UPDATED ON 2 FEBRUARY 2026
1. Personal Data Protection Policy
This Personal Data Protection Policy (hereinafter referred to as the “Policy”) describes the rules applicable to information processed by SMOVENGO, a simplified joint-stock company (société par actions simplifiée) with a share capital of €4,406,000, having its registered office at 10 rue du Commandant d’Estienne d’Orves, 92390 Villeneuve-la-Garenne, France, registered with the Nanterre Trade and Companies Register under number 830 888 640, and whose intra-Community VAT number is FR90 830888640 (hereinafter “SMOVENGO”).
This Policy explains how SMOVENGO processes the personal data of users (hereinafter the “Users”) collected when browsing and using the websites https://www.velib-metropole.fr and http://blog.velib-metropole.fr/ (hereinafter the “Websites”), as well as the Vélib’ application (hereinafter the “Application”).
SMOVENGO pays constant attention to the protection of Users’ data. SMOVENGO may therefore amend, supplement or update its Personal Data Protection Policy. Users are invited to regularly consult the latest version in force, available on the Website. If major changes are made, Users will be informed by email or through the services in order to allow them to review such changes before they take effect.
2. What personal data are collected and for what purposes?
2.1. Data processing carried out by SMOVENGO
Below is a detailed description of the purposes for which SMOVENGO may process Users’ personal data.
Account creation
• Categories of data: Identification data (title, last name, first name, date of birth, password, email address, postal address, phone number)
• Legal basis: Your contract (General Terms and Conditions of Use and Sale – GTCU)
• Retention period: Data are retained for one (1) year from account creation.
Management of communications (start and end of trip)
• Categories of data:
• Identification data (ID)
• Vélib’ usage data (date and time of the last trip)
• Legal basis: Legitimate interest (business management)
• Retention period: For the duration of use of the Vélib’ platform, or until the right to object is exercised.
Ongoing trip alerts
• Categories of data:
• Identification data (ID)
• Vélib’ usage data (trip duration)
• Legal basis: Legitimate interest (business management)
• Retention period: For the duration of use of the Vélib’ platform, or until the right to object is exercised.
Management of communications (news, special offers and events)
• Categories of data: Email address
• Legal basis: Consent
• Retention period: Until consent is withdrawn.
Management of subscriptions and plans
• Categories of data:
• Identification data (title, last name, first name, date of birth, password, email address, postal address, phone number)
• Transaction-related data (order reference, last four digits of the bank card, card expiration date)
• Legal basis: Your contract (GTCU)
• Retention period: One (1) year from the expiry of the User’s last subscription.
After this period, the data may be archived on a separate medium to meet legal, accounting and tax obligations (such as the ten (10) year invoice retention obligation under Article L.123-22 of the French Commercial Code) and/or at least for the applicable limitation period (such as the five (5) year general limitation period under Article 2224 of the French Civil Code).
Management of commercial incentives
• Categories of data:
• Identification data (ID)
• Vélib’ usage data (date of last application use, registration validation data, item added to a basket)
• Legal basis: Legitimate interest (commercial solicitations)
• Retention period: For the duration of use of the Vélib’ platform plus a maximum of three (3) years, or until the right to object is exercised.
User loyalty programs
• Categories of data:
• Identification data (ID)
• Vélib’ usage data (unused purchased ticket, subscription type, subscription status, discount applied, date of last purchase, order completion, subscription end date, date and time of last trip)
• Legal basis: Legitimate interest (commercial solicitations)
• Retention period: For the duration of use of the Vélib’ platform plus a maximum of three (3) years, or until the right to object is exercised.
Customer satisfaction (feedback on your achievements)
• Categories of data:
• Identification data (ID)
• Vélib’ usage data (number of kilometres travelled, number of trips completed, longest trip, average speed over the year, CO₂ saved through cycling)
• Legal basis: Legitimate interest
• Retention period: One (1) month from notification.
Management of favourite stations
• Categories of data: Open Cell ID, list of station numbers marked as favourites by the User
• Legal basis: Consent
• Retention period: Until consent is withdrawn.
Account suspension management
• Categories of data: Service-related data (expired or invalid payment method, unpaid invoices, expired access codes, expired subscription)
• Legal basis: Your contract (GTCU)
• Retention period: For the duration of the account suspension.
Expired bank card alerts
• Categories of data:
• Identification data (ID)
• Transaction-related data (payment method expiration date)
• Legal basis: Your contract (GTCU)
• Retention period: Until banking details are updated.
