1. Data controller and scope
The data controller is AZUP AUTOMOBILES, a French SAS with share capital of €2,000, RCS Paris 910 617 067, 102 avenue des Champs-Élysées, 75008 Paris, France, trading as Blue Prestige. Personal-data contact: contact@blueprestigemobility.com, or by post to that postal address.
This policy covers the showcase website and communications relevant to services, billing, business accounts, marketing, applications and operator approval. The bespoke booking platform is currently closed for redesign; any historical data remaining there is still subject to protection and retention obligations.
2. Collection, sources and necessity
Data comes from you, your communications with Blue Prestige or the person preparing your journey: a company, assistant, hotel, concierge service or other authorised booker. For business marketing, it may come from professional contact details published on LinkedIn or from a provider such as Lusha. The precise source is stated at first contact and can be requested from Blue Prestige.
Forms prepare your enquiry in the browser. Apart from the address searches described below when enabled, the website code does not transmit entries to Blue Prestige before you send them. The simulator's send buttons transmit your assignments and contact details to the Blue Prestige server: the enquiry is stored in a private area at Hostinger and our team is notified by email. The technical copy expires after 30 days and is deleted when the next enquiry is processed. An IP-address fingerprint is used to limit abusive submissions for one hour. Received communications follow the periods in the Retention section. The simulator stores a draft on your device so you can resume for 24 hours. It includes the journey, preferences and contact details already entered. You can delete it from the simulator; an expired draft is deleted on the next opening. This local save is not a submission to Blue Prestige. Other forms remain in the open page; your browser may apply its own autofill.
The simulator's autocomplete sends address fragments of three or more characters to the Blue Prestige server and then to Geoapify to search for addresses. Name, email and telephone fields are not sent to this service. Suggestions and their coordinates remain temporarily in page memory. The website module does not log addresses: its counter retains only call volumes and alert status. You may keep a manually entered address without selecting a suggestion.
Telephone appointments are booked on Cal.com in a new tab. Entered contact details (name, email and telephone), the time slot and any notes are used to arrange your discussion with Blue Prestige. The booking is sent to Blue Prestige and synchronised with its Google Calendar. No Cal.com form is loaded within the website's pages.
Opening WhatsApp or email transmits the prepared text to the chosen service, notably through the WhatsApp link, before you complete the sending yourself. These services' technical processing and hosting logs remain separate. You may contact Blue Prestige directly without using the simulator.
Fields marked mandatory are used to prepare the corresponding enquiry. Without information necessary for the journey, safety or billing, Blue Prestige may be unable to respond or confirm the service. Optional preferences need not be supplied.
3. Purposes and legal bases
Enquiries, quotations and service performance
Useful information includes identity and contact details, locations, dates and times, flight or train number, passenger and luggage numbers and instructions needed for the assignment. Processing is based on pre-contractual steps requested by the person or performance of their contract where they are a party. For a passenger booked by a third party or a company contact, it is based, as applicable, on the legitimate interest in organising and following the ordered journey, subject to their rights and reasonable expectations. Specific regulatory requirements rely on the corresponding legal obligation.
Assistance needs
A practical instruction may reveal health or disability information. Limit it to what is essential for organisation; do not include a diagnosis or medical document in an initial form. Where sensitive data is genuinely necessary, Blue Prestige must identify a basis under GDPR Article 6 and an applicable exception under Article 9. If explicit consent is used, it is collected separately and documented for the stated purpose and recipients. Booking terms or sending an enquiry do not replace it.
Billing, payment and accounting
Client identity, company, billing address, services, amounts, references and payment status are used to invoice and track payment. Accounting and tax obligations form the basis for statutory supporting records; contract performance and, where necessary, the legitimate interest in debt recovery cover other operations. Card data entered with a payment provider must not be sent to Blue Prestige by email or WhatsApp.
Business accounts and contacts
Company identity, contacts' details and roles, order references and relevant history enable relationship management. The contract is the basis when concluded with the data subject; for employees or representatives of a legal entity, relationship management relies on the legitimate interests of Blue Prestige and the client company.
Business marketing
Name, role, company, business contact details and relevant history are used to offer services related to the recipient's profession, based on legitimate interest after assessing the contact's relevance and expectations. Article 7 explains information and objection. A passenger's contact details do not automatically become a marketing database.
