Data Protection Statement
We appreciate your interest in our company. GP SAS management places particular emphasis on the security of user data and compliance with data protection laws. You can visit the website www.pilote.fr without providing any personal information. However, we may need to process your personal data if you wish to avail specific services from our company through our website. In cases where such processing is required and there is no legal basis, we always seek explicit consent from the concerned individual.
The processing of personal data, such as name, address, email address, or phone number, is always done in accordance with the General Data Protection Regulation and the applicable national data protection laws for GP SAS. Through this data protection statement, our company aims to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Additionally, individuals concerned will be informed about their rights in this matter.
As the data controller, GP SAS has implemented numerous technical and organizational measures to ensure comprehensive protection of personal data collected on this website. However, internet data transmission may have security gaps, making absolute protection impossible. For this reason, individuals concerned also have the option to provide their data through alternative means, such as by phone.
Data Controller’s Identity
Data Controller Entity:
The Data Controller, as per the General Data Protection Regulation, any data protection laws applicable in the Member States of the European Union, or any other directive related to data protection, is:
Route du demi-bœuf
44310 La Limouzinière
Contact Information for the External Data Protection Officer:
Email : email@example.com
The data protection statement is based on the terminologies of the General Data Protection Regulation (GDPR).
Personal data refers to any information concerning an identified or identifiable natural person (hereinafter referred to as the “data subject”). An “identifiable natural person” is considered to be a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific factors specific to his physical, physiological, genetic, mental, economic, cultural, or social identity.
A data subject is an identified or identifiable natural person whose personal data is processed by the data controller.
Processing refers to any operation or set of operations performed, with or without the aid of automated processes, and applied to personal data or sets of personal data. These operations include collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, communication by transmission, dissemination, or any other form of making available, alignment, or combination, restriction, erasure, or destruction.
Data Controller or Controller
The data controller or controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing. When the purposes and means of such processing are determined by the law of the Union or the law of a Member State, the data controller may be designated or the specific criteria for its designation may be provided for by the law of the Union or the law of a Member State.
The processor is the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.
The recipient is the natural or legal person, public authority, agency, or any other body to whom personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
A third party is a natural or legal person, public authority, agency, or body other than the data subject, the data controller, the processor, and the persons who, under the direct authority of the data controller or the processor, are authorized to process personal data.
Consent refers to any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her.
Information on the Collection of Personal Data
Collection of Data and General Information
GP SAS needs to collect personal information from you to provide you with a service. We collect personal information when you provide it to us, whether by phone, postal mail, email, or through your use of any of our websites or products and services. Please note that, in certain circumstances, if you do not provide the personal information we require, we may not be able to provide you with the products and services for which you have subscribed, or we may not be able to comply with a legal obligation.
Through data collection, GP SAS can provide its clients with user-friendly services and optimize the information and offers presented on our website to better meet the expectations of the public. Our legitimate interests include:
- Ensuring the proper administration and management of our customer relationship.
- Understanding how our customers use our services and optimizing our vehicle fleet.
- Analyzing the services or products our customers desire or how they would like our services and products to be improved.
- Understanding how our customers use our websites and identifying issues with website usage.
- Improving the customer user experience.
- Informing our customers about various products and services we offer and keeping them informed about updates.
- Understanding customer feedback and responding to it as effectively as possible.
- Improving the promotions and benefits we can offer to our customers.
- Managing disputes and accidents and obtaining legal or professional advice.
Whenever a person visits the website www.pilote.fr, certain data and general information are recorded. This information is stored in server log files. The following data may be recorded:
- The type and version of the web browser used.
- The computer’s operating system.
- The URL of the site from which the system accessed pilote.fr.
- The sub-sites from which the system accessed pilote.fr.
- The date and time of access to our site.
- The Internet service provider of the system.
Any other data and similar information that would help us defend against an attack on our computer systems.
These anonymously collected data and information will be evaluated by GP SAS for statistical purposes and with the aim of improving the protection and security of our company’s data, thereby ensuring optimal protection of the personal data we process. The anonymous data from server log files will be stored separately from any other personal data of the data subject.
Categories of Personal Data
In the course of our professional activities, we may process the following categories of personal data:
• Permanent data: Permanent data includes, for example, first name, last name, company name, address (private and/or professional), date of birth, nationality.
• Contact data: Contact data includes, for example, phone number, email address (private and/or professional).
• Optional data: Optional data refers to information that you provide voluntarily, such as your preferences regarding vehicle equipment or vehicle category preferences. This may also include additional details about your journey to the agency (flight, train, etc.).
Use of Social Media
GP SAS is active on various social media platforms.
