PRIVACY AND PERSONAL DATA PROTECTION POLICY
Updated 26 July 2026
Elite Protection Driver places a particular emphasis on confidentiality, discretion, and the safeguarding of all information entrusted to us.
This Privacy Policy outlines how personal data is collected, utilised, retained, and, where necessary, disclosed within the context of our website, enquiries, bookings, bespoke services, and Private Circle relations.
It complements the General Terms and Conditions of Elite Protection Driver.
ARTICLE 1 – DATA CONTROLLER
The data controller for processing carried out directly by Elite Protection Driver is:
ELITE PROTECTION DRIVER
Société par actions simplifiée (Simplified Joint Stock Company)
Share capital: 1,800 euros
Registered office: 60 rue François Ier, 75008 Paris
SIREN: 989 045 190
RCS Paris
Intra-Community VAT number: FR60 989045190
Website: eliteprotectiondriver.com
Personal data contact:
Pdg@eliteprotectiondriver.com
Where certain services are performed by another entity acting as a data controller for its own obligations or activities, that entity remains responsible for the processing operations it determines itself, in accordance with applicable regulations.
ARTICLE 2 – ELIGIBLE PERSONS
EPD may process data concerning, notably:
website visitors;
prospective clients;
private Clients;
representatives and employees of corporate Clients;
Beneficiaries of a service;
individuals accompanying a Client or Beneficiary when necessary for the mission;
contacts within family offices, conciergeries, Maisons, companies, agencies, or other intermediaries;
individuals appearing in recordings made within the scope of a mission, where such recording is legally permitted;
service providers, partners, and professional contacts of EPD.
ARTICLE 3 – DATA SUBJECT TO COLLECTION
Depending on the nature of the relationship and the service, EPD may process the following categories of data in particular.
3.1 — Identity and contact details
The following may be processed in particular:
surname;
first name;
title;
email address;
telephone number;
company or organisation;
professional position;
billing address;
information necessary to identify the Client or the Beneficiary.
3.2 — Mission-related information
The following may be processed in particular:
date and time of engagement;
place of engagement;
destination;
itinerary or programme;
schedule;
number of guests;
flight or train details;
engagement preferences;
logistical requirements;
vehicle category;
selected options;
information necessary for the organisation of the mission.
3.3 — Safety and security information
Where necessary for the preparation or execution of a mission, EPD or the competent entity may process certain information required to assess operational constraints and organise the appropriate resources.
Collection is strictly limited to information relevant to the intended purpose.
EPD requests that the Client refrains from transmitting any particularly sensitive data that is not strictly necessary for the organisation of the service.
3.4 — Contractual and commercial data
The following may be processed in particular:
quotation requests;
selected configurations;
bookings;
Convention Premium;
specific terms and conditions;
mission confirmations;
service history;
correspondence with EPD;
invoices;
claims;
information necessary for the management of the client relationship.
3.5 — Payment details
Payments may be processed by specialised payment service providers.
EPD does not retain complete payment card data when processed directly by the payment service provider.
EPD may, however, process information necessary for accounting and transactional management, such as:
amount;
currency;
payment status;
transaction reference;
date of payment;
information relating to a refund or payment dispute.
3.6 — Technical data
When using the website, certain technical data may be processed in accordance with the technologies currently employed, including:
IP address;
browser or device details;
technical logs;
data required for website security;
data relating to privacy preferences and cookies, where applicable.
The corresponding processing operations are detailed, where applicable, in the cookie policy.
ARTICLE 4 – PURPOSES OF PROCESSING
Data may be processed, in particular, to:
respond to enquiries;
prepare a quotation;
assess the feasibility of a mission;
register an order;
verify the information required for the service;
organise and coordinate a mission;
manage the relationship with the Client and the Beneficiary;
engage the necessary professionals or partners;
manage Executive Mobility;
organise services pertaining to Executive Protection or other regulated activities when requested;
manage Private Circle and Convention Premium;
manage invoicing and monitor payments;
process refunds;
handle claims;
ensure the security of transactions;
prevent, identify, or document an incident;
manage an insurance claim;
ensure the security of information systems;
comply with legal and regulatory obligations;
respond to requests from competent authorities;
establish, exercise, or defend the rights of EPD or the parties concerned.
ARTICLE 5 – LEGAL BASES
Depending on the purpose in question, processing may notably be based on:
The performance of a contract or pre-contractual measures
When processing is necessary for a request for a quote, a booking, a mission, a Convention Premium, or the performance of the contractual relationship.
