PRIVACY NOTICE
Last updated: 21.07.2026 | Classification: C2 – General Business
About this notice
This privacy notice relates to the motor insurance distribution service provided by bolttech Europe Brokerage SAS (“bolttech”, “we”, “us”, “our”) in cooperation with BYD France (“the Dealer”). It is issued pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, as amended (the “French Data Protection Act”), and the applicable insurance distribution legislation (Book V of the French Insurance Code).
bolttech is an insurance broker entered in the single French register of intermediaries maintained by ORIAS (registration no.: 21001112, verifiable at www.orias.fr), subject to the supervision of the Autorité de contrôle prudentiel et de résolution (ACPR). It operates a digital platform (“the Platform”) that enables customers introduced by the Dealer to obtain quotes for motor and related insurance products and, where desired, to take out motor and related insurance products.
The Dealer’s role is limited to that of a mere introducer; it does not provide insurance advice, does not intermediate insurance contracts and does not act as a processor on behalf of bolttech.
bolttech does not act as an insurer and does not underwrite insurance risks. bolttech determines the purposes and means of the processing described in this notice and is therefore the controller within the meaning of Article 4(7) GDPR. Insurance services are provided by the insurer(s) named in your insurance documentation, which act as independent controllers.
Their respective privacy notices can be found at:
• Generali: https://www.dialog-versicherung.de/dsgvo
1. Data controller's contact details
The controller responsible for the processing of your personal data described in this notice is:
Company name: bolttech Europe Brokerage SAS
Registered office: 43 Rue de Liège, 75008 Paris, France
E-mail address: [email protected]
Data Protection Officer: [email protected]
2. Applicable law
References to the GDPR in this notice are to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation), supplemented in France by the French Data Protection Act (Law No. 78-17 of 6 January 1978, as amended).
This notice is also subject to the following legislation:
• Article 82 of the French Data Protection Act and the CNIL’s guidelines and recommendation on cookies and other trackers — cookies and access to terminal equipment; Article L34-5 of the French Postal and Electronic Communications Code — electronic commercial communications;
• Book V of the French Insurance Code, implementing Directive (EU) 2016/97 on insurance distribution — insurance distribution;
• Articles L561-2 et seq. of the French Monetary and Financial Code (anti-money laundering and counter-terrorist financing — AML/CFT), insofar as applicable to the intermediary’s product offering;
• Article L123-22 of the French Commercial Code and Article L102 B of the French Tax Procedure Code — commercial and tax record-keeping obligations.
3. How we collect your personal data
3.1 Data received from the Dealer — Article 14 GDPR
When you purchase or order a vehicle from the Dealer, the Dealer asks you, within its own systems and in accordance with its own privacy notice, for your consent to share relevant personal and vehicle data with bolttech for insurance purposes. bolttech has no influence over, and does not manage, this consent process.
Subject to your consent given to the Dealer, the data is transmitted to the Platform via a secure, one-way API integration. The Dealer has no access to the Platform and receives no personal data back from bolttech. bolttech processes this data independently and does not rely on the Dealer’s consent as the legal basis for its processing.
bolttech will provide you with this privacy notice in accordance with Article 14(3) GDPR within one (1) month of receiving your data from the Dealer or at the time of first contact with you, whichever is earlier.
The categories of data received from the Dealer are:
• identification and contact data: name, e-mail address, telephone number, date of birth;
• vehicle data: registration plate, vehicle identification number (VIN), model, trim, fuel type, engine capacity, import status, current market value;
• order reference data: sales order number, dealer ID, advisor ID.
3.2 Data collected directly on the Platform
Additional personal data required to produce an insurance quote is collected directly from you via the Platform. This data is at no time shared with, or visible to, the Dealer. It includes:
Page / Section | Data fields |
Vehicle data | Registration plate, year of manufacture, model designation, fuel type, number of seats, import status, current market value, installed tracking device |
Personal details | Title, first name, surname, date of birth, telephone number, e-mail address, postcode, full address, marital status, residence status in France/the EU and date (if applicable), home ownership, employment status, job title, industry, details of any second occupation |
Driving experience | Driving licence category, licence issue date, restrictions and limitations under the harmonised EU codes shown on the driving licence (Directive 2006/126/EC). |
4. Categories of personal data, legal basis and purposes of processing
a. Categories of personal data processed
Depending on the stage of the process, bolttech may process the following categories of personal data:
• contact data: name, address, e-mail address, telephone number, date of birth;
• vehicle data: registration plate, model, year of manufacture, fuel type, engine capacity, import status, current value, tracking device information;
• personal and socio-economic data: marital status, residence in France, home ownership, employment and occupation details;
• driving and insurance history: licence type and date;
• health data may be revealed within the meaning of Article 9 GDPR: restrictions and limitations under the harmonised EU codes shown on the driving licence. See section 4(b)(v);
• order and dealer reference data: order number, dealer ID, advisor reference — used solely for internal documentation and traceability;
• technically generated data: IP address, log files, session identifiers, device and browser information, security-related metadata.
