Legal notice
This document is being finalised.
Publisher
The French version of this page is the legally binding one. Translations are provided for information only.
In accordance with articles 1-1 and 19 of French law no. 2004-575 of 21 June 2004 on confidence in the digital economy (LCEN), the website cote-privee.com is published by:
- [to be completed], sole trader (entrepreneur individuel, EI), trading as “Côte Privée”
- Address: [to be completed]
- Phone: [to be completed]
- Email: contact@cote-privee.com
- Registered in the French national business register (Registre national des entreprises, RNE): SIREN [to be completed]
- VAT: [to be completed]
Publication director
The publication director is [to be completed]. Contact: contact@cote-privee.com.
Hosting
The website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, United States.
Regulated activity: passenger transport by VTC
The publisher operates as a VTC operator (voiture de transport avec chauffeur, a pre-booked car with driver). It is registered in the register of VTC operators provided for by article L3122-3 of the French Transport Code (Code des transports). The registration is renewed every five years. The register is kept by the French ministry in charge of transport.
The register is public: you can check this registration at https://registre-vtc.developpement-durable.gouv.fr/.
The driver, [to be completed], holds VTC driver's professional card.
All services are provided on advance booking only (article L3120-2 of the French Transport Code). The car cannot be hailed in the street or taken without a booking.
Professional insurance
In accordance with article L3120-4 of the French Transport Code, the publisher holds professional liability insurance. Insurer: [to be completed].
The vehicle is insured for paid passenger transport. Insurer: [to be completed]. Territorial cover of both policies: France, European Union and Switzerland.
Consumer mediation
In accordance with articles L612-1, L616-1 and R616-1 of the French Consumer Code (Code de la consommation), any consumer client may use, free of charge, the consumer mediator the publisher belongs to, to settle a dispute amicably. The client must first have tried to settle it directly with the publisher through a written complaint (see the terms of sale, section “Complaints and mediation”).
Consumer mediator:
- [to be completed]
- Address: [to be completed]
- Website, with an online form to submit a case: [to be completed]
Intellectual property
The texts, photographs, illustrations, maps, logos and layout of the website are protected by copyright. They belong to the publisher or are used with their authors' permission.
Any full or partial reproduction or representation without prior written permission is prohibited (article L122-4 of the French Intellectual Property Code).
The brands and names mentioned on the website (wine estates, restaurants, car maker) belong to their respective owners.
Personal data: data controller
This section and the following ones explain how we use your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and French law no. 78-17 of 6 January 1978 (loi Informatique et Libertés).
The data controller is [to be completed], [to be completed], reachable at contact@cote-privee.com. We have not appointed a data protection officer: our activity does not require one (article 37 of the GDPR).
Data we collect
We only collect the data needed for your booking, the service and the website's security:
- Booking form: name, email address, phone number, pickup address, date and time, number of passengers and notes (for example flight or train number, luggage, child seats). The question “How did you hear about us?” is optional.
- Messages: what you send us by email or phone.
- Payment: the deposit is paid by card on Stripe's secure payment page (Stripe Checkout). Your card details never reach us: we receive the payment's status and amount, and the card's brand and last four digits.
- Technical data: the host records server logs (IP address, date and time, page requested) for the website's security.
- Abuse protection: the website keeps your IP address and email address only as one-way fingerprints made with a secret key (HMAC), in counters that expire with their time window (from 15 minutes to one day). A one-day record also prevents the same booking from being sent twice.
- “Notes” field: only enter what is useful for the service. If you tell us about a health or mobility need, we use it only to adapt the service.
Purposes and legal bases
Each use of your data relies on a legal basis set out in article 6 of the GDPR:
- Handling your booking request, providing the service and answering your requests: performance of the contract or of pre-contractual steps taken at your request (article 6.1.b).
- Booking a tasting or a table for you, at your request: steps taken at your request (article 6.1.b). Only the useful details (name, number of guests, time) are passed on to the venue.
- Issuing the advance booking proof required for VTC services and showing it during roadside checks (arrêté of 6 August 2025), invoicing, keeping accounts and keeping proof of contracts made online with consumers: compliance with our legal obligations (article 6.1.c).
- Keeping the website secure, preventing abuse and fraud, answering questions that are not about a booking, handling complaints and defending our rights in a dispute: legitimate interest (article 6.1.f).
