1. Identification of the Data Controller
This Privacy Policy governs the processing of personal data collected through viblyshufflespt.garden and during the booking and provision of luxury passenger coach services operated by Viblyshufflespt Luxury Transport SAS (hereinafter referred to as "Viblyshufflespt", "we", "us", or "our").
Registered Address: 48 Rue François 1er, 75008 Paris, France
Company Registration Number: 892 411 902 R.C.S. Paris
Data Protection Officer (DPO): [email protected]
2. Categories of Personal Data Collected
In operating our high-end passenger charter services across France, we collect and process information strictly necessary for concierge coordination, security compliance, and commercial execution:
- Identification & Contact Data: Full legal name, official title, corporate affiliation, verified telephone number, primary email address, and billing address.
- Passenger Manifest & Security Credentials: For certain landmark and private zone authorizations within Paris central security perimeters, passenger names and valid government identification numbers may be requested.
- Financial & Transactional Records: Invoiced transactions, corporate payment processing tokens, VAT numbers, and confirmation histories. (Note: payment cards are processed via certified PCI-DSS Level 1 compliant processors and are never stored on our web servers).
- Bespoke Catering & Dietary Preferences: Allergen information, religious dietary restrictions, and beverage preferences supplied voluntarily for charter provisioning.
- Technical & Browsing Telemetry: IP address, device specifications, session duration, and referral sources collected via functional and analytical cookies.
3. Legal Bases and Purposes of Processing
Under Article 6 of the General Data Protection Regulation (GDPR), all personal data processing carried out by Viblyshufflespt is justified under one of the following legitimate grounds:
- Contractual Performance (Art. 6(1)(b)): Executing booking contracts, dispatching chauffeurs, organizing onboard catering, and providing customer support.
- Legal Compliance (Art. 6(1)(c)): Fulfilling French transport regulatory obligations, municipal passenger manifest filings, accounting laws, and anti-money laundering regulations.
- Legitimate Interests (Art. 6(1)(f)): Maintaining operational vehicle safety, preventing fraud, and refining our WebGL digital presentation interfaces.
- Explicit Consent (Art. 6(1)(a)): Delivering non-transactional announcements or invitations to private salon events, which may be revoked at any time.
4. Data Retention Periods
Personal data is retained only for durations strictly commensurate with the purposes outlined:
- Booking Invoices & Passenger Contracts: Retained for ten (10) years in accordance with Article L. 123-22 of the French Commercial Code.
- General Concierge Inquiries: Retained for twenty-four (24) months from the date of the last active client communication.
- Dietary and Bespoke Preferences: Purged thirty (30) days following the completion of the chartered voyage unless explicitly requested to be held on profile for future bookings.
- Analytics & Web Logs: Retained for a maximum of thirteen (13) months following initial collection.
5. Data Processors and Cross-Border Transfers
We do not sell, rent, or trade client data to third parties. We share data solely with vetted subprocessors bound by Data Processing Agreements (DPAs) meeting European standards:
- Cloud hosting infrastructure situated within the European Union (Frankfurt and Paris regions).
- PCI-DSS Level 1 payment gateway providers.
- Municipal authorities and transport control bodies when strictly mandated by French transport regulations.
6. Your Rights Under European and California Law
Pursuant to Articles 15 to 22 of the GDPR and the California Consumer Privacy Act (CCPA), you maintain the following actionable rights regarding your personal records:
- Right of Access: Obtain official confirmation regarding whether your data is being processed, and receive a portable copy.
- Right to Rectification: Require immediate correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request data deletion when records are no longer necessary for transport or legal archiving requirements.
- Right to Restriction and Objection: Limit processing under contested accuracy or object to processing founded on legitimate interest.
- Right to Data Portability: Receive your provided records in a structured, commonly used, and machine-readable format.
To exercise any of these privileges, please submit a signed written request accompanied by proof of identity to [email protected]. You also maintain the right to lodge a formal complaint with the French supervisory authority, the CNIL (Commission Nationale de l'Informatique et des Libertés) at www.cnil.fr.
7. Security Safeguards
We employ high-grade technical safeguards including TLS 1.3 cryptographic transport protocols, hardware-isolated firewalls, strict role-based access authorizations, and regular vulnerability audits to guarantee the absolute confidentiality of passenger and route data.