Data Protection Policy (GDPR)
Shuttle Booking International — Last update: February 2026
Table of contents
1. Introduction & data controller
This data protection policy (hereinafter 'GDPR Policy') describes how Shuttle Booking International S.A.S. (hereinafter 'S.B.I.', 'we', 'our') collects, uses and protects your personal data in accordance with the European Union General Data Protection Regulation (GDPR).
Data controller:
Shuttle Booking International S.A.S.
17 Lieu Dit Les Grands Thenards, France
Trade register SENS / No 811 410 109
2. Personal data collected
Data you provide to us
- Identification data: first name, last name, email, phone number
- Travel data: dates, times, pickup and destination locations
- Payment data: card number, expiry date (stored by our payment providers)
- Preferences: vehicle type, number of passengers, special needs
Automatically collected data
- IP address and connection information
- Browser type and operating system
- Pages visited and time spent on the site
- Geolocation data (if authorized)
- Cookies and session identifiers
3. Purposes & legal basis
| Purpose | Legal basis |
|---|---|
| Booking processing | Contract performance |
| Customer service & support | Contract / Legitimate interest |
| Transactional email sending | Contract performance |
| Marketing & promotional offers | Consent |
| Service improvement | Legitimate interest |
| Legal & tax obligations | Legal obligation |
4. Data recipients
Your data may be shared with:
- Carrier partners: for the execution of the transport service
- Payment providers: Stripe, PayPal for transaction processing
- Technical providers: cloud hosting, email services
- Competent authorities: upon legal or judicial request
All our providers are contractually bound to respect the confidentiality and security of your data in accordance with the GDPR.
5. Transfers outside the EU
Some of our providers may be located outside the European Union. In such cases, we ensure that appropriate safeguards are in place:
- European Commission adequacy decision
- Standard Contractual Clauses (SCC)
- Binding Corporate Rules (BCR)
- Privacy Shield certification (for the United States, where applicable)
6. Retention period
| Data type | Duration | Justification |
|---|---|---|
| Account data | Account lifetime + 3 years | Civil statute of limitations |
| Booking data | 10 years | Accounting obligations |
| Payment data | 13 months | Chargebacks |
| Marketing consents | 3 years | CNIL recommendation |
| Technical logs | 1 year | IT security |
7. Your GDPR rights
Under the GDPR, you have the following rights:
Right of access (Art. 15)
Obtain confirmation of processing and a copy of your data
Right of rectification (Art. 16)
Correct inaccurate or incomplete data
Right to erasure (Art. 17)
Request the deletion of your data ('right to be forgotten')
Right to portability (Art. 20)
Receive your data in a structured format
Right to object (Art. 21)
Object to processing based on legitimate interest
Right to restriction (Art. 18)
Temporarily restrict the processing of your data
How to exercise your rights?
Send your request to contactshuttle-booking-international.com with a copy of your ID. We will respond within one month (extendable by two months for complex requests).
8. Data security
We implement state-of-the-art technical and organizational measures:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Role-based access control (RBAC)
- Multi-factor authentication for administrators
- Access logging and monitoring
- Regular penetration testing
- Business continuity plan and backups
10. Updates to this policy
We may amend this GDPR policy at any time to reflect changes in our practices or regulatory requirements.
In case of substantial modification, we will inform you by email and/or via a notification on our site at least 30 days before entry into force.
The current version is always available on this page with its update date.
11. Contact & complaints
Data Protection Officer (DPO)
Email: contactshuttle-booking-international.com
Address: Shuttle Booking International - DPO Service
17 Lieu Dit Les Grands Thenards, France
Response time: 1 month maximum
Complaint to the supervisory authority
If you believe your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL):
Website: www.cnil.fr
Phone: 01 53 73 22 22
Address: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07
Cookie consent
We use cookies to improve your experience on our site, analyze traffic and personalize content. Some cookies are essential for the site to work.
What we use:
- • Essential cookies - Navigation and security (required)
- • Analytics cookies - Site improvement (optional)
- • Marketing cookies - Personalized ads (optional)
By continuing, you accept our use of cookies. Your privacy is important to us.