Privacy Policy
How VTC and GO collects and processes your personal data when you request a price, book, pay or write to us, and how to exercise your rights. This translation is provided for information; only the French version is legally binding.
Last updated: 7 October 2026
01 · Data controller
The controller of personal data within the meaning of the GDPR (in French "RGPD") is VTC and GO, a société à responsabilité limitée à associé unique (French single-member limited liability company) with share capital of 1 500 €, registered under SIREN 879 987 006, whose registered office is at 21 rue de la Montagne de l'Espérou, 75015 Paris, represented by its manager (gérant) Jordan Moussard.
No data protection officer (DPO) has been appointed, given the volume and nature of the processing. Any request relating to personal data is handled directly by the controller.
- GDPR contact: contact@vtc-and-go.com
- Landline: 01 45 30 19 12
- Direct contact, WhatsApp and SMS: 06 75 61 44 94
- Postal address: 21 rue de la Montagne de l'Espérou, 75015 Paris
02 · Scope
This policy applies to data collected via the website, the booking process, the payment page, the client area and the direct channels operated by VTC and GO (e-mail, telephone, WhatsApp, SMS).
It does not apply to third-party websites accessible via links (social networks, review platforms, partner websites), which have their own policies.
03 · Inventory of processing activities
For each processing activity: purpose, data, legal basis, recipients and retention period. Technical providers are identified by category; the exact list of providers used is available on simple written request to contact@vtc-and-go.com.
A. Price request
- Purpose: to calculate and display a price before any booking.
- Data: departure, arrival and stopover addresses, date, time, number of passengers, options. No name, e-mail address or telephone number is requested at this stage.
- Legal basis: pre-contractual measures (Art. 6(1)(b) GDPR).
- Recipients: the controller, the hosting provider, the public address search and route calculation service (Géoplateforme of IGN, the French national mapping agency), which receives only the addresses entered.
- Retention: the quotation contains no identity data; it is attached to the booking if one is made.
B. Booking
- Purpose: to process the booking, perform the journey, provide operational follow-up and issue the booking voucher (bon de réservation).
- Data: the client's identity, telephone number and e-mail address; the passenger's identity and telephone number if different; addresses, date and time; number of passengers; vehicle category; luggage; special requirements (child seat, meet and greet); flight or train number; pick-up instructions.
- Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c): VTC regulations, accounting).
- Recipients: the controller, the hosting and database provider, the provider sending confirmation e-mails; where applicable, a partner chauffeur, solely for the information needed for the journey.
- Retention: duration of the contract, then 10 years for accounting records (Article L. 123-22 of the Code de commerce, the French Commercial Code).
C. Client account
- Purpose: to allow the client to log in and view their bookings.
- Data: e-mail address, any username, password (hashed, never stored in plain text), booking history.
- Legal basis: performance of the contract (Art. 6(1)(b)).
- Recipients: the controller, the hosting and database provider.
- Retention: for as long as the account is active, then 3 years after the last login, without prejudice to accounting obligations.
D. Payment
- Purpose: to collect payment online at the time of booking, on board by payment terminal, or by bank transfer for business clients; to manage refunds.
- Data: amount, date, status, payment method, transaction reference; for bank transfers, company name and invoice references. Card data (number, expiry date, security code) is entered directly with the payment provider: VTC and GO neither collects nor stores it.
- Legal basis: performance of the contract (Art. 6(1)(b)) and legal accounting obligation (Art. 6(1)(c)).
- Recipients: the controller, PCI-DSS certified payment providers (online payment and on-board terminal), VTC and GO's bank.
- Retention: 10 years for accounting records. Bank data is governed by the payment provider's policy.
Some providers may process data outside the European Economic Area; these transfers are based on the European Commission's Standard Contractual Clauses and, where applicable, on the EU-US Data Privacy Framework.
E. Invoicing and accounting
- Purpose: to issue invoices, keep the accounts and comply with tax obligations.
- Data: identity of the client or company, address, e-mail address, service reference, amounts excluding VAT, VAT and including VAT, payment method and status.
- Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
- Recipients: the controller, the invoicing and accounting provider, the chartered accountant, the tax authorities upon official request.
- Retention: 10 years (Article L. 123-22 of the Code de commerce).
F. WhatsApp messages, SMS and e-mails
- Purpose: to confirm the booking, send information useful for the pick-up, send reminders and reply to your messages.
- Data: telephone number, e-mail address, name, content of messages, booking reference.
- Legal basis: performance of the contract (Art. 6(1)(b)); responding to your enquiry (Art. 6(1)(f)).
- Recipients: the controller, messaging providers (WhatsApp, SMS) and e-mail sending providers.
- Retention: 3 years after the last exchange, unless the item is attached to a booking.
Some providers may process data outside the European Economic Area; these transfers are based on the European Commission's Standard Contractual Clauses and, where applicable, on the EU-US Data Privacy Framework.
G. Flight or train details
- Purpose: to anticipate the arrival and adjust the pick-up time.
- Data: flight or train number, airport or station, times.
- Legal basis: performance of the contract (Art. 6(1)(b)).
- Recipients: the controller.
- Retention: duration of the contract, then together with the booking.
H. Security and change log
- Purpose: to keep a record of who created or modified a booking or a payment, and to prevent errors and fraud.
- Data: author of the action (logged-in account or system), date, nature of the change.
- Legal basis: legitimate interest of VTC and GO (Art. 6(1)(f)).
- Recipients: the controller.
- Retention: aligned with that of the booking concerned.
I. Client reviews
- Purpose: to allow clients to read public reviews and, if they wish, to publish one.
- Data: name or pseudonym, rating and content of the review, collected directly by the chosen review platform.
