Privacy and cookie policy

This policy sets out how personal data of the users and clients of the Qasqad platform (the “Site” or the “Service”) is collected, processed and protected, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and French law no. 78-17 of 6 January 1978 as amended.

1. Controller

The controller is KITTS (trading as Qasqad), whose registered office is at 10 avenue Jean-Baptiste Clément, 92100 Boulogne-Billancourt, France. Its full registration is set out in our legal notice.

Data protection contact: privacy@qasqad.com

For the fleet, driver and offence data that the client company entrusts to Qasqad, KITTS acts as a processor within the meaning of article 28 GDPR: the client remains the controller and determines the purposes. KITTS acts as a controller for its own processing, in particular browsing on the Site, management of the commercial relationship and security of the Service.

2. Data collected

Depending on the context, the following categories of data are collected:

• Identification and contact — surname, first name, business email address, phone number, role within the client company;
• Company data — company name, registration numbers, registered address, billing details;
• Fleet and vehicle data — registration plate, make and model, vehicle assignment, geolocation and telematics data transmitted by the client or its providers;
• Offence data — parking fine notices, traffic ticket notices, data from third parties (ANTAI, motorway companies, the French public finances directorate), identity of the designated driver, payment or appeal status;
• Connection and usage data — connection logs, IP address, session identifiers, browsing data collected through cookies and trackers.

The eligibility check offered on the Site queries the public company register through the Pappers service, using the name or registration number entered. Only the query passes through our servers; no account is created at that point.

Booking a demo goes through the Cal.com service (Cal.com, Inc., United States). The information you enter in the calendar — name, email address, chosen slot and any message — is collected by Cal.com on behalf of KITTS to arrange the call. If you have accepted marketing cookies, the calendar opens in a window embedded in the Site; otherwise, the link takes you straight to the Cal.com website, which applies its own privacy policy.

Qasqad does not collect data falling within the special categories of article 9 GDPR and carries out no solely automated decision producing legal effects on a person: the actions the platform proposes remain subject to the client's validation.

3. Purposes and legal bases

• Provision and performance of the Service — detection, driver designation, payment, recovery and appeal of offences: performance of the contract (art. 6.1.b GDPR);
• Management of the commercial relationship, invoicing and accounting: performance of the contract and legal obligations (art. 6.1.b and 6.1.c GDPR);
• Compliance with applicable legal obligations, in particular driver designation within the statutory deadline: legal obligation (art. 6.1.c GDPR);
• Prospecting and communication aimed at professionals: consent or legitimate interest (art. 6.1.a and 6.1.f GDPR);
• Security of the Service, prevention of fraud and abuse: legitimate interest (art. 6.1.f GDPR);
• Audience measurement and improvement of the Site experience: consent where required (art. 6.1.a GDPR).

4. Recipients

Data may be disclosed:

• to KITTS staff authorised by virtue of their duties;
• to the bodies competent in offence processing — ANTAI, the French public finances directorate, local authorities and motorway concession companies;
• to KITTS's technical processors — hosting, email delivery, payment, support and audience measurement — acting on KITTS's instructions and bound by a contract compliant with article 28 GDPR;
• to administrative or judicial authorities where the law so requires.

KITTS does not sell or rent its users' personal data to third parties for commercial purposes.

5. Hosting and transfers outside the European Union

Service data is hosted in France. Certain technical providers (network infrastructure, content delivery, tooling) may nonetheless be established or operate servers outside the European Economic Area, in particular in the United States. In that case, KITTS ensures the transfer is framed by appropriate safeguards within the meaning of articles 44 to 49 GDPR, such as the European Commission's standard contractual clauses, supplemented where necessary by additional measures.

6. Retention periods

• Contractual and billing data: the term of the contractual relationship, extended by the applicable statutory and tax limitation periods, up to ten years;
• Offence and designation data: the period needed to process the case, extended by the applicable appeal and challenge periods;
• Prospecting data: three years from the last useful contact, unless objected to;
• Connection data: twelve months at most, in line with CNIL recommendations.

7. Security

KITTS implements appropriate technical and organisational measures — encryption in transit and at rest, access control, logging, environment segregation, regular review of permissions — to ensure a level of security matched to the risk and to prevent any unauthorised access, loss, alteration or disclosure.

8. Your rights

Under the GDPR and the French Data Protection Act, every data subject has the following rights:

• right of access (art. 15);
• right to rectification (art. 16);
• right to erasure (art. 17);
• right to restriction of processing (art. 18);
• right to data portability (art. 20);
• right to object (art. 21);
• right to withdraw consent at any time where processing rests on it;
• right to give directions on the fate of their data after their death.

These rights are exercised by writing to privacy@qasqad.com, stating your surname, first name and the subject of your request, with proof of identity where there is reasonable doubt. KITTS replies within one month of receipt, extendable by two months given the complexity or the number of requests. Where the request concerns data processed on behalf of a client company, it is passed to that company as controller.

If, after contacting us, you consider that your rights are not respected, you may lodge a complaint with the French data protection authority (CNIL) — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.

9. Cookies and trackers

A cookie is a small text file placed on your device — computer, tablet, phone — when you visit a site. It lets its issuer recognise that device on later visits and collect certain browsing information. Placing cookies that are not strictly necessary is subject to your prior consent, under article 82 of the French Data Protection Act and the CNIL guidelines.

9.1 Managing your consent

On your first visit, a banner lets you accept, refuse or customise cookies that are not strictly necessary. You can change your choices at any time below, or through your browser's settings.

9.2 Strictly necessary cookies

Essential to the operation of the Site, they cannot be disabled and require no prior consent.

9.3 Audience measurement cookies

Subject to your consent, they let us compile anonymised traffic statistics to improve the Site. They are only placed if you accept them.

9.4 Marketing cookies

Also subject to your consent, they measure the effectiveness of our campaigns and, where applicable, allow relevant content to be offered to you on third-party platforms.

9.5 Refusing or deleting cookies

Besides the banner and the Site's preference centre, you can set your browser to refuse all cookies or to warn you when one is placed. Refusing non-necessary cookies does not prevent access to the Site, but may affect some of its features.

10. Data breaches

In the event of a personal data breach likely to result in a risk to people's rights and freedoms, KITTS notifies the CNIL within 72 hours of becoming aware of it and informs the clients concerned without delay, in accordance with articles 33 and 34 GDPR.

11. Changes to this policy

KITTS may amend this policy at any time, in particular to comply with regulatory, case-law or technical developments. The applicable version is the one published on the Site at the date of consultation.

12. Contact

For any question about this policy or the exercise of your rights, write to privacy@qasqad.com. Our terms of use complete this document.