Applications and partners
For employment applications, contact details, the CV and information directly relevant to the position are used to assess the application on a pre-contractual basis. Retention in a talent pool requires separate information and a documented basis, including your agreement if that option is used. Identity or professional documents are requested only when necessary; a coordinator's CV does not justify systematic collection of a private-hire driver card.
Independent partnership enquiries are distinguished from employee recruitment. Approval requires statutory checks of the operator, its drivers and vehicles. Necessary documents and verification records fall notably under French Transport Code obligations; other communications preparing the partnership rely on the appropriate contractual basis or legitimate interest.
Complaints, rights and security
Information strictly necessary for a complaint or defence of a right is processed on the basis of legitimate interest or applicable legal obligations. GDPR requests and handling objections serve compliance with legal obligations. Technical logs necessary for security must be limited to that purpose and a justified duration. The simulator makes no automatic decision producing legal effects: it supplies an estimate and Blue Prestige reviews the enquiry.
4. Retention periods
The schedule below distinguishes current uses from necessary archives. An evidential archive contains only necessary information with restricted access; it cannot be used for permanent marketing.
- Enquiries and services
- For the time needed to handle the enquiry, assignment and payment. Information necessary for a dispute is then archived for the limitation period applicable to the action concerned. No general three-year retention of all conversations is planned by default.
- Accounting records and invoices
- 10 years from the end of the financial year concerned. This period does not extend to all messages, CVs and travel instructions.
- Business-account contacts
- During the relationship and while the person remains the relevant contact, followed by deletion, updating or archiving of only necessary records. Marketing use follows its own retention period.
- Business prospects
- At most 3 years from collection or the last active contact initiated by the prospect. An unanswered follow-up or simply opening a message does not restart the period. An objection ends solicitations without waiting for this deadline.
- Unsuccessful applications
- For the current selection process. A talent pool may be offered for at most 2 years after the applicant's last contact, with documented information and legal basis. This period does not authorise automatic retention of identity documents or all supporting records. A separate evidential archive is maintained only if necessary and justified.
- Partner supporting documents
- During the relationship, with required documents and deadlines kept up to date. The period for archiving only necessary evidence afterwards must be determined according to applicable obligations and remedies; ‘partnership + 5 years’ is not presented as a general statutory period.
- Assistance needs
- Deletion as soon as assistance organisation and immediate follow-up no longer require the information, unless another duly identified basis applies. Retaining a preference for a future assignment requires assessment and, where applicable, separate consent.
- Objection to marketing
- A minimal identifier and record of the objection are retained for at least 3 years, in accordance with the CNIL recommendation, exclusively to prevent renewed contact. Their retention period is reassessed while that need continues.
- Rights, disputes and technical logs
- Necessary records during handling and then, if justified, archiving limited to applicable evidential periods. Identity verification does not result in systematic retention of an identity-document copy.
- Enquiry and service archiving schedule
- Enquiries that do not proceed: 3 years after the last contact. Completed services: for the duration of the relationship, then archived for 5 years; accounting records: 10 years.
- Archiving of business-account contacts
- For the duration of the business relationship, then 3 years after the last contact.
- Evidential archiving of applications
- 2 years after the last contact if no collaboration follows, unless earlier deletion is requested.
- Archiving of partner supporting documents
- For the duration of the partnership, then 5 years as evidence of the checks performed.
- Deletion period for assistance instructions
- Deleted no later than 3 months after the service, unless a complaint is ongoing.
- Archiving of rights requests, complaints and disputes
- Rights requests and complaints: 5 years after closure; disputes: until all avenues of appeal have been exhausted.
- Technical-log retention
- Hosting provider's technical logs: no more than 12 months.
5. Recipients and tools used
Data is intended for authorised Blue Prestige team members and participants who need it for their assignment. The driver and operator receive useful instructions, including the passenger's name and telephone number, locations, times and monitored flight or train. An airport or luggage service provider receives only information necessary for the ordered service.
- Hostinger: website hosting and business email.
- WhatsApp Business application: operational communications with people using this channel.
- Cal.com and Google Calendar: telephone-appointment booking, confirmations and calendar management.
- Facture.net: invoice creation and management.
- Qonto and banking providers: bank transfers, payment links and payment tracking.
- Stripe: payments and historical data relating to the former booking platform, currently closed. This showcase website does not load Stripe payment functionality.
- LinkedIn and Lusha: professional research and contact according to the uses and settings actually adopted.
- Plausible: audience measurement only when enabled, as described in Article 10.
