Draft document. Fields marked “to be completed” must be confirmed by ZOND and its legal counsel before final publication.
1. Data controller
ZOND, identified under French SIREN number 810 807 354, acts as the controller for the processing described on this website. Registered office address and legal form: to be confirmed before final publication. Contact: contact@zond.app.
2. Data we process
- Identity and contact details submitted through forms, including name, phone number, city and profile.
- Information related to partner, courier or driver applications.
- Technical data strictly necessary for the security and operation of the website.
- In the apps: account, orders, rides, payments and location data, depending on the enabled service.
- Face data used for identity verification when this feature is enabled, under the conditions set out below.
3. Face data (identity verification)
When identity verification is enabled, the app confirms, with your in-app consent, that the person using the driver account is the registered driver.
A liveness check runs first: images of your face and, on supported devices, depth data are processed entirely on your device. Depth data is never stored or transmitted and is discarded when the check completes.
A selfie is then transmitted securely to Ondemand Apps OU, our data processor operating the app's software platform, which compares it with your reference photograph using AWS Rekognition as a sub-processor.
We keep face data no longer than needed and never indefinitely: the selfie is deleted automatically once verification completes, at the latest immediately upon completion or interruption of the verification session after capture; the reference photograph is kept while your driver account is active, because repeated checks require an image to compare against, and is deleted within 30 days after the account closes; after each check, only the pass/fail result and its date are retained, containing no face data.
Face data is shared with no one except the two providers named above, solely to perform the verification. AWS processes the images transiently, does not retain them after the call completes and does not use them to train or improve its services. Face data is never used for advertising, marketing, profiling or analytics, and is never sold.
4. Purposes and legal bases
We use data to respond to requests, prepare a contractual relationship, provide requested services, secure the platform, comply with legal obligations and improve ZOND. Depending on the processing, the legal basis may be steps taken before entering into a contract, performance of a contract, a legal obligation, legitimate interests or consent. Face-data identity verification is initiated with consent collected in the app.
5. Recipients and processors
Access is limited to authorised ZOND teams and providers required for hosting, support, communications, payments or operations. The specific processing of face data and its only recipients are described in section 3. Other production providers and any transfers outside the European Economic Area will be specified according to the services enabled.
6. Retention periods
Data is retained only for as long as necessary for the relevant purpose, then archived or deleted in accordance with applicable obligations. The specific periods for selfies, reference photographs and verification results are set out in section 3.
7. Your rights
You may request access, correction, deletion, restriction or portability of your data, or object to certain processing. You may withdraw consent at any time when consent is the legal basis. Send your request to contact@zond.app. You may also lodge a complaint with the French Data Protection Authority (CNIL).
8. Security and updates
ZOND implements organisational and technical measures proportionate to the risks. We update this policy whenever the processing, providers or Client, Driver, Vendor and Admin apps change.