Privacy Policy

1. Overview

This Privacy Policy describes how SelfGo (SIREN: 993 658 988) collects, uses, shares, and protects your personal information when you use our booking platform — including our website at www.selfgo.fr and our mobile applications available on the Apple App Store and Google Play Store.

2. Data Controller

The data controller responsible for your personal information is:

3. Information We Collect

3.1 Information You Provide

When you use our booking platform, we collect:

Data Category	Examples	Purpose
Contact Information	Name, email, phone number	Account creation, booking confirmation, driver communication
Booking Details	Pickup/drop-off addresses, date, time, flight number	Service provision, driver assignment, flight tracking
Passenger Information	Number of passengers, luggage count	Vehicle selection, service planning
Special Requests	Accessibility needs, child seats, language preferences	Service customization
Payment Details	Tokenized card information (managed by SumUp)	In-app payment processing
Communication Records	Customer support messages, in-app chats with driver	Quality assurance, dispute resolution

3.2 Information Collected Automatically

• Device Information: Device type, operating system (iOS / Android version), app version, device language, time zone
• Usage Data: Screens visited, features used, time spent in app, interactions
• Technical Logs: IP address, browser type (web), crash reports
• Cookies and Similar Technologies: See our Cookie Policy

3.3 Mobile App Permissions

The SelfGo mobile applications request the following permissions on your device. Each permission is requested only when needed, and you can deny or revoke any permission at any time through your device settings.

Permission	Why We Need It	Required?
Location (Foreground only)	To detect your current location and pre-fill your pickup address when you tap "Use my location". We do NOT track your location in the background.	Optional — you can enter addresses manually
Notifications	To send booking confirmations, driver assignment alerts, ride status updates, and important customer service messages.	Recommended for the best experience
Camera	To scan QR codes (e.g., for promotional offers, driver verification, or quick booking).	Optional — only requested when you tap a QR scan feature
Microphone	To enable in-app voice calls between you and your driver (instead of revealing real phone numbers, protecting both parties' privacy).	Optional — only requested when you initiate an in-app call

3.4 Information We DO NOT Collect

4. How We Use Your Information

4.1 Legal Bases for Processing (GDPR)

Purpose	Legal Basis
Processing bookings and payments	Contract performance — Article 6(1)(b) GDPR
Customer support	Legitimate interest — Article 6(1)(f) GDPR
Marketing communications	Consent — Article 6(1)(a) GDPR
Legal and tax compliance	Legal obligation — Article 6(1)(c) GDPR
Fraud prevention and security	Legitimate interest — Article 6(1)(f) GDPR
Analytics and platform improvement	Legitimate interest — Article 6(1)(f) GDPR

4.2 Specific Uses

• Booking Management: Create your account, process and coordinate transportation requests
• Driver Assignment: Share booking details with the assigned independent driver
• Payment Processing: Securely process in-app payments via SumUp
• Communication: Send booking confirmations, ride updates, and customer support messages by SMS, email, push notifications, or in-app
• Service Improvement: Analyze anonymous usage patterns to enhance our platform (via Microsoft Clarity, see Section 5)
• Fraud Prevention: Detect and prevent fraudulent bookings or payments
• Customer Support: Respond to inquiries, resolve issues, manage refund requests
• Legal Compliance: Fulfill regulatory and tax obligations under French law

5. How We Share Your Information

5.1 With Independent Drivers

When you make a booking, we share the necessary information with the independent professional driver assigned to your ride:

• Your name and phone number (or in-app proxy number) — for pickup coordination
• Pickup and drop-off locations
• Date and time of booking
• Number of passengers and luggage
• Special requests (if any)
• Flight number (if airport ride)

Important: Drivers are independent contractors and act as separate data controllers for the data they receive. They are responsible for their own GDPR compliance.

5.2 Trusted Service Providers (Data Processors)

We share data with carefully selected service providers who help us operate the platform. All processors are bound by data processing agreements (DPAs) compliant with GDPR Article 28.

Service Provider	Purpose	Data Shared	Location
SumUp Limited	Payment processing (in-app payments)	Tokenized card data, transaction details	United Kingdom (FCA-regulated)
SiteGround Spain S.L.	Website and database hosting	Website data, booking records	Spain (EU)
Cloudflare, Inc.	CDN, DDoS protection, performance	IP address, technical logs	EU edge servers
Microsoft Clarity	Anonymous behavioral analytics	Anonymized usage data, session recordings (no PII)	EU data center (configured)
SMS Provider	Booking confirmations and OTP	Phone number, SMS content	EU
Email Service	Transactional emails	Email address, booking details	EU
Apple App Store / Google Play	App distribution and crash reports	Device ID (anonymous), crash logs	Apple Inc. (USA) / Google LLC (USA / Ireland)

5.3 Microsoft Clarity Analytics

We use Microsoft Clarity to understand how users interact with our platform. Clarity captures:

• Heatmaps showing where users tap or click
• Anonymized session recordings (no personally identifiable information)
• Page navigation patterns

Clarity does NOT track users across other websites and does NOT use this data for advertising. For more information, see Microsoft's Privacy Statement.

