Bledrive — bledrive.com and mobile app (EU GDPR, UK GDPR, PIPEDA, Quebec Law 25)
DRAFT — to be reviewed by a qualified lawyer before use
Version [X.X] — Last updated: [DATE]
1. Who is responsible for your data
1.1 The controller of personal data processed through the Platform is Bledrive LLC, [STATE] limited liability company, [ADDRESS], USA (“Bledrive”, “we”). Contact for privacy matters: [DPO EMAIL].
1.2 EU representative (as Bledrive is established outside the EU): [NAME, ADDRESS, EMAIL]. UK representative: [NAME, ADDRESS, EMAIL]. Person in charge of the protection of personal information (Quebec): [NAME/TITLE, EMAIL]. [COUNSEL: confirm need to appoint a DPO.]
1.3 The independent rental agency named in your booking (the “Partner”), established in Algeria, is a separate controller for the data it processes to perform the rental contract.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Identity | Name, date and place of birth, nationality | You |
| Identity documents | Passport / ID card scan, driving licence scan, International Driving Permit | You (upload) or Partner at handover |
| Contact | Email, phone, WhatsApp number, postal address, address in Algeria | You |
| Booking | Dates, places, flight number, vehicle, options, drivers, inspection reports and photos, damage/fine records | You, Partner |
| Payment | Payment metadata from Stripe (card brand, last 4 digits, country, transaction ID, status); COD receipts. We do not store full card numbers. | Stripe, Partner |
| Communications | Emails, WhatsApp messages, chat messages, complaints, call notes | You, Partner |
| Account & device | Login details, IP address, device and browser data, app version, language, logs | Automatically |
| Marketing & cookies | Cookie IDs, pixel events (Meta, TikTok, Google), campaign source, preferences | Automatically, with consent where required |
2.1 We do not intentionally collect special-category data. Please do not include health or other sensitive information in messages unless necessary (e.g. an accessibility request), in which case we process it only with your explicit consent.
3. Purposes and legal bases
Legal bases below refer to the EU GDPR and UK GDPR. For Canadian residents, we rely on your consent (express or implied, as appropriate) and the purposes listed, which a reasonable person would consider appropriate.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create your account, take and manage bookings, transmit the booking to the Partner, send confirmations and updates | Performance of a contract (Art. 6(1)(b)) |
| Verify driver identity, age and licence; prevent fraud | Contract; legitimate interests in preventing fraud and protecting Partners’ vehicles (Art. 6(1)(f)) |
| Process payments, refunds, deposits, chargebacks | Contract; legal obligation |
| Accounting, tax, responding to authorities | Legal obligation (Art. 6(1)(c)) |
| Customer service and complaints, including AI-assisted message handling (section 9) | Contract; legitimate interests in efficient support |
| Booking updates by WhatsApp | Contract / your choice of channel; [consent where required] |
| Damage, fines and claims management | Contract; legitimate interests in establishing and defending legal claims |
| Marketing emails/WhatsApp messages | Consent, or soft opt-in for existing customers where permitted; you can opt out at any time |
| Advertising and analytics cookies/pixels (Meta, TikTok, Google) | Consent (Art. 6(1)(a)) collected through the cookie banner |
| Platform security, debugging, service improvement | Legitimate interests |
4. Sharing your data
4.1 Partners in Algeria. We share with the Partner handling your booking the data needed to provide the vehicle: names, contact details, flight number, delivery address, driver information and, where uploaded, copies of your licence and passport. Partners are contractually bound to use it only for your rental and to protect it.
4.2 Service providers (processors) acting on our instructions:
| Provider | Role | Location / transfer mechanism [TO VERIFY] |
|---|---|---|
| Supabase | Database, authentication, file storage (document scans) | EU region [REGION]; sub-processors may be outside EU |
| [HOSTING PROVIDER] | Website / app hosting | EU [COUNTRY] |
| Stripe | Card payments, fraud prevention (Stripe is an independent controller for some processing) | EU/US — EU-US Data Privacy Framework / SCCs |
| WhatsApp (Meta) | Booking messages, customer support | US/global — DPF / SCCs |
| [EMAIL PROVIDER] | Transactional and marketing emails | [LOCATION] |
| [AI PROVIDER(S)] | AI agents assisting with customer messages (section 9) | [LOCATION] — [mechanism] |
| Meta (Facebook/Instagram), TikTok, Google | Advertising, measurement and analytics via cookies/pixels (with consent). These providers may act as joint or independent controllers for some processing. | US/global — DPF / SCCs |
| [ANALYTICS / CRM TOOL] | Analytics, CRM | [LOCATION] |
4.3 We may also disclose data to insurers, loss adjusters, lawyers, auditors, police and other authorities where required by law or to establish or defend legal claims, and to a buyer in the event of a business transfer.
