Privacy and Data Protection Policy

Terms & Conditions | Privacy Policy | Cookies Policy

Effective date: 5 February 2024

1. General

Comuto SA (whose registered office is at 84, avenue de la République, 75011 Paris, France) (“BlaBlaCar”, “we”, “our” or “us”), acting as data controller, is committed to protecting and respecting your privacy. This notice (the “Privacy Policy”) is designed to tell you about our practices regarding the collection, use and disclosure of information that you may provide via our platform accessible from the website www.blablacar.co.uk or our mobile applications (the “Platform“).

This Privacy Policy (together with our Terms and Conditions, any other documents referred to in it and our Cookie Policy) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

2. What information do we collect from you and for how long?

We may collect and process the following data about you:

2.1. Information you give us

You may give us information, including information that can identify you or passengers for whom you book seats (“Personal Data“), when you use our Platform, by filling in forms on the Platforms (such as the sign-up form), when you enter into any of our competitions, promotions or surveys, when you correspond with us by phone, e-mail or otherwise, and when you report a problem related to the use of our Platform.

The information you give us may include:

2.1.1. Mandatory information required to register for and for the provision of the service we provide on our Platform or to access other services provided by us, including your name, email address, date of birth, and a password. All these fields are mandatory for creating an account on our Platform. Additionally, your phone number is required for publishing or booking carpooling trips. When booking bus tickets, your email address and passenger information are also mandatory. BlaBlaCar will not be able to provide you with the services offered on our Platform if the required information is not provided or, if applicable, you will not be able to register for an user account on our Platform;

2.1.2. A photograph;

2.1.3. A postal address;

2.1.4. Details on your cars;

2.1.5. Your mini-biography, your gender when you agree to provide that information;

2.1.6. A record of any correspondence between you and BlaBlaCar; we may record and/or listen to the phone calls between you and BlaBlaCar (for example, with the agents of our Community Relations service). We give you the possibility to object to that processing at the beginning of the call;

2.1.7. A record of any bookings you have made or trip related advertisements you have placed with or through our Platform;

2.1.8. Details of accounting or financial transactions including transactions carried out through our Platform or otherwise. This may include information such as your payment card or bank account details, details of trips or legs you have booked or offered through our Platform. These information may include your trip preferences;

2.1.9. Details of your visits to our Platform and the resources that you access;

2.1.10. Your replies to any surveys or questionnaires, such as your reviews on the trips made through our Platform. Such information may be used for analytic & user understanding purposes;

2.1.11. Information we may require from you when you report a problem with our Platform or our service, such as the subject of your request for support;

2.1.12. Location information, so that we can respond to your search for trips near you or facilitate the publication of your trip; and

2.1.13. A copy of your Passport, Driving Licence, ID Card and such other similar documents that you agreed to provide to us within the context of Verified Profile.

2.2. Information we collect automatically

2.2.1. If you sign up via social media authentication methods, BlaBlaCar will access certain Personal Data (e.g. first name, surname, picture and email) in your social media account pursuant to the applicable terms and conditions of these social media platforms. We may also collect some of your Personal Data when you interact with third party social media features, such as “Like” functions.

2.2.2. With regard to each of your visits to our Platform we may collect, in accordance with applicable laws and where required with your consent, information relating to the devices you use and the networks you are connected to when using our services. This may include the following information: your IP address, log-in information, browser type and version, browser plug-in types and versions, operating system and platform, information about your visit including the URL clickstream to the different pages of our Platform, content you viewed or searched for, search terms used, download errors, length of visits to certain pages, the advertising identifier of your device, page interaction and any phone number used to contact us. We collect this information through the use of various technologies including cookies (for further information please refer to our Cookie Policy).

2.2.3. We also collect aggregated information regarding your activity on our Platform (such as the amount of rides offered, your message response rate, etc.). Such information may be published on your public profile, should you have one.

2.2.4. Finally, we collect information about you from our insurance partners or intermediary in connection with your request for eligibility for the insurance programs or your subscription to the insurance contracts proposed when we act as insurance representative.

2.3. Data retention

2.3.1. Except regarding the categories of Personal Data mentioned in clauses 2.3.2 and 2.3.3 below, your Personal Data will be archived after the following retention periods:

5 years after your last use of our Platform, if you did not close your account;
30 days after the closing of your account, except if you received a negative rating or report, in which case your data is stored for 2 years following the closing of your account.

2.3.2.The following categories of Personal Data may be stored for different durations:

Financial data (e.g. payments, reimbursements, etc.) is stored for the duration required by applicable tax and accounting laws (for example, the accounting documents are stored for up to 10 years);
All user-generated content (e.g. comments, feedback and ratings) is anonymised according to the durations mentioned in section 2.3.1 but remains available on our Platform;
Log data are stored for up to 12 months from the date of their collection;
The phone calls with our Community Relations service are stored for up to 1 month and the analysis documents (such as time and duration of the call) are stored up to 1 year.
Data collected for the ID verification process and for the detection of fraud are stored for 1 year.
The payment card information that you consented to save for your future transactions on the Platform is stored until the time you withdraw your consent, or the expiration date of the payment card, whichever occurs earlier.

2.3.3. In the event that your account is suspended or blocked, we will keep your data for a period of 2 or 10 years depending on the gravity of the breach in order to prevent you from circumventing the rules applying to our Platforms.

2.3.4. We may archive some of your Personal Data for a period that will not exceed five (5) years in order to comply with our legal obligations and to manage potential disputes.

3. How do we use the information we collect from you?

We will use the information we collect:

