Política de privacitat

Virtuo acts as the controller of your personal data.

This information is required to enable you to access the services offered by Virtuo. In addition, it is used by Virtuo to improve its services.

Unless at your request or with your express consent and in strict compliance with your instructions, Virtuo will not process any personal data other than that described in the articles below.

In any case, the personal data collected:

-        will be obtained and processed fairly and lawfully;

-        will be stored for specific and legitimate purposes;

-        will be used in accordance with these purposes;

-        shall be adequate, relevant, and not excessive in relation to those purposes; and

-        will be subject to precautions to ensure the security and confidentiality of the data in order to prevent them from being damaged, modified, destroyed or communicated to unauthorised third parties.

This privacy policy is systematically brought to your attention when you register with the Site and/or the Application, and when you reserve a vehicle. As a matter of fact, the creation of an account and the use of the Services implies your express, full and complete acceptance of this Privacy Policy.

By checking the box: "I acknowledge that I have read and understood the privacy policy and accept this policy", you consent to your personal data being stored and processed by Virtuo and/or its potential partners. 

IMPORTANT: NOTE TO USERS

ANY BROWSING OF THE SITE AND/OR THE APPLICATION AND/OR ANY USE OF THE SERVICES AFTER THE PUBLICATION OF THIS PRIVACY POLICY IMPLIES FULL ACCEPTANCE OF THIS POLICY.

If you wish to withdraw your consent to the processing of your data, simply send a request directly by email to [email protected].

In addition, where required by law and/or in certain circumstances, your consent will be obtained or an opportunity to opt out will be provided prior to any transmission of data

The data collected by Virtuo is freely communicated by you when you register on the Site and/or on the Application.

It may also be collected automatically when you use the Site and/or the Application, and/or avail of the Services, in particular when you :

• browse the Site and/or the Application, even without having created an account;
• create an account on the Site and/or the Application; and
• make use of Virtuo Services.

Data that is required to be provided to Virtuo is identified as such when you register and/or use the Services. In particular, the collection of location data is necessary to enable you to use the services offered by Virtuo.

Therefore, without this list being exhaustive, the following categories of personal data may be collected, stored, and used

Identification data

When you register on the Site and/or the Application, Virtuo collects your identification data (e.g., last name, first name, email address, country of residence, telephone number, selfie, photographs of your ID card, and driver's licence). In addition, all data entered into the Application is retained, including all photographs taken via the Application.Financial data

When you register on the Site and/or the Application, Virtuo collects data relating to your means of payment (e.g. the last four digits and the expiry date of the bank card).

When you reserve a vehicle, Virtuo collects information relating to the completed transaction (e.g. transaction number, invoices issued, payment execution, pre-authorisations and security deposits).

Rental data

Virtuo offers a range of connected vehicles, equipped with an on-board device that collects and provides certain categories of information. As such, Virtuo can use this device at any time to monitor the condition, performance, and operation of the vehicle.

When you rent a vehicle, Virtuo collects information about the rented vehicle (e.g. the model of the vehicle, the times and location of the rental).

Virtuo also collects and processes data relating to mechanical failures and potential damage to vehicles, such as accidents, loss, or theft of the vehicle (e.g. incident report, police or third-party report, including the nature of any physical injury and/or property damage).

Virtuo also collects and processes data relating to fines for offences committed during the rental period (e.g. speeding fines, parking fines, tolls, or other fines relating to traffic legislation and/or traffic offences).

Connected vehicle data

The vehicles offered by Virtuo for rental are all equipped with an on-board device that collects and provides certain categories of information (including personal data) to Virtuo and the manufacturer of the vehicle and/or on-board device. The purpose of using the collected data relating to the connected vehicle is to provide you with a 24/7 vehicle access service, to ensure that the vehicle is in working order and to make the vehicle rental service more efficient.

Virtuo collects information relating to the use of the vehicle, such as the fuel level, vehicle maintenance information (e.g. whether a light is illuminated on the dashboard, battery level), mileage or maximum speed, vehicle controls (e.g. door locks).

Location data

Virtuo has equipped its vehicles with an on-board device to provide you with efficient vehicle access services and to combat theft and fraud. In this context, location data may be collected. This information may be used both during and after the end of the rental period. However, Virtuo never uses this location data to track or monitor your movements in general.