A legal or regulatory obligation
When the retention or transmission of certain information is required by applicable legislation, notably regarding accounting, taxation, transport, security, or cooperation with competent authorities.
Legitimate interest
When processing is necessary for a legitimate interest pursued by EPD or an involved party, provided that the rights and freedoms of individuals do not override this interest.
Depending on the circumstances, this may notably concern the safety of individuals and property, incident prevention, IT security, dispute management, or the defence of rights.
Consent
When regulations require prior consent for a specific processing operation.
Where processing is based on consent, this may be withdrawn under the conditions provided by the regulations, without affecting the lawfulness of the processing carried out prior to such withdrawal.
ARTICLE 6 – CLIENT AND BENEFICIARY
A service may be ordered by an individual other than the Beneficiary.
The Client is invited to transmit to the Beneficiary all information relating to the service and to the protection of their personal data intended for them.
This obligation does not exempt EPD or any other data controller from fulfilling their own information obligations when these are applicable.
EPD limits the Beneficiary's data to that which is reasonably necessary for the organisation and execution of the service.
ARTICLE 7 – PARTNERS, SERVICE PROVIDERS AND REGULATED ACTIVITIES
EPD may transfer certain data to service providers or partners when such transmission is necessary for the organisation or execution of a mission.
These may notably include:
chauffeurs or transport operators;
professionals or companies authorised to carry out regulated private security activities;
technical service providers;
payment service providers;
accounting service providers;
insurers;
legal advisors;
IT service providers;
logistics partners.
Only the information necessary for their intervention shall be communicated.
Where a recipient acts as a processor within the meaning of the GDPR, they process the data in accordance with the instructions of the data controller and the applicable contractual obligations.
Where a partner determines for themselves the purposes and means of processing relating to their own regulated activity or legal obligations, they may act as a separate data controller.
ARTICLE 8 – CONFIDENTIALITY OF MISSIONS
Confidentiality is an intrinsic standard of the EPD experience.
Information relating in particular to:
the identity of the Client or the Beneficiary;
travel details;
frequented locations;
schedules;
itineraries;
habits;
accompanying persons;
and operational arrangements,
is accessible only to those individuals who require such knowledge for the preparation, coordination, execution, management or follow-up of the service.
EPD strictly applies the principle of limiting access to operational information.
ARTICLE 9 – ENHANCED CONFIDENTIALITY PROTOCOL
Certain missions may be subject to an enhanced Confidentiality Protocol.
This protocol may provide for additional measures tailored to the mission and expressly defined with the Client.
The non-subscription of such a protocol does not imply that the ordinary services of EPD would be devoid of confidentiality.
ARTICLE 10 – PHOTO, VIDEO AND AUDIO CAPTURE FOR OPERATIONAL PURPOSES
Certain missions may require the use of image recording devices and, where legally permitted, sound recording devices.
These devices are only utilised when their use is necessary, justified, and proportionate to the intended purpose, and in full compliance with the applicable regulations.
They may notably serve the following purposes:
personal security;
incident prevention;
incident documentation;
establishing facts;
claim management;
protection of personnel; or
the establishment, exercise, or defence of a legal claim.
Depending on the circumstances and subject to applicable regulations, the devices utilised may notably include:
cameras installed in or on a vehicle;
body-worn cameras; or
other recording equipment used by the professionals engaged in the mission.
Recording may take place inside a vehicle or, where necessary and legally authorised, outside as part of the mission.
ARTICLE 11 – ABSENCE OF SYSTEMATIC RECORDING
The presence of recording equipment does not mean that a mission is necessarily subject to permanent recording.
EPD does not, solely on the basis of these provisions, implement a permanent, general or disproportionate recording of all the Client's movements and activities.
The activation and use of any device must meet the defined purpose and respect the principles of necessity and proportionality.
ARTICLE 12 – INFORMATION REGARDING RECORDING
Acceptance of the General Terms and Conditions of Sale allows the Client to acknowledge having been informed of the possibility that certain recording devices may be used during a mission when their use is legally authorised, necessary and proportionate.
However, acceptance of the General Terms and Conditions of Sale does not automatically constitute consent within the meaning of the GDPR when specific consent represents the required legal basis for the processing concerned.
When consent is legally required, it is obtained separately under the conditions stipulated by the regulations.
