Privacy policy

Data controller

A.F Group (AutoFlow Group), Avenue de la liberté 175, 1080 Brussels, Belgium — VAT BE1022174617. For any question about your data or to exercise your rights: [email protected].

Data we process

User account

Name, email, phone, password (hashed), language.

Client company

Company name, email, phone, address, VAT number.

Missions & condition reports

Pickup and delivery addresses, contacts, plate and VIN, renter identity, driving-licence photo (front/back), handwritten signature, vehicle photos.

Delivery tracking

Driver GPS position during the mission, for real-time tracking.

Online booking

Name, email, phone and addresses provided for a one-off booking without an account.

Browsing

IP address, cookies (see Cookies), analytics data.

Purposes and legal bases

Deliver the service

Managing transport missions and condition reports — basis: performance of the contract.

Invoicing & accounting

Issuing and retaining invoices — basis: legal obligation.

Tracking & security

Delivery tracking, fraud prevention, service security — basis: legitimate interest.

Photos & analytics

Condition-report photos and analytics cookies — basis: consent.

Recipients and processors

We never sell your data. It is shared only with the providers needed to run the service:

Cloudflare

Site delivery and bot protection (Turnstile) — traffic transit only, your data is not stored there.

Google Analytics / Ads (US)

Analytics and advertising, only with your consent — cookie identifiers, IP.

HERE Technologies

Address autocomplete and route calculation — addresses and coordinates entered.

Komoot / Photon (DE)

Address autocomplete (fallback) — addresses entered.

Zoho Mail (EU)

Sending transactional emails — recipient and message content.

Enfact (BE)

E-invoicing — the company billing details.

Transfers outside the European Union

Google (analytics, only with your consent) is established in the United States; traffic passes through Cloudflare (United States) without being stored there. These transfers are governed by the European Commission Standard Contractual Clauses.

Cookies

On your first visit, a banner lets you accept or decline non-essential cookies.

Session (necessary)

Keeps you signed in and secures the service — exempt from consent.

cookie_consent (necessary)

Remembers your cookie choice — 1 year.

Cloudflare Turnstile (security)

Bot protection on forms — exempt from consent.

Google Analytics _ga / _gid

Analytics — set only after acceptance.

Retention periods

GPS position

6 months, then deleted.

Licence & renter identity

Anonymised 6 months after the mission.

Unconverted online bookings

6 months.

Address cache

6 months.

Condition reports & missions

Anonymised 6 months after the mission.

User account

For as long as the account is active.

Your rights

Under the GDPR you have the following rights, exercisable at [email protected]:

Access & portability

Obtain a copy of your data in a readable format.

Rectification

Correct inaccurate data.

Erasure

Request deletion of your data, subject to legal obligations.

Objection & restriction

Object to processing or ask that it be restricted.

Withdraw consent

Withdraw a given consent at any time (cookies, photos).

Complaint

Lodge a complaint with the Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels — [email protected].

Security

Personal files (licences, signatures, PDFs) are stored in a private area not publicly accessible; access is controlled by role and authentication; passwords are hashed; sealed documents are digitally signed and timestamped.