Privacy Policy

1. Who are we?

The data controller for personal data collected through this website is:

2. What data do we collect?

In the course of providing our vehicle rental services and operating our website, we may collect the following categories of data:

• Identification data: first name, last name, email address, phone number.
• Booking data: rental dates, vehicle type, pick-up location.
• Payment data: card details (card number, expiry date, CVV) are never transmitted through or stored on our servers. They are collected and processed exclusively by our payment provider OSB (Tahiti) via the secure PayZen platform, certified PCI-DSS.
• Browsing data: IP address, browser type, pages visited, session duration (via Google Analytics).
• Cookies: please see our Cookie Policy.

3. Why do we use your data?

4. How long do we retain your data?

• Booking and contractual data: 5 years from the end of the rental agreement (accounting and legal obligation).
• Contact data: 3 years from the date of last contact.
• Browsing data: 26 months maximum (in line with CNIL guidelines).

5. Who do we share your data with?

Your data may be shared with the following recipients, strictly to the extent necessary:

• OSB (Tahiti) — PayZen platform: our online payment provider. All payment card data is processed directly by OSB via the PayZen platform (PCI-DSS certified). We do not store any card data on our systems.
• Google Analytics (anonymised audience measurement — United States, with contractual safeguards).
• Email service provider (sending booking confirmations and rental agreements).
• Competent authorities (where required by law or court order).

We do not sell your personal data to third parties.

6. Your rights

Under the GDPR (General Data Protection Regulation) and applicable regulations, you have the following rights:

• Right of access: obtain a copy of the personal data we hold about you.
• Right of rectification: have inaccurate or incomplete data corrected.
• Right to erasure: request deletion of your data (subject to legal retention obligations).
• Right to restriction: temporarily suspend the processing of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent at any time (without affecting prior processing).

To exercise these rights, contact us at contact@avis-borabora.com, enclosing a copy of your identity document.

If your request is not satisfactorily resolved, you may lodge a complaint with the CNIL (www.cnil.fr).

7. Data security

We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access or disclosure. Our website uses the HTTPS protocol (TLS encryption).

8. Regional provisions

8.1 European Union visitors (GDPR)

If you reside in the European Union or the European Economic Area, you benefit from the rights described in Article 6 above, under Regulation (EU) 2016/679 (GDPR). If we do not respond satisfactorily within 30 days, you may lodge a complaint with your national supervisory authority (in France: CNIL).

8.2 California, USA residents (CCPA / CPRA)

If you reside in California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you specific rights:

• Right to know what personal data we collect and how it is used.
• Right to deletion of your personal data (subject to legal exceptions).
• Right to opt out of the sale or sharing of your personal data.
  We do not sell your personal data. No sharing for cross-context behavioural advertising takes place.
• Right to non-discrimination for exercising your CCPA rights.

To exercise these rights: contact@avis-borabora.com.

8.3 Brazil residents (LGPD)

If you reside in Brazil, the Lei Geral de Proteção de Dados (LGPD — Lei nº 13.709/2018) grants you rights similar to those under the GDPR: access, rectification, portability, erasure, information on sharing, and objection. You may also contact the Autoridade Nacional de Proteção de Dados (ANPD) if your request is not satisfactorily resolved.

8.4 Switzerland residents (nFDP)

If you reside in Switzerland, the new Federal Act on Data Protection (nFDP, in force since 1 September 2023) applies. You benefit from the same rights as EU residents. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

9. Amendments

We reserve the right to update this policy at any time. The date of the most recent revision appears at the top of this document. We encourage you to review it periodically.