4.4 We do not sell your personal data.
5. International transfers
5.1 Your data is hosted in the EU. It is transferred outside your country in particular: (a) to Algeria, to the Partner performing your rental; (b) to the United States, where Bledrive LLC is established and where some providers operate; and (c) to other countries where our providers or their sub-processors operate.
5.2 Algeria is not covered by an adequacy decision of the European Commission or the UK. Transfers to Partners are made under the EU Standard Contractual Clauses [and the UK International Data Transfer Addendum], supplemented by contractual and organisational measures (data minimisation, secure upload links, access limited to staff handling the rental, deletion after the rental). Certain transfers are also necessary for the performance of the rental contract you requested. [COUNSEL: confirm transfer mechanism and need for a transfer impact assessment.]
5.3 Transfers to the US rely on the EU-US Data Privacy Framework (and UK extension) where the recipient is certified, or on Standard Contractual Clauses.
5.4 Canadian and Quebec residents: your information may be stored and processed outside Canada and Quebec and may be accessible to courts and authorities of those countries. Before communicating personal information outside Quebec, we assess whether it will receive adequate protection, as required by Quebec law. [COUNSEL: privacy impact assessment to be documented.]
5.5 You may request a copy of the relevant safeguards at [DPO EMAIL].
6. Retention
| Data | Retention period [TO CONFIRM] |
|---|---|
| Account data | Until account deletion, or [3] years of inactivity |
| Booking and contract data | [5] years after the end of the rental (limitation periods) |
| Passport/licence scans | [30–90] days after the end of the rental, unless needed for an open claim or fine; Partners’ retention subject to Algerian law |
| Accounting and payment records | [7–10] years, as required by tax law |
| Customer service messages (incl. WhatsApp, AI-processed) | [24] months |
| Marketing data | Until you withdraw consent, or [3] years after last contact |
| Cookies | Maximum [13] months; consent choices stored [6–13] months |
7. Your rights
7.1 Depending on where you live, you have the right to: access your data; rectify it; erase it; restrict or object to processing (including at any time to direct marketing); data portability; withdraw consent at any time without affecting prior processing; and not to be subject to a decision based solely on automated processing producing legal or similarly significant effects. Quebec residents also have the right to be informed of, and to request correction of, information used in automated decisions, and to de-indexation where applicable.
7.2 To exercise your rights, write to [DPO EMAIL]. We may ask for proof of identity. We reply within one month (EU/UK) or 30 days (Canada), extendable where permitted by law.
7.3 You may complain to a supervisory authority: in France the CNIL; in the UK the Information Commissioner’s Office (ICO); in Canada the Office of the Privacy Commissioner of Canada; in Quebec the Commission d’accès à l’information; or the authority of your EU country of residence.
8. Cookies, pixels and consent
8.1 We use: (a) strictly necessary cookies (login, security, booking, consent storage) — no consent required; (b) analytics cookies (e.g. Google Analytics); and (c) advertising cookies and pixels (Meta Pixel / Conversions API, TikTok Pixel / Events API, Google Ads tags) to measure campaigns and show relevant ads.
8.2 Analytics and advertising cookies and pixels are only activated after you consent via our cookie banner, which offers “Accept all”, “Reject all” and “Customise” with equal prominence. Server-side events sent to advertising platforms are subject to the same consent. You can change your choice at any time via “Cookie settings” in the footer of the site or the app settings.
8.3 A full list of cookies, their providers and durations is available in our cookie table [LINK]. [COUNSEL: confirm consent mode configuration and app-tracking (iOS ATT) wording.]
9. AI agents processing customer messages
9.1 We use AI-based tools (“AI agents”) provided by [AI PROVIDER(S)] to help answer and route your messages received by email, WhatsApp or chat, draft replies, summarise conversations, and extract booking details (e.g. dates, flight numbers). The data processed may include the content of your messages and your booking information.
9.2 AI agents do not make decisions that produce legal or similarly significant effects on you (such as refusing a booking or charging damages) without human review. You can ask at any time to speak to a human agent.
9.3 Our AI providers act as processors under data processing agreements and [do not use your data to train their models]. We instruct the AI agents not to request sensitive data. [COUNSEL: check EU AI Act transparency obligations for chatbots and Quebec automated-decision disclosure.]
9.4 When you interact with an AI agent, you will be informed that you are communicating with an automated system.
10. Security
10.1 We use encryption in transit and at rest, access controls with least privilege, secure time-limited links for document sharing with Partners, logging and regular reviews. In the event of a data breach likely to result in a risk to you, we will notify the competent authorities and you as required by law.
11. Children
11.1 The Platform is not intended for persons under 18. We do not knowingly collect children’s data, except names/ages of child passengers where needed for a child seat, provided by the adult booking.
12. Changes and contact
12.1 We may update this policy; material changes will be notified by email or in the app. Contact: [DPO EMAIL] — Bledrive LLC, [ADDRESS].