PURPOSES		LEGAL BASIS
3.1. to carry out our obligations arising from any contracts entered into between you and us or you and our business partners and to provide you with the information and services that you requested;		This processing is necessary for the performance of our mutual contractual obligations.
3.2. to send you service-related information by email and/or text message and/or any other communication means (e.g. your booking confirmation);		This processing is necessary for the performance of our mutual obligations.
3.3. to collect payment from you or to enable payments of Cost contribution on the Platform via Hyperwallet Payment Solution;		This processing is necessary for the performance of our mutual contractual obligations and for compliance with the legal obligations.
3.4 to enable you to save your payment card information for your future transactions on the Platform;		This processing is carried out with your consent. You can withdraw your consent at any time by deleting your information in your profile or by contacting our Community Relations service.
3.5. to enable you to personalize your user profile on our Platform;		This processing is carried out with your consent. You can withdraw your consent at any time by deleting your information in your profile or by contacting our Community Relations service.
3.6. to enable you to communicate and interact with other members or with bus transport operators distributed on the Platform about our services or about the trips(s) you have/will do and/or to organise such trips;		This processing is necessary for the performance of our mutual contractual obligations.
3.7. to give you access to and to enable you to communicate with our Community Relations service;		This processing is (i) necessary for the performance of our mutual contractual obligations, or (ii) necessary for the establishment, exercise or defence of legal claims.
3.8. to enhance our Community Relation service and train our customers agents through the record of your phone conversations with us;		This processing is based on our legitimate interest (to provide you a high quality customer support/to enhance our customer support). You can object to this processing during each contact.
3.9. to ensure compliance with (i) applicable laws, (ii) our Terms and Conditions, and (iii) our Privacy Policy. Certain breaches that we regard as inappropriate may lead to the suspension of your account on our Platform. For these purposes, we may use technologies to automatically analyse your use of the Platform, including the content of your publications, in order to detect any behaviour that may constitute a violation on your part;		This processing is necessary (i) for the performance of our mutual contractual obligations, (ii) based on our legitimate interest (to prevent any circumvention of the rules in effect on our Platform), in which case you have the right to object, or (iii) for the establishment, exercise or defence of legal claims.
3.10. to send you, by email and/or text message and/or any other communication means, in accordance with applicable laws and where required, with your consent, marketing materials and to make you suggestions and recommendations about goods or services related to our services that may interest you. We also use your data to target you in order to serve our ads on social media platforms or third-party sites, or to create exclusion lists for advertising messages. You can learn more about how these features work, and the data that we obtain about you, by visiting the relevant sections of the third party social media platforms or sites;		This processing is (i) based on your consent, you can withdraw your consent to receive commercial prospecting at any time by modifying your preferences in your profile, clicking on the unsubscribe link provided in each of our communications, or contacting our Community Relations service; or (ii) based on our legitimate interest (providing you with relevant advertisements); in this case, you have the right to object. For more information, please refer to Article 6 – Targeted ads and our communications sent by e-mail and/or text messages.
3.11. to notify you, by email and/or text message and/or any other communication means, about changes to our services or accompanying you in the use of our services		This processing is necessary (i) for the performance of our mutual contractual obligations, (ii) for compliance with our legal obligations or (iii) the establishment, exercise or defence of legal claims.
3.12. to verify the information contained in your Passport, Driving Licence, ID Card and other identity documents that may be collected from you at the time of registration or at any other time during your use of our Platform;		This processing is carried out (i) based on your consent within the context of obtaining the Verified Profile badge (in this case, you can withdraw your consent at any time by contacting our Community Relations service, (ii) for compliance with our legal obligations, or (iii) for the establishment, exercise or defence of legal claims.
3.13. to administer our Platforms and for internal operations, including troubleshooting, data analysis, testing, research;	This processing is based on our legitimate interest (i.e. ensuring the security of our Platform and improving its features).
3.14. to monitor customer relations and in particular to carry out (by email or phone calls) satisfaction surveys and studies including polls, product tests and statistics;	This processing is based on our legitimate interest (i.e. evaluate our Platform and the services we provide in order to improve them). You can object to this processing when contacted.
3.15. to improve our Platform to ensure that content is presented in the most effective manner for you and for your device;	This processing is based on our legitimate interest (i.e. providing you with meaningful content).
3.16. to allow you to participate in interactive features of our service, when you choose to do so, such as searching for trips around you based on your location or publishing trips based on your location;	This processing is necessary (i) for the performance of our mutual contractual obligations or (ii) based on your consent where required by law. In this case, you can withdraw your consent by disabling the access permissions directly in your phone’s operating system.
3.17. as part of our efforts to keep our Platform safe and secure; namely for fighting against fraud; and	This processing is based on (i) our legitimate interest (fighting against fraud and ensuring the security of our Platforms), (ii) for compliance with our legal obligations, or (iii) carried out for the establishment, exercise or defence of legal claims.
3.18. to measure or understand the effectiveness of advertising we serve, and to deliver relevant advertising to our users.	This processing is based on (i) our legitimate interest (i.e. measuring and optimising the efficiency of our advertising campaigns) or (ii) your consent where required by law. (You can change your cookie settings at any time. You can adjust them by simply going to the cookie settings displayed in the footer of the page or in your BlaBlaCar account settings.)

4. Who are the recipients of the Information we collect from you and for which purposes?

4.1. When you use our services, some information about you is shared with the members of our communities or with bus transport operators distributed on our Platform, either on your public profile or during the booking process (e.g. we give your telephone number to the members with whom you will share a ride to facilitate the organization of your ride, your age is displayed on your public profile to help maintain a high level of trust among our members).

