Privacy policy

Controller and contact

The M&A Luxury Drive website is published by CHEMLOUL MOHAMED, sole trader and micro-entrepreneur, registered with the National Business Register (RNE). SIREN: 841 208 762. SIRET of head office: 841 208 762 00028. Administrative address: 10 Square Fernand Widal, 91000 Évry-Courcouronnes, France.

The service can be reached at maluxurydrive@gmail.com and on +33 7 45 63 24 01. See also the legal notice.

Data used

• Booking and contact: name, telephone, email address, date, time, journey addresses, number of passengers and luggage, vehicle category and message.
• Reviews: displayed name, rating, comment, optional journey, language and submission date. A review is public only after validation.
• Geolocation: only after your consent in the browser, to suggest a departure address and calculate the journey.

Purposes and recipients

Booking and contact requests are passed to WhatsApp when you choose to open and send the message. Contact details, journey, date, vehicle, estimated price and chosen payment method are recorded in Supabase when a quote is prepared. They are used to follow up the request and for invoicing. Invoices and their PDFs are archived in the private database, with no public download link. Access is limited to expressly authorised accounts and, for invoicing accounts, to the invoices their rights give access to. Reviews are also stored in Supabase. The site is hosted on Cloudflare. Address search uses the French government's Address API and distance estimation uses the OSRM service.

Legal bases

Responding to requests, the quote and the organisation of the transport rely on pre-contractual measures and performance of the contract (Article 6(1)(b) GDPR). Invoicing and retention of accounting records rely on legal obligations (Article 6(1)(c)). Securing the site, limiting abuse and moderating reviews rely on the publisher's legitimate interest (Article 6(1)(f)). Optional geolocation and the publication of a review are subject to your consent (Article 6(1)(a)).

External services and transfers

The project's Supabase database is located in the European region eu-west-1. Cloudflare provides hosting and protection of the site; Resend sends the emails. Depending on their operations and sub-processors, these providers and WhatsApp may process some data outside the European Union. Their transfer safeguards and sub-processors are described in their data processing agreements: Supabase, Cloudflare, Resend and WhatsApp. WhatsApp requests are passed on only when you choose to send the message. Journey addresses are sent to the geocoding and route-calculation services to produce the estimate.

Retention and security

We apply the following retention periods:

• Invoices and accounting records: ten years from the end of the financial year concerned, in accordance with accounting obligations.
• Booking requests, contact requests and quotes, with the data they contain: for the time needed to process them, then three years after our last exchange with you. They are then deleted or anonymised, unless they are linked to an invoice.
• Reviews: for as long as they are published. You can ask for their removal at any time.
• Technical security logs of the site: twelve months at most.
• Geolocation: your current position is not tracked continuously or stored; only the addresses of the chosen journey are saved with the request.

Public access to the database is limited to the functions needed by the site, reviews are moderated and communications are encrypted by HTTPS.

Your rights

You can request access to, rectification, erasure or restriction of your data, and object to its processing, by writing to maluxurydrive@gmail.com. You may also lodge a complaint with the CNIL.

Cookies

The site does not install any advertising cookie or marketing tracking tool. External services may apply their own rules when you open their links.