Introduction and scope
Transparency commitment and legal framework
Navo (company being registered, hereinafter “Navo” or “we”) attaches great importance to the privacy and security of the data of its business clients, their drivers and passengers.
This policy applies to the navo.so website, the app.navo.so application, its APIs and any related service. It explains how your data is collected, processed, retained and protected, in accordance with:
- the General Data Protection Regulation (GDPR no. 2016/679 of 27 April 2016);
- French law no. 78‑17 of 6 January 1978 on information technology, data files and civil liberties, as amended.
Data controller and processing on behalf of clients
GDPR article 28: who is responsible for what
Navo as data controller
For data relating to the business relationship: transport company accounts, billing of Navo subscriptions, demo requests, support and platform security.
Navo as technical processor
When a client (taxi, private hire, ambulance, coach operator) manages the data of its drivers, principals or passengers in Navo, the client remains the sole data controller. Navo acts on its documented instructions.
Contractual processing commitment (DPA)
Navo implements appropriate technical and organisational measures so that processing complies with the GDPR and protects the rights of data subjects.
Data collected and purposes
Data minimisation principle (GDPR art. 5.1.c)
Navo only collects the data needed for the following purposes:
| Category | Data concerned | Purposes |
|---|---|---|
| Identity and login | Last name, first name, business email, phone, encrypted password, role (admin, dispatcher, driver). | Secure access via Cloud‑IAM, multi-factor authentication, permission management. |
| Operations and rides | Pickup and drop-off addresses, dates and times, status, notes, vehicle type. | Schedules, dispatch, shuttle sheets and activity history. |
| Driver geolocation | GPS position sent by the driver’s phone, only while on duty. | Assigning the nearest ride, estimating arrival time, mission safety. |
| Billing and CPAM | Company ID (SIRET), VAT, CPAM electronic billing forms (prescription number, health insurance fund) for medical modules. | Compliant invoices (e-invoicing), CPAM electronic billing, payment tracking. |
| Browsing and support | Connection logs, anonymised IP address, messages to support or via the demo form. | Infrastructure security, intrusion detection, assistance and business relationship. |
Legal bases for processing
GDPR article 6
Performance of the contract
Providing the platform, account management, dispatch and support.
Legal obligation
Accounting and tax obligations, invoice archiving, transport regulations.
Legitimate interest
Server security, fraud prevention, technical optimisation and monitoring.
Consent
Obtained for any marketing communication or non-essential cookie.
Hosting, sovereignty and sub-processors
The core application stays in France
Navo applies a strict sovereignty policy to avoid any uncontrolled transfer outside the European Union.
Application and databases (app.navo.so)
Mainland FranceOperational, billing and transport data is hosted and operated by Navo on its own servers in France, with no third-party managed host for the databases.
Authentication (Cloud‑IAM)
Realm in FranceSessions and passwords are managed by Cloud‑IAM (Keycloak Enterprise), deployed in a French region, in line with ANSSI and GDPR requirements.
Website (navo.so)
Cloudflare · United States / EUThe static navo.so website is delivered by Cloudflare Pages for fast loading and DDoS protection.
No sale of data
Navo undertakes, including contractually, never to sell, rent, exchange or monetise the data of its clients, their drivers or their passengers.
Retention periods
Limited to operational and legal needs
User account and operational data: kept for the term of the contract, then archived for 3 years for evidential purposes.
Accounting data and invoices: in accordance with article L.123‑22 of the French Commercial Code and the French General Tax Code.
Raw geolocation: live positions are overwritten as soon as the ride ends; historical traces are purged or anonymised according to the operator’s settings.
Prospects and demo requests: from the prospect’s last contact.
Data security and integrity
Technical and organisational measures (GDPR art. 32)
Encryption
Web and mobile traffic over TLS 1.3. Databases encrypted at rest with AES‑256.
Access control (RBAC)
Strict isolation between clients, fine-grained roles and permissions, hashed passwords (Argon2 / Bcrypt).
Backups
Daily, encrypted, replicated on geographically separate volumes in France.
Audit and logging
Traceability of administrative access, continuous monitoring and web application firewall (WAF).
Your rights and remedies
GDPR articles 15 to 22
Access
Obtain confirmation of processing and a copy of your data.
Rectification
Correct inaccurate or incomplete data.
Erasure
Request permanent deletion of your data.
Restriction
Temporarily freeze processing in the cases provided for by law.
Portability
Receive your data in a structured, machine-readable format.
Objection
Object to the processing of your data on legitimate grounds.
To exercise these rights, write to contact@navo.so.
If, after contacting us, you believe your rights have not been respected, you may lodge a complaint with the CNIL (French data protection authority): cnil.fr, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
Cookies and trackers
Only what is necessary
- Strictly necessary cookies: keeping your session on
app.navo.so, CSRF protection and delivery by the Cloudflare CDN. - No advertising trackers: no third-party advertising pixel is used without your prior consent.
Contact and data protection officer
One point of contact for your data
For any question about this policy, about security or to exercise your rights: