Privacy Policy

Colia, a sole trader (micro-entreprise), is the controller of the personal data collected through the colia.io Platform.

For any question related to personal data, contact: contact@colia.io

In the course of using the Platform, Colia collects the following data:

• Identification data: first name, last name, email address, phone number.
• Identity data: date of birth (mandatory at registration).
• Profile data: profile photo (hosted on Cloudinary), biography, country of residence.
• Verification data: identity document (ID card or passport) for Travelers seeking a verification badge.
• Trip and request data: information published on your trips and delivery requests.
• Messaging data: exchanges via the built-in messaging system.
• Browsing data: IP address, browser type, pages visited (via Umami Analytics, a privacy-friendly tool with no third-party cookies).

During the launch phase, no online payment is processed by the Platform: rewards are settled directly in cash between Users. Colia therefore collects no banking data and shares none with any payment provider.

Your data is processed for the following purposes:

• Service provision: creating and managing your account, matching Senders and Travelers.
• Identity verification (badge): validating documents for verification badge assignment.
• Communication: sending transactional emails (match confirmations, notifications).
• Service improvement: anonymized analysis of Platform usage.
• Security: detecting and preventing fraud and malicious activity.
• Legal obligations: compliance with accounting, tax and regulatory requirements.

During the launch phase, Colia processes no online payment: rewards are settled directly in cash between Users, with no payment provider involved.

Colia never sells your personal data to third parties. Your data may be shared with the following sub-processors, strictly within the scope of their mission:

• Cloudinary (hosting profile and item photos)
• Brevo (sending transactional emails)
• Umami Analytics (anonymized browsing statistics, cookie-free)

No payment provider is used during the launch phase. Payments are made directly in cash between users.

These providers are bound by confidentiality obligations and may only use your data for the purposes for which it was shared with them.

Colia may be required to disclose your data to competent authorities if required by law or in the context of legal proceedings.

Your data is retained for the period necessary to fulfill the purposes for which it was collected:

• Active account data: for the duration of your account's activity.
• Transaction data: 5 years from the transaction date (accounting obligations).
• Identity documents: deleted after validation, or at most 1 year after verification.
• Messaging data: 2 years after the last activity on the corresponding match.
• Browsing data: maximum 13 months (in line with CNIL recommendations).

After account deletion, your data is anonymized or deleted within 30 days, subject to any legal retention obligations.

Under the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of the data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data ("right to be forgotten") — see Delete your account.
• Right to restriction: restrict processing of your data in certain cases.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to the processing of your data for direct marketing purposes.
• Right to withdraw consent at any time for processing based on consent.

To exercise these rights, contact us at contact@colia.io. You also have the right to lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.

Colia uses a minimal number of cookies, strictly necessary for the Platform to function:

• Session cookies: maintaining your login (secure local storage).
• Preference cookies: remembering your preferred language and currency.

Colia does not use advertising or third-party tracking cookies. The Umami analytics tool is configured without cookies and anonymizes all browsing data.

You can configure your browser to refuse cookies or be notified when they are set. Note that some Platform features may be affected if essential cookies are refused.

Colia implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction or alteration:

• Encrypted communications via HTTPS (TLS).
• JWT token authentication with limited lifetime.
• Data access restricted to authorized personnel.
• No online payment is processed during the launch phase — no banking data is collected or stored.
• Photos hosted on Cloudinary with access control.

In the event of a data breach likely to result in a risk to your rights and freedoms, Colia undertakes to notify you within the legal timeframes (72 hours to the CNIL, then notification to affected individuals).