PRIVACY
POLICY

Why do we process personal data and on what grounds?

We process personal data for the following purposes:

• To manage boat rental bookings made in our offices and online (location-bateaux-electriques.com), as well as contracts, payments, refunds and gift vouchers: we collect the data required to manage bookings and communication with our customers, as well as the data required to draw up the rental contract, receive payment of the deposit and process online or on-site payments or rental orders or gift vouchers via our payment contractors. These processing operations are necessary for the performance of the rental contract.
• To manage customer reviews and comments on our website: our customers can leave a public review of our service and leave a comment under each news feed on our website. The processing operations are subject to customer consent.
• To manage requests received via the contact form (professional quotes, practical information, complaints, improvements): we use data to process the request (reception of the request, reply, logging). The data processing operation for professional quote management is required for the performance of the rental contract. Other processing operations are required for our legitimate interests for communicating with our customers, managing complaints or receiving suggestions for improvement.
• To conduct sales lead prospecting operations: we can use our customers’ e-mail address and telephone number to send them promotional information about our products or services, provided they give their consent. The processing operation is required for pursuing our legitimate interests for promoting our products and services with our customers.
• To manage employee recruitment: we collect personal data when we receive job applications on our website. The processing operation is required for the performance of pre-contract procedures prior to hiring. Resumes can be stored, unless the applicant objects, on the basis of our legitimate interest for the promotion of our job offers.
• To comply with the exercise of the rights listed below. The processing operation is required under the terms of the GDPR.
• To gather audience rating statistics via our website’s analytical cookies and prevent security incidents on our website. The processing operations are required for the pursuit of our legitimate interests for the measurement of our audience ratings and secure our website.

What type of data do we collect?

For our data processing activities, we collect and process the following personal data categories:

• ID: title, last name, first name, postal address, phone number, e-mail address, date of birth, rental contract number, data regarding registration on opt-out lists.
• Order data: transaction number, order details, amount, invoice payment data (payments, discounts).
• Payment means data: credit card number, credit card expiry data, visual cryptogram (which is immediately deleted).
• Data regarding service use reviews: comments, ratings.
• Data required for the execution of loyalty-building and sales prospecting operations, i.e. purchase history.
• Login data: your terminal’s operating system (Windows, Mac, Android, iOS, etc.), web browser used and user language, IP address, time stamp, type of terminal.
• Cookies: for our website rating analysis, we collect personal data via cookies (IP address, segmented or not…).
• Data regarding professional experience for a recruitment process.

Data recipients

For our data processing activities, we share data with the following people and bodies:

• Our personnel in charge of bookings, customers and recruitment;
• Our subcontractor in charge of bookings, customer comments and payment via the rubanvert-nantes.digital-nautic.com website, the company BAND OF BOATS, based 6 rue René Viviani in Nantes (44200), as well as its subsequent subcontractors in charge of payment (Crédit Mutuel ARKEA, Mangopay, Payline) and the company TRUSTPILOT for the management of customer reviews;
• Our subcontractor in charge of our website maintenance and sending promotional e-mails, the company Business to web, based 1 bis avenue Jules Verne in Saint-Sébastien-sur-Loire (44230);
• Our subcontractor in charge of hosting our website data, the company OVH, based 2 rue Kellermann in Roubaix (59100).

Data storage period

We store data solely for the duration required to achieve the purpose for which the data is collected. The data can be stored in buffer archives until the expiry of the statute of limitations period or in order to meet our legal obligations.

We store the data required for order management and billing throughout the business relationship period and ten (10) years in keeping with accounting obligations.

The data required for the performance of sales lead prospecting is stored throughout the business relationship period and three (3) years from the last order.

The data you send to us via contact forms is stored for three (3) years from the submittal of the contact form.

The data regarding the means of payment is not used by BAND OF BOATS after the transaction. It is stored in a buffer archive for complaint management purposes for 13 months after the debit date or 15 months for deferred debit cards, in keeping with the terms of article L. 133-24 of the Monetary and Financial Code. The visual cryptogram is never stored.

Data regarding opt-out lists from sales lead prospecting is stored for three (3) years from the opt-out date.

Recruitment data is stored while the application is under analysis and deleted if the application is rejected. It may be stored for two (2) years from the time the application is rejected, unless the applicant objects.

Data security

We make sure that the personal data is processed in a secure manner to guarantee its confidentiality, integrity and availability. We also implement technical and organizational measures to meet this security objective. We use the HTTPS protocol with TLS 1.2 on all our websites to ensure their authenticity and guarantee the encryption of data flows. Our servers are secured by OVH and hosted within the European Union. We also ensure that our payment contractor (Payline) has credit card security guarantees, including PCI DSS certification.

Your rights

Under the data protection regulations, you have rights, which include:

Right of access – You have the right to access your personal data and request a copy from us.

Right to rectification – You have the right to ask that we correct any inaccurate information. You also have the right to ask us to add missing information.

Right to erasure – You have the right to ask us to delete your personal data under specific circumstances.

Right to restriction of processing – You have the right to restrict the processing of your personal data under specific circumstances.

Right to object to data processing – You have the right to object to the processing of your personal data under specific circumstances.

Right to data portability – you have the right to ask us to transfer the data you have submitted to us to another organization or to yourself, under specific circumstances.

You can withdraw your consent to the publication of your comments on our website.

No costs apply for the exercise of your rights. If you issue a request, we have a period of one month to respond. In case of reasonable doubts about your ID, we may ask you to give proof of your ID by providing ID documentation (ID card, passport, residence permit).

Right to give instructions regarding how your personal data is processed after your death – You may give instructions about the storage, erasure and communication of your personal data after your death.

If you wish to exercise these rights, please contact us at: contact[at]rubanvert.fr or at the following address: RUBAN VERT Sarl, 20 Île de Versailles, 40000 Nantes.

If you no longer wish to receive commercial offers from us (exercise of the right to oppose or withdraw consent), you can unsubscribe by clicking on the link on the e-mail footer or by following the instructions sent by text message.

After contacting us, if you consider that your rights under the “Data Protection Act” are not complied with, you can send a complaint to the CNIL, online (www.cnil.fr) or by mail at: CNIL – Service des plaintes, 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07.