Privacy policy

1. Data controller

The controller for data collected through allinkey.fr and the AllinKey solution is:

2. Data collected

AllinKey collects only the data needed to provide its service:

Agency account identification data

• User's first name, last name and role
• Business email address
• Agency or company name
• Password (stored encrypted and non-reversible)

Vehicle and document data

• Unique QR code identifier and the internal vehicle identifier (plate, model)
• Documents uploaded by the agency: registration card, insurance certificate, rental contract
• Six-digit PIN (stored securely and non-reversibly)

Technical data

• IP address, browser type, connection data (for security and logging purposes)
• Cookies strictly necessary for the site to work

3. Purposes of processing

The data collected is processed for the following purposes:

• Letting the agency bind a QR code to a vehicle and upload the matching documents
• Letting the driver read the documents after a scan and PIN entry
• Keeping the service secure and detecting abnormal access
• Answering information or support requests
• Meeting legal and regulatory obligations

No personal data is ever used for prospecting, resale or profiling.

4. Legal basis

The processing of your data is based on:

• The performance of the contract between PATEOUEILLE GROUP SAS and the client agency
• The legitimate interest in keeping the service secure and available
• The legal obligation to retain certain connection data

5. Retention periods

• Account data: kept while the account is active, then deleted within 30 days of cancellation
• Vehicle documents: kept while linked to an active QR. The agency can delete them at any time
• Technical logs: 12 months at most
• Contact requests: 3 years after the last exchange

6. Data recipients

The data is accessible to:

• Authorized internal teams at PATEOUEILLE GROUP SAS (support, operations, security)
• The host, strictly within its technical obligations
• Competent authorities in case of a legal requisition

PATEOUEILLE GROUP SAS transfers no personal data outside the European Union without GDPR-equivalent safeguards.

7. Security

The following technical and organizational measures are in place:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Password storage via a robust hashing function (bcrypt or equivalent)
• Six-digit PIN lock for driver access, with a temporary lockout after five failed tries
• Regular backups and access logging
• Periodic internal security audits

8. Your rights

Under the GDPR, you have the following rights:

• Right of access to data about you
• Right to rectify inaccurate data
• Right to erasure (right to be forgotten)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw your consent at any time

To exercise these rights, write to julien@allinkey.fr. You will receive an answer within one month at most.

If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

9. Cookies

The allinkey.fr website uses only cookies strictly necessary for it to work (session management, security). No advertising or third-party analytics cookie is set without your consent.

You can configure your browser to refuse these cookies at any time; the service may then stop working properly.

10. Changes

PATEOUEILLE GROUP SAS may update this policy to keep up with regulatory or technical changes. The applicable version is always the one published on this page, whose update date is shown at the top.