Data relating to conversations with customer service

Virtuo collects and processes data relating to email, phone or chat conversations with customer service. In particular, Virtuo may record or track calls for quality control, training, customer service improvement or similar purposes.

Data relating to the monitoring of the commercial relationship

Virtuo collects and processes data relating to the monitoring of your commercial relationship (for example the billing address, the number of reservations made, the rental location) or relating to the implementation of loyalty promotions.

Driving-related video data

Some vehicles, except in Germany according to the legislation in place, may be equipped with an on-board camera, installed beneath the front mirror of the vehicle and only filming the road in front of the vehicle.

The on-board camera automatically films the road, however, the video recording is only triggered in the event of unusual driving behaviour (such as acceleration, braking, or a sudden change in the vehicle's direction) or at the specific request of the fleet administrator, and is then temporarily stored on a cloud instance.

Video data relating to parking locations

In the places where vehicles are parked, you are informed that video protection systems are in place, which are operated by the person in charge of managing the parking area. In this context, identification data may be collected (for example your image). Virtuo is in no way responsible for the processing of this data.

Statistical data

As part of its activity, Virtuo collects, processes and stores statistical data relating to the use of the Site and/or the Application and relating to your activity on the Site and/or the Application.

This usage data, which may be passed on to third parties, is anonymous and in no way enables the identification of Internet users, even indirectly.

Login data

When you access the Site and/or the Application, cookies and other trackers may be deposited and stored on your device in order to collect and process information relating to your navigation.

The Cookie Policy will provide you with transparent information about how Virtuo deposits, uses, and stores cookies and other trackers on your device when you use the Site and/or the Application. It will also show you the options to manage or delete them.

Virtuo only uses personal data for the purposes for which they were collected.

The personal data collected on our Site and/or our Application and/or when using our Services is used for the following purposes:

Using the Application

This processing is necessary to identify you and to prepare and facilitate your future bookings and rental contracts, and is based on the implementation of contractual measures.

The data is retained for the duration of the commercial relationship. However, information that serves as evidence of a right or a lease, or that must be retained by virtue of a legal obligation, is subject to an intermediate archiving policy for a period that shall not exceed the purposes of retention.

Managing reservations and rentals, and in particular in order to:

-        confirm, modify, and cancel your reservations;

-        perform identity, security, driver's licence and credit checks;

-        confirm and insure your rentals;

-        communicate with you regarding your reservation and rental (e.g. send reminder notifications before you pick up or drop off the vehicle);

-        manage your rentals (vehicle pick-up and drop-off);

-        manage your communication (by email, phone or chat) with the customer service

-        manage the payment of services;

-        manage your invoices;

-        manage the collection of amounts due;

-        manage potential claims;

-        manage the potential recovery of compensation in the event of damage to the vehicle; and

-        manage your insurance.

This processing is necessary to enable the booking and the execution of the rental contract, and is based on the execution of contractual measures.

The data is retained for the duration of the business relationship, i.e. until you delete your user account. However, information that serves as evidence of a right or a lease, or that must be retained by virtue of a legal obligation, is subject to an intermediate archiving policy for a period that shall not exceed the purposes of retention. Records of exchanges with the customer service are kept for five (5) years from the last contact with the customer.

Managing tickets, in particular in order to:

-        transfer the identity of the principal driver mentioned on the rental contract to the National Automated Ticket Processing Agency (Agence Nationale de Traitement Automatisé des Infractions, ANTAI); and

-        to satisfy the procedures for the collection of the fines to which Virtuo is subjected, with regard to the French and foreign authorities, as well as the corresponding invoicing.

This processing is based on a legal obligation.

The data is retained for the time necessary to identify the driver responsible for the commission of the offence that gave rise to the ticket, which may not exceed forty-five (45) days from the receipt of the ticket for offences in France. However, the relevant information is kept for a longer period of time, from the time the ticket is received, as part of an intermediate archiving policy.

Managing a list of clients with certain contractual risks, with respect to:

-        payment incidents resulting in litigation ;

-        traffic accidents or repeated damage caused by a Virtuo customer;

-        accidents or damages caused deliberately by a Virtuo client; and

-        the use of Virtuo's Services in violation of the General Terms and Conditions of Rental.

This processing is based on Virtuo's legitimate interest and aims to reduce Virtuo's exposure to risks during the execution of the rental contracts. If you appear on this list of at-risk clients, your reservation or rental request may be rejected. Under certain conditions, you may challenge this decision by contacting privacy@govirtuo.com.

The data is retained for three (3) years from the date of the event in case of unpaid incidents and accidents; for five (5) years from the date of the event in case of breaches of the General Rental Conditions, it being specified that the data relating to payment incidents shall be deleted as soon as the situation is resolved.

Making automated individual decisions, based on:

-        booking habits;

-        rental patterns; and

-        contractual risks.

This processing is based on Virtuo's legitimate interest and aims to improve the processing time for reservation requests, but also to reduce Virtuo's exposure to risks during the execution of rental contracts. Depending on the results of this processing, your reservation or rental request may be rejected. If you have been subject to such a decision, you may request a review of your situation, express your views, obtain an explanation of the decision taken, or challenge that decision, by contacting privacy@govirtuo.com.

This data shall be retained for the duration of the commercial relationship. However, data concerning contractual risks shall be kept in compliance with the maximum periods for processing customers presenting contractual risks as set out above.

Managing the location of vehicles

The geolocation of rental vehicles is used to provide you with a 24/7 vehicle access service, to prevent potential offences, to combat theft and fraud, and to obtain a vehicle status in case of emergency. Virtuo never uses this location data to track or monitor your movements during the rental.

This processing is based on the legitimate interest of Virtuo.

The data is retained for a maximum period of nine (9) months from the date of rental of the vehicle.

Managing the means of proof in case of damage

The video recording of the driving captured by on-board camera aims to determine precisely the responsibilities of each party in case of damage to the vehicle, and in particular, to protect you from unjustified claims from third parties.

This processing is based on Virtuo's legitimate interest in reducing disputes between Virtuo and yourself in case of damage to the vehicle.

The data is retained for a period of six (6) months, or until the vehicle has been driven for three hundred and twenty-three (323) hours, whichever is shorter.

Improving our products and services, based on:

-        customer satisfaction surveys; and

-        trade statistics.

This processing is based on Virtuo's legitimate interest in having a better knowledge of your needs and offering you personalised features to improve your experience of products and services.

The data is retained for three (3) years from the last contact with the customer.

Conducting sales and commercial prospecting activities, including:

-        sending emails, SMS, and push notifications within the Application regarding special offers and promotions;

-        recording our rental history to suggest preferred products or services when you are looking for new reservations or rentals;

-        recording your rental history to send you special offers and benefits based on the volume and frequency of your purchases;

-        sending emails, SMS, and push notifications within the Application, relating to a reservation that you have not completed or relating to the status of your reservation requests;

-        sending emails presenting products and services to professionals;

-        the organisation of contests and sweepstakes; and

-        the management and updating of the customer and prospect database.

For individuals, commercial prospecting activities, i.e. the sending of messages of a commercial nature to promote the products and services offered by Virtuo, are subject to your express consent. If you are an existing customer and the message concerns products or services similar to those already ordered, the underlying processing to promote these products and services will not be based on your consent, but rather on Virtuo's legitimate interest.

For professionals, commercial prospecting activities are subject to the prior notification of the persons contacted that their email address will be used for prospecting purposes, as well as of their right to object to this use. This processing is based on the legitimate interest of Virtuo.

The data shall be retained for customers for three (3) years from the end of the commercial relationship. For prospective customers, they are retained for three (3) years from the date of collection of the personal data or from the last contact from the prospective customer.

Proposing partner offers, including:

-        distributing advertising content via the Application and/or the Site; and

-        proposing offers from partners based on your choices, provided that you have expressly consented to this.

This processing is based on your consent, in order to offer you personalised features.

The data is retained for three (3) years from the last contact with the customer.

Managing requests to exercise rights

The processing of requests to exercise the rights listed in paragraph IX, below, is based on a regulatory requirement.

The data is retained for one (1) year after the customer's request.

Aggregate personal data with non-personal data

Virtuo reserves the right to publish, disclose and use aggregated information (information about Users or specific groups or categories of Users combined in such a way that an individual User can no longer be identified or referred to) and non-personal information for industry and market analysis, demographic profiling, promotional and advertising purposes, and other business purposes.

Means of purging your personal data are put into place in order to provide for the effective deletion of your personal data as soon as the period of retention or archiving as required for the fulfilment of the determined or imposed purposes is reached.

The recipient of your personal data collected on the Site and/or on the Application, and/or when using the Services, is, in the first instance, Virtuo.

Your personal data will not be communicated to third parties, other than to Virtuo's partners, to whom the communication of personal data is necessary for the realisation of the services offered by Virtuo.

In particular, your personal data may be communicated:

To employees and authorised representatives of Virtuo, or any of its affiliates (the term "affiliate" shall have the meaning defined in Article L.233-3 of the French Commercial Code), or any other entity, if the transfer of the data proves necessary for the performance of the services by Virtuo.

To subcontractors and service providers who assist Virtuo in providing the products and services, the most notable of whom are listed below:

-        For marketing services: CaptainData, Demodesk, Facebook, Google, HubSpot, Hunter, Lemlist, LinkedIn, Lusha;

-        For the management of trackers and cookies: Facebook, Google, Realytics;

-        For application development and management: Atlassian, Google;

-        For user identification: Resocom, Ubble;

-        For geolocation: BMW, Mercedes;

-        For payment management: Checkout, Stripe; PayPal;

-        For SMS management: SMSmode, Twilio;

-        For the call centre: Aircall;

-        For the messaging platform: Intercom;

-        For the management of fines: Safo Group;

-        For insurance management: Kooalys,Axa, Théorème; and

-        For statistics: Appsflyer, Google, Logz.io, Looker.

Virtuo requires that all of its subcontractors and service providers implement all necessary technical and organisational measures, on an ongoing basis, as required to keep your personal data secure and to ensure the same high level of personal data protection as required by Virtuo. Its subcontractors and partners undertake to comply scrupulously with the provisions of the Data Protection Act, the GDPR, and any future provisions.

As such, when the entity concerned is located outside the European Union, or in a country that does not have an adequate regulation as defined by the GDPR, Virtuo shall regulate its contractual relationship with this entity by adopting an appropriate contractual arrangement.

To the Agence Nationale de Traitement Automatisé des Infractions (ANTAI), or its foreign equivalents, in the case of violations committed abroad, regarding information processed for the payment of tickets.

To the Conseil National des Professions de l'Automobile (CNPA) concerning customers considered to be a "customer at risk", as defined by CNIL Deliberation No. 2006-235 of November 9, 2006 (i.e., in the event of a payment incident, accident, deliberate accident, and/or failure to comply with the general rental conditions).

To the appropriate authorities pursuant to legal obligations, in order to respond to requests for information from government agencies or law enforcement.

If we transfer your personal data outside the European Union to a country that does not provide an adequate level of protection, we shall ensure that appropriate safeguards are in place.

In the event of a change of control concerning Virtuo, a merger, an acquisition, a collective procedure, or any other form of transfer of assets, the data collected by Virtuo may be transferred to third parties. Nevertheless, Virtuo is committed to guaranteeing the confidentiality of the personal data collected and to informing you before they are transferred or become subject to new confidentiality rules.

Where required by law, your consent will be obtained or an opportunity to opt-out will be provided prior to any transmission of data.

Virtuo undertakes to implement the appropriate technical and organisational measures deemed reasonably necessary with regard to the regulations applicable to the protection of personal data, including protection against unauthorised or unlawful processing, and against loss, destruction, or accidental damage, in order to guarantee a level of security appropriate to the risks incurred to the rights and freedoms of individuals within the context of the processing referred to in this privacy policy.

When personal data is transferred to third parties for processing, Virtuo shall ensure that these third parties implement all appropriate technical and organisational measures to ensure the protection of the personal data in accordance with applicable laws.

These measures are defined taking into account the state of knowledge, the costs of implementation, and the nature, scope, context, and purpose of the processing, as well as the identified risks.

Virtuo shall take the necessary precautions, with regard to the nature of your data, the requirements, the risks, the costs, and the purpose of the processing, to preserve the security of the data and, in particular, to prevent it from being distorted, damaged, or accessed by unauthorised third parties (physical protection of the premises, authentication process for our customers with personal and secure access via confidential identifiers and passwords, logging of connections, encryption of certain data...).

Finally, in the event of a violation of rights concerning personal data that is likely to incur a high risk to the rights and freedoms of the User, Virtuo undertakes to inform the User of this violation within a maximum period of seventy-two (72) hours.

Virtuo only processes your data within the European Union and does not transfer this data outside this area.

However, in the case of international transfers outside the European Union, a distinction must be made between:

-        countries that have been the subject of an adequacy decision by the European Commission: in this case, the data shall be transferred to a country that provides a level of protection deemed sufficient and equivalent to the provisions of European data protection regulations; and

-        countries whose level of data protection has not been recognised as adequate: in this case, in order to guarantee a transfer in compliance with European regulations, and in particular to ensure data security, Virtuo will base its transfer on protection mechanisms adapted to each service provider and subcontractor, such as the conclusion of standard contractual clauses approved by the European Commission, the application of binding corporate rules, or under an approved certification mechanism.

You can access and update your personal data or delete your account and personal information at any time via the Application, using your login and password.

In accordance with the GDPR, you have the following rights:

-        A right of access: the right to obtain confirmation as to whether or not your personal data is being processed and, if so, to access such personal data;

-        A right of rectification: the right to obtain the rectification of inaccurate personal data or the right to have incomplete personal data rendered complete;

-        A right to erasure: the right to have your personal data erased under certain circumstances;

-        A right to objection: the right to object, at any time, to the processing of your personal data for certain situations;

-        A right to limitation: the right to request the limitation of the processing, in certain instances;

-        A right to portability: the right to receive the personal data you have provided in a structured, commonly machine-readable format, and to share it with a third party;

-        A right to define post-mortem directives: the right to set directives regarding the handling of your personal data (retention, deletion, disclosure) after your death

You can exercise these rights:

-        by post, addressed to Virtuo Technologies - 114 rue Cardinet – 75017 Paris

-        by email to the DPO: [email protected]

Should you choose to exercise one of these rights, you will be required to send to Virtuo the elements necessary for your identification: name, first name, email address, and potentially your postal address.

In addition, in accordance with the regulations in force, your request must be signed, accompanied by a photocopy of an identity document bearing your signature, must be clear, and must specify in detail the right you wish to exercise as well as the address to which you wish to receive the response if exercising one of the rights listed above.                          

Virtuo undertakes to respond within a maximum of one (1) month following receipt of your complete request.

Due to the complexity of the request and/or the number of requests, this period may be extended to two (2) months, provided that Virtuo informs you of the reasons for the postponement within one (1) month of receiving your request.

If, after contacting Virtuo, your feel that your rights have not been respected, you may file a complaint in one of the ways indicated below:

For France, with the Commission Nationale de l’Informatique et des Libertés - CNIL:

-        via the CNIL website: www.cnil.fr/fr/plaintes or www.cnil.fr

-        by post:

Commission Nationale de l'Informatique et des Libertés - CNIL

3 Place de Fontenoy

TSA 80715 - 75334 PARIS CEDEX 07

For Germany, with Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit:

-        by phone : +49 228 997799-0

-        by e-mail : [email protected]

-        by de-mail : [email protected]

-        by post:

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit

Graurheindorfer Str. 153

53117 BONN

On the Site and/or the Application, you may have access to various links directing you to third-party sites.

Virtuo cannot be held responsible for any information that is sent to or collected by these third parties.

This privacy policy does not govern third-party sites or third-party content that you access from the Site and/or the Application.

Virtuo has no control over hyperlinks and/or other promotional formats.

Consequently, Virtuo does not provide any guarantee concerning the practices, in terms of the protection of personal data, of the indexed websites, and can under no circumstances be held responsible within the context of any dispute arising between a website that is indexed on the Site and/or on the Application and one of the Users, in particular on account of losses or damages suffered, the operators of the indexed websites being solely responsible for their practices with regard to the protection of personal data.

Virtuo reserves the right to modify and update this present privacy policy at any time, with a view to taking into account any legal and/or jurisprudential developments, and in order to meet the requirements of the regulations applicable to the protection of personal data.

Virtuo will notify you of important changes or updates to this policy by email.

The version that prevails is the one that is accessible online on the day that the Site and/or the Application is consulted.

The privacy policy is available in several languages but only the French version is binding.

Any consultation of the Site and/or the Application after the publication of the modified privacy policy shall be deemed to represent an unconditional acceptance of the new privacy policy.

Version updated on 22 april 2022.