This privacy policy applies to the site: Carsup.
When browsing or using the CARSUP website, accessible from the address www.carsup.io (“the Site”), and/or on the CARSUP mobile application (“the Application”) (hereinafter collectively “the Digital Supports”), we may ask you to provide us with certain personal data concerning you in order in particular to be able to create your Customer account, validate your orders for Services (as defined in the CSSLs) or register for our newsletter.
Under this Privacy Policy:
The purpose of this Privacy Policy is to inform natural persons browsing or using the Site and/or the Application (the “Users”) of the methods by which their personal data is collected from Digital Media and processed by the company CARS-UP SAS, which is domiciled at 1 rue des Hauts, 45380 La Chapelle Saint-Mesmin, France and registered with the Orléans Trade and Companies Register under the number 851 614 594 (“CARS-UP SAS”), which is domiciled at 1 rue des Hauts, 45380, 45380 La Chapelle Saint-Mesmin, France and registered with the Orléans Trade and Companies Register under number 851 614 594 (“CARS-UP SAS”), which is domiciled at 1 rue des Hauts, 45380 La Chapelle Saint-Mesmin, France. SUP”).
This Privacy Policy applies to the collection and processing of all personal data communicated by you, or collected by us during your browsing on Digital Media, in particular via Cookies.
The collection and processing of personal data of European Union nationals must comply with the requirements of Law 78-17 of 6 January 1978 as amended (known as the “Data Protection Act”) as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”).
Should be considered personal data, all data being likely to identify a User as an individual. This includes, but is not limited to, the first name, last name, age, postal address, email address, location of the User or even his IP address (hereinafter the “Personal Data” or “Data”).
By browsing and using CARSUP Digital Media, you therefore communicate, as a User, certain Personal Data.
CARSUP, as defined in Article 1 of this Privacy Policy. ·
> Email contact: contact@carsup.io - Telephone on +33 1 89 47 00 43
CARSUP has appointed as the contact point for the management of personal data:
> Mr Jean-Luc Grellier - Contact: dp@carsup.io
As part of its activity, CARSUP is required to collect a certain amount of Personal Data concerning the User and in particular:
> Identification data: first name, last name, postal address, postal address, email address, email address, telephone number, identity document (CNI or passport), driver's license, proof of address, when necessary
> Economic and financial data: the last 4 digits of the payment card if this payment method is selected and if you are located in the European Union
> Connection and internet data: OS version, application version, application version, User IP address, telephone operating system, device identifier
> Other data: comments left on the Application or the Site in connection with the use of the services, conversations with our Customer Service in the context of managing and providing the services.
This Personal Data may be collected when you download or browse the Application, browse our Site or use our Services.
The collection and processing by CARSUP of the User's Personal Data are justified by the following legal bases, derived from the RGPD:
> “Consent” (articles 7 and 6.1 (a) of the RGPD): when the User has expressly and freely consented to the processing of his Personal Data for one or more specific purposes;
> “Contract” (Article 6.1 (b) of the RGPD): when the processing is necessary for the execution of a Contract to which the User is a party or for the execution of pre-contractual measures taken at the request of the User;
> “Legal obligation” (article 6.1 (c) of the RGPD): when the processing is necessary for compliance with a legal obligation to which the Data Controller is subject; ·
> “Legitimate interest” (article 6.1 (f) of the RGPD): when the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party (such as, for example, following up on the request to exercise rights, the fight against fraud or contractual breaches, the fight against fraud or contractual breaches, maintaining the quality of our Services,...), unless the interests or fundamental rights and freedoms of the person concerned prevail, which require protection of Personal Data.
