Privacy policy

1. Overview

This Privacy Policy describes how ONLY VTC collects, uses, stores and protects its users' personal data in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

This policy applies to all users of the ONLY VTC Platform: individual customers, business customers, passengers and partner drivers.

2. Data Controller

3. Data Collected

3.1 Identification data

• First and last name
• Email address
• Phone number
• Profile photo (optional)

3.2 Login data

• Account credentials
• Login history
• IP address
• Device type and operating system

3.3 Geolocation data

• GPS position (with consent)
• Departure and arrival addresses
• Journey history

3.4 Payment data

• Bank card information (via secure provider Stripe)
• Transaction history
• Invoicing data

3.5 Driver-specific data

• Professional VTC card
• Driving licence
• Vehicle information
• Insurance certificate
• Bank details (for payment of income)

3.6 Company-specific data

• Company name and SIRET
• VAT number
• Invoicing contact details
• List of authorised staff

4. Purposes of Processing

We use your data for the following purposes:

4.1 Performing the service

• Creating and managing your account
• Connecting with drivers
• Processing bookings
• Real-time ride tracking
• Invoicing and payment

4.2 Improving the service

• Usage analysis to optimise the application
• Personalising the user experience
• Developing new features

4.3 Communication

• Ride-related notifications
• Service information (updates, changes)
• Marketing communications (with consent)

4.4 Security and compliance

• Fraud prevention
• Compliance with legal obligations
• Handling disputes and complaints

5. Legal Basis for Processing

Under the GDPR, we process your data on the following legal bases:

6. Data Recipients

Your data may be shared with:

6.1 Operational partners

• Partner drivers : information necessary to perform the ride
• Stripe : secure payment processing
• Google Maps : route calculation and geolocation
• SMS/email delivery providers : notifications

6.2 Hosting providers

Our data is hosted on secure servers located in the European Union.

6.3 Authorities

We may be required to transmit data to the competent authorities on judicial request or where there is a legal obligation.

7. Retention Period

We retain your personal data only for the periods indicated above. User account data is retained for the duration of the contractual relationship plus 3 years; geolocation data, 1 year; login logs, 1 year; ride history, 5 years; invoicing data, 10 years under the legal obligation to retain accounting records.

When these periods expire, data is automatically deleted from our production systems and backups, or irreversibly anonymised when retained for statistical purposes.

You may at any time request the deletion of your account and associated data from the application (Menu → Settings → My data) or by email to dpo@onlyvtc.fr. Deletion takes effect within 30 days, except for data subject to a legal retention obligation.

8. Your Rights

In accordance with the GDPR, you have the following rights:

8.1 Right of access

You may obtain a copy of all data concerning you.

8.2 Right to rectification

You may request the correction of inaccurate or incomplete data.

8.3 Right to erasure

You may request the deletion of your data, subject to our legal retention obligations.

8.4 Right to restriction

You may request the temporary suspension of the processing of your data.

8.5 Right to portability

You may obtain your data in a structured, machine-readable format.

8.6 Right to object

You may object to the processing of your data for legitimate reasons.

8.7 Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time.

We respond to your requests within one month. For complex requests, this period may be extended by two months.

9. Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of sensitive data at rest
• Strong authentication and access management
• Intrusion monitoring and detection
• Regular backups
• Staff training

10. Use of cookies

10.1 Essential cookies

Necessary for the site to function, they cannot be disabled:

• User session
• Security preferences

10.2 Analytics cookies

These make it possible to analyse use of the service (with consent):

• Browsing statistics
• Application performance

10.3 Managing cookies

You can manage your cookie preferences via your browser settings or our consent banner.

11. International Transfers

Your data is mainly processed within the European Union. In the event of a transfer to a third country, we ensure that appropriate safeguards are in place (standard contractual clauses, adequacy decision).

12. Minors

Our services are not intended for people under 16. If we discover that a minor's data has been collected without parental consent, we will delete it.

13. Changes

This Privacy Policy may be updated. We will inform you of any substantial change by notification in the application or by email. The date of the last update is indicated at the top of this document.

14. Complaints

If you believe that the processing of your data does not comply with regulations, you may lodge a complaint with the CNIL:

15. Contact us

For any question about this Privacy Policy or the processing of your data: