# Privacy Policy

**BORA CARS**
*Last updated: May 27, 2026*

---

## Article 1 — Data Controller

The data controller for personal data is:

**COULET Maël**
Sole Proprietorship (Entrepreneur individuel) — Trading name: BORA CARS
3 Rue de la Fontaine, 25620 Tarcenay-Foucherans, France
Email: contact@boracars.com

BORA CARS does not have a designated Data Protection Officer (DPO). For any enquiry regarding your personal data, please contact the data controller directly at the address above.

---

## Article 2 — Data Collected

In the course of its business activities, BORA CARS may collect the following categories of personal data:

### 2.1 — Identification and Booking Data

- First and last name;
- Date of birth;
- Postal address;
- Email address;
- Phone number;
- Copy of driving license;
- Copy of identity document (national ID card or passport);
- Proof of address;
- Any additional document requested for identity verification purposes.

### 2.2 — Financial Data

- Payment information (deposit, balance, security deposit);
- Banking or payment details submitted during the transaction.

### 2.3 — Browsing Data

- IP address;
- Browser type and operating system;
- Pages visited, visit duration, navigation path;
- Data collected via cookies and trackers (see Article 7).

### 2.4 — Communication Data

- Messages sent via the website contact form;
- Exchanges by email, telephone, or social media;
- Email address collected through newsletter subscription (where applicable).

---

## Article 3 — Purposes and Legal Basis

Personal data collected is processed for the following purposes:

| Purpose | Legal Basis |
|---|---|
| Booking management and performance of the rental agreement | Performance of a contract (Art. 6.1.b GDPR) |
| Client identity and eligibility verification | Performance of a contract (Art. 6.1.b GDPR) |
| Invoicing and payment management | Performance of a contract (Art. 6.1.b GDPR) |
| Client relationship management (follow-up, complaints, after-rental service) | Legitimate interest (Art. 6.1.f GDPR) |
| Sending marketing communications and newsletters | Consent (Art. 6.1.a GDPR) |
| Website traffic analysis and improvement | Consent (Art. 6.1.a GDPR) |
| Advertising audience measurement (Meta Pixel) | Consent (Art. 6.1.a GDPR) |
| Compliance with legal and accounting obligations | Legal obligation (Art. 6.1.c GDPR) |

---

## Article 4 — Data Retention Periods

Personal data is retained for the following periods:

| Data Type | Retention Period |
|---|---|
| Booking data and rental agreement | 5 years from the end of the contract (accounting and tax obligations) |
| Copies of identity documents and driving license | Deleted within 30 days of vehicle return, unless a dispute is ongoing |
| Invoicing and accounting data | 10 years (statutory accounting requirements) |
| Browsing data and cookies | Maximum 13 months from deposit |
| Newsletter data | Until consent is withdrawn (unsubscription) |
| Contact form data | 3 years from the last exchange |

Upon expiry of these periods, data is deleted or irreversibly anonymised.

---

## Article 5 — Data Recipients

Personal data is processed exclusively by BORA CARS and is only shared with third parties in the following cases:

- **Payment processors**: for secure transaction processing;
- **Technical service providers**: website hosting (Netlify, Inc.), analytics tools (Google Analytics), advertising tools (Meta Platforms, Inc.);
- **Insurers**: in the event of an incident during the rental period;
- **Competent authorities**: upon judicial order or legal obligation.

BORA CARS does not sell, rent, or otherwise transfer its clients' personal data to third parties for commercial purposes under any circumstances.

### Transfers Outside the European Union

Certain technical service providers (Netlify, Google, Meta) are based in the United States. Such transfers are governed by the appropriate safeguards under the GDPR (European Commission standard contractual clauses or adequacy decision, as applicable).

---

## Article 6 — User Rights

In accordance with the GDPR (EU 2016/679) and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights regarding your personal data:

- **Right of access**: to obtain confirmation that your data is being processed and to receive a copy;
- **Right to rectification**: to have inaccurate or incomplete data corrected;
- **Right to erasure**: to request the deletion of your data, subject to statutory retention obligations;
- **Right to restriction of processing**: to request suspension of processing in certain circumstances;
- **Right to data portability**: to receive your data in a structured, machine-readable format;
- **Right to object**: to object to processing on legitimate grounds, or at any time for direct marketing purposes;
- **Right to withdraw consent**: to withdraw your consent at any time for processing based on consent (newsletter, analytics and advertising cookies), without affecting the lawfulness of processing carried out prior to withdrawal.

### How to Exercise Your Rights

Send your request by email to: **contact@boracars.com**, accompanied by a copy of your identity document. BORA CARS undertakes to respond within 30 days.

### Complaint

In the event of a dispute, you have the right to lodge a complaint with the French data protection authority (CNIL):
- Website: www.cnil.fr
- Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

---

## Article 7 — Cookies and Trackers

### 7.1 — What Is a Cookie?

A cookie is a small text file stored on your device (computer, smartphone, tablet) when you visit www.boracars.com. It records information relating to your browsing activity.

### 7.2 — Cookies Used

| Cookie Type | Name / Tool | Purpose | Duration | Consent Required |
|---|---|---|---|---|
| Essential cookies | Session, security | Website functionality, browsing security | Session duration | No |
| Analytics cookies | Google Analytics | Audience measurement, traffic and behaviour analysis | 13 months | Yes |
| Advertising cookies | Meta Pixel (Facebook) | Advertising campaign performance measurement, targeting, and remarketing | 13 months | Yes |

### 7.3 — Managing Your Preferences

On your first visit to the website, a cookie banner allows you to accept or decline non-essential cookies. You may change your preferences at any time:

- Via the cookie banner or consent management module on the website;
- Via your browser settings (deleting or blocking cookies).

Declining analytics and advertising cookies does not affect your ability to browse the website.

### 7.4 — Third-Party Cookies

Cookies set by Google Analytics and Meta Pixel are subject to the respective privacy policies of Google (https://policies.google.com/privacy) and Meta (https://www.facebook.com/privacy/policy).

---

## Article 8 — Data Security

BORA CARS implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Financial transactions are secured using standard encryption protocols.

---

## Article 9 — Policy Updates

BORA CARS reserves the right to amend this privacy policy at any time. Any changes will be published on this page with an updated revision date. In the event of a material change, users will be notified through appropriate means.

---

## Article 10 — Governing Law

This privacy policy is governed by French law and the GDPR (EU 2016/679). In the event of a dispute, the competent courts within the jurisdiction of BORA CARS' registered office (Tribunal judiciaire de Besançon) shall have jurisdiction.

---