Through Digital Media, CARSUP processes Data concerning you according to the above legal bases and which are strictly necessary for the following purposes: ·
Purposes of the treatment whose legal basis is “Consent”
> Cookies that we use on our Digital Media and whose purposes are described in our Cookie Policy (Article 5 and following of the Privacy Policy)
> creation of the User Account and first use of the Application
> ordering Services via the Application
> Application usage statistics (see article 5.6 below)
Purposes of the treatment whose legal basis is “the Contract”:
> formalization of commercial offers and quotations in connection with the commercial relationship
> production, management, follow-up of files with Users
> execution of the Contract and the Services ordered in particular via the Application
> creation and opening of the User Account on the Application, and management of the User's actions and orders via the Application
> management of the means of access to the Parks/ Car Parks or for the Squares, necessary for the use of the Services
> collection of invoices in connection with the execution of the Contract
> transmission of information necessary for the proper execution of the contract, in particular to registration agencies, insurance companies, bailiffs or lawyers in charge of litigation or not
Purposes of the processing whose legal basis is “the Legal Obligations”:
> prevention of money laundering and terrorist financing and the fight against corruption
> billing
> accounting
> legal period of conservation or archiving
Purposes of the processing whose legal basis is “Legitimate Interest”:
> prospecting and organizing in connection with our Services and carrying out surveys or polls, subject to express consent when required by the RGPD
> management of the relationship with the User, including registering or unsubscribing to the Newsletter
> organization, registration and invitation to Events set up by CARSUP
> resolution of disputes with its CUSTOMERS, in particular through the collection and administration of evidence for this purpose
> production of anonymous statistics on the use of our Digital Media in order to improve and optimize our Services
> access to certain functionalities of our Digital Supports.
> personalization of responses to Users' requests for information and management of requests to exercise Users' rights under the RGPD
> management of Users' opinions on the Services or the content of the Application and/or the Site
> loyalty program management
The Personal Data that we collect to ensure these purposes and which are essential for us to respond to your requests (mainly your name, first name, postal address, telephone number, e-mail and, where applicable, bank details) are mentioned by an asterisk on the collection forms. If you do not fill in these mandatory fields, we will not be able to respond to your requests.
Data is kept for a period of time that does not exceed the time necessary for the purposes for which they were collected:
> For the management of your subscription to the newsletter: we keep the Data of a User subscribed to the newsletter 3 years after the last positive act of the subscriber. As soon as we receive your request to unsubscribe, we proceed to deactivate the sending of newsletters.
> For orders for CARSUP Services: we keep the Data collected for the purposes of the execution of your order or Contract, then for the period necessary to establish proof of a right or a contract, i.e. 48 months; this Data may be archived in accordance with the provisions of the Commercial Code relating to the shelf life of books and documents created during commercial activities and the Consumer Code relating to the preservation of contracts concluded electronically.
With regard to the retention period by category of Personal Data (as referred to in article 2.3):
> Identification Data and Economic and Financial Data: for the duration of the Contract or the use of our Services (depending on the latest date) up to 3 years from the deletion of the User Account or the last use of the Digital Media for the duration of the Contract or the last use of the Digital Media for the purposes of data collected for prospecting purposes. At the end of this period of 3 years, CARSUP reserves the right to contact the User again to find out if he is still interested in receiving commercial requests.
> Connection data and Internet data: see Cookies Policy (Article 5)
> Data allowing the management of requests to exercise rights: 2 years from the request for the exercise of rights by the User
> Accounting data (invoices): 10 years from the end of the accounting year
> Data required for evidentiary purposes: duration of the legal limitation period (5 years in general)
> Other data: for the duration of the use of CARSUP Services and up to 3 years from the date of the deletion of the User Account or the last use of the Services.
Your Personal Data, collected and processed by CARSUP, is exclusively intended for CARSUP and/or CARSUP Service Providers and Operators (as defined in the CGS) as well as support providers (hosts, CRM application platforms and others), for the sole purpose of responding to your requests and allowing the execution of the Services for your satisfaction.
In any event, CARSUP only transmits your personal data to a third party when:
> CARSUP must share this Data with third parties to provide you with the Service you request and to the sharing/transfer of which you have expressly consented, when signing the Contract and the corresponding acceptance of the CGS (article 15)
> or, for other necessary transfers, CARSUP has obtained your express prior agreement for the sharing of your Personal Data
> or CARSUP is required by a judicial authority or any other administrative or judicial authority (bailiffs, notaries, etc.) to communicate your Data to it.