5.4 Legal Requirements

We may disclose your information if required by law or to:

• Comply with legal processes, court orders, or government requests
• Enforce our Terms of Use
• Protect the rights, property, or safety of SelfGo, our users, drivers, or others
• Investigate fraud or security issues

5.5 We DO NOT Sell Your Data

6. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). Some service providers may transfer data outside the EEA. For these transfers, we ensure adequate protection through:

• EU Adequacy Decisions: Transfers to countries deemed adequate by the European Commission (UK, Switzerland, Canada commercial sector, etc.)
• EU-US Data Privacy Framework (DPF): For transfers to certified US companies (Apple, Microsoft, Google)
• Standard Contractual Clauses (SCC): EU-approved contractual safeguards for other transfers
• Binding Corporate Rules: Where applicable

For more information about safeguards in place for specific transfers, contact info@selfgo.fr.

7. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected:

Data Type	Retention Period	Reason
Account information	Until account deletion + 30 days	Active service provision
Booking records	3 years after last booking	Customer service, dispute resolution
Marketing consent	Until consent withdrawal	Marketing communications
Invoicing and tax records	10 years	French legal obligations (Article L.123-22 Code de commerce)
Payment transaction logs	13 months (active dispute period)	Bank dispute regulations (PSD2)
Microsoft Clarity analytics	Up to 12 months (anonymous)	Service improvement
Customer support tickets	3 years	Quality assurance, audit

After retention periods expire, we securely delete or anonymize your data.

8. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights:

8.1 Right of Access (Article 15)

Request a copy of all personal data we hold about you, including the source, purpose, and recipients of your data.

8.2 Right to Rectification (Article 16)

Request correction of inaccurate or incomplete data — directly through the app (Profile settings) or by contacting us.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17)

Request deletion of your personal data. See Section 8.9 for the account deletion process.

8.4 Right to Restriction of Processing (Article 18)

Request limitation on how we use your data while a dispute is being resolved.

8.5 Right to Data Portability (Article 20)

Receive your data in a structured, commonly used, machine-readable format (JSON or CSV) for transfer to another service.

8.6 Right to Object (Article 21)

Object to processing based on legitimate interests or for marketing purposes.

8.7 Right to Withdraw Consent (Article 7)

Withdraw consent at any time for processing where consent is the legal basis (e.g., marketing emails).

8.8 Right to Lodge a Complaint (Article 77)

File a complaint with your local data protection authority. For French users, this is the CNIL. Other authorities are listed in Section 14.

8.9 Account Deletion (How to Exercise Your Right to Erasure)

8.10 How to Exercise Your Other Rights

For any other GDPR request, contact us at info@selfgo.fr with subject line "GDPR Request". We respond within 30 days. Free of charge for the first request per year.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: TLS 1.3 for all communications
• Encryption at rest: Database and backups encrypted
• Access controls: Role-based access, limited to authorized personnel
• Secure servers: Hosted in PCI-DSS compliant data centers (SiteGround, EU)
• Payment security: SumUp is PCI-DSS Level 1 certified — we never store full card numbers
• Regular audits: Security patches, vulnerability scanning, code reviews
• Two-factor authentication: For administrative access
• Incident response: Documented procedures, 72-hour breach notification to CNIL per GDPR
• Continuous monitoring: 24/7 security monitoring via Cloudflare

Important: Despite our efforts, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Cookies and Tracking

We use cookies and similar technologies on our website. The mobile apps use the equivalent of cookies (local storage and SDK identifiers). For detailed information:

• Types of cookies and SDKs we use
• How to manage cookie preferences (web)
• How to opt out of analytics in the mobile app (Settings)
• Third-party cookies and SDKs

Please see our Cookie Policy.

11. Children's Privacy

Our services are not directed to children under 15 years of age (in accordance with Article 8 of the GDPR and Article 7-1 of the French Data Protection Act).

We do not knowingly collect personal information from children under 15 without parental consent. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at info@selfgo.fr and we will delete such information promptly.

For minors aged 15–17, we recommend parental supervision when booking transportation services.

12. Marketing Communications

12.1 Email and Push Notification Marketing

We may send you marketing communications about our services if you have:

• Given explicit consent (during account creation or in app settings), or
• Previously used our services (soft opt-in for similar services, in compliance with French law)

12.2 How to Unsubscribe

You can opt out of marketing communications at any time:

• Email: Click the "unsubscribe" link in any marketing email
• Push notifications: Disable in app Settings → Notifications, or via your device settings
• Manual request: Email info@selfgo.fr or call +33 1 85 09 41 92

Note: Even if you opt out of marketing, we will still send essential service-related communications (booking confirmations, ride updates, security alerts).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email and in-app notification (for material changes)
• Display a prominent notice in the App and on the website
• For changes requiring consent, request renewed consent

We encourage you to review this Privacy Policy periodically.

14. Contact Us

14.1 Data Protection Inquiries

14.2 Supervisory Authorities

You have the right to lodge a complaint with your local data protection authority. Some examples:

Country	Authority	Website
🇫🇷 France	CNIL	www.cnil.fr
🇩🇪 Germany	BfDI	www.bfdi.bund.de
🇪🇸 Spain	AEPD	www.aepd.es
🇮🇹 Italy	Garante per la privacy	www.garanteprivacy.it
🇳🇱 Netherlands	Autoriteit Persoonsgegevens	autoriteitpersoonsgegevens.nl
🇵🇹 Portugal	CNPD	www.cnpd.pt
EU (other)	European Data Protection Board	edpb.europa.eu

For French users, the CNIL contact details are: