Privacy policy

1. Data controller

The controller of the personal data collected through the FJ13.fr platform is:

• Jocelin FREQUELIN
• Trading name: FJ13
• Date of creation: 2019
• Email: contact@FJ13.fr
• GDPR contact: rgpd@FJ13.fr
• Chauffeur service licence (VTC, France's licensed private-hire chauffeur service): EVTC067190060

Jocelin FREQUELIN personally acts as data protection officer in practice, but no formal Data Protection Officer (DPO) has been appointed, as such an appointment is not mandatory given the nature of the activity and the volume of processing.

2. Data collected

When you use the platform, we collect the following data:

For FJ13 (chauffeur service operator)

• Surname, first name, company name, SIREN number
• Email address, telephone number
• Business postal address
• EVTC number, professional card number
• Bank details (IBAN/BIC) for invoicing
• Profile photo (optional)
• Connection data (IP address, user agent, timestamp)

For passengers (end customers)

• Surname, first name
• Email address, telephone number
• Pick-up and destination addresses
• Booking and invoicing history
• Ratings and comments left after journeys

For partner drivers

• Surname, first name, company name, SIREN number
• Email address, telephone number
• EVTC number, professional card
• Vehicle information (make, model, registration number)
• History of journeys completed

For prospects (enquiry via the contact form or a quote request)

• Name, email address, telephone number, content of the message
• Approximate location (city, region, country) inferred from the IP address
• Device type, operating system and browser (inferred from the user agent)
• Source of the enquiry (see section 5, marketing attribution)

No sensitive data within the meaning of the GDPR (health, religion, political opinions, sexual orientation, racial or ethnic origin) is collected. No full payment card data (card number) is stored on our servers: payments are processed directly by our payment provider (SumUp, Square, Stripe or Qonto, as the case may be).

3. Purposes of the processing

The data is collected for the following purposes:

• Creation and management of user accounts, secure authentication
• Handling, monitoring and fulfilment of transport bookings
• Invoicing, payment management and debt recovery
• Communication with customers and drivers (SMS, email, WhatsApp)
• Compliance with accounting and tax obligations (retention of invoices)
• Synchronisation with third-party services chosen by the user (Google Calendar, Stripe)
• Continuous improvement of the service and technical support
• Prevention and detection of fraud and abuse
• Handling of requests to exercise GDPR rights

4. Legal bases for the processing

Each processing activity relies on a specific legal basis:

• Performance of a contract (art. 6.1.b GDPR): handling of bookings, invoicing, account management
• Legal obligation (art. 6.1.c GDPR): retention of invoices (10 years), accounting data
• Legitimate interest (art. 6.1.f GDPR): improvement of the service, fraud prevention, IT security
• Consent (art. 6.1.a GDPR): sending of marketing communications, cookies that are not strictly necessary (where applicable)

5. Recipients and processors

Your data is processed by technical service providers selected for their GDPR compliance. A data processing agreement (DPA) has been signed with each of them in accordance with Article 28 of the GDPR:

SCCs = the European Commission's Standard Contractual Clauses (in French, CCT), which ensure an adequate level of protection for transfers outside the European Union.

6. Retention periods

• Active account data: kept for the whole duration of the contract
• Data after account closure: 3 years for evidential purposes, then anonymisation
• Invoicing data: 10 years after issue (accounting obligation, art. L123-22 of the French Commercial Code)
• Booking data: 3 years after the journey
• Connection and security logs: 12 months (art. L34-1 of the French Postal and Electronic Communications Code)
• Prospects (contact forms): 3 years after the last contact
• Strictly necessary cookies: duration of the session or 13 months at most

When these periods expire, the data is deleted or irreversibly anonymised, unless the law requires otherwise.

7. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification: have inaccurate or incomplete data corrected
• Right to erasure: request the deletion of your data
• Right to data portability: receive your data in a structured, commonly used format
• Right to object: object to the processing on legitimate grounds
• Right to restriction: request that the processing be temporarily suspended
• Right to withdraw your consent at any time, for processing based on consent
• Right to set post-mortem directives on what happens to your data

If you disagree with our reply, you may lodge a complaint with the CNIL:

• Commission Nationale de l'Informatique et des Libertés
• 3 place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
• Website: www.cnil.fr

8. Transfers of data outside the European Union

Some of our processors (Vercel, Stripe, Square, Resend, Google, Meta) are located in the United States. These transfers are governed by the Standard Contractual Clauses adopted by the European Commission, which ensure a level of data protection equivalent to that of the European Union.

Sensitive data (IBAN, SIREN, invoicing information) is stored exclusively on Supabase's European servers.

9. Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction:

• Full encryption of communications (HTTPS/TLS 1.3)
• JWT authentication with time-limited tokens
• Access control policies (RLS) at database level
• Passwords hashed with bcrypt (never stored in plain text)
• Strong passwords required (minimum 8 characters, with complexity requirements)
• Logging of sensitive access for 12 months
• Hosting on European servers certified ISO 27001 (Supabase)
• Automatic daily backups

10. Notification in the event of a breach

In the event of a data breach likely to result in a risk to your rights and freedoms, we undertake to:

• Notify the CNIL within 72 hours of becoming aware of it
• Inform you individually without undue delay if the risk is high
• Document the incident, its causes and the measures taken

11. Cookies and trackers

The site uses cookies that are strictly necessary for its operation and do not require prior consent:

• Supabase session cookie: keeps the user logged in
• Authentication token: stored in the browser's localStorage
• Theme preference (light/dark): remembers the chosen display setting
• Consent choice: remembers your answer to the cookie banner

Only with your consent, collected through the banner shown on your first visit:

• Google Ads tag (Google Ireland Ltd.): advertising conversion measurement, i.e. knowing whether a visit coming from an FJ13 ad ends in a quote request, a call, a WhatsApp message or a booking. Google cookies (for example _gcl_au) for up to 90 days, and a click identifier (gclid) kept for 90 days in the browser. This identifier may be passed to our booking provider Cabline and attached to your quote request.

Without consent, no request is sent to Google and the site works normally. We use neither Google Analytics, nor Meta Pixel, nor ad retargeting. You can withdraw your consent at any time:

12. Minors

Our service is not intended for minors under 15. No data is knowingly collected from children without the consent of their parents or legal guardians.

13. Changes to this policy

We reserve the right to amend this privacy policy to reflect legal, technical or organisational changes. Any substantial change will be notified by email to active users at least 30 days before it takes effect.

14. Contact

For any question about this policy or the processing of your personal data:

• By email: rgpd@FJ13.fr
• By post: Jocelin FREQUELIN, FJ13, 35 rue du Parc, 67960 Entzheim, France
• Via the online form: FJ13.fr/rgpd