Last updated: September 16, 2026
Privacy Policy
Article 1 — Data Controller
The data controller for personal data is:
COULET Maël
Sole Proprietorship (Entrepreneur individuel) — Trading name: BORA CARS
3 Rue de la Fontaine, 25620 Tarcenay-Foucherans, France
Email: contact@boracars.com
BORA CARS does not have a designated Data Protection Officer (DPO). For any enquiry regarding your personal data, please contact the data controller directly at the address above.
Article 2 — Data Collected
In the course of its business activities, BORA CARS may collect the following categories of personal data:
2.1 — Identification and Booking Data
- First and last name;
- Date of birth;
- Postal address;
- Email address;
- Phone number;
- Copy of driving license;
- Copy of identity document (national ID card or passport);
- Proof of address;
- Any additional document requested for identity verification purposes.
2.2 — Financial Data
- Payment information (deposit, balance, security deposit);
- Banking or payment details submitted during the transaction.
2.3 — Browsing Data
- IP address;
- Browser type and operating system;
- Pages visited, visit duration, navigation path;
- Data collected via cookies and trackers (see Article 7).
2.4 — Communication Data
- Messages sent via the website contact form;
- Exchanges by email, telephone, or social media;
- Email address collected through newsletter subscription (where applicable).
Article 3 — Purposes of Processing
Personal data collected is processed for the following purposes:
- Booking management and performance of the rental agreement — Legal Basis : Performance of a contract (Art. 6.1.b GDPR)
- Client identity and eligibility verification — Legal Basis : Performance of a contract (Art. 6.1.b GDPR)
- Invoicing and payment management — Legal Basis : Performance of a contract (Art. 6.1.b GDPR)
- Client relationship management (follow-up, complaints, after-rental service) — Legal Basis : Legitimate interest (Art. 6.1.f GDPR)
- Sending marketing communications and newsletters — Legal Basis : Consent (Art. 6.1.a GDPR)
- Website traffic analysis and improvement — Legal Basis : Consent (Art. 6.1.a GDPR)
- Advertising audience measurement (Meta Pixel) — Legal Basis : Consent (Art. 6.1.a GDPR)
- Compliance with legal and accounting obligations — Legal Basis : Legal obligation (Art. 6.1.c GDPR)
Article 4 — Data Retention Periods
Personal data is retained for the following periods:
- Booking data and rental agreement — Retention Period : 5 years from the end of the contract (accounting and tax obligations)
- Copies of identity documents and driving license — Retention Period : Deleted within 30 days of vehicle return, unless a dispute is ongoing
- Invoicing and accounting data — Retention Period : 10 years (statutory accounting requirements)
- Browsing data and cookies — Retention Period : Maximum 13 months from when the cookie is set
- Newsletter data — Retention Period : Until consent is withdrawn (unsubscription)
- Contact form data — Retention Period : 3 years from the last exchange
Upon expiry of these periods, data is deleted or irreversibly anonymised.
Article 5 — Data Recipients
Personal data is processed exclusively by BORA CARS and is only shared with third parties in the following cases:
- Payment processors: for secure transaction processing;
- Technical service providers: website hosting (Netlify, Inc.), analytics tools (Google Analytics), advertising tools (Meta Platforms, Inc.);
- Insurers: in the event of an incident during the rental period;
- Competent authorities: upon judicial order or legal obligation.
BORA CARS does not sell, rent, or otherwise transfer its clients' personal data to third parties for commercial purposes under any circumstances.
Transfers Outside the European Union
Certain technical service providers (Netlify, Google, Meta) are based in the United States. Such transfers are governed by the appropriate safeguards under the GDPR (European Commission standard contractual clauses or adequacy decision, as applicable).
Article 6 — User Rights
In accordance with the GDPR (EU 2016/679) and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights regarding your personal data:
- Right of access: to obtain confirmation that your data is being processed and to receive a copy;
- Right to rectification: to have inaccurate or incomplete data corrected;
- Right to erasure: to request the deletion of your data, subject to statutory retention obligations;
- Right to restriction of processing: to request suspension of processing in certain circumstances;
- Right to data portability: to receive your data in a structured, machine-readable format;
- Right to object: to object to processing on legitimate grounds, or at any time for direct marketing purposes;
- Right to withdraw consent: to withdraw your consent at any time for processing based on consent (newsletter, analytics and advertising cookies), without affecting the lawfulness of processing carried out prior to withdrawal.
How to Exercise Your Rights
Send your request by email to: contact@boracars.com, accompanied by a copy of your identity document. BORA CARS undertakes to respond within 30 days.
Complaint
In the event of a dispute, you have the right to lodge a complaint with the French data protection authority (CNIL):
- Website: www.cnil.fr
- Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Article 7 — Cookies and Trackers
7.1 — What Is a Cookie?
A cookie is a small text file stored on your device (computer, smartphone, tablet) when you visit www.boracars.com. It records information relating to your browsing activity.
7.2 — Cookies Used
- Essential cookies — Name / Tool : Session, security ; Purpose : Website functionality, browsing security ; Duration : Session duration ; Consent Required : No
- Analytics cookies — Name / Tool : Google Analytics ; Purpose : Audience measurement, traffic and behaviour analysis ; Duration : 13 months ; Consent Required : Yes
- Advertising cookies — Name / Tool : Meta Pixel (Facebook) ; Purpose : Advertising campaign performance measurement, targeting, and remarketing ; Duration : 13 months ; Consent Required : Yes
7.3 — Managing Your Preferences
On your first visit to the website, a cookie banner allows you to accept or decline non-essential cookies. You may change your preferences at any time:
- Via the cookie banner or consent management module on the website;
- Via your browser settings (deleting or blocking cookies).
Declining analytics and advertising cookies does not affect your ability to browse the website.
7.4 — Third-Party Cookies
Cookies set by Google Analytics and Meta Pixel are subject to the respective privacy policies of Google (https://policies.google.com/privacy) and Meta (https://www.facebook.com/privacy/policy).
Article 8 — Data Security
BORA CARS implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Financial transactions are secured using standard encryption protocols.
Article 9 — Policy Updates
BORA CARS reserves the right to amend this privacy policy at any time. Any changes will be published on this page with an updated revision date. In the event of a material change, users will be notified through appropriate means.
Article 10 — Governing Law
This privacy policy is governed by French law and the GDPR (EU 2016/679). In the event of a dispute, the competent courts within the jurisdiction of BORA CARS' registered office (Tribunal judiciaire de Besançon) shall have jurisdiction.
BORA CARS — All rights reserved.