Privacy Policy

The data controller is TBF, Simplified joint-stock company (SAS – société par actions simplifiée) with share capital of 100 €, whose registered office is at 27 rue Louis Eydoux, 31400 Toulouse, France, registered under RCS Toulouse 105 235 584.

Data protection contact: privacy@partn-air.com.

Data you provide

• Account and identity: name, email, phone number, role, company (distributor customer, distribution group or partner-workshop user).
• Business content: parts requests, vehicle registrations and details, parts photos, quotes, orders, messages exchanged.
• Distributor and group billing: company name, registration number, address, billing details (card numbers are never stored by PartnAir — see Stripe).
• Support: content of your exchanges with our team.

Data collected automatically

• Connection and technical data: IP address, session identifier, device and browser type, timestamps, event logs.
• Usage data: pages viewed, actions in the app, interactions with the AI agents.
• Trackers: cookies and similar technologies, as described in the Cookie Policy.

PartnAir relies on AI agents that interpret requests, analyse parts photos, identify references and prepare quotes and orders. These operations use models provided by sub-processors (see §7).

• Your business content may be sent to these models solely to produce the expected response, as part of delivering the Service.
• We do not allow our providers to train their models on your data: processing is limited to inference.
• Human oversight remains available: sensitive or disputed cases can be escalated to a human operator.
• Decisions with contractual effect (quotes, orders) require human validation; no solely automated decision within the meaning of Article 22 GDPR is taken without possible intervention.

• Authorised PartnAir staff, within the limits of their duties.
• The distributor customer and authorised users at partner workshops in its network, within the relevant case and their assigned permissions.
• Our technical sub-processors (§7), bound by confidentiality and security obligations.
• Administrative or judicial authorities, where required by law.

PartnAir does not sell or rent your personal data to third parties.

Data is logically isolated per distributor customer through database-level security rules (PostgreSQL Row Level Security). Partner workshops are attached to their distributor's scope with access limited to their cases; one distributor cannot access another distributor's data.

We use the following sub-processors to deliver the Service. Some are located outside the European Union; the corresponding transfers are governed by appropriate safeguards (European Commission Standard Contractual Clauses).

An up-to-date list of sub-processors is also annexed to the Data Processing Agreement (DPA).

• Encryption in transit (TLS) and at rest.
• Named access control, least privilege, per-tenant isolation.
• Access and security event logging.
• Regular backups and restoration procedures.
• Notification of data breaches to affected individuals and to the CNIL where applicable, within legal deadlines. Security contact: security@partn-air.com.

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection, portability, the right to withdraw consent at any time, and the right to give directives regarding your data after your death.

To exercise these rights: privacy@partn-air.com. We respond within one month. Where your data is processed on behalf of a distributor customer acting as controller, including where it originates from a partner workshop in its network, we will direct you to the appropriate contact.

You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.

This policy may change to reflect legal or Service developments. The last-updated date appears at the top of the document; substantial changes are notified specifically.