The personal data of the User collected by Karos on behalf of and for the account of Île-de-France Mobilités are subject to processing within the meaning of the amended French Data Protection Act of January 6, 1978, and of the European Regulation 2016/679 of April 27, 2016, on data protection, known as the “GDPR,” for the purpose of providing the carpooling service offered on the Covoit IDFM application.

This Privacy Policy explains how Île-de-France Mobilités (“Île-de-France Mobilités” or “we”), as the data controller within the meaning of Article 4 of the GDPR, processes your personal data when you use the Covoit’IDFM mobile application (the “Application”) operated by Karos Mobility SAS, acting as data processor within the meaning of Article 28 of the GDPR.

The registered office of Île-de-France Mobilités is located at 39bis-41 rue de Châteaudun, 75009 Paris, France. For any questions regarding data protection, you may contact our Data Protection Officer (DPO) at: dpo@iledefrance-mobilites.fr.

Karos Mobility SAS (10 rue de la Paix, 75002 Paris, France) acts solely as a data processor within the meaning of Article 28 of the GDPR.

For the purposes of this policy:

Karos, on behalf of and for the account of Île-de-France Mobilités, processes Personal Data within the framework of the following processing activities:

During your use of the Application, we may collect and process the following categories of personal data. This information enables us to provide, operate, and improve the services:

This data may be collected directly from you (e.g., during account creation) or indirectly through your use of the Application.

The legal bases and purposes are detailed in the following section.

To benefit from the services offered through the Application, you must create a user account. During this process, we collect certain information about you. This processing is based on our contractual obligations. Mandatory fields include the following information:

After successful registration, you can update your data.

We also invite you to create a password or to register via “Sign in with Apple” or through single sign-on (SSO) using an IDFM Connect account. In the latter case, we only receive the data that you authorize us to share. For more information, please consult the privacy policy: https://www.iledefrance-mobilites.fr/cgu-compte

Legal basis: Art. 6(1)(b) GDPR (contract performance)

To enable you to benefit from our carpooling service, we may in particular:

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) of the GDPR (consent, revocable at any time) for optional profile information.

In certain cases, and in order to verify Eligibility for the Service, we may ask you to provide documents such as a driving licence, identity card, and/or proof of address. Data is processed via a secure interface with a third-party verification service

These documents and the information they contain are used for security purposes to verify member’s age, authenticity, and uniqueness of accounts. The documents and information may also be shared with our banking partners as part of European anti-money laundering efforts.

This may involve sharing data with banking partners.

Legal basis: Art. 6(1)(c) GDPR (legal obligation)

We analyze your connection and geolocation data during carpools to verify that the carpooling actually took place under the conditions defined at the time of booking, to trigger the driver’s payment, and to charge the passenger. Your trip and contact data may be shared with our anti-fraud verification partners so that they can carry out verification calls.

Legal basis: Art. 6(1)(c) of the GDPR (legal obligation for fraud prevention required by Class C of the Carpooling Proof Register).

We analyse your activity and interactions with the Application to improve the offered services (e.g., improving mobile app interfaces or customer service messages).

Legal basis: Art. 6(1)(b) of the GDPR (Performance of the contract in order to ensure security, carry out proper technical diagnostics, and guarantee the proper functioning and continuous improvement of the Service).

With your consent, the Application may access your phone contacts to send invitations. Your friends will not receive any additional commercial messages. Only the phone numbers of the selected contacts are collected and processed by Île-de-France Mobilités, via Karos acting as data processor. The selected friends’ numbers are kept for 2 months to activate a referral bonus if the contact signs up. Make sure your friends have agreed to receive such messages. .

Legal basis: Art. 6(1)(a) GDPR (consent, revocable at any time).

Spain: Participation in the Energy Savings Certificate (CAE) System

In order for the user to participate in and benefit from the Energy Savings Certificate system promoted and implemented by the Ministry for the Ecological Transition and the Demographic Challenge (MITECO), we must collect and process identifying data (such as name, last name, and DNI/NIE) and technical data about the vehicle (make, model, license plate, type of combustion), for the purpose of recording the savings generated by shared journeys and transferring them to the authorised bodies or entities for validation.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

In certain regions, carpoolers are eligible for public subsidies or bonuses. These amounts are received by Île-de-France Mobilités, via Karos acting as data processor, and redistributed to its Members.

In this context, certain data (e.g., date, origin, and destination of your trips, proof that the trips took place, etc.) may be provided to the public authorities granting the subsidy or bonus.

Legal basis: Art. 6(1)(b) of the GDPR (Performance of the contract to enable the management of regional programs and the calculation of subsidies).

In some regions, we collaborate with local authorities like the ones managing public mobility to provide its services. In this context, we may share certain data (e.g., your name, first name, email address, phone number, transport card number, postal address...) with our partner.

Aggregated information on the use of the Application in the area may also be provided.

Legal basis: Art. 6(1)(b) of the GDPR (Performance of the contract to enable the management of regional programs and the calculation of subsidies).

When a company or school partners with Île-de-France Mobilités as part of a Carpooling Program: If a member chooses to affiliate with the relevant company or school, in accordance with our terms of use, Karos may share necessary identification data with the company or school for administrative management of affiliations, such as name, first name, and any other strictly required information to enable reliable identification, as a data processor.

This sharing is solely for administrative purposes, including allowing partner companies to maintain updated lists of their active employees and partner schools to maintain updated lists of their active students.

Aggregated and anonymized data on the use of the Application by Members identified as employees or students may also be provided for statistical purposes or to evaluate the program.

Individualized data (for example, for tax or compliance purposes) may also be transmitted when Members have given their consent.

In certain cases, the purposes and means of data processing may be jointly determined with the employer (for example, reporting distances traveled for tax or mobility programs). The respective responsibilities are defined in a separate agreement.

