Privacy policy
Data controller
The data controller is Nicolas RONGIONE, a sole trader operating under the trade name Gare&Drive, 18 rue Dom Ganneron, 77230 Dammartin-en-Goële, France, reachable at gareanddrive@gmail.com. Given the size of the business, no data protection officer (DPO) is appointed: you may exercise your rights directly with the data controller.
Data collected
We collect only the data strictly necessary to handle your requests: name, e-mail address, telephone number (optional) and the content of the message sent through the contact form. The name, e-mail address and message are needed to identify your request and reply to it: without them, it cannot be handled. The telephone number is optional and failure to provide it has no consequences for the handling of your request. No statutory or contractual requirement obliges you to give us this data: providing it is voluntary and affects only our ability to reply to you. On each submission, your IP address is also recorded, for the sole purpose of limiting the number of submissions per visitor and preventing abuse; this recording cannot be disabled from the form. The same measure applies to attempts to log in to the site's administration area.
Purpose of processing
Your data is used to respond to the enquiries you send us through the contact form and, in the case of the IP address alone, to limit the number of submissions per visitor and prevent abuse. It serves no other purpose and is never sold or transferred to third parties.
Legal basis
The legal basis depends on the purpose pursued. The content of your request (name, e-mail address, optional telephone number and message) is processed on the basis of your consent (Article 6(1)(a) GDPR), collected when you send your message. You may withdraw it at any time by writing to us at gareanddrive@gmail.com, without affecting the lawfulness of processing already carried out. The recording of your IP address, by contrast, relies on our legitimate interests (Article 6(1)(f) GDPR): protecting the contact form and access to the administration area against mass submissions and abuse, and preserving the availability of the service for all visitors. This security measure applies independently of your consent and withdrawing your consent does not stop it; you do, however, have the right to object on grounds relating to your particular situation.
Recipients
Gare&Drive is the sole recipient of your data. It is neither sold nor transferred for commercial purposes. Three categories of technical providers may access it only to run the service, with no reuse on their own behalf: the site host (Vercel Inc., United States), the database provider (Neon, LLC, a US company; the data is stored in the European Union, in Frankfurt) and the e-mail delivery service. As the site host and the database provider are established in the United States, your data may be transferred outside the European Union. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework, which is the subject of an adequacy decision by the European Commission. The other transfers, including those relating to e-mail delivery, are governed by the appropriate safeguards provided for in Article 46 GDPR. You may obtain a copy of these safeguards by writing to us at gareanddrive@gmail.com.
Data retention
Your personal data is kept for a maximum of three years from the last contact, and is then deleted. The IP address recorded to limit contact-form submissions is used for ten minutes only; it is then erased, at the latest on the next submission.
Your rights
Under the GDPR, you have the right of access, rectification, erasure, restriction of processing, objection and portability. To exercise these rights, use the contact form available on this site. You also have the right to lodge a complaint with a supervisory authority — in France, the Commission nationale de l'informatique et des libertés (CNIL).
Cookies
The public pages of this site use two functional cookies and no advertising or analytics tracker. The gd_theme cookie stores your theme preference (light or dark) for one year. The NEXT_LOCALE cookie stores the display language you selected; it is a session cookie, removed when you close your browser. Both cookies are strictly necessary for the site to work and are never used for tracking. No consent banner is required for these strictly necessary technologies.
