Privacy Policy

Data Protection Statement

We appreciate your interest in our company. GP SAS management places particular emphasis on the security of user data and compliance with data protection laws. You can visit the website www.pilote.fr without providing any personal information. However, we may need to process your personal data if you wish to avail specific services from our company through our website. In cases where such processing is required and there is no legal basis, we always seek explicit consent from the concerned individual.

The processing of personal data, such as name, address, email address, or phone number, is always done in accordance with the General Data Protection Regulation and the applicable national data protection laws for GP SAS. Through this data protection statement, our company aims to inform the public about the nature, scope, and purpose of the personal data we collect, use, and process. Additionally, individuals concerned will be informed about their rights in this matter.

As the data controller, GP SAS has implemented numerous technical and organizational measures to ensure comprehensive protection of personal data collected on this website. However, internet data transmission may have security gaps, making absolute protection impossible. For this reason, individuals concerned also have the option to provide their data through alternative means, such as by phone.

Our website contains links to sites of other providers or partners. Our Privacy Policy does not extend to the protection of your data on these websites. The data collected by the operators of these sites, if any, is beyond our knowledge and influence.

Data Controller’s Identity

Data Controller Entity:
GP SAS

The Data Controller, as per the General Data Protection Regulation, any data protection laws applicable in the Member States of the European Union, or any other directive related to data protection, is:
GP SAS
Route du demi-bœuf
44310 La Limouzinière
FRANCE

Tél : +33 (2) 43 32 16 00
Email : info@pilote.fr
web : www.pilote.fr

Contact Information for the External Data Protection Officer:
Christian Bonnin
Integraal-MD
44200 Nantes
Email : dpo@groupe-pilote.com

Definitions

The data protection statement is based on the terminologies of the General Data Protection Regulation (GDPR).

Personal Data

Personal data refers to any information concerning an identified or identifiable natural person (hereinafter referred to as the “data subject”). An “identifiable natural person” is considered to be a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific factors specific to his physical, physiological, genetic, mental, economic, cultural, or social identity.

Data Subject

A data subject is an identified or identifiable natural person whose personal data is processed by the data controller.

Processing

Processing refers to any operation or set of operations performed, with or without the aid of automated processes, and applied to personal data or sets of personal data. These operations include collection, recording, organization, structuring, storage, adaptation, or alteration, retrieval, consultation, use, communication by transmission, dissemination, or any other form of making available, alignment, or combination, restriction, erasure, or destruction.

Data Controller or Controller

The data controller or controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing. When the purposes and means of such processing are determined by the law of the Union or the law of a Member State, the data controller may be designated or the specific criteria for its designation may be provided for by the law of the Union or the law of a Member State.

Processor

The processor is the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller.

Recipient

The recipient is the natural or legal person, public authority, agency, or any other body to whom personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

Third Party

A third party is a natural or legal person, public authority, agency, or body other than the data subject, the data controller, the processor, and the persons who, under the direct authority of the data controller or the processor, are authorized to process personal data.

Consent

Consent refers to any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data concerning him or her.

Information on the Collection of Personal Data

Collection of Data and General Information

GP SAS needs to collect personal information from you to provide you with a service. We collect personal information when you provide it to us, whether by phone, postal mail, email, or through your use of any of our websites or products and services. Please note that, in certain circumstances, if you do not provide the personal information we require, we may not be able to provide you with the products and services for which you have subscribed, or we may not be able to comply with a legal obligation.

Through data collection, GP SAS can provide its clients with user-friendly services and optimize the information and offers presented on our website to better meet the expectations of the public. Our legitimate interests include:

  • Ensuring the proper administration and management of our customer relationship.
  • Understanding how our customers use our services and optimizing our vehicle fleet.
  • Analyzing the services or products our customers desire or how they would like our services and products to be improved.
  • Understanding how our customers use our websites and identifying issues with website usage.
  • Improving the customer user experience.
  • Informing our customers about various products and services we offer and keeping them informed about updates.
  • Understanding customer feedback and responding to it as effectively as possible.
  • Improving the promotions and benefits we can offer to our customers.
  • Managing disputes and accidents and obtaining legal or professional advice.

