Last updated: October 5, 2026
1. Introduction
Protecting your personal data is a priority for us. Incarline is committed to complying with the regulations applicable to the processing of personal data, in particular Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act (“Informatique et Libertés”).
2. Data controller
The data controller is Incarline, whose registered office is located at Espace commercial Le Méridien, Route de Montpellier, 34700 Lodève, France.
For any question about data protection, you can contact our Data Protection Officer (DPO): contact@incarline.com.
3. Data collected and purposes
We only collect the data needed for our business:
| Type of data | Purpose | Legal basis |
|---|---|---|
| Identity and contact details (last name, first name, e-mail, phone, address, company, VAT number) | Order management, invoicing, delivery, workshop appointments, training courses | Performance of a contract (Art. 6.1.b GDPR) |
| Vehicle information (registration, VIN, model, ECU references and readings) | Technical diagnosis, ordering suitable parts, carrying out the work | Performance of a contract (Art. 6.1.b GDPR) |
| Exchanges with the workshop (quote requests, messages, e-mails, photos and attached files) | Answering your requests, following up on your file | Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR) |
| Customer relationship and prospecting (contact details, requests, orders, history of exchanges, in our HubSpot tool) | Managing our business relationships, contacting you about your request, informing you about our services | Legitimate interest (Art. 6.1.f GDPR); your consent for e-mail prospecting if you are not a customer |
| Payment (transaction, history) | Collection of payments and accounting. Incarline does not keep any bank card data: payment takes place on Stripe’s secure page | Legal obligation (Art. 6.1.c GDPR) |
| Connection and security (technical logs, IP address, essential cookies) | Site security, keeping you signed in, shopping cart | Legitimate interest (Art. 6.1.f GDPR) |
| Cookieless audience measurement (pages viewed, referring site, irreversible daily fingerprint) | Site traffic statistics | Legitimate interest (Art. 6.1.f GDPR) |
| Browsing tracked by HubSpot (pages viewed, where your visit came from, linked to your record if you contact us) | Understanding the context of your request to answer it better | Your consent (Art. 6.1.a GDPR), given in the cookie banner and revocable at any time |
Details on cookies are given in our cookie policy.
4. Recipients of the data
Your data is intended for our internal departments (workshop, training, administration). It is also shared, to the extent relevant, with the following providers, who act on our behalf (processors):
| Provider | Role | Data concerned |
|---|---|---|
| Hostinger (server located in France) | Hosting of the site, our databases and our management software (Odoo, hosted on our server) | All site data |
| OVH (France) | E-mails exchanged with you | |
| HubSpot | Customer relationship management (CRM); browsing tracking if you accept it | Contact details, requests, orders, browsing |
| Stripe | Online payment | Amount, e-mail, payment data (processed by Stripe) |
| DHL | Parcel pickup and delivery | Name, address, phone |
| Our accounting firm | Accounting and tax obligations | Invoices |
We do not sell, rent or transfer any of your personal data to third parties for commercial purposes.
5. Transfers outside the European Union
HubSpot and Stripe belong to companies established in the United States. When data is transferred to them, these transfers are governed by the EU–U.S. Data Privacy Framework, under which HubSpot, Inc. and Stripe are certified, and by the European Commission’s standard contractual clauses. HubSpot hosts our data in its European data centre.
6. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration or destruction: encrypted communications (SSL/TLS), restricted access, secure daily backups.
7. Retention periods
- Customer files and work carried out: 10 years after the last intervention, for technical follow-up and the warranty of the vehicles we worked on.
- Invoicing: 10 years (accounting obligation).
- Prospects (requests that did not lead to an order): 3 years after the last contact.
- Cookieless audience measurement: 25 months.
- HubSpot cookies and cookie choice: 6 months at most (see the cookie policy).
8. Your rights
In accordance with the regulations, you have the following rights:
- Right of access: know what data we hold about you.
- Right to rectification: correct inaccurate data.
- Right to erasure: request the deletion of your data (unless a legal obligation applies).
- Right to data portability: receive your data in a structured format.
- Right to object: object to a processing operation, in particular to prospecting, at any time.
- Right to withdraw your consent: for HubSpot tracking, via the “Manage cookies” link at the bottom of every page or from My account › Cookies and tracking.
- Instructions after death: decide what happens to your data after your death.
To exercise these rights, write to us at contact@incarline.com or by post to the address above. If you are not satisfied with our answer, you may lodge a complaint with the CNIL (www.cnil.fr).
Would you like to exercise your rights over your personal data?
Contact the DPOIncarline is committed to protecting the confidentiality of your personal data.