Legal basis: Art. 6(1)(b) of the GDPR (Performance of the contract to enable the calculation of subsidies).

We have established certain partnerships to display available trips from its platform on third-party route-finding services. In this context, we may share with our partners certain data regarding our members and the trips they offer.

Legal basis: Art. 6(1)(f) GDPR (Legitimate interest in enhancing visibility of trips via partnerships while protecting user data).

If your carpools are eligible for a return assistance program, we share your contact information and addresses with our partner transport providers.

Legal basis: Art. 6(1)(a) GDPR (consent).

If your carpools entitle you to a reserved parking space, we share your contact information and addresses with the relevant partner to reserve your parking space and for control purposes.

Legal basis: Art. 6(1)(a) GDPR (consent).

Your carpools or activity may entitle you to certain benefits, such as gifts, vouchers or other perks, if you participate in games organized by Île-de-France Mobilités, through Karos acting as data processor.

Legal basis: Art. 6(1)(b) GDPR (contract performance as per the terms set out in the T&Cs).

Newsletters: we may send periodic newsletters, in-app messages and surveys using third party partners. You may unsubscribe anytime using the link provided in the communication.

Legal basis: Art. 6(1)(a) GDPR (consent).

Contests and Giveaways: When organizing contests, participants’ data (e.g., name, email address) are processed in order to carry out the operation. The data are subsequently deleted unless otherwise required by law.

Legal basis: Art. 6(1)(a) GDPR (consent).

User feedback: To improve the services, feedback may be collected from members.

Legal basis: Art. 6(1)(a) GDPR (consent).

Within the Application, registered members can interact with each other using features such as:

During such interactions, the following data may be visible:

When necessary, especially in cases of abnormal behaviour or user reports, we may analyze user interactions and discussions on the Application.

Legal basis: Art. 6(1)(b) of the GDPR (Performance of the contract to ensure security and compliance with community rules).

We kindly ask you not to communicate, enter, or transmit, when using this service, any information that falls within the special categories of personal data (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning health, sex life, or sexual orientation). Such data have no direct or necessary connection with the service offered, and we are not authorized to collect or process them, even if you consent to their use.

Some sections of our Website and Application include links to third-party websites including social networks (e.g., Instagram, Facebook, LinkedIn, YouTube, X). Clicking these links forwards you to the respective platform, which may receive user data. Please refer to the platforms’ privacy policies for details. These sites operate under their own privacy policies. We are not responsible for their operations, including data handling.

Please refer to the privacy policies of these platforms for more details. These sites operate under their own privacy policies. We are not responsible for their operation, including their management of data.

We may use cookies to analyze your behavior in detail. Cookies are small text files stored on your device. They are used to ensure certain technical functionalities of the site. These data are not merged with other data. The information collected may include:

We differentiate between the following categories of cookies:

The data stored in cookies are used solely for the purposes described above and are not used to create complete user profiles or to track behavior beyond the specified purposes.

Legal basis: Art. 6(1)(a) GDPR (consent).

As part of user support and complaint handling, Île-de-France Mobilités, through Karos acting as a data processor, processes certain personal data in order to identify Members, analyze the reported situations, and provide an appropriate response.

The processing operations include, in particular:

The data processed in this context are used solely for the purposes of resolving requests, preventing fraud, and improving user support.
Where applicable, they may be shared with service providers involved in handling the complaint (for example: payment providers, mobility partners, technical support), but only to the extent strictly necessary to resolve the issue.

Legal basis: Art. 6(1)(b) of the GDPR — Performance of the contract (assistance and dispute resolution).

We process personal data to fulfill legal obligations, such as trade, business, or tax retention periods.

Legal basis: Art. 6(1)(c) GDPR in conjunction with applicable commercial, trade, or tax laws.

We process personal data to assert legal claims or defend against them, and to investigate or prevent criminal acts.

Legal basis: Article 6(1)(c) of the GDPR (Legal obligation for legal protection and security).

We do not use automated decision-making or profiling as defined in Art. 22 GDPR.

Île-de-France Mobilités, with the support of Karos acting as data processor, ensures the protection of user data through state-of-the-art encryption, authentication, and fraud detection techniques. Dedicated teams work daily to protect the community from fraudulent and abusive uses.

Only our internal teams have access to your data. By exception, certain data may be shared with partners and service providers, to whom they may be transmitted, subject to your consent when required. These recipients include, in particular:

Here is our current list of providers we may share data with:

Data is also shared with public authorities and partners for:

We only share data necessary for the specific purpose and in accordance with Art. 28 GDPR (data processor agreements) or Art. 26 GDPR (joint controllership agreements).

We anonymise and aggregate trip information, routes, and certain user profile characteristics to produce usage statistics intended for third parties.

We undertake, in accordance with the provisions of the GDPR, to retain personal data only for as long as necessary for the purposes for which they are processed:

We implement appropriate security measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and any other processing that does not comply with our privacy policy.

According to GDPR, you have the following rights:

You can exercise your rights by sending a request to dpo@iledefrance-mobilites.fr. Proof of identity will be required.

You may also contact rgpd@karos.fr (technical data processor).

In the event that your rights are not respected, you may lodge a complaint with the CNIL or any other competent authority.

You can also delete your Covoit IDFM account directly from the Application.

With the exception of the processing operations listed below, your data used for the operation of the Service are processed within the European Union.

We carry out these transfers on the basis of the Standard Contractual Clauses (SCCs) approved by the European Commission.

We reserve the right to change this privacy policy at any time.

Application members are informed directly in the Application and must comply with them to continue using the services.

Unless otherwise stated, such changes are effective upon publication.

We recommend checking this policy regularly.