Data Protection Policy
Last updated: 8 September 2026
This page explains what personal data we collect when you use sixieme-etoile.com or book our services, why we collect it, how long we keep it, and what rights you have.
1. Who is responsible for your data
The data controller is Sixième Étoile, a French simplified joint-stock company with share capital of €12,000, registered with the Meaux Trade and Companies Register under number (SIREN) 834 524 985 (SIRET 834 524 985 00027), whose registered office is at 24-30 avenue du Gué Langlois, 77600 Bussy-Saint-Martin, France.
For any question about your data:
- By email: protection@sixieme-etoile.com
- By post: Sixième Étoile — for the attention of the Data Protection Officer, 24-30 avenue du Gué Langlois, 77600 Bussy-Saint-Martin, France
Data protection officer: Lounes Hanniche.
2. What we collect, why, and for how long
| Purpose | Data concerned | Legal basis | Retention period |
|---|---|---|---|
| Responding to a contact or quotation request | Name, email, telephone, company, message content, journey details | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) | 3 years from last contact if the request does not proceed |
| Performing and managing a transport service | Identity, contact details, pick-up and drop-off addresses, times, any stated preferences | Performance of the contract (Art. 6(1)(b) GDPR) | Duration of the business relationship, then 3 years |
| Invoicing and accounting obligations | Identity, billing address, amounts, supporting documents | Legal obligation (Art. 6(1)(c) GDPR) | 10 years (Art. L.123-22 French Commercial Code) |
| Website security and prevention of abuse | IP address, connection logs, browser technical data | Legitimate interest in protecting the website (Art. 6(1)(f) GDPR) | 12 months |
| Audience measurement and advertising | Cookie identifiers, pages viewed, referral source, browsing data | Your consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act) | Cookies: 13 months maximum. Data derived from cookies: 25 months |
| Business-to-business marketing | Name, job title, business email, company | Legitimate interest (Art. 6(1)(f) GDPR), with a right to object at any time | 3 years from last contact |
We do not collect special category data within the meaning of Article 9 GDPR. The website has no user accounts and no online payment.
3. Who has access to your data
Your data is accessible to authorised staff of Sixième Étoile responsible for customer relations, operations and invoicing, and to chauffeurs for the information strictly necessary to carry out the journey.
We use the following providers, acting as processors:
- OVH SAS (France) — website and database hosting
- Google Ireland Limited — audience measurement (Google Analytics) and advertising (Google Ads), via the Site Kit plugin
- Complianz — cookie consent management and storage of consent records
- Messages sent through our forms are stored in the website database, hosted by OVH
Your data is never sold, rented or exchanged. It may be disclosed to administrative or judicial authorities where the law requires it.
4. Transfers outside the European Union
The website and its database are hosted in France.
Google’s audience measurement and advertising services may involve a transfer of data to the United States. These transfers are covered by the European Commission adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, to which Google LLC is certified, supplemented by standard contractual clauses.
Such transfers only take place if you have accepted analytics or advertising cookies.
5. Your rights
You have the following rights over your data:
- Access — obtain a copy of the data we hold about you (Art. 15)
- Rectification — have inaccurate or incomplete data corrected (Art. 16)
- Erasure — request deletion of your data (Art. 17)
- Restriction — request that processing be temporarily suspended (Art. 18)
- Portability — receive the data you provided in a machine-readable format (Art. 20)
- Objection — object to processing based on our legitimate interest, including marketing (Art. 21)
- Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand (Art. 7(3))
- Post-mortem instructions — set out what should happen to your data after your death (Art. 85 of the French Data Protection Act)
To exercise these rights, write to protection@sixieme-etoile.com or to the postal address given in section 1. We reply within one month, which may be extended by two months for complex requests.
We will only ask for proof of identity where we have reasonable doubt as to who you are, in accordance with Article 12(6) GDPR. Any copy provided is deleted as soon as the check is complete.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
6. Cookies
A cookie is a small file placed on your device when you visit the website.
We use four categories of cookies:
- Essential — required for the website to work and to record your choices. Placed without consent, in accordance with Article 82 of the French Data Protection Act.
- Personalisation — remember your display preferences.
- Analytics — measure website traffic (Google Analytics).
- Marketing — measure the effectiveness of our campaigns and show relevant advertising (Google Ads).
Apart from essential cookies, no cookie is placed before you have given your agreement. Continuing to browse does not amount to consent: until you click “Accept”, analytics and advertising cookies remain blocked.
You can accept, refuse or customise your choices at any time through the “Cookie settings” link at the bottom of every page. Your choice is stored for 6 months, after which you will be asked again. You can also configure your browser to block cookies, bearing in mind that some features may then be degraded.
7. Security
The website is served over HTTPS. We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure or alteration: firewalls, encryption in transit, access controls and regular updates.
As no system is entirely secure, in the event of a personal data breach likely to result in a high risk to your rights, we will inform you and notify the CNIL within the time limits set out in Articles 33 and 34 GDPR.
8. Changes to this policy
This policy may be updated to reflect legal developments or changes in our processing activities. The date of the latest update appears at the top of this page. We will inform you by appropriate means of any substantial change.
This English version is provided for information purposes. In the event of any discrepancy, the French version prevails.