• Facebook Page: Pilote
• YouTube Channel: Pilote
A social network is an online platform, a virtual community on the Internet that typically allows users to communicate and interact with each other. A social network can serve as a platform for the exchange of opinions and experiences or enable the online community to share personal or business-related information.
We are not aware of the content of the data transmitted and its use by these companies. You can refer to the privacy policies of these individual companies for more information on the purpose and extent of the processing of data, as well as their provisions regarding the use of your personal data:
• Facebook: Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA
For individuals residing outside the United States or Canada, the data controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
• YouTube: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USAYouTube: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA
Use of Google Tools
The website www.pilote.fr employs several tools from the American internet giant Google. This allows us to increase efficiency, stay organized, grow our business, and be constantly at your service.
Google uses this information to evaluate your use of the www.pilote.fr website, generate reports on site activities, and provide additional services related to web and internet usage. This data primarily allows us to optimize the www.pilote.fr website and conduct a cost-benefit analysis of internet advertising.
This service allows for the display of interactive maps directly on the www.pilote.fr website for an optimized user experience. This makes the site more functional and attractive to users, representing a legitimate interest for GP SAS.
Google Tag Manager
The www.pilote.fr website uses the Google Tag Manager service. It allows for the administration of tags via a dedicated platform and the collection of data useful for the management and improvement of our products and services. In the realm of computing and programming, a tag refers to a series of characters intended to automatically trigger the execution of an action by a computer program. Tags primarily allow for data collection.
Our services use Google Ads, Google’s online advertising platform. Google Ads installs a cookie on your computer (“Conversion Cookie”) when you arrive on our website through a Google ad. These cookies are valid for only 30 days and cannot personally identify you. Information collected with the conversion tracking cookie is used to establish conversion statistics for Google Ads clients. AdWords clients learn the number of users who clicked on their ad and were directed to a page with a conversion tracking tag.
Use of HubSpot Tools
The website www.pilote.fr utilizes the HubSpot service, which allows us to create forms and, through them, better understand the visitors to our websites. This service also enables us to personalize the experience on the sites by placing a cookie for each visitor.
You have the option to send us requests via email through our website on the contact page. If you send us information requests, we store the information you provide (email address, subject of your email, content of your message, and the date of contact), including the contact details you enter (name, first name, address, and phone number if applicable) to process your request and for subsequent exchanges. We do not transmit this data without your consent. The email address you entered remains in our software until you ask us to delete it or revoke your consent for storage.
Object and Legal Basis of Processing
We specify below what the legal bases are for the data processing activities that we carry out:
The purposes for which we collect information are as follows:
Execution of a Contract:
Legal Basis: Article 6, paragraph 1, letter b of the GDPR.
Justification: Processing is necessary for the performance of a contract to which the data subject is a party. This includes the processing of data related to the provision of a service or the execution of pre-contractual measures, such as requests for our products or services.
Compliance with Legal Obligations:
Legal Basis: Article 6, paragraph 1, letter c of the GDPR.
Justification: Processing is necessary for compliance with a legal obligation to which our company is subject, such as fulfilling tax obligations.
Safeguarding Vital Interests:
Legal Basis: Article 6, paragraph 1, letter d of the GDPR.
Justification: Processing is necessary to protect the vital interests of the data subject or another natural person, for example, in the case of a visitor sustaining an injury during a visit to one of our agencies.
Legal Basis: Article 6, paragraph 1, letter f of the GDPR.
Justification: Processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, unless overridden by the interests or fundamental rights and freedoms of the data subject. This includes activities such as understanding customer usage patterns, optimizing our vehicle fleet, and improving customer experience.
Business Activities for Prosperity:
Legal Basis: Article 6, paragraph 1, letter f of the GDPR.
Justification: Processing is necessary for the performance of our business activities for the prosperity of our employees, clients, and shareholders. This encompasses various activities such as managing customer relations, analyzing customer preferences, improving website usability, informing customers about products and services, managing disputes and accidents, and seeking legal or professional advice.
Consent for Specific Purposes:
Legal Basis: Article 6, paragraph 1, letter a of the GDPR.
Justification: Outside the aforementioned cases, our company relies on the legal basis of consent for the processing of personal data for each specific purpose. This involves obtaining consent for specific activities mentioned above.
Note: GDPR refers to the General Data Protection Regulation.
Retention Period for Personal Data
The retention period for your personal data varies depending on the purpose of their collection:
- Permanent, contact, and contractual data are retained beyond the commercial relationship with selective archiving.
- Telephone conversations with our customer support are not retained.