Where regulations require additional information at the time or place of the recording, this is provided by an appropriate means.
ARTICLE 13 – THIRD-PARTY ENGAGEMENT
A mission may take place in an environment where persons other than the Client or the Beneficiary are present.
Recording devices must be utilised in such a manner as to limit, as far as is reasonably practicable, the collection of data concerning third parties that is not necessary for the intended purpose.
The rights of persons appearing on the recordings shall be exercised in accordance with the conditions prescribed by the regulations, subject in particular to the rights and freedoms of others, security requirements, the needs of legal proceedings, and any other legally applicable limitations.
ARTICLE 14 – AUDIO RECORDING
The capture of sound or conversations is subject to particularly high vigilance.
It is not carried out systematically simply because a technical device possesses an audio function.
Any audio capture must have an appropriate legal basis and respect the specific rules applicable to the protection of privacy and communications.
Where legal conditions are not met, the audio function must be deactivated or not used.
ARTICLE 15 – RETENTION OF RECORDINGS
Recordings made for operational purposes are retained only for a duration compatible with their purpose and the applicable regulations.
EPD does not retain operational recordings for longer than necessary.
When a recording documents an incident, a loss, a claim, litigation, or an event liable to trigger the liability of a party, the recording in question may be isolated and retained for the duration necessary to handle this event and to establish, exercise, or defend a legal right.
The precise durations applicable to the systems actually deployed are defined in internal documentation and, where regulations so require, in the information provided to the individuals concerned.
ARTICLE 16 – ACCESS TO CAPTURES
Access to recordings is strictly limited to duly authorised personnel.
Where necessary and legally permitted, recordings may be shared with, notably:
competent administrative or judicial authorities;
law enforcement agencies;
insurers;
legal counsel or advisors;
courts;
or professionals whose intervention is required to manage an incident or claim.
No access shall be granted to any individual without a legitimate reason to consult the data.
ARTICLE 17 – SECURITY OF RECORDS
EPD implements appropriate technical and organisational measures to protect the recordings against, in particular:
unauthorised access;
unauthorised copying;
loss;
destruction;
alteration;
disclosure;
or use incompatible with their purpose.
The technical arrangements for recording, transfer, storage, access and deletion are defined in accordance with the systems actually used.
ARTICLE 18 – COMMERCIAL USE OF IMAGE
Images captured for operational purposes are not utilised for advertising or promotional purposes solely by virtue of their existence or the acceptance of the GTC.
Any identifiable use of a Client's or Beneficiary's image for communications, marketing, social media, public relations, or promotional purposes shall, where required by regulation, be subject to specific authorisation or consent.
A refusal to authorise the commercial use of one's image shall not affect access to the EPD services.
ARTICLE 19 – RETENTION PERIODS
EPD retains data for no longer than is necessary for the purposes for which it is processed, extended where necessary by the retention or limitation periods imposed or authorised by regulations.
In particular, retention periods may vary depending on whether the data relates to:
a prospect enquiry;
a contractual relationship;
an invoice or accounting document;
a regulatory document;
an incident;
a complaint;
litigation;
or an operational capture.
Data subject to a legal retention obligation is retained for the period mandated by such obligation.
ARTICLE 20 — DATA RECIPIENTS
Within the limits of their respective authorities and the need-to-know principle, data may be accessible to:
authorised personnel within EPD;
individuals whose involvement is required for the mission;
service providers and partners necessary for its organisation;
authorised security professionals when their intervention is required;
payment service providers;
IT service providers;
chartered accountants;
insurers;
legal advisors;
legally authorised authorities.
EPD does not commercialise the personal data of its Clients or Beneficiaries.
ARTICLE 21 — INTERNATIONAL TRANSFERS
Certain missions may require the involvement of partners or service providers located outside France or the European Economic Area.
Where personal data is transferred to a country that does not benefit from an adequacy decision by the European Commission, the guarantees required by the GDPR are implemented whenever applicable.
EPD ensures that the information communicated is strictly limited to the data necessary for the organisation and execution of the mission.
ARTICLE 22 — INTERNATIONAL MISSIONS
When a mission is conducted abroad, the local regulations governing data protection, security, CCTV, or recording may differ from those applicable in France.
Recording devices and their associated processing must be adapted to the legal requirements in force within the relevant territory.
A device authorised in France is not presumed to be legally usable in another State.