For the purposes of technical storage and security of your Personal Data, they are centralized:
> with regard to the Application, the information and Data collected via the Application are stored and hosted in the datacenters located in the European Union of the company Amazon Web Services - LightSail; Amazon Web Services Inc. - 410 Terry Avenue North - 410 Terry Avenue North - Seattle, WA 98109-5210, USA. Contact: https://aws.amazon.com, tel. +00 (206) 266-4064, email: contact@amazon.com.
> with respect to the Site or sub-site sites linked to the domain www.carsup.io : on the servers of Webflow INC, located at 11th Street, 2nd Floor - San Francisco, CA 94103. Contact: contact@webflow.com. The company Webflow INC is listed among the organizations certified by the United States Department of Commerce (Data Privacy Framework) who are committed to adhering to the legal framework and standard contractual clauses of the European Union in application of the RGPD. The transfer of Data by CARSUP to Webflow therefore presents an adequate level of Data protection, in application of the Data Processing Addendum concluded.
For the purposes of order taking, billing and collection in particular, the necessary Personal Data collected via our Digital Supports are stored and hosted on servers located in France or Belgium at our CRM solution publisher Odoo, which acts and guarantees the protection of Personal Data in accordance with the rules set out by the RGPD and in application of the subscription contract taken out by CARSUP.
> See the Odoo guide to European data protection rules
For marketing purposes (to deliver personalized messages, to offer you a smooth and adapted experience on our Digital Supports and on the telephone), your transactional (orders) and behavioral Data (opening and clicking in emails and behavior on our Digital Supports) are also stored and hosted on the servers of our service provider Odoo.
> Odoo S.A. - Data protection - Chaussée de Namur, 40 - 1367 Grand-Rosière — Belgium - Contact information: privacy@odoo.com
> Odoo Privacy Policy.
Your Personal Data collected via the Site may be transferred to the United States via the host of the Site, Webflow; however, it is recalled that Webflow is among the organizations certified by the United States Department of Commerce which are committed to adhering to the legal framework of the RGPD, in particular by respecting the standard contractual clauses adopted by the European Union.
Your Personal Data collected via our Digital Media may be transferred to Canada through replications of backups carried out by Odoo, it being specified that Odoo indicates that hosting/transfer outside the European Union, if applicable, meets the adequacy of protection requirements of the European Union.
However, your Personal Data may not be transferred, rented or exchanged for the benefit of third parties, without the prior and express consent of the User for this purpose.
Even after having consented to the processing of your Data pursuant to this Privacy Policy, you retain the right to withdraw your consent to the processing (and in particular to the transfer outside the European Union) of your Data at any time in the terms provided for in article 7.3 of the RGPD and Article 4 below.
CARSUP has endeavoured to put in place all useful precautions to preserve the confidentiality and security of the Personal Data processed and to prevent them from being deformed, damaged, destroyed or from being accessed by unauthorized third parties. Technical and organizational security measures in accordance with the state of the art, in particular with regard to information systems, have been implemented. As part of the creation of the User Account, entering a password that is personal to you is mandatory and is part of our Privacy Policy.
However, CARSUP does not control all the risks associated with the functioning of the Internet and:
> draws the attention of Users to the existence of possible risks inherent in its use and operation.
> urges Users to refer to the terms and conditions of the CGU (which must be respected) which detail the obligations of Users in terms of vigilance and maintaining the security and confidentiality measures required to ensure the protection of their login identifiers.
You have the right to receive a copy of your Personal Data in our possession (“right of access”).
You can also request the deletion of your Personal Data as well as the correction of erroneous or obsolete Personal Data. (“right to de-referencing and right to rectification”). Please note that we may keep certain information about you when required to do so by law or when we have a legitimate reason to do so.
You also have the right to object at any time, for reasons relating to your particular situation, (i) to the processing of your Personal Data for direct marketing purposes or to processing carried out on the basis of our legitimate interest. (“right to object”).