Whenever a person visits the website www.pilote.fr, certain data and general information are recorded. This information is stored in server log files. The following data may be recorded:

  • The type and version of the web browser used.
  • The computer’s operating system.
  • The URL of the site from which the system accessed pilote.fr.
  • The sub-sites from which the system accessed pilote.fr.
  • The date and time of access to our site.
  • The Internet service provider of the system.

Any other data and similar information that would help us defend against an attack on our computer systems.

These anonymously collected data and information will be evaluated by GP SAS for statistical purposes and with the aim of improving the protection and security of our company’s data, thereby ensuring optimal protection of the personal data we process. The anonymous data from server log files will be stored separately from any other personal data of the data subject.

Categories of Personal Data

In the course of our professional activities, we may process the following categories of personal data:

• Permanent data: Permanent data includes, for example, first name, last name, company name, address (private and/or professional), date of birth, nationality.
• Contact data: Contact data includes, for example, phone number, email address (private and/or professional).
• Optional data: Optional data refers to information that you provide voluntarily, such as your preferences regarding vehicle equipment or vehicle category preferences. This may also include additional details about your journey to the agency (flight, train, etc.).

Use of Social Media

GP SAS is active on various social media platforms.

• Facebook Page: Pilote

• YouTube Channel: Pilote

A social network is an online platform, a virtual community on the Internet that typically allows users to communicate and interact with each other. A social network can serve as a platform for the exchange of opinions and experiences or enable the online community to share personal or business-related information.

We are not aware of the content of the data transmitted and its use by these companies. You can refer to the privacy policies of these individual companies for more information on the purpose and extent of the processing of data, as well as their provisions regarding the use of your personal data:

• Facebook: Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, USA

For individuals residing outside the United States or Canada, the data controller is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

• YouTube: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USAYouTube: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA

Use of Google Tools

The website www.pilote.fr employs several tools from the American internet giant Google. This allows us to increase efficiency, stay organized, grow our business, and be constantly at your service.

Google Analytics

GP SAS uses a website analytics service provided by Google. Analytics employs methods that allow a detailed analysis of the website’s usage by internet users. The service uses cookies, text files stored on the user’s computer and transmitted to a Google server (for more information, refer to the following page: Cookie Policy). This data is stored by Google in the United States. If necessary, Google may transmit to third parties the personal data collected by this technique. Among the data studied are the URL of the website (referrer) from which the system accessed another site, which individual pages of the website the user viewed, how often, and for how long.

Google uses this information to evaluate your use of the www.pilote.fr website, generate reports on site activities, and provide additional services related to web and internet usage. This data primarily allows us to optimize the www.pilote.fr website and conduct a cost-benefit analysis of internet advertising.

Google Maps

This service allows for the display of interactive maps directly on the www.pilote.fr website for an optimized user experience. This makes the site more functional and attractive to users, representing a legitimate interest for GP SAS.

Google Tag Manager

The www.pilote.fr website uses the Google Tag Manager service. It allows for the administration of tags via a dedicated platform and the collection of data useful for the management and improvement of our products and services. In the realm of computing and programming, a tag refers to a series of characters intended to automatically trigger the execution of an action by a computer program. Tags primarily allow for data collection.

Remarketing

Through the Google Ads platform, we create remarketing campaigns. Remarketing allows us to reach users who have already interacted with the www.pilote.fr site, whether on desktop or mobile. This way, we can reposition advertising to our visitors when they browse Google or its partner websites. Advertisements are displayed through the use of cookies. You can disable cookie storage by adjusting your browser settings and/or by opposing data collection for Google remarketing via the following link www.google.com/policies/technologies/ads/.

Google Ads

Our services use Google Ads, Google’s online advertising platform. Google Ads installs a cookie on your computer (“Conversion Cookie”) when you arrive on our website through a Google ad. These cookies are valid for only 30 days and cannot personally identify you. Information collected with the conversion tracking cookie is used to establish conversion statistics for Google Ads clients. AdWords clients learn the number of users who clicked on their ad and were directed to a page with a conversion tracking tag.

Google’s Privacy Policy:

Google’s privacy policy contains more information about the purpose and scope of data collection and processing by Google. You will also find information about your rights and configuration options to protect your privacy: policies.google.com/privacy. Google processes your personal data in the United States and adheres to the EU-US Privacy Shield: www.privacyshield.gov/EU-US-Framework. You can also contact them at the following address: Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. 

