Privacy Policy

1. Data Controller

The data controller for personal data is:

• Company name: BOB BORROW & BACK
• Legal form: SAS with a share capital of €10,000.00
• RCS: 940 267 057 R.C.S. Toulon
• Registered office: 52 Chemin de la Closerie des Lilas (VC 217), 83500 La Seyne-sur-Mer, France
• Email: contact@bobapp.fr
• Phone: +33 6 25 48 29 33

Data Protection Officer (DPO): Jean-Charles Meilland – contact@bobapp.fr

2. Data We Collect

When using the BOB – Borrow & Back application, we collect the following categories of data:

• Identification data: name, email address, phone number (if provided)
• Profile data: avatar, bio, optional fields
• Contact data: if you authorize access for the "close contacts only" feature
• User-generated content (UGC): messages, item descriptions, photos
• Technical data: device type, operating system, IP address, connection logs, technical identifiers
• Browsing data: cookies, pages visited, visit duration

3. Purposes of Processing

Your personal data is processed for the following purposes:

• Provision and management of the Application's features (lending/borrowing, messaging, collectives, reminders)
• Creation and management of your user account
• Security, fraud prevention, and content moderation
• Service improvement and anonymized statistics
• Customer support and operational communications
• Compliance with our legal and regulatory obligations

4. Legal Bases for Processing

In accordance with article 6 of the GDPR, data processing is based on the following legal grounds:

• Performance of a contract: processing necessary to provide the service (article 6.1.b GDPR)
• Legitimate interest: security, service improvement, anti-abuse (article 6.1.f GDPR)
• Consent: contacts access, push notifications, non-essential cookies (article 6.1.a GDPR)
• Legal obligation: lawful requests, mandatory retention (article 6.1.c GDPR)

5. Retention Periods

In accordance with the storage limitation principle (article 5.1.e GDPR), your data is retained for the following periods:

• Account data: duration of account activity + 24 months after last activity, then deletion or anonymization
• Technical logs: up to 12 months, in accordance with CNIL recommendations
• Messages and content (UGC): while the account is active or until deletion by the user
• Non-essential cookies: up to 13 months in accordance with CNIL recommendations
• Billing data: 10 years in accordance with the French Commercial Code (article L.123-22)

6. Recipients and Processors

Your data may be shared with the following categories of recipients, in strict compliance with the GDPR:

• Hosting: OVHcloud (OVH SAS – 2 rue Kellermann, 59100 Roubaix, France)
• Artificial intelligence: Mistral AI (Mistral AI SAS – 15 rue des Halles, 75001 Paris, France)
• Technical services: analytics, email/push notification delivery, anti-spam

Data processing agreements compliant with article 28 of the GDPR are in place with each provider. The full list of processors is available upon request at contact@bobapp.fr.

7. International Data Transfers

BOB BORROW & BACK prioritizes providers located in France and the European Union.

Where applicable, any transfer of data outside the European Economic Area is governed by appropriate safeguards in accordance with articles 44 to 49 of the GDPR:

• Standard Contractual Clauses adopted by the European Commission
• Adequacy decisions by the European Commission

Supporting documentation is available upon request.

8. Data Security

In accordance with article 32 of the GDPR, BOB BORROW & BACK implements appropriate technical and organizational measures to ensure data security:

• Data encryption in transit (TLS/SSL)
• Access control and secure authentication
• Access logging and monitoring
• Regular backups and disaster recovery plan
• Hosting on servers located in France (OVHcloud)

9. Your Rights

In accordance with articles 15 to 22 of the GDPR and articles 48 to 56 of the French Data Protection Act, you have the following rights:

• Right of access (article 15 GDPR): obtain confirmation of processing and receive a copy of your data
• Right to rectification (article 16 GDPR): correct inaccurate or incomplete data
• Right to erasure (article 17 GDPR): request deletion of your data
• Right to restriction (article 18 GDPR): obtain restriction of processing
• Right to object (article 21 GDPR): object to the processing of your data
• Right to portability (article 20 GDPR): receive your data in a structured, machine-readable format
• Withdrawal of consent: withdraw your consent at any time, without affecting the lawfulness of prior processing
• Post-mortem directives: define instructions regarding your data after your death (article 85 of the French Data Protection Act)

To exercise these rights, contact us at: contact@bobapp.fr

We commit to responding to your request within one month, in accordance with article 12.3 of the GDPR.

In case of a complaint, you may contact the CNIL (French Data Protection Authority): www.cnil.fr – 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

10. Cookies

In accordance with European Directive 2009/136/EC and CNIL recommendations (deliberation No. 2020-091 of September 17, 2020), the Application uses the following categories of cookies:

• Strictly necessary cookies: essential for the Application to function (authentication, security). They do not require your consent.
• Analytics cookies: audience measurement and service improvement. Subject to your prior consent.
• Personalization cookies: remembering your preferences. Subject to your prior consent.

You can manage your cookie preferences at any time via the Application or browser settings. Consent validity is up to 13 months.

11. Artificial Intelligence

The Application uses artificial intelligence services provided by Mistral AI (Mistral AI SAS – 15 rue des Halles, 75001 Paris, France), a French company subject to European law and the GDPR.

Data transmitted to Mistral AI is limited to what is strictly necessary and is subject to contractual guarantees in accordance with article 28 of the GDPR. No personal data is used to train AI models without your explicit consent.

12. Protection of Minors

The Application is intended for individuals aged 18 or over. We do not knowingly collect personal data from minors. If we discover that a minor has provided personal data, it will be deleted as soon as possible.

13. Changes to This Policy

BOB BORROW & BACK reserves the right to modify this privacy policy at any time. In the event of a substantial change, users will be notified via a notification in the Application or by email. The date of the last update is indicated at the top of this page.

14. Contact

For any questions regarding this privacy policy or to exercise your rights:

• Email: contact@bobapp.fr
• Phone: +33 6 25 48 29 33
• Address: BOB BORROW & BACK – 52 Chemin de la Closerie des Lilas (VC 217), 83500 La Seyne-sur-Mer, France
• DPO: Jean-Charles Meilland – contact@bobapp.fr