You have the right to limit the processing carried out on your Personal Data (“right to limitation”). Please note that this right only applies if (i) you contest the accuracy of your Personal Data for the period allowing us to verify the accuracy of your Personal Data; (ii) in the event of unlawful processing on our part and you require a limitation of their use rather than an deletion, (iii) we no longer need the Personal Data for the purposes of processing but they are still necessary for the establishment, exercise or defense of rights in justice; iv) in case of exercising your right of opposition during the period of verification to determine whether the legitimate reasons we are pursuing prevail over yours.
You have the right to file a complaint with the competent supervisory authority or to obtain compensation from the competent courts if you consider that we have not respected your rights. (“right to file a complaint”).
You also have the right to the portability of your data, i.e. the right to receive the Personal Data that you have transmitted to us in a structured, commonly used and machine-readable format and the right to transmit this data to another data controller. (“right to portability”).
You also have the right to define guidelines relating to the fate of your Personal Data after your death. (“right to define guidelines after death”).
You have the right to access the File of Bank Accounts and Similar Accounts (FICOBA) (“right of access to FICOBA”) and you also have the right not to be the subject of a fully automated decision, which would have a legal effect or would significantly affect you (“right to profiling”).
Finally, you have the right to refuse any commercial prospecting on our part by unsubscribing from the electronic messages we send by clicking on the unsubscribe link at the bottom of each message concerned or by contacting us. (“right to refuse any commercial prospecting”)).
To exercise these rights, you can contact our contact point for the management of personal data in the following ways:
> For the newsletter: either within the dedicated section of our website (contact form) or by using the unsubscribe link in each newsletter sent to you.
> As part of an order for CARSUP services:
>> via the contact form or by email to dp@carsup.io
>> or by sending a letter to: CARSUP, Personal Data Protection, 1 rue des Hauts, 45380 La Chapelle Saint-Mesmin, France.
More generally, you can ask any question relating to the management of your personal information by sending an email to dp@carsup.io or a letter to: CARSUP, Personal Data Protection, 1 rue des Hauts, 45380 La Chapelle Saint-Mesmin, France.
In addition, in the event of a complaint, you can send a complaint directly to the Commission Nationale de l'Informatique et des Libertés, at the following link: https://www.cnil.fr/fr/plaintes.
At the time of any request to exercise its rights, CARSUP reserves the right to ask you to justify your identity by any means. If we have doubts about your identity, we may ask you for additional information that appears necessary including, if applicable, a copy of a signed identity document.
For any request from the User relating to his rights, CARSUP undertakes to respond to him as soon as possible and, in any event, within one month of receiving his request. If necessary, this period may be extended by two months taking into account the complexity and number of requests sent to CARSUP. In this case, the User will be informed of this extension and the reasons for the delay.
If his request is presented in electronic form, the information will also be provided to him electronically when possible, unless the User expressly requests that it be otherwise.
A Cookie is a small text file that can be saved in a dedicated space on the hard drive of your terminal (computer, tablet, smartphone...) when you consult an online service using your browser software (web browser). A Cookie file allows its sender to identify the terminal in which it is registered and to recognize the browser on your terminal, during the period of validity or registration of said Cookie.
Websites use Cookies to help users navigate efficiently and perform certain functions. Cookies necessary for the proper functioning of the website can be set without your permission. All other cookies must be approved before they can be set up in the browser.
CARSUP uses Cookies to offer you the best possible experience on its Site, to offer you personalized content and for audience measurement or advertising purposes. The deposit of Cookies is likely to allow us to access navigation data and/or Personal Data concerning you.
The purpose of the Cookies we issue is:
> to establish statistics and volumes of attendance and use of the various elements that make up our Digital Supports (sections and content visited, routes), allowing us to improve the interest and ergonomics of our services, as well as the visibility of the content we publish;
> to allow or facilitate your navigation on our Digital Media, or to provide you with the online communication services that you request while browsing, and thus:
>> to adapt the presentation of our Digital Media to the display preferences of your terminal (language used, display resolution, operating system used, etc.) during your visits to our Site, according to the hardware and software for viewing or reading that your terminal includes;
>> to memorize information relating to a form that you filled out on our Digital Supports (registration or access to your account) or to services or information that you have chosen on our Digital Supports (service subscribed to, content of an order, etc.);
>> to allow you to access reserved and personal areas of our Digital Media, such as your account, using identifiers or data that you may have previously given us;
>> to implement security measures, for example when you are asked to connect to a content or service again after a certain period of time.
These Cookies are divided into different categories:
> Strictly necessary: Strictly necessary Cookies enable basic functionalities of the Site such as user login and account management. The Site cannot be used properly without strictly necessary Cookies.
> Performance: Performance Cookies are used to see how Users use the Site, for example analytics cookies. These cookies cannot be used to directly identify a specific User.
> Targeting: Targeting Cookies are used to identify Users on various websites, for example content partners, banner networks. These Cookies can be used by businesses to create a profile of visitors' interests or to display relevant advertising on other websites.
> Functionality: Functionality Cookies are used to remember User information on the Site, such as language, time zone, and enhanced content.
Our Digital Media also use the “AdWords” and Remarketing List functionalities of Google Analytics for the Display Network. We use first-party “Cookies” (such as Google Analytics “cookies”) and third-party “Cookies” (such as DoubleClick “cookies”) in order to adapt, optimize, and deliver ads based on your previous visits. As a result, Google can show our ads on other sites that you visit. You can get acquainted with How Google uses your data.
You can disable DoubleClick “Cookies” and the delivery of personalized ads from the Google Display Network by going to the Ad Settings page at “google.com/settings/ads.” Please note that if you deactivate “cookies”, you will not be able to take advantage of all the functions of our Site.
The issuance and use of cookies by third parties are subject to the privacy policies of these third parties. We inform you of the purpose of the cookies we are aware of and the means at your disposal to make choices with respect to these cookies.
5.3.1. Cookies issued as a result of third-party applications integrated into our Site:
We may include computer applications from third parties on our Site, which allow you to share content from our Site with other people or to let these other people know your consultation or your opinion concerning the content of our Site. This is in particular the case of the “Share”, “Like” buttons, from social networks (such as “Facebook”, “Twitter” etc.).
The social network providing such an application button is likely to identify you using this button, even if you did not use this button when consulting our Site. Indeed, this type of application button can allow the social network concerned to follow your navigation on our Site, simply because your account with the social network concerned was activated on your terminal (open session) during your browsing on our Site.
You can get acquainted with how Meta (formerly Facebook) uses your data.
We have no control over the process used by social networks to collect information relating to your browsing on our Site and associated with the personal data they have at their disposal. We invite you to consult the privacy policies of these social networks in order to learn about the purposes of use, in particular advertising, of the browsing information that they can collect through these application buttons. In particular, these protection policies must allow you to exercise your choices with these social networks, in particular by setting up your user accounts for each of these networks.
5.3.2. Cookies issued on our Site by third parties:
Our Site may contain Cookies issued by third parties (communication agency, audience measurement company, etc.) and allowing them, during the period of validity of these Cookies: to collect browsing information relating to Terminals consulting our Site, and in particular in order to measure the effectiveness of our paid referencing campaigns with search engines.
Several possibilities are offered to you to manage Cookies. Any configuration that you may undertake will be likely to modify your navigation on our Site and your conditions of access to certain services requiring the use of Cookies.
5.4.1. The choices offered by the CARSUP Site
When you first browse our Site, we will ask you to make your choice in terms of Cookies:
> By clicking on “Accept all” you consent to the use of all categories of Cookies (see Articles 5.2 and 5.3)
> By clicking on “Reject All” you refuse Cookies that require your consent (such as those that are strictly necessary) and you will not have access to certain functionalities or personalized content.
> By clicking on “Personalize my choice”, you can configure, modify your preferences or withdraw your consent for all or certain categories of Cookies.
Your choices concerning Cookies will be kept for a period of six (6) months.
Then, you can deactivate or modify your cookie choices at any time by clicking on the “Cookie settings” icon, always visible at the bottom left of the Site. Your new choices regarding Cookies will be retained for a period of six (6) months.
