website is:

  • Company name: NOBILIS
  • SIRET: À compléter
  • Registered office: 12 Rue Paul Alavail
  • DPO contact: contact@nobilis.bookcab.fr

2. Personal data collected (legal basis: Art. 6 GDPR)

We collect only the data necessary to provide our transport booking services, in accordance with the data minimisation principle (Art. 5.1.c GDPR):

  • Identification data: Surname, first name, email address, phone number
  • Booking data: Pick-up and drop-off addresses, journey date and time, number of passengers, preferred vehicle type, flight information (where applicable)
  • Payment data: Bank card details (processed securely by our provider Stripe, PCI-DSS certified). We do not have access to your full card details.
  • Navigation data: IP address, browser type, pages visited, visit duration (via analytics cookies with your consent)
  • Communication data: History of exchanges by email or phone with our customer service team

3. Legal basis for processing (Art. 6.1 GDPR)

Your data is processed on the following legal bases:

  • Performance of a contract (Art. 6.1.b): Processing your booking, journey-related communications, invoicing
  • Legal obligations (Art. 6.1.c): Retention of invoices (10 years), tax and accounting obligations
  • Legitimate interests (Art. 6.1.f): Improving our services, fraud prevention, anonymised statistics
  • Consent (Art. 6.1.a): Analytics cookies, newsletter (where applicable), commercial offers

4. Data recipients (Art. 13.1.e GDPR)

Your data may be shared with the following categories of recipients:

  • Authorised personnel: Our employees and partner chauffeurs, strictly within the scope of their duties
  • Technical subcontractors: Hosting provider (OVH, European Union), payment provider (Stripe Inc., Privacy Shield and SCCs certified), email service
  • Public authorities: Only upon judicial requisition or legal obligation

Safeguards: All our subcontractors are bound by standard contractual clauses (SCCs) compliant with GDPR requirements. For transfers outside the EU, we apply the standard contractual clauses issued by the European Commission.

5. Data retention periods (Art. 5.1.e GDPR)

In accordance with the storage limitation principle, your data is retained for the following periods:

  • Booking data: 3 years from the date of the last service
  • Invoicing data: 10 years (statutory accounting obligation)
  • Customer contact data: 3 years after the last contact
  • Analytics cookies: maximum 13 months (in accordance with CNIL recommendations)
  • Connection logs: 1 year (statutory obligation)

6. Data security (Art. 32 GDPR)

We implement appropriate technical and organisational measures to ensure the security of your data:

  • SSL/TLS encryption for all data transmissions
  • Secure hosting on certified servers (ISO 27001) located within the European Union
  • Access to data restricted to authorised personnel with strong authentication
  • Regular, encrypted backups
  • Data breach notification procedures (Art. 33–34 GDPR)

7. Your GDPR rights (Chapter III GDPR)

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR): Obtain confirmation that your data is being processed and access it, along with information about that processing.
  • Right to rectification (Art. 16 GDPR): Have inaccurate data corrected or incomplete data completed.
  • Right to erasure (Art. 17 GDPR): Have your personal data deleted under certain conditions (right to be forgotten).
  • Right to restriction of processing (Art. 18 GDPR): Request the restriction of processing of your data in certain circumstances.
  • Right to data portability (Art. 20 GDPR): Receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
  • Right to object (Art. 21 GDPR): Object to the processing of your data on grounds relating to your particular situation, or for direct marketing purposes.
  • Rights regarding automated decision-making (Art. 22 GDPR): Not be subject to a decision based solely on automated processing that produces legal effects concerning you.
  • Right to define post-mortem directives: Define directives regarding the fate of your data after your death.

8. Cookies and similar technologies (ePrivacy Directive)

In accordance with Article 82 of the French Data Protection Act as amended and Directive 2002/58/EC (ePrivacy Directive), we use cookies and similar technologies:

  • Strictly necessary cookies: Essential for the website to function (authentication, basket, security, language preferences). These cookies do not require your prior consent.
  • Analytics cookies: Google Analytics to measure audience and improve our services (anonymised data, truncated IP). Retention period: maximum 26 months.
  • Performance cookies: Microsoft Clarity to analyse user behaviour and optimise the experience (pseudonymised data).
  • Managing your preferences: You can accept, decline or configure the use of cookies via our consent banner or your browser settings. Declining does not affect essential navigation.
  • Withdrawing consent: You can change your choices at any time by clicking 'Manage cookies' at the bottom of the page or by deleting cookies from your browser.

9. Contact and exercising your rights

9.1. Data Protection Officer (DPO)

For any questions about the processing of your personal data or to exercise your GDPR rights, please contact our Data Protection Officer:

  • Email: contact@nobilis.bookcab.fr
  • Post: 12 Rue Paul Alavail
  • Subject: "Exercise of GDPR rights" or "Data protection"

9.2. Procedure for exercising your rights

  • Response time: We commit to responding within one month of receiving your request.
  • Identity verification: A copy of a proof of identity may be requested to verify your identity.
  • Free of charge: Exercising your rights is free of charge, except in cases of manifestly unfounded or excessive requests.

9.3. Recourse in the event of a personal data dispute

If you disagree with the processing of your personal data, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL):

  • Website: www.cnil.fr
  • Phone: 01 53 73 22 22
  • Address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07

10. General provisions

10.1. Policy amendments

We reserve the right to amend this Privacy Policy at any time. Amendments take effect upon publication on the website. We will notify you of any material changes by email or via a notification on the website.

10.2. Applicable law

This Privacy Policy is governed by French law and the GDPR. In the event of a dispute relating to data protection, the French courts shall have jurisdiction following an attempt at amicable resolution.

Last updated: December 2024
Version: 2.0
This Privacy Policy is available to view and download at any time on our website.