Use of HubSpot Tools

The website www.pilote.fr utilizes the HubSpot service, which allows us to create forms and, through them, better understand the visitors to our websites. This service also enables us to personalize the experience on the sites by placing a cookie for each visitor. 

HubSpot Privacy Policy:

HubSpot’s privacy policy contains further information about the purpose and extent of data collection and processing by HubSpot. You will also find information about your rights and configuration options to protect your privacy: https://legal.hubspot.com/fr/data-privacy. HubSpot processes your personal data in the United States and adheres to the EU-US Privacy Shield: www.privacyshield.gov/EU-US-Framework. You can also contact them at the following address: HubSpot Inc. 25 First Street, 2nd Floor – Cambridge, MA 02141 USA.

You have the option to send us requests via email through our website on the contact page. If you send us information requests, we store the information you provide (email address, subject of your email, content of your message, and the date of contact), including the contact details you enter (name, first name, address, and phone number if applicable) to process your request and for subsequent exchanges. We do not transmit this data without your consent. The email address you entered remains in our software until you ask us to delete it or revoke your consent for storage.

Object and Legal Basis of Processing

We specify below what the legal bases are for the data processing activities that we carry out:

The purposes for which we collect information are as follows:

Execution of a Contract:

Legal Basis: Article 6, paragraph 1, letter b of the GDPR.
Justification: Processing is necessary for the performance of a contract to which the data subject is a party. This includes the processing of data related to the provision of a service or the execution of pre-contractual measures, such as requests for our products or services.

Compliance with Legal Obligations:

Legal Basis: Article 6, paragraph 1, letter c of the GDPR.
Justification: Processing is necessary for compliance with a legal obligation to which our company is subject, such as fulfilling tax obligations.

Safeguarding Vital Interests:

Legal Basis: Article 6, paragraph 1, letter d of the GDPR.
Justification: Processing is necessary to protect the vital interests of the data subject or another natural person, for example, in the case of a visitor sustaining an injury during a visit to one of our agencies.

Legitimate Interests:

Legal Basis: Article 6, paragraph 1, letter f of the GDPR.
Justification: Processing is necessary for the purposes of the legitimate interests pursued by our company or a third party, unless overridden by the interests or fundamental rights and freedoms of the data subject. This includes activities such as understanding customer usage patterns, optimizing our vehicle fleet, and improving customer experience.

Business Activities for Prosperity:

Legal Basis: Article 6, paragraph 1, letter f of the GDPR.
Justification: Processing is necessary for the performance of our business activities for the prosperity of our employees, clients, and shareholders. This encompasses various activities such as managing customer relations, analyzing customer preferences, improving website usability, informing customers about products and services, managing disputes and accidents, and seeking legal or professional advice.

Consent for Specific Purposes:

Legal Basis: Article 6, paragraph 1, letter a of the GDPR.
Justification: Outside the aforementioned cases, our company relies on the legal basis of consent for the processing of personal data for each specific purpose. This involves obtaining consent for specific activities mentioned above.

Note: GDPR refers to the General Data Protection Regulation. 

Retention Period for Personal Data

The retention period for your personal data varies depending on the purpose of their collection:

  • Permanent, contact, and contractual data are retained beyond the commercial relationship with selective archiving.
  • Telephone conversations with our customer support are not retained.

Recipients of Personal Data

Internal Transmission:

GP SAS internally transmits your data to various specialized departments to comply with its legal and contractual obligations. Personal data is only transmitted or disclosed to the extent necessary, in compliance with current data protection regulations.

Group-Level Transmission:

GP SAS is a subsidiary of the Pilote Group, a company located in France operating at the European level. GP SAS may share information about data subjects with other entities within the Pilote Group as outlined in this policy.

Third-Party Transmission:

Pilote may be required to transmit personal data to specific third parties to provide corresponding services or applications. These third parties offer external service provisions. They process data only according to our instructions, and they are prohibited from using this data for their own commercial purposes.

