The Serre-Ponçon Community of Municipalities is committed to protecting your personal data in accordance with applicable European and French regulations.
This privacy policy is intended to inform you about the purposes and conditions under which we process the personal data we collect in connection with our Vaï transportation services.
1. GENERAL PROVISIONS
Definitions
What is personal data?
Any information relating to an identified or identifiable natural person. A person may be identified directly (last name, first name, etc.) and/or indirectly (customer number, phone number, images, etc.).
What is the processing of personal data?
Any operation performed on personal data (collection, recording, modification, storage, erasure, etc.).
Data Controller
The data controller for your personal data is the Serre-Ponçon Community of Municipalities.
Terms of Use
The Privacy Policy is an integral part of the General Terms of Use for our services and the General Terms of Use for our websites and mobile app, and must be read in conjunction with them.
Applicable Law and Competent Regulatory Authority
This Privacy Policy is governed by the General Data Protection Regulation No. 2016/679 (“GDPR”) and by the French Data Protection Act No. 78-17 of January 6, 1978, as amended (“French Data Protection Act”), under the regulatory oversight of the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés – www.cnil.fr).
Links to Third-Party Websites
Our websites may contain or use links to websites, mobile applications, products, or services operated by third parties (including advertising sites, our partners’ sites, or social media platforms). Please note that this Privacy Policy does not apply to these third parties, over which we have no control and for which we cannot be held liable.
We encourage you to review the privacy policies, procedures, and practices of these third parties.
Protection of Minors
In order to provide Vaï products and services, we may collect personal data from minors under the age of 16, under the supervision and with the consent of their legal representatives (parents or guardians). Users of our services who inform us that they are under 16 years of age have the right to request the deletion of their data (subject to our legal retention obligations described below), which they may exercise directly or through their legal representative, at any time and for any reason (see the “Contact Us” section).
2. PERSONAL DATA COLLECTED
This Privacy Policy applies to personal data that we may collect from you or about you from the following sources:
- Websites www.vai-serreponcon.fr and www.tad.vai-serreponcon.fr;
- The TAD Vaï mobile app;
- Emails, text messages, and other electronic messages between you and the Serre-Ponçon Community of Municipalities or the operators of Vaï services with whom the Serre-Ponçon Community of Municipalities has entered into a contract;
- Telephone or voice communications between you and the Serre-Ponçon Community of Municipalities or the operators of Vaï services with whom the Serre-Ponçon Community of Municipalities has entered into a contract;
- Exercise of your rights under the GDPR by mail and/or email.
3. USE OF COLLECTED DATA AND RETENTION PERIOD
We collect and use your personal data for the primary purposes described in Article 4. We retain your personal data only for as long as necessary to fulfill the various purposes, except in cases where the law authorizes or requires us to retain it for a longer period.
Purposes | Types of Data Collected | Retention Periods |
|---|---|---|
| Management of your user accounts on the tad.vai-serreponcon.fr website and/or the TAD Vaï mobile app | Login data Identification Data | 1 year from the date of user inactivity |
Management and registration for the on-demand transportation service | Identification data Login data Pickup and drop-off addresses, date, time, and location | The data will be deleted or anonymized 2 years after the last reservation. |
Responses to your requests for information / questions |
Identification data and details of the request Requests Received Responses Provided | 1 year from the date of your request |
| Complaint Handling | Identification information Requests received Responses provided | 5 years from the resolution of the claim |
| Cookie/Tracker Management | Cookies/trackers | To find out how long your data related to cookie management is retained, please refer to the “Cookie Policy .” |
| Conducting statistical analyses on the use of Vaï transportation services | Anonymized statistics | Not applicable |
| Pre-litigation and litigation management, gathering evidence | Data necessary for the ongoing proceedings | Duration of the proceedings |
Handling of requests to exercise rights and provide information under the GDPR | Identification data, including identification documents Requests received Responses provided | 5 years from the date the complete request is received.
The identification document is retained only for the duration of the verification process. |
| Issuance of penalty notices as provided for in the regulations governing on-demand transportation | Identification data
| 10 years |
4. WEBSITES AND MOBILE APP
The cookies used to ensure the proper functioning of the www.vai-serreponcon.fr website are described in the site’s legal notices.
Those used to ensure the proper functioning of the www.tad.vai-serreponcon.fr website are described in the “Cookie Policy – TAD Vaï Website,” available on the website.
