1. Responsable du traitement
The data controller is À compléter avant ouverture publique, available at contact@excarra.com.
2. Data processed
- identification and contact data;
- driver and owner profile information;
- listings, availability, booking requests and messages;
- technical security data, access logs and administrative audit trails;
- documents submitted through the pilot verification module;
- reviews, notifications and history of use of the pilot EX programme.
3. Purposes and legal bases
| Purpose | Base principale |
|---|---|
| Create and manage an account, provide search, booking and messaging. | Performance of the Terms and pre-contractual measures. |
| Secure the platform, limit abuse and maintain an audit log. | Legitimate interest in protecting the service and its users. |
| Voluntarily verify a profile in the pilot module. | Consent and action initiated by the user; this processing must be reassessed when professional KYC is deployed. |
| Comply with legal obligations and respond to authorised authorities. | Legal obligation. |
| Send future marketing communications. | Consentement, lorsqu’il est requis. |
4. Destinataires
Data may be accessed by authorised staff of the operator, users involved in a booking or conversation, and strictly necessary technical providers. Data may be disclosed to authorities where required by law.
5. Retention periods
| Active account | For the duration of the relationship, then deletion or archiving in accordance with applicable obligations. |
|---|---|
| Requests, bookings and messages | For as long as necessary to provide the service, establish evidence and manage disputes; the final period must be recorded in the processing register. |
| Security logs and rate limits | A short period proportionate to abuse detection, unless an incident requires longer retention. |
| Pilot verification documents | They must not be used with genuine documents before the definitive KYC storage solution is deployed. An automatic deletion policy must be configured before actual activation. |
| Prospects investisseurs | Up to three years after the last contact, unless an objection or different obligation applies. |
6. Security
EXCARRA applies attempt limits, secure sessions, access controls, administrative logging, prepared queries and security headers. However, no system can guarantee zero risk.
7. Your rights
Depending on the processing, you may request access, rectification, erasure, restriction, portability or object to certain uses. You may withdraw consent without affecting prior processing. Send your request to contact@excarra.com. Une preuve d’identité peut être demandée uniquement si un doute raisonnable subsiste.
You may also lodge a complaint with the CNIL.
8. Cookies, mesure et stockage local
La plateforme utilise des cookies strictement nécessaires à la session, à la sécurité et aux préférences. Google Analytics, Google Tag Manager ou Google Ads ne sont chargés qu’après le consentement correspondant et uniquement lorsqu’ils sont configurés. Détail complet : cookie policy.
9. Changes
This policy will be updated when payment, insurance, professional KYC, the mobile application or new processors are added.