Privacy Policy
Summary of your rights
As a user of our website, you have rights over your personal data in accordance with the GDPR. You can access, rectify or erase your data, or withdraw your consent at any time.
1. Introduction
ZRL-DRIVE, as data controller, is committed to protecting the privacy of the users of its website and services. This privacy policy informs you in a transparent manner about how we collect, use, share and protect your personal data in accordance with the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) and the Belgian law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
Date of last update: 28/09/2026
2. Data controller
Company name: ZRL-DRIVE
Company number: BE 1008.363.005
Registered office: Da Vincilaan 2, 1930 Zaventem, Belgium
Email: info@zrl-drive.be
Phone: +32 487 01 23 24
DPO / GDPR contact: rgpd@zrl-drive.be
3. Personal data collected
We collect the following categories of personal data:
3.1. Identification data
- First and last name
- Email address
- Phone number
3.2. Booking data
- Pick-up and destination addresses
- Date and time of the ride
- Number of passengers
- Requested vehicle type
- Special instructions
3.3. Technical data (with your consent)
- IP address
- Browser type and operating system
- Pages visited and visit duration
- Cookies and session identifiers
3.4. Billing data (business clients)
- Company name and VAT number
- Billing address
- Bank details for refunds
4. Purposes and legal bases of processing
In accordance with Article 6 of the GDPR, we process your data on the following legal bases:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Management of bookings and performance of transport services | Performance of the contract - Art. 6(1)(b) |
| Communication with clients (confirmations, reminders) | Performance of the contract - Art. 6(1)(b) |
| Invoicing and accounting | Legal obligation - Art. 6(1)(c) |
| Responding to contact requests | Legitimate interest - Art. 6(1)(f) |
| Sending marketing communications | Consent - Art. 6(1)(a) |
| Audience measurement and website improvement (analytics cookies) | Consent - Art. 6(1)(a) |
| Handling of disputes and complaints | Legitimate interest - Art. 6(1)(f) |
5. Data retention periods
Your personal data is kept for the following periods:
- Booking data: 3 years after the last service
- Billing data: 10 years (Belgian legal accounting obligation)
- Contact data: 3 years after the last contact
- Marketing data: Until you withdraw your consent
- Analytics cookies: Maximum 13 months (CNIL recommendation)
- Connection logs: 1 year
Upon expiry of these periods, your data is irreversibly deleted or anonymised.
6. Recipients of the data
Your personal data may be shared with the following recipients:
6.1. Internal recipients
- Our drivers (for the performance of the services)
- Our customer service
- Our accounting department
6.2. Processors (with DPA agreements compliant with Art. 28 GDPR)
- Web hosting: Vercel Inc. (USA) - Standard Contractual Clauses
- Email sending: EmailJS - Data processed in the EU
- Online payment: [Payment provider] - PCI-DSS certified
- Analytics: Google Analytics (with consent) - Standard Contractual Clauses
6.3. Other recipients
- Judicial or administrative authorities (if required by law)
- Insurance companies (in the event of a claim)
We never sell your personal data to third parties.
7. International data transfers
Some of our processors may be established outside the European Economic Area (EEA). In that case, we ensure that appropriate safeguards are in place:
- Adequacy decisions of the European Commission
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Approved certifications and codes of conduct
You can obtain a copy of the appropriate safeguards by contacting us at rgpd@zrl-drive.be.
8. Your rights
In accordance with the GDPR, you have the following rights over your personal data:
Right of access (Art. 15)
Obtain confirmation that your data is being processed and access a copy of that data.
Right to rectification (Art. 16)
Have your inaccurate or incomplete data corrected.
Right to erasure (Art. 17)
Request the deletion of your data under certain conditions (withdrawal of consent, data no longer necessary, etc.).
Right to restriction of processing (Art. 18)
Temporarily restrict the processing of your data.
Right to data portability (Art. 20)
Receive your data in a structured, machine-readable format, or have it transferred directly to another data controller.
Right to object (Art. 21)
Object to the processing of your data, in particular for direct marketing purposes.
Right to withdraw your consent (Art. 7)
Withdraw your consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal.
Right to lodge a complaint (Art. 77)
Lodge a complaint with the competent supervisory authority.
How to exercise your rights?
To exercise any of these rights, contact us at:
- Email: rgpd@zrl-drive.be
- Post: ZRL-DRIVE - GDPR, Da Vincilaan 2, 1930 Zaventem, Belgium
We will respond to your request within a maximum of 30 days. Proof of identity may be requested to verify your identity.
9. Cookies and similar technologies
Our website uses cookies and similar technologies. In accordance with the ePrivacy Directive and the recommendations of the CNIL, we obtain your consent before placing non-essential cookies.
Types of cookies used:
- Necessary cookies: Essential for the operation of the website (session, language preferences)
- Analytics cookies: Google Analytics - Audience measurement (with consent)
- Marketing cookies: Google Ads, Facebook Pixel (with consent)
Your current preferences
No consent recorded.
10. Data security
In accordance with Article 32 of the GDPR, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk:
- Encryption of data in transit (HTTPS/TLS)
- Restricted access to data on a need-to-know basis
- Secure authentication for administrator access
- Regular and secure backups
- Regular updates of systems and software
- Staff training in good security practices
11. Protection of minors
Our website and services are not intended for persons under 16 years of age. We do not knowingly collect personal data concerning minors. If you are a parent or guardian and you discover that your child has provided us with personal data, please contact us so that we can take the necessary measures.
12. Complaints
If you believe that your rights are not being respected despite our efforts, you can lodge a complaint with the competent supervisory authority:
Data Protection Authority (APD-GBA) - Belgium
- Address: Rue de la Presse 35, 1000 Brussels
- Phone: +32 2 274 48 00
- Email: contact@apd-gba.be
- Website: www.autoriteprotectiondonnees.be
13. Changes to this policy
We may update this privacy policy periodically. Any change will be published on this page with a new update date. In the event of substantial changes, we will inform you by email or by a visible notification on our website. We encourage you to consult this page regularly.
14. Contact us
For any question regarding this privacy policy or the processing of your personal data, you can contact us:
- General email: info@zrl-drive.be
- GDPR email: rgpd@zrl-drive.be
- Phone: +32 487 01 23 24
- Address: ZRL-DRIVE, Da Vincilaan 2, 1930 Zaventem, Belgium
Related legal documents
Last updated: 28/09/2026