Regarding the TAD Vaï mobile app, the storage and tracking technologies are listed below:
- Data stored locally in MMKV
Key Name | Category | Purpose / Description | Retention period | Required | Subject |
|---|---|---|---|---|---|
azure_auth_token | Security and Authentication | Keeps the user logged in and identifies their account during interactions with the service. | Until the user logs out or the token is revoked | Required | Internal |
auth-storage | Security and Authentication | Stores basic session information, such as name, email address, and login status. | Until the user logs out | Required | Internal |
settings-store | Functional / Personalization | Saves user preferences, such as the theme, notifications, and certain profile information. | Until reset or uninstallation | Required for the theme; optional for notifications | Internal |
config-storage | Functional | Stores the configuration needed to connect the app to the correct Carruko service. | Until updated or uninstalled | Required | Internal |
local_app | Functional | Saves the language selected by the user to display the app in that language. | Until changed or uninstalled | Required | Internal |
first_login_visited | Functional | Indicates whether the user has already completed the onboarding steps during their first login. | Retained until explicitly reset | Required | Internal |
push_registration_id | Push notifications and communication | Used to manage the device’s registration for push notifications. | Deleted upon logout or unsubscription | Required if notifications are enabled | Internal |
push_token | Push notifications and communication | Used to send push notifications to the correct device and update the token if necessary. | Deleted upon logout or unsubscription | Required if notifications are enabled | Internal, token issued by Google or Apple |
- Temporary storage in memory
Identifier | Category | Purpose / Description | Retention period | Required | Party |
|---|---|---|---|---|---|
localToken (JS variable) | Security and Authentication | Temporarily stores the login token while the app is in use to enable communication with the service. | Deleted upon logout or when the app is closed | Required | Internal |
- Firebase / Google (Android only)
Firebase is used via expo-notifications to send push notifications on Android using FCM.
ID / Storage | Category | Purpose / Description | Retention Period | Required | Data Subject |
|---|---|---|---|---|---|
Firebase Installation ID | Push Notifications and Communication | Identifies the app installation on the device to enable push notifications. | Retained until reinstallation; can be deleted via Firebase | Required if notifications are enabled | Third Party: Google |
FCM Registration Token | Push notifications and communication | Allows Carruko to send a push notification to the device in question. | Retained until the token is renewed | Required if notifications are enabled | Third-party: Google |
Firebase Common / DataTransport cache | Functional | Technical storage used by Firebase to ensure notifications function properly. | Managed automatically by Firebase | Required for FCM to function | Third-party provider: Google |
- Azure AD B2C / MSAL authentication
Identifier / Storage | Category | Purpose / Description | Retention Period | Required | Party |
|---|---|---|---|---|---|
OAuth 2.0 Authorization Code + PKCE Status | Security and Authentication | Used temporarily during the session to secure the return to the application. | Only during the session; deleted after redirection | Required | Third-party: Microsoft / Internal |
Azure AD B2C access token (JWT) | Security and authentication | Used to verify that the user is logged in when using Carruko services. | Expires according to the B2C policy, typically after 1 hour | Required | Third Party: Microsoft |
Azure AD B2C Refresh Token | Security and Authentication | Allows the session to be renewed without requiring the user to log in too often. | Expires according to the B2C refresh policy, typically between 14 and 90 rolling days | Required | Third Party: Microsoft |
MSAL Redirect URI Scheme | Security and Authentication | Used to complete the return to the application after login. No personal data is stored. | Not applicable | Required | Internal / Microsoft |
- Microsoft SignalR (real-time communication)
Identifier / Storage | Category | Purpose / Description | Retention Period | Required | Data Subject |
|---|---|---|---|---|---|
SignalR Connection ID | Functional | Temporarily identifies a real-time connection while the application is in use. | In-memory only; deleted when the connection is closed | Required for real-time features | Internal |
- Map display (Leaflet / WebView)
Identifier / Storage | Category | Purpose / Description | Retention Period | Required | Data Subject |
|---|---|---|---|---|---|
WebView HTTP Cache (map tiles) | Functional | May temporarily store map images to improve display and performance. Leaflet does not set cookies. | Managed by the system’s WebView cache policy | Required for map functionality | Internal |
MapLibre tile cache (if used) | Functional | May store certain map tiles on the device for faster rendering. | Deleted along with the app data or when the cache is cleared | Required for map functionality | Internal |
- Expo Platform Services
Identifier / Storage | Category | Purpose / Description | Retention Period | Required | Party |
|---|---|---|---|---|---|
Expo Updates manifest cache | Functional | Stores the latest version of the app downloaded remotely in order to provide available updates. | Until the app is updated or uninstalled | Required for OTA updates | Third-party: Expo |
Expo Constants / EAS Project ID | Functional | Provides technical information about the app version. This data is not used for user tracking. | Read-only, not stored elsewhere | Required | Third Party: Expo |
- Location (iOS and Android)
Identifier | Category | Purpose / Description | Retention Period | Required | Data Subject |
|---|---|---|---|---|---|
GPS Location / Network | Functional | Uses the user’s location—only with their consent—to display it on the map and help them find a route. The location is not stored after the session and is not sent to an analytics service. | Only during the session; not stored | Optional; the user may opt out | Internal |
5. LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA
In accordance with applicable regulations, we process your data when we have a legal basis that allows us to do so. This may include contractual performance, your consent, legitimate interest, or a legal obligation.