4.2. We may receive and send information about you, including your Personal Data, with other BlaBlaCar entities and affiliates, for the purposes outlined in this Privacy Policy.
4.3.We may disclose information about you to courts, law enforcement agencies, government or public authorities, tax authorities, or authorized third parties, if and to the extent that we are required to do so by law or in a good faith we believe that it is reasonably necessary to (i) respond to claims asserted against BlaBlaCar, (ii) to comply with legal proceedings, (iii) to enforce any agreement with our members such as our Terms and Conditions and our Privacy Policy, (iv) in the event of an emergency involving the danger of public health, death or physical injury to a person (v) in the framework of investigation or (vi) to protect the rights, property or personal safety of BlaBlaCar, its members or others

4.4. We are also working closely with third parties which may be the recipients of your Personal Data such as:

our business partners who are social media platforms and which may provide you with connecting services, such as the connection of the information of your BlaBlaCar profile, from their social media platforms to our Platform;

our business partners who may advertise their services on our Platforms and to which you may decide to sign up for. Namely, these services may be insurance services, banking services, rental services, etc.;

our business partners who may advertise our services on their websites;

our sub-contractors including in technical, payment, identity verification and delivery services, or analytics providers.

4.5. We only share your Personal Data with any of these third parties mentioned in section 4.4 in the following cases:

4.5.1. Where we resort a third party service provider, for the performance of any contract we enter into with you in order to facilitate or extend our services (e.g. in the framework of the payments made on our Platform);

4.5.2. As part of the booking process and in order to provide the requested services, information such as your name, photography, mobile phone number and/or email address, may be displayed on the Platform and/or passed on to another member;

4.5.3. As part of our rating system, the reviews you write will be published on the Platform. The reviews including your abbreviated name and photography are visible to all visitors of the Platform;

4.5.4. We use analytics and search engine providers to assist us in the improvement and optimization of our Platforms;

4.5.5. It is explicitly requested by you (e.g. with when using social media authentication methods, subscribe to a service provided by one of our partners, request to participate to an offer or a good deal of one of our partners);

4.5.6. We may distribute parts of our Platforms (including the trips you have posted) for display on our business partners’ websites through API or widgets. In these cases, some information from your public profile may be displayed on these websites;;

4.5.7. In the event that we sell or buy any business or assets, in which case we may disclose your Personal Data to the prospective seller or buyer of such business or assets.

4.6. In accordance with applicable law and where required with your consent (in this case you can withdraw your consent at any time by contacting our Community Relations service), we may combine information about you, including your Personal Data and cookie information, we send to and receive from our business partners. We may only use this information and the combined information for the purposes set out above.

4.7. We draw your attention on the fact that if you decide to share your information, including Personal Data, with us through our business partners’ connecting services, any of our business partners’ privacy policies and/or notices may also be applicable to you, in addition to this Privacy Policy. We do not control the collection and/or the processing of your information eventually made by our business partners on their own platforms.

4.8. As requested per the applicable regulations, the payouts are handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., as a Payment Solution Provider, a duly licensed Luxembourg credit institution under Article 2 of the law of 5 April 1993 on the financial sector acting as a separate controller. The personal data collected and processed by Payment Solution Provider are subject to the Hyperwallet privacy policy (https://pay.hyperwallet.com/hw2web/consumer/page/privacyAgreement.xhtml). As further explained in our Terms and Conditions, you may be asked by PayPal to provide additional information for “Know Your Customer” (KYC) procedure. The KYC checks carried out by Payment Solution Provider are distinct and independent of the verifications that BlaBlaCar may carry out in relation to the use of Platform and are subject to the Hyperwallet privacy policy.

5. How do we use and moderate your messages?

5.1. We may read the messages you exchange with other members of our community through our Platform for fraud prevention, service improvement, customer support purposes, enforcement of the contracts entered into with our members (such as our Terms and Conditions). For example, in order to prevent the circumventing of our online booking system, we may scan and analyse messages sent through our Platform to check that they do not include any contact details or references to other websites and, where applicable, messages can be blocked, or totally or partially filtered.

5.2. We never scan or analyse your messages with other members of our community for commercial and advertising purposes. We may use automated methods to carry out the moderation of these messages, but no automated individual decision-making is performed in this regard.

