TLCS, which operates the ATA France brand, attaches great importance to the protection of your personal data. This policy describes the processing carried out in connection with the use of the website www.atafrance.com, in accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act No. 78-17 of 6 January 1978.
1. Data controller
The data controller is Transport Logistiques Conseils et Service (TLCS), a French limited liability company (SARL) with share capital of €30,000, whose registered office is at 32 rue Paul Fort, 77330 Ozoir-la-Ferrière, Melun Trade and Companies Register 815 194 113. Contact: contact@tlcs.fr — +33 1 30 33 10 56.
2. Data collected
We collect only the data necessary for the purposes described below:
- Account data: title, surname, first name, email address, phone number, password (stored in encrypted form);
- Booking data: pick-up and destination addresses, date and time, number of passengers and items of luggage, vehicle category, flight or train number, special instructions;
- Payment data: processed directly by our provider Stripe. We do not store your bank-card number; we receive only a transaction identifier and the payment status;
- Technical data: IP address, connection and security logs, data strictly necessary to protect the site against abuse (anti-bot).
3. Purposes and legal bases
- Manage bookings and perform the transport — legal basis: performance of the contract (Art. 6.1.b GDPR);
- Manage your customer account and your trip history — legal basis: performance of the contract;
- Process payments and combat fraud — legal basis: performance of the contract and legitimate interest;
- Issue and keep invoices — legal basis: legal obligation (accounting and tax);
- Ensure the security of the site (abuse limitation, anti-bot protection) — legal basis: legitimate interest;
- Respond to your requests and complaints — legal basis: legitimate interest.
4. Recipients and processors
Your data is never sold. It is accessible to the Provider's authorised staff and passed on, strictly as necessary, to the following processors:
- Stripe — secure processing of bank-card payments;
- Logipax — passing trip information to the operations service in order to assign and brief the driver;
- OVH — hosting of the site and data (servers located in the European Union);
- Mapbox — calculation of distances and routes for fare estimation;
- Cloudflare — anti-bot protection (Turnstile) and access security.
Each of these providers is bound by a contract guaranteeing a level of protection compliant with the GDPR.
5. Transfers outside the European Union
Data hosting takes place within the European Union. Some technical providers (in particular Stripe and Cloudflare) may process data outside the European Union. In that case, such transfers are governed by appropriate safeguards, in particular the European Commission's standard contractual clauses, ensuring a level of protection equivalent to that of the GDPR.
6. Retention periods
- Account data: kept for as long as the account is active, then deleted or anonymised after a period of inactivity, or on request for deletion;
- Booking data: kept for the duration of the contractual relationship and for evidential purposes;
- Invoices and accounting records: kept for 10 years, in accordance with legal obligations;
- Technical and security logs: kept for a limited period necessary for the security of the site.
7. Your rights
Under the GDPR, you have the following rights over your data: the right of access, rectification, erasure, restriction of processing, objection, and the right to data portability. You may also set out instructions concerning the fate of your data after your death.
To exercise these rights, send your request to contact@tlcs.fr, specifying your request and providing proof of identity if necessary. We undertake to respond within one month.
8. Cookies and trackers
The site uses only cookies and trackers strictly necessary for its proper operation and security: keeping your session when you are logged in, and anti-bot protection (Cloudflare Turnstile). These trackers, essential to the service, do not require prior consent and are not used for advertising or commercial-tracking purposes. No third-party analytics or targeted-advertising cookie is placed.
9. Security
The Provider implements appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure or alteration: encryption of communications (HTTPS), encrypted storage of passwords, access compartmentalisation, protection against abuse and monitoring of security logs.
10. Contact and complaints
For any question about this policy or the processing of your data, contact us at contact@tlcs.fr.
If, after contacting us, you consider that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.