Retention periods
After the periods below, your data is deleted or anonymised:
- Contracts made online for €120 or more (booking confirmation and accepted terms): 10 years from the date of the service (article L213-1 of the French Consumer Code; threshold set by article D213-1, period by article D213-2).
- Invoices and accounting records: 10 years (article L123-22 of the French Commercial Code).
- Your details as a client, for the business relationship: 3 years after the last service.
- Messages from people who did not book: 1 year after the last contact.
- The copy of the booking on the website's server: 30 days, then deleted automatically.
- Abuse counters: until their window ends (15 minutes to 1 day).
- The record against duplicate bookings: 1 day.
- Server logs: as long as the host keeps them for security, 12 months at most.
- The website's cookies (language, theme): 12 months (see the “Cookies” section).
Recipients
Your data is intended for the publisher. It is never sold or rented. Our providers use it only on our instructions.
It may be shared, only as far as necessary, with:
- the website's host: Netlify, Inc.;
- the service that sends the booking emails: Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, United States;
- the payment provider: Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland;
- our accountant;
- another VTC operator, only if you agree that they provide the service in our place;
- the wine estates and restaurants we book for you, at your request;
- authorised inspectors and authorities, where the law provides for it (for example during a check of the booking proof).
Where your data is, and transfers outside the European Union
Your booking request is processed by the website's server functions, which run on Netlify in the United States (US East region, Ohio).
A copy of the booking is kept for 30 days in Netlify Blobs in Frankfurt (European Union, region eu-central-1), then deleted automatically.
Booking emails go through Resend, which stores account data, email metadata and its logs in the United States.
Fonts: they are hosted on the website itself. Displaying them does not send your IP address to Google or to any other third party.
Transfers to US companies certified under the EU-US Data Privacy Framework (DPF) rely on the European Commission's adequacy decision of 10 July 2023; otherwise, on the standard contractual clauses adopted by the Commission (Implementing Decision (EU) 2021/914). The services concerned:
- Netlify, Inc. (United States), hosting: its data processing agreement includes the 2021 standard contractual clauses, and Netlify states that it complies with the DPF.
- Resend (Plus Five Five, Inc., United States), booking emails: DPF and standard contractual clauses.
- Stripe, payments: contract with Stripe Payments Europe, Limited (Ireland); Stripe, Inc. is certified under the DPF for transfers to the United States.
Your rights
Under the conditions set by the GDPR (articles 15 to 22) and the loi Informatique et Libertés, you have the rights below. To use them, write to contact@cote-privee.com or by post to [to be completed], [to be completed]. We reply within one month, which may be extended by two months for a complex request. If we have reasonable doubts about your identity, we may ask you to prove it.
- Access: find out what data we hold about you and get a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: have your data deleted, unless the law requires us to keep it.
- Restriction: ask for the use of your data to be temporarily suspended.
- Portability: receive the data you gave us in a common format.
- Objection: object to a use based on our legitimate interest, on grounds relating to your particular situation, and at any time to direct marketing.
- Withdrawal of consent: at any time, where the use relies on your consent.
- Instructions after death: decide what happens to your data after your death (article 85 of the loi Informatique et Libertés).
Complaints to the CNIL
If, after contacting us, you feel your rights are not respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL) (article 77 of the GDPR). The complaint must be written in French. If you live in another European Union country, you may also contact the data protection authority of that country.
- Online: www.cnil.fr/fr/adresser-une-plainte
- By post: CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France
Your browser's local storage
The website also keeps a few items in your browser's local storage. They are not cookies: they stay on your device and are not sent to us; only the booking you send reaches us.
You can erase them at any time by clearing the website's data in your browser settings.
Items kept:
- cp-saved: “My trip”, the places you save.
- cp-cart: the booking in progress (forgotten after 3 days) and, for one day, the contact details you typed, removed as soon as the booking is sent.
- cp-cart-contact: those details after sending, in the open tab only (session storage), to show the confirmation.
- cp-still: your “Pause the animations” choice.
- cp-cookies: remembers that you have seen the cookie note, so that it is not shown again.
Credits
- Photographs: see the “Photo credits” page, which gives the author and licence of each image.
- Illustrations and maps: drawn for the website.
- Fonts: Fraunces, Manrope and Noto Naskh Arabic, under the SIL Open Font License; Chinese text uses your device's own fonts.
Last updated · 2026-10-07