- Legal basis: consent (Art. 6(1)(a)) for publication; legitimate interest for the invitation to leave a review, to which you may object at any time.
- Recipients: public review platforms, accessible via external links. The website does not load any review widget or script.
- Retention: according to the terms of the platform concerned.
J. Live journey tracking
- Purpose: to allow the client to see their chauffeur approaching and the estimated time of arrival on their booking page.
- Data: location of the chauffeur's telephone (latitude, longitude, accuracy), only between departure for the pick-up and the end of the journey. The client's location is never collected.
- Legal basis: performance of the contract (Art. 6(1)(b)) for the client; legitimate interest (Art. 6(1)(f)) for the chauffeur, who turns the location on their telephone on or off.
- Recipients: the client, via the private link to their booking; the persons with whom the client chooses to share tracking; the public route calculation service (Géoplateforme of IGN), which receives only two points in order to estimate the time of arrival.
- Sharing with someone close: from their booking page, the client can create a tracking link and send it to the person of their choice. This link shows only the stage of the journey, the time, the pick-up location, the destination, the vehicle's position during the journey, and the chauffeur's first name, the vehicle model and its registration plate, so that it can be recognised. It never shows the price, the payment, the booking reference, or the client's name or contact details. The client can stop sharing at any time: the old link stops working immediately. The link no longer displays anything a few hours after the end of the journey, or as soon as the journey is cancelled.
- Retention: for the client's tracking, only the latest position is used; it is deleted as soon as the journey ends or is cancelled, and at the latest after 12 hours. For the journey report (distance travelled, average speed), the chauffeur's positions are also kept, visible to VTC and GO only, and deleted after 30 days.
04 · Legal bases
- Performance of the contract or pre-contractual measures (Art. 6(1)(b)): prices, bookings, account, payments, operational messages.
- Legal obligation (Art. 6(1)(c)): booking voucher, invoicing, accounting, tax obligations.
- Legitimate interest (Art. 6(1)(f)): responding to an enquiry, security, fraud prevention, invitation to leave a review, after balancing against your rights.
- Consent (Art. 6(1)(a)): publication of a review. It may be withdrawn at any time.
Your data is never sold, rented or used for advertising purposes.
05 · Your rights
In accordance with Regulation (EU) 2016/679 (GDPR) and amended French Law No. 78-17 of 6 January 1978, you have the following rights:
- Right of access and to obtain a copy.
- Right to rectification.
- Right to erasure, where applicable (see the section "Deleting your data").
- Right to restriction of processing.
- Right to object, in particular to processing based on legitimate interest.
- Right to portability of the data provided in connection with the contract.
- Right to withdraw your consent at any time.
- Right to give instructions regarding the handling of your data after your death.
These rights may be exercised free of charge by e-mail to contact@vtc-and-go.com. We respond within one month and may ask for proof of identity where there is reasonable doubt.
In the event of a persistent disagreement, you may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
06 · Deleting your data
With an account, you can do it yourself from “My rides”, “My data” section: “Download my data” gives you a copy of your data (account, contact details, rides, invoices, WhatsApp messages) and “Delete my account” erases it immediately, unless a ride is still upcoming.
Without an account, or to request the deletion of your data, including data arising from our WhatsApp or SMS exchanges, write to contact@vtc-and-go.com or send a message to 06 75 61 44 94, stating the e-mail address or telephone number concerned.
We delete your account, your messages and your contact details within one month and confirm this to you. Only the data that the law requires us to keep (bookings and invoices, 10 years) is retained, and it is not used for any other purpose.
08 · Categories of recipients
Data is disclosed only to authorised persons and to the providers essential to the service:
- The controller and its authorised operational contacts.
- Website and database hosting providers (identified in the legal notice).
- Public address search and route calculation service.
- Payment providers (online and on board).
- Messaging providers (WhatsApp, SMS) and e-mail sending providers.
- Invoicing and accounting provider, chartered accountant, bank.
- Where applicable, partner chauffeurs, solely for the information needed for the journey.
- Administrative or judicial authorities where required by law.
09 · Transfers outside the European Economic Area
The database is hosted in Paris. Some providers (website hosting, online payment, WhatsApp messaging) may process data outside the European Economic Area, in particular in the United States. These transfers are based on a mechanism recognised by the GDPR: Standard Contractual Clauses adopted by the European Commission on 4 June 2021 and, where applicable, the EU-US Data Privacy Framework.
10 · Security
- Encryption of all connections (HTTPS).
- Passwords hashed, never stored in plain text.
- Administrative access restricted to authorised persons, with a change log.
- Database access rules: each client sees only their own bookings.
- No bank card data stored by VTC and GO.
- Verified signatures on notifications received from payment and messaging providers.
VTC and GO does not claim any security certification that it has not obtained. Any suspected incident may be reported to contact@vtc-and-go.com.
11 · Minors
VTC and GO does not collect data concerning minors other than in connection with a transport service. When a child is carried, only the information needed to prepare the pick-up (suitable equipment, for example) may be requested.
12 · Retention periods: summary
- Bookings, booking vouchers and invoices: 10 years (Article L. 123-22 of the Code de commerce).
- Client account: while active, then 3 years after the last login.
- WhatsApp messages, SMS and e-mails: 3 years after the last exchange.
- Price requests: no identity data.
- Chauffeur's location during the journey: deleted at the end of the journey, at the latest after 12 hours; journey trace for its report: 30 days.
- Tracking link shared with someone close: active until the client stops it; displays nothing 3 hours after the end of the journey, or after a cancellation.
- Bank card data: never stored by VTC and GO.
13 · Changes to this policy
This policy may be updated to reflect changes in processing activities, providers or regulations. The version in force is the one published on this page. In the event of a substantial change, account holders are informed by e-mail.