Device pairing management
• Categories of data:
• Identification data (ID)
• Vélib’ usage data (subscription type, discount type, subscription start and end dates, unlocking method, order validation)
• Legal basis: Your contract (GTCU)
• Retention period: For the duration of the pairing process.
Management of requests and complaints
• Categories of data:
• Identification data (last name, first name, email address)
• Data relating to the request (category, sub-category, specific case, description)
• Legal basis: Legitimate interest (request management)
• Retention period:
• Requests or complaints processed and accepted: retained for two full financial years.
• Requests rejected without bodily injury: retained for five (5) years.
• Requests rejected with bodily injury: retained for ten (10) years.
Management of data subject rights
• Categories of data:
• Identification data (last name, first name, email address)
• Data relating to the request (content of the request)
• Legal basis: Legal obligation
• Retention period: One (1) year from the last correspondence relating to the request, or until the expiry of legal action, in order to constitute proof in the event of litigation.
2.2. Processing of personal data in the context of access to the Vélib’ Métropole purchase page from the Île-de-France Mobilités application
To allow the User to access the Vélib’ Métropole purchase page from the Île-de-France Mobilités application, SMOVENGO, the Autolib’ Vélib’ Métropole Syndicate and the public administrative body Île-de-France Mobilités (hereinafter the “Joint Controllers”) jointly process the User’s personal data.
The personal data processed are:
• The Navigo card number, only if the User has chosen to use their Navigo pass to unlock their bike;
• The User’s email address (Navigo Connect identifier), only if the User has logged into the Île-de-France Mobilités application using their Navigo Connect account.
The legal basis for this processing is consent, in accordance with Article 6(1)(a) of the GDPR.
The data retention period corresponds to the duration of the User’s commercial relationship with SMOVENGO, plus three (3) years.
Data subjects may exercise their GDPR rights with and against each of the Joint Controllers.
The Joint Controllers have designated the following contact point:
SMOVENGO Data Protection Officer
2.3. Processing of personal data for access to Vélib’ Métropole purchase information in the Île-de-France Mobilités personal space
To allow the User to access their Vélib’ Métropole purchase information in their Île-de-France Mobilités personal space, the Joint Controllers jointly process the User’s personal data.
The personal data processed are: amount, offer, purchase date, bike unlocking method, payment identifier, email address, payment operator.
The legal basis for this processing is the contract, in accordance with Article 6(1)(b) of the GDPR.
The retention period corresponds to the duration of the User’s commercial relationship with SMOVENGO, plus three (3) years.
The contact point designated is:
Île-de-France Mobilités Data Protection Officer
2.4. Processing of personal data for after-sales service management
As part of Vélib’ Métropole after-sales service management, the Joint Controllers jointly process the User’s personal data.
The personal data processed are: last name, first name, email address, and details of the User’s request.
The legal basis for this processing is the contract, pursuant to Article 6(1)(b) of the GDPR.
The retention period corresponds to the duration of the User’s commercial relationship with SMOVENGO, plus three (3) years.
3. What information does SMOVENGO share with third parties?
All personal data collected and processed by SMOVENGO are strictly confidential.
SMOVENGO may temporarily and securely transfer certain personal data to Partners, particularly to ensure order fulfillment, subscription monitoring, fraud prevention and detection of criminal activities, and to conduct satisfaction surveys.
SMOVENGO may also share certain personal data with duly authorised processors. SMOVENGO ensures that such processors provide sufficient guarantees regarding the implementation of appropriate technical and organisational measures to ensure GDPR compliance and the protection of Users’ rights.
SMOVENGO may also disclose personal data to comply with legal obligations or requests from competent authorities.
4. What are the Users’ rights?
In accordance with applicable regulations, Users have the following rights:
• Right of access and rectification;
• Right to update and complete personal data;
• Right to restriction or deletion of personal data when such data are inaccurate, incomplete, outdated, or unlawfully processed;
• Right to withdraw consent at any time;
• Right to restriction of processing;
• Right to object to the processing of personal data;
• Right to data portability for data provided by the User and processed by automated means based on consent or a contract.
Requests may be sent to: [email protected]
Users may also lodge a complaint with the supervisory authority, in particular the CNIL (https://www.cnil.fr/fr/plaintes). Requests will be processed within 30 days. A copy of a valid ID may be requested to verify the User’s identity.
5. How to contact SMOVENGO?
For any questions, complaints, recommendations or comments regarding this Personal Data Protection Policy, Users may contact SMOVENGO at: [email protected]