Recipients of Personal Data
GP SAS internally transmits your data to various specialized departments to comply with its legal and contractual obligations. Personal data is only transmitted or disclosed to the extent necessary, in compliance with current data protection regulations.
GP SAS is a subsidiary of the Pilote Group, a company located in France operating at the European level. GP SAS may share information about data subjects with other entities within the Pilote Group as outlined in this policy.
Pilote may be required to transmit personal data to specific third parties to provide corresponding services or applications. These third parties offer external service provisions. They process data only according to our instructions, and they are prohibited from using this data for their own commercial purposes.
Transfer to a Third Country or International Organization:
GP SAS may need to transfer personal data to recipients located in countries outside the European Economic Area (EEA) for the aforementioned purposes. Transmission occurs only to fulfill our contractual and legal obligations or based on your consent. The transfer conditions are protected in accordance with the current regulations on the protection of personal data.
Rights of the Individuals Concerned
Right of Access:
European directives and regulations grant individuals whose personal data is processed the right to obtain, free of charge, from the data controller information about the personal data collected, the purpose of processing, the categories of data involved, the recipients or categories of recipients to whom this data has been communicated, the retention periods, and a copy of this information. To exercise this right of access, please contact firstname.lastname@example.org.
Right of Confirmation:
European directives and regulations grant individuals the right to obtain confirmation from the data controller that personal data concerning them is being processed. If an individual wishes to exercise this right of confirmation, they can address the Data Protection Officer at any time.
Right of Rectification:
You have the right to request the correction of inaccurate or incomplete personal information about you. If an individual wishes to exercise this right of rectification or have incomplete data completed, they can address the Data Protection Officer at any time. We will strive to update your personal data promptly.
Right to Erasure
In accordance with European directives and regulations, the individual concerned has the right to obtain from the data controller the erasure of personal data concerning them without undue delay when one of the following grounds applies and to the extent that their processing is not required:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- The individual withdraws consent on which the processing is based according to Article 6, paragraph 1, point (a), or Article 9, paragraph 2, point (a) of the GDPR, and there is no other legal ground for the processing.
- The individual objects to the processing pursuant to Article 21, paragraph 1 of the GDPR, and there are no overriding legitimate grounds for the processing, or the individual objects to the processing pursuant to Article 21, paragraph 2 of the GDPR.
- The personal data have been unlawfully processed.
- The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject.
- The personal data have been collected in relation to the offer of information society services referred to in Article 8, paragraph 1 of the GDPR.
If any of the above applies and an individual wishes for personal data recorded with GP SAS to be erased, they can contact the Data Protection Officer at any time. The Data Protection Officer will promptly address the request. Please note that we may retain certain information about you when required by law or when we have a legitimate reason to do so.
Right to Restriction of Processing
The individual concerned has the right to obtain from the Data Protection Officer the restriction of processing of personal data when one of the following applies:
- The accuracy of the personal data is contested by the individual concerned, for a period enabling the data controller to verify the accuracy of the data.
- The processing is unlawful, and the individual concerned opposes the erasure of personal data and requests the restriction of their use instead.
- The data controller no longer needs the personal data for the purposes of the processing, but they are required by the individual concerned for the establishment, exercise, or defense of legal claims.
- The individual concerned has objected to processing pursuant to Article 21, paragraph 1 of the GDPR, pending the verification whether the legitimate grounds of the Data Protection Officer override those of the individual concerned.
If any of the above applies, and an individual wishes to request the limitation of processing of personal data recorded by GP SAS, they can contact the Data Protection Officer. The Data Protection Officer will ensure the prompt handling of the request.
Right to Data Portability:
The individual concerned also has the right to data portability, meaning the right to receive the personal data provided in a structured, commonly used, and machine-readable format and the right to transmit this data to another data controller. When exercising the right to data portability under Article 20, paragraph 1 of the GDPR, the individual also has the right to have the personal data transmitted directly from one data controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.
Right to Object:
In accordance with European directives and regulations, any individual has the right to object at any time, for reasons related to their particular situation, to the processing of their personal data. From that moment, GP SAS no longer processes the personal data unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the individual concerned or for the establishment, exercise, or defense of legal claims. The individual concerned also has the right to object to the processing of their personal data for direct marketing purposes.
Right to Lodge a Complaint:
The individual concerned has the right to lodge a complaint regarding the processing of personal data with the Data Protection Officer or with a supervisory authority.
Revocation of Your Consent to Data Processing:
In accordance with European directives and regulations, any individual has the right to revoke their consent to the processing of their personal data at any time. If the individual concerned wishes to exercise their right to revoke their consent, they can contact email@example.com at any time. As the responsible entity, we waive automated decision-making processes or profiling.