6. Targeted ads and our communications sent by e-mail and/or text messages

In accordance with applicable laws and where required with your consent, we may use the information you give us on our Platform for electronic direct marketing purposes (e.g. (i) receiving our newsletters, (ii) receiving invitations to our events or other communications that we think may interest you or (ii) serving you with targeted advertising on social media platforms or third parties websites) based on your profile and interests.

For electronic marketing communications: You can withdraw your consent at any time by (i) modifying your preferences in your profile, (ii) clicking on the unsubscribe link we provide in each communication sent to you, or (iii) contacting us using the contact details provided in section 13 below.

For targeted ads and content:

on social media (e.g. Facebook): you can object at any time by configuring your settings regarding advertisement directly via your social media account or by contacting us pursuant article 13 below;

on third party websites: please refer to our Cookie Policy to see how to object.

7. Is your Information being transferred, how and where?

In principle, we store the Personal Data that we hold about you in the European Union (“EU“). However, since for example some of our service providers are based in countries outside of the European Union (“third countries”), we also transfer some of your data to third countries. This may include third countries where the European Commission has not taken the decision that such third country ensures an adequate level of protection. In that case, we ensure that the transfer is performed in accordance with the applicable legislation and that appropriate safeguards have been put in place (especially standard contractual clauses as issued by the European Commission) in order to guarantee a sufficient level of protection of individuals’ private life and fundamental rights.

By sending a request to the Group Data Protection Officer ([email protected]), we can provide you with the details regarding such appropriate safeguards (for example, the standard contractual clauses issued by the European Commission).

8. What are your rights in respect of your personal data?

8.1. You are entitled to receive a copy of your personal data that is in our possession (your right of data access).

8.2. For processing activities carried out on the basis of your consent, you can withdraw your consent at any time as described in Article 3.

8.3. You may request the deletion of personal data or the correction of inaccurate personal data (your right to erasure and rectification). Please note that we may keep certain information concerning you, as required by law, or when we have a legal basis to do so. For instance, if we believe you have committed fraud or violated our Terms and Conditions and we want to prevent you from circumventing the rules applicable to our community.

8.4. You have the right to object at any time (i) to the processing of your personal data for the purpose of direct marketing, or (ii) other processing of your personal data based on our legitimate interest (your right to object to processing).

8.5. You have the right to restrict the processing of your personal data (your right to restriction of processing). Please note that this only applies if (i) you contested the accuracy of your personal data and we are verifying the accuracy of the personal data, (ii) you exercised your right to object and we are still considering, as foreseen by the applicable law, whether the legitimate reasons we are pursuing prevail over yours; or (iii) your personal data has been processed by us in an unlawful way and you request a restriction on their processing rather than erasure; or (iv) we no longer need the personal data for the purposes of processing, but they are still necessary for you to establish, exercise or defend legal claims.

8.6. You have the right to data portability, i.e. the right to receive the Personal Data you have provided us with, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller (your right to data portability).

8.7. You also have the right to make a complaint to the relevant data protection supervisory authority or to seek a remedy through the courts if you believe that your rights have been breached.

8.8. You have the right to establish directives regarding the fate of your Personal Data after your death.

8.9. To exercise your rights, please contact the Group Data Protection Officer using the contact details provided in section 13 below.

9. Cookies & similar technologies

To find out more, please see our Cookie Policy.

10. Confidentiality of your password

Where you have chosen a password which enables you to access your account on our Platform, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

11. Links to other websites and social media

Our Platform may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy practices and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any Personal Data to these websites.

12. Changes to our Privacy Policy

Any changes we may make to our Privacy Policy in the future will be posted on this page. Where appropriate, we will notify you or seek your consent. Please check back frequently to see any updates or changes to our Privacy Policy.

13. Contact & Data Protection Officer

If you have any questions about this Privacy Policy or if you have any requests relating to your Personal Data, you can contact us via email to our Data Protection Officer at [email protected]

——— O ———– O ————-

Effective date: 17 October 2023