- Accountant, advisers and authorities: data necessary for their assignment or a legal obligation.
Depending on the operations, these participants may act as processors, independent controllers or in another role requiring assessment. Merely providing a tool or carrying out transport does not determine the GDPR role. Corresponding contracts and information must specify responsibilities. Blue Prestige neither sells nor rents client or passenger data.
- Provider entities, roles and processing locations
- Hostinger International Ltd (Cyprus): website hosting and email, acting as a processor. WhatsApp (Meta Platforms Ireland Ltd, Ireland): customer communications. Qonto (France): banking. Facture.net (France): invoicing, acting as a processor. LinkedIn (LinkedIn Ireland Unlimited Company, Ireland) and Lusha (Lusha Systems Ltd, Israel): business prospecting. Plausible (Plausible Insights OÜ, Estonia): audience measurement, acting as a processor.
6. International transfers
International providers may involve processing or access outside the European Economic Area, notably for messaging, marketing and data from the former platform. Having a European registered office does not alone exclude a transfer.
For each transfer, the countries, entities and safeguards actually applicable must be identified: an adequacy decision covering the recipient and processing, or appropriate safeguards such as standard contractual clauses accompanied by necessary assessments and measures. A general reference to standard clauses does not prove they cover the service used. For the United States, any adequacy basis notably requires checking certification and its scope where required.
- Countries and safeguards for international transfers
- Data is processed primarily in the European Union. Israel, where Lusha is established, benefits from a European Commission adequacy decision. Meta (WhatsApp) and LinkedIn may transfer data to the United States under the EU–US Data Privacy Framework or standard contractual clauses adopted by the European Commission.
- How to obtain a copy of safeguards
- A copy of the applicable safeguards can be obtained by writing to contact@blueprestigemobility.com.
- Identity and contact details of the former platform's hosting provider
- Mon Site En Ligne, the provider that hosted the former booking platform.
- Handling and retention of former-platform data
- Data from the former booking platform has been deleted; none was retrieved or retained.
7. Marketing, indirect collection information and objection
Business solicitation must relate to the recipient's role. Public contact details or details obtained from a provider cannot be reused without checking legal conditions, source and the person's reasonable expectations. The first message identifies Blue Prestige, the source of the contact details and access to this policy; each solicitation offers a simple, free way to object.
Where data comes from a third party, the information required by GDPR Article 14 is provided within the applicable period, normally no later than one month, and earlier at first communication or disclosure if that occurs sooner. This obligation also concerns passengers booked by third parties, subject to documented statutory exceptions.
You may reply to the message received or write to contact@blueprestigemobility.com to stop receiving solicitations. No reason is required for an objection to marketing. Minimal information needed to honour this choice is retained solely for that purpose; completely deleting the record could lead to renewed solicitation.
Passenger data is not reused for marketing without their agreement. Any marketing consent must be freely given, specific and separate from a journey enquiry. No marketing consent is obtained merely by accepting booking terms or browsing the website.
8. Security and confidentiality
Protection arrangements must cover confidentiality of communications, access authorisation, account and device security, backups, retention periods and incident management. Information sent to participants is limited to what their role requires. Detailed commitments and measures are monitored internally without publishing security configurations.
A confidentiality undertaking does not replace each participant's GDPR obligations or, where required, an Article 28-compliant processing agreement. Procedures and their implementation must be checked before this policy is adopted.
9. Your rights and how to exercise them
Subject to GDPR conditions, you may request access, rectification, erasure or restriction of processing of your data. Portability concerns automated processing based on contract or consent where applicable. You may withdraw consent at any time without affecting the lawfulness of previous operations.
You may object to processing based on legitimate interest for reasons relating to your particular situation. You may object to marketing at any time without giving a reason. These rights do not allow deletion of a record whose retention is legally required. You may also give instructions concerning your data after your death.
Write to the contact in Article 1, specifying your request and information useful to locate your file. Proof of identity may be requested only where there is reasonable doubt and proportionately. A response is normally provided within one month; an extension of up to two further months may be needed depending on complexity or the number of requests, with reasons given within the first month.
You may contact the French data protection authority (CNIL) if you believe your rights are not being respected.
11. Updates to this policy
The document's date and status appear at the top of the page. Any new use, provider or booking journey requires information to be reviewed and, where necessary, required choices to be collected before launch. New purposes are not authorised merely by changing this page.