Privacy Policy

No data protection officer has been appointed, as the activity does not fall within the cases requiring mandatory appointment; any request concerning data is handled at the address above.

2.1 Operators (Park & Keep customers) — Tresor Kaya is the data controller.

2.2 Operators' end customers — Tresor Kaya acts as processor (Article 28 of the GDPR) on behalf of the operator, who is the data controller. Data concerned: identity and contact details, vehicle registration and characteristics, dates and locations, vehicle condition report photos, signature, payment data processed by Stripe, messages sent. This data is processed solely on the operator's instructions, to perform the booking or storage contract, and is retained for a maximum of 36 months after the last service (vehicle condition report photos: 90 days after the vehicle is returned, unless a dispute arises), unless a legal obligation requires otherwise. Requests to exercise rights should be addressed primarily to the operator; Park & Keep assists the operator in responding to them.

2.3 Visitors to parkandkeep.com — the contact form and sign-up collect the data entered (name, email, company, message) to respond to the request (legitimate interest / pre-contractual measures), retained for 12 months. Mere browsing does not involve any identifying data collection.

Tresor Kaya uses the following providers, bound by GDPR-compliant data processing agreements:

No data is sold or transferred to third parties for advertising purposes. Transfers outside the European Union, limited to the providers listed above, are governed by the European Commission's standard contractual clauses or by an adequacy decision.

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• →Access — obtain a copy of the data concerning you;
• →Rectification — have inaccurate or incomplete data corrected;
• →Erasure — request the deletion of your data, subject to legal retention obligations;
• →Restriction — request the temporary suspension of processing;
• →Portability — receive your data in a structured, machine-readable format (operators have built-in CSV and PDF exports);
• →Objection — object to processing based on legitimate interest or to direct marketing;
• →Post-mortem directives — decide what happens to your data after your death.

To exercise your rights: contact@parkandkeep.com or by post to 1 rue du Sculpteur Bussière, 57130 Ars-sur-Moselle, France, providing proof of identity. We respond within a maximum of one (1) month. You may also lodge a complaint with the CNIL (3 place de Fontenoy, 75007 Paris — cnil.fr) or the supervisory authority in your country.

Tresor Kaya implements appropriate technical and organizational measures to protect data against unauthorized access, loss, destruction or disclosure:

• →encryption of exchanges (HTTPS / TLS) and of data at rest at the hosting providers;
• →hashed passwords (bcrypt), limited-use valet codes, signed sessions, limitation of the number of login attempts;
• →strict segregation of data by operator (each request is filtered by account);
• →logging of sensitive actions, daily database backups;
• →system access restricted to the Publisher, protected by strong authentication.

In the event of a data breach likely to result in a risk to individuals, the Publisher notifies the CNIL within 72 hours and informs the operators concerned without delay.

Park & Keep uses only strictly necessary cookies for the operation of the service, exempt from consent: a session cookie (authentication of back office, field app and portal users), a language preference cookie ("pk_locale", 12 months) and a request-forgery protection token. No advertising, social network or third-party audience measurement cookie is placed, either on parkandkeep.com or on operators' booking websites.

This policy may be updated to reflect changes to the service or to applicable regulations; the date of the last update is shown at the top of the page. Substantial changes are notified to operators by email.