Privacy Policy

We collect the following categories of data:

Identification data

• First name, last name, date of birth
• Email address and phone number
• Profile picture (optional)
• Identity documents (for GPs only)

Transaction data

• Booking and trip history
• Payment data (processed and secured by Stripe)
• Ratings and reviews

Geolocation data

• Precise GPS position, shared by your browser or device when you use the "GPs near me" feature
• Manually entered address when you don't share your position
• This data is only used for the duration of your search and is not retained after your session

Browsing data

• IP address and connection data
• Cookies and usage data (see our Cookie Policy)
• Device used and operating system

• Contract performance: managing accounts, bookings, payments and deliveries.
• Identity verification: vetting GPs for the platform's security.
• Communication: status notifications, alerts, customer service messages.
• Service improvement: usage analysis, bug fixes, new features.
• Marketing: sending the newsletter (with explicit consent only).
• Legal obligations: tax compliance, accounting, responding to judicial requests.

• Contract performance (Art. 6.1.b GDPR): processing bookings and payments.
• Legitimate interest (Art. 6.1.f GDPR): fraud prevention, platform security.
• Consent (Art. 6.1.a GDPR): newsletter, non-essential cookies, precise geolocation ("GPs near me" feature).
• Legal obligation (Art. 6.1.c GDPR): accounting and tax obligations.

• Account data: duration of the contractual relationship + 3 years.
• Transaction data: 10 years (accounting obligation).
• GPs' identity documents: 1 year after the end of the subscription.
• Browsing data (logs): 12 months maximum.
• Newsletter data: until unsubscription.
• Data in the event of a dispute: until the dispute is finally resolved.

Your data may be shared with:

• Stripe: secure payment processing (PCI-DSS level 1 certified).
• Hosting providers: secure data storage within the European Union.
• Carriers (GPs): name, phone number and delivery address, only for the relevant bookings.
• Competent authorities: upon judicial request or legal obligation.

We never sell your personal data to third parties.

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request the deletion of your data ("right to be forgotten").
• Right to data portability: receive your data in a structured, readable format.
• Right to object: object to the processing of your data, in particular for marketing purposes.
• Right to restriction: restrict the processing of your data in certain cases.

ColisBled implements appropriate technical and organizational measures to protect your data:

• SSL/TLS encryption of all communications
• Irreversible password hashing (bcrypt)
• Data access restricted to authorized staff
• Regular security audits
• Daily encrypted backups