At the end of the period of six (6) months, if no change has occurred, we will ask you again to make your choice in terms of Cookies.
5.4.2. The choices offered to you by your browser
You can configure your browser software so that Cookies are saved in your terminal or, on the contrary, that they are rejected, either systematically or according to their sender. You can also configure your browser so that the acceptance and refusal of Cookies are offered to you from time to time, before a Cookie is likely to be saved in your terminal.
> The cookie agreement
The registration of a Cookie in a terminal is essentially subject to the will of the Terminal User, which the latter can express and modify at any time and free of charge through the choices offered to him by his browser software. If you have accepted the recording of Cookies in your terminal in your browser software, the Cookies integrated into the pages and content you have consulted may be stored temporarily in a dedicated space on your terminal. They will only be readable by their sender.
> Refusal of Cookies
If you refuse the registration of Cookies on your terminal, or if you delete those saved there, you will no longer be able to benefit from a certain number of functionalities which are nevertheless necessary to navigate in certain areas of our Application. This would be the case if you tried to access our content or services that require you to be identified. This would also be the case when we or our service providers could not recognize, for technical compatibility purposes, the type of browser used by your terminal, its language and display settings or the country from which your terminal seems to be connected to the Internet. Where applicable, we decline all responsibility for the consequences related to the degraded functioning of our Services resulting from our inability to save or consult the cookies necessary for their functioning and that you would have refused or deleted.
> How to exercise your choices, depending on the browser you use?
For the management of Cookies and your choices, the configuration of each browser is different. It is described in the help menu of your browser, which will allow you to know how to change your cookie preferences.
If your terminal is used by several people and when the same terminal has several navigation software, we cannot be certain that the services and advertisements intended for your terminal correspond to your own use of this terminal and not to that of another user of this terminal.
If necessary, sharing the use of your terminal with other people and configuring your browser settings with respect to cookies is your free choice and your responsibility.
For more information on cookies and their use, you can consult the file of the Commission Nationale de l'Informatique et des Libertés at the following address: http://www.cnil.fr.
We use the Sentry.io service to collect anonymous statistics on the use of our Application as well as error information in order to continuously improve our service. All data collected for these purposes by Sentry.io is anonymized and does not allow you to be personally identified.
Information collected includes:
> Technical data such as application and operating system versions, information about errors and anomalies encountered in the application. This collection helps us maintain the quality of our services, identify application malfunctions and improve the user experience.
> Global and anonymous usage statistics, which will be the subject of a request for your prior consent.
No information that can identify you personally (name, email address, etc.) is transmitted to Sentry.io.
The data collected is not used for automated decision-making or for profiling purposes. Sentry.io stores the collected data on servers located within the European Union, ensuring that the information is not transferred outside the EU.
For more information on Sentry.io's privacy policy, please see this link: https://sentry.io/privacy/
5.6.1. Management of consents for the monitoring of usage statistics in the Mobile Application
When using our Application for the first time, we will ask for your explicit consent for the collection of anonymous statistics for the purposes of analysis and continuous improvement of our services.
You can, at any time, modify or withdraw your consent by accessing the application settings, under the “My Account” section. Withdrawing your consent will not affect the use of the Application, but may limit our ability to understand and improve the user experience.
This Privacy Policy came into force on 01/09/2024.
As our business is constantly evolving, our Privacy Policy is subject to change as a result, in part or in whole.
We will ensure that you are informed of these changes either by a special mention on our Application, or by a personalized warning, or by display the next time the Application is opened or when browsing the Site.
Changes to the Privacy Policy will be effective as of the publication of the new Policy. The use by the User of the Application or the Site, following the entry into force of the new Privacy Policy, will constitute recognition and acceptance of the new Policy (except in cases where the User will be expressly asked to accept the new Privacy Policy). In the absence of acceptance and if this new Policy does not suit the User, the User will no longer have to access or navigate on Digital Media, and he may also request the deletion of his User Account. In any event, the User is informed that he will not be able to order Services if he does not wish to agree to the processing of his Personal Data in accordance with the Privacy Policy, the implementation of which is necessary for the execution of the Services.