Controller

The controller is ATLANTIC BIKE, 111 avenue de Maubuisson, 33121 Carcans, France. Data-rights contact: contact@atlanticbike.fr.

Data and purposes

The application processes the following data:

Booking requests: first name, last name, email, telephone, message, dates, bikes, options, pickup or delivery and delivery address.
Contact requests: first name, last name, email, telephone, reason and message.
Customer area: email address, single-use sign-in code and a session lasting at most thirty days.
Abuse prevention: IP or network address and technical timestamp, to protect the forms.
Rental contract: data needed for the quote, the booking, the contract and the customer relationship.
Audience measurement: not active. There is no advertising, remarketing, chat, CRM, GA4 measurement or online payment. Google Search Console is an SEO tool used by the operator and loads no script for visitors.
Customer reviews: a server-side Google Places connector fetches the shop’s public reviews. It receives no visitor data.
External links: the page loads no Google map, font or navigation resource. When a review is displayed, its author’s Google avatar is loaded from Google. An intentional link may open Google Maps in a new tab, where Google’s policy applies.

Legal bases and recipients

Booking requests are processed for pre-contractual steps and contract performance. Contact requests are processed to answer them and to protect the service. Any audience measurement would rely on prior consent.

Processors: OVHcloud hosts the server and its backup in Strasbourg, France; Brevo sends transactional emails and stores its data in the European Union; Google receives only the server-side request that reads the public reviews. No data is sold or shared for advertising.

Retention periods

The retained periods are: contact requests, three years after creation; unconfirmed or cancelled booking requests, three years after creation; reservations and contracts, five years after the rental ends, or ten years where a legal retention rule for an electronic contract or accounting record applies; inactive customer accounts, three years after the last activity; anti-abuse and audit logs, one rolling year; sessions and sign-in codes, one year after creation; database and photo backups, daily and kept thirty days; OVHcloud standard VPS backup, twenty-four hours.

The application purge runs automatically every day in production and logs its result without copying personal data. If the VPS is terminated, OVHcloud states that data is archived for thirty days before deletion.

Data-subject rights

Under the GDPR, people may request access, correction, deletion, restriction or portability of their data, or object to certain processing, by writing to contact@atlanticbike.fr. The customer area also lets a customer download their data and delete an account that holds no booking. Only the identity checks strictly needed may be requested.

A complaint may be lodged with the CNIL, the French data-protection authority.

Security and breaches

Traffic is encrypted (HTTPS), the customer area is opened with a single-use code, and writes coming from another website are refused. AtlanticBike keeps a record of processing activities and reports any personal-data breach that creates a risk to the CNIL within seventy-two hours, and to the people concerned when the risk is high.