- Purposes of processing based on contractual (or pre-contractual) performance:
- Use of Vaï services;
- Registration for the Vaï on-demand transportation service (TAD) and management of reservations;
- The management, creation, and use of your user accounts on the TAD Vaï website and app;
- Billing and collection of penalties associated with the TAD Vaï service, as provided for in the service’s terms of use
- Processing purposes based on your consent:
- Managing cookies and trackers on our websites and app, excluding technical cookies and trackers necessary for operation;
- Processing purposes based on legitimate interest:
- Managing requests for information, questions, and complaints;
- Management of lost and found items;
- Handling pre-litigation and litigation matters, and gathering evidence: data necessary for ongoing proceedings;
- Data collected based on a legal obligation:
- Handling your requests to exercise your rights (access, rectification, objection, etc.) under the GDPR;
6. RECIPIENTS OF THE COLLECTED DATA
Your personal data is shared with the operators of Vaï transportation services with whom the Serre-Ponçon Community of Municipalities has entered into a contract, for the purposes set forth in Article 5.
The Serre-Ponçon Community of Municipalities may also be required to transfer your personal data:
- To the Public Treasury for the issuance and collection of fines corresponding to the penalties set forth in the terms of use for the Vaï on-demand transportation service;
- To third parties for legal reasons: in cases where we are required to comply with laws and regulations, legal requests, and orders, or if permitted by law (i.e., for the protection and defense of rights, situations threatening life, health, or safety, etc.).
We share certain pseudonymized data—which contains no direct identifiers—regarding cookies and trackers collected with the service provider that collects and processes these cookies and trackers. This service provider is a separate data controller responsible for the processing activities performed.
In any case, we always require these recipients to provide sufficient confidentiality and security safeguards and to take the necessary physical, organizational, and technical measures to protect and secure your personal data, in accordance with applicable law.
Any data transfers outside the European Union are governed by mechanisms approved by the European Commission or the competent authorities. Under no circumstances do we share this data for commercial purposes on your behalf.
7. DATA SECURITY
The Serre-Ponçon Community of Municipalities safeguards your personal data by implementing appropriate physical, organizational, and technical measures to prevent any unauthorized access, use, disclosure, alteration, or destruction, in accordance with applicable regulations.
These measures include, in particular:
- Storage on secure servers within the European Union;
- Securing your data, in particular through pseudonymization, encryption of transmitted data, and the implementation of measures to ensure the confidentiality, integrity, and availability of your data;
- Restricted access for employees and contractors on a “need-to-know” basis;
Although the Serre-Ponçon Community of Municipalities implements all possible measures to protect your personal data, we cannot guarantee the security of information transmitted on our websites or through the mobile app if a security flaw affects your device or browser.
8. YOUR RIGHTS REGARDING YOUR PERSONAL DATA
Under the GDPR and the French Data Protection Act, you have various rights, including:
- Access, rectification, and erasure of your personal data: to the extent permitted by the GDPR, you may request access to your personal data held and processed by the Serre-Ponçon Community of Municipalities, review it, obtain a paper or electronic copy, and request that it be corrected, updated, or deleted.
- Restriction of processing: In certain cases, you may request that the processing of your data be restricted.
- Objection: You may, at any time, request that certain personal data no longer be processed.
- Data portability: You may request that your data currently being processed be provided to you in an open, machine-readable format, whether for your personal use or to transfer it to another data controller.
- Complaint to a Supervisory Authority: Without prejudice to any other legal remedies, you have the right to file a complaint with the supervisory authority of the European Union country in which you reside, work, or in which you believe a violation of your rights has occurred.
- Disposition of Your Data After Your Death: You have the option to specify the disposition of your data after your death.
To the extent permitted by the GDPR, you may exercise all of these rights by submitting a request, accompanied by proof of identity, to the contacts listed in Section 9.
9. CHANGES TO THE PRIVACY POLICY
The Serre-Ponçon Community of Municipalities may need to amend the Privacy Policy. When necessary, we will notify you and/or seek your consent.
We encourage you to check this page regularly to review any changes and stay informed about the measures we take to protect your personal data.
10. CONTACT US
To the extent permitted by the GDPR, you may exercise all of your rights by submitting a request accompanied by proof of identity:
- Online: “Contact Us”
- By mail to the following address: Communauté de communes de Serre-Ponçon – 14 espace Delaroche – 05200 Embrun
You may also contact the Data Protection Officer for the Serre-Ponçon Community of Municipalities at the following address: dpo@cdg05.fr
We will endeavor to respond to your requests as soon as possible and in accordance with applicable regulations. However, in certain cases, we may not be able to grant your request in order to comply with our legal or contractual obligations.
If, after contacting us, you believe that your rights have not been respected, you may file a complaint with the CNIL: https://cnil.fr/plaintes