Transfer to a Third Country or International Organization:

GP SAS may need to transfer personal data to recipients located in countries outside the European Economic Area (EEA) for the aforementioned purposes. Transmission occurs only to fulfill our contractual and legal obligations or based on your consent. The transfer conditions are protected in accordance with the current regulations on the protection of personal data.

Rights of the Individuals Concerned

You can exercise any right described in this section with the Data Protection Officer, as designated by this Privacy Policy.

Right of Access:

European directives and regulations grant individuals whose personal data is processed the right to obtain, free of charge, from the data controller information about the personal data collected, the purpose of processing, the categories of data involved, the recipients or categories of recipients to whom this data has been communicated, the retention periods, and a copy of this information. To exercise this right of access, please contact dpo@groupe-pilote.com.

Right of Confirmation:

European directives and regulations grant individuals the right to obtain confirmation from the data controller that personal data concerning them is being processed. If an individual wishes to exercise this right of confirmation, they can address the Data Protection Officer at any time.

Right of Rectification:

You have the right to request the correction of inaccurate or incomplete personal information about you. If an individual wishes to exercise this right of rectification or have incomplete data completed, they can address the Data Protection Officer at any time. We will strive to update your personal data promptly.

Right to Erasure

In accordance with European directives and regulations, the individual concerned has the right to obtain from the data controller the erasure of personal data concerning them without undue delay when one of the following grounds applies and to the extent that their processing is not required:

  • The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
  • The individual withdraws consent on which the processing is based according to Article 6, paragraph 1, point (a), or Article 9, paragraph 2, point (a) of the GDPR, and there is no other legal ground for the processing.
  • The individual objects to the processing pursuant to Article 21, paragraph 1 of the GDPR, and there are no overriding legitimate grounds for the processing, or the individual objects to the processing pursuant to Article 21, paragraph 2 of the GDPR.
  • The personal data have been unlawfully processed.
  • The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject.
  • The personal data have been collected in relation to the offer of information society services referred to in Article 8, paragraph 1 of the GDPR.

If any of the above applies and an individual wishes for personal data recorded with GP SAS to be erased, they can contact the Data Protection Officer at any time. The Data Protection Officer will promptly address the request. Please note that we may retain certain information about you when required by law or when we have a legitimate reason to do so.

Right to Restriction of Processing

The individual concerned has the right to obtain from the Data Protection Officer the restriction of processing of personal data when one of the following applies:

  • The accuracy of the personal data is contested by the individual concerned, for a period enabling the data controller to verify the accuracy of the data.
  • The processing is unlawful, and the individual concerned opposes the erasure of personal data and requests the restriction of their use instead.
  • The data controller no longer needs the personal data for the purposes of the processing, but they are required by the individual concerned for the establishment, exercise, or defense of legal claims.
  • The individual concerned has objected to processing pursuant to Article 21, paragraph 1 of the GDPR, pending the verification whether the legitimate grounds of the Data Protection Officer override those of the individual concerned.

If any of the above applies, and an individual wishes to request the limitation of processing of personal data recorded by GP SAS, they can contact the Data Protection Officer. The Data Protection Officer will ensure the prompt handling of the request.

Right to Data Portability:

The individual concerned also has the right to data portability, meaning the right to receive the personal data provided in a structured, commonly used, and machine-readable format and the right to transmit this data to another data controller. When exercising the right to data portability under Article 20, paragraph 1 of the GDPR, the individual also has the right to have the personal data transmitted directly from one data controller to another, where technically feasible and provided that this does not adversely affect the rights and freedoms of others.

Right to Object:

In accordance with European directives and regulations, any individual has the right to object at any time, for reasons related to their particular situation, to the processing of their personal data. From that moment, GP SAS no longer processes the personal data unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the individual concerned or for the establishment, exercise, or defense of legal claims. The individual concerned also has the right to object to the processing of their personal data for direct marketing purposes.

Right to Lodge a Complaint:

The individual concerned has the right to lodge a complaint regarding the processing of personal data with the Data Protection Officer or with a supervisory authority.

Revocation of Your Consent to Data Processing:

In accordance with European directives and regulations, any individual has the right to revoke their consent to the processing of their personal data at any time. If the individual concerned wishes to exercise their right to revoke their consent, they can contact dpo@groupe-pilote.com at any time. As the responsible entity, we waive automated decision-making processes or profiling.