ARTICLE 23 — DATA SECURITY
EPD implements appropriate technical and organisational measures with regard to the nature of the processed data and the identified risks.
These measures may notably concern:
authorisation management;
access control;
account protection;
limitation of the number of recipients;
securing of media;
backup;
deletion of data that has become unnecessary;
security incident management.
ARTICLE 24 — DATA BREACH
When EPD identifies a personal data breach likely to result in a risk to the rights and freedoms of individuals, it implements the procedures prescribed by the GDPR.
When the regulatory criteria are met, the breach is notified to the competent supervisory authority and, where required, to the data subjects concerned.
ARTICLE 25 — RIGHTS OF INDIVIDUALS
Under the conditions provided for by the applicable regulations, any data subject may, in particular, exercise:
a right of access;
a right to rectification;
a right to erasure;
a right to restriction of processing;
a right to object;
a right to data portability, where applicable;
the right to withdraw consent, where processing is based upon it;
the right to define directives regarding the post-mortem disposition of their data, under the conditions provided for by French legislation.
These rights are not absolute and may be subject to limitations as provided for by the regulations.
ARTICLE 26 — EXERCISE OF RIGHTS
Requests regarding personal data may be addressed to:
Elite Protection Driver
60 rue François Ier
75008 Paris
or by email:
[GDPR EMAIL ADDRESS TO BE COMPLETED]
EPD may request such information as is reasonably necessary to verify the identity of the requester where justified.
Requests are processed within the timeframes stipulated by the regulations.
ARTICLE 27 — LODGING A COMPLAINT WITH THE CNIL
Any data subject has the right to lodge a complaint with the French supervisory authority:
Commission nationale de l’informatique et des libertés — CNIL
The methods of referral and updated contact details are available on the official CNIL website.
This option does not prevent the data subject from first contacting EPD in order to resolve their request.
ARTICLE 28 — MINORS
EPD services are not intended to be directly ordered by minors.
When a minor is a Beneficiary or an accompanying guest under an engagement ordered by an adult or an organisation, only the data strictly necessary for organising the mission may be processed.
Particular vigilance is exercised when data or images relating to a minor are liable to be processed.
ARTICLE 29 — COOKIES AND SIMILAR TECHNOLOGIES
The website may use cookies or similar technologies necessary for its operation or, depending on its configuration, for audience measurement and other functionalities.
The applicable terms are set out in the cookie policy available on the website.
Where consent is required, the technologies in question are only used once it has been obtained.
ARTICLE 30 — ONLINE PAYMENTS
When a payment is made online, certain data is processed directly by the selected payment provider.
This provider may act as an independent data controller for operations falling under its own obligations, particularly regarding payment security, fraud prevention, and compliance with its legal obligations.
The Client is invited to consult the privacy policy of the respective payment provider.
ARTICLE 31 — NO SALE OF DATA
EPD does not sell or lease the personal data of its Clients and Beneficiaries to third parties for commercial purposes.
Communications of data occur solely when they possess an appropriate legal basis and are necessary for the purposes described in this Policy or mandated by law.
ARTICLE 32 — CONFIDENTIALITY AND LEGAL OBLIGATIONS
Confidentiality may not obstruct communications mandated or legally required notably by:
a judicial authority;
an administrative authority;
law enforcement;
a regulatory obligation;
the CNAPS, where applicable;
or an obligation necessary for the management of a claim or the defence of a right.
To the extent permitted by law, EPD limits the information disclosed to that which is strictly necessary for the request or obligation in question.
ARTICLE 33 — POLICY UPDATE
This Policy may be amended to reflect, in particular:
regulatory developments;
changes to processing operations;
the introduction of a new technical system;
developments in services;
or a modification of EPD’s organisation.
The applicable version is the one published on the website on the date of consultation.
Should a substantial amendment affect an ongoing processing operation and require specific notification to the individuals concerned, such notification shall be carried out in accordance with the applicable regulations.
ARTICLE 34 — CONTACT
For any questions regarding the protection of personal data or to exercise your rights:
ELITE PROTECTION DRIVER
60 rue François Ier
75008 Paris
GDPR Email: pdg@eliteprotectiondriver.com
Website: eliteprotectiondriver.com
Executive Protection Driver
SAS — Share capital: €1,800
60 rue François Ier — 75008 Paris
SIREN: 989 045 190
RCS Paris
Intracommunity VAT: FR60 989045190