b. Purposes and legal bases
i. Contract performance and pre-contractual measures — Article 6(1)(b) GDPR
When you request an insurance quote or take steps to conclude motor insurance, the following processing is necessary for the performance of the contract or in order to take steps at your request prior to entering into a contract:
• receiving and processing the data transmitted by the Dealer following your introduction, in order to initiate the quotation process on the Platform;
• collecting and processing the data you provide directly on the Platform in order to produce an insurance quote;
• transmitting data to the insurer(s) in order to obtain a quote and — if you conclude the contract — to issue and administer your policy;
• customer onboarding, identity verification for insurance purposes and support with policy administration;
• customer communications directly related to your quote request or your policy: sending quote details, renewal notices, expiry notices and important policy information by e-mail, SMS or telephone.
bolttech does not rely on the consent you gave to the Dealer as the legal basis for its own data processing. The legal basis arises independently from Article 6(1)(b) GDPR.
ii. Legitimate interests — Article 6(1)(f) GDPR
The following processing operations are carried out on the basis of bolttech’s legitimate interests, provided your rights and freedoms do not override those interests:
• fraud detection, abuse prevention and financial crime screening to protect customers and the integrity of the Platform;
• IT and information security monitoring, including detection of unauthorised access or unusual activity;
• platform performance monitoring and technical optimisation;
• internal reporting, business analytics and service development using aggregated or pseudonymised data where possible;
• retention of dealer reference data (order number, dealer ID, advisor reference) for internal audits and traceability;
• market research, customer satisfaction surveys and data analytics, including profiling for service development purposes (see section 6 on automated decision-making);
• contacting you by e-mail to ask you to rate our service or take part in a survey.
You have the right to object at any time to processing based on legitimate interests. See section 9.
iii. Compliance with a legal obligation — Article 6(1)(c) GDPR
Personal data is processed to the extent necessary to comply with the statutory and regulatory obligations applicable to bolttech as a registered insurance intermediary, including:
• obligations under the applicable insurance distribution legislation (Book V of the French Insurance Code, implementing Directive (EU) 2016/97 / IDD), including the conduct of business and record-keeping requirements applicable to registered and supervised insurance intermediaries;
• anti-money laundering obligations under Articles L561-2 et seq. of the French Monetary and Financial Code, insofar as applicable to the intermediary’s product offering, and their implementing provisions;
• tax and accounting obligations under Article L123-22 of the French Commercial Code, Article L102 B of the French Tax Procedure Code and applicable EU legislation;
• obligations to respond to lawful requests from the ACPR, the CNIL, the French tax administration (DGFiP), TRACFIN (the French financial intelligence unit), law enforcement authorities or the courts.
iv. Consent — Article 6(1)(a) GDPR
Consent is relied upon as a legal basis only where no other basis is appropriate and the requirements for freely given, specific, informed and unambiguous consent under Article 7 GDPR are met. bolttech relies on consent solely for:
Marketing communications: at the end of the quotation process you will be asked whether you wish to receive marketing communications from bolttech. If you agree, we may inform you by e-mail or SMS about products, promotions or services. Electronic direct marketing is subject to Article L34-5 of the French Postal and Electronic Communications Code. You may withdraw your consent at any time (see section 9).
Non-essential cookies and analytics: where non-essential cookies or similar tracking technologies are placed on your device for analytics or personalisation purposes, this is done on the basis of your prior consent pursuant to Article 82 of the French Data Protection Act in conjunction with Article 6(1)(a) GDPR. See our cookie policy at [cookie policy URL – to be inserted].
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
v. Special categories of personal data
No special categories of personal data within the meaning of Article 9(1) GDPR are required for the motor insurance quote itself. Should such data be required for a specific product or cover (e.g. health data in connection with accident or personal injury insurance), bolttech will obtain your prior explicit consent in accordance with Article 9(2)(a) in conjunction with Article 7 GDPR before such data is collected or processed.
Where such consent is given, bolttech processes the data solely to produce the requested quote and to transmit it to the insurer(s) for assessment of insurability, terms and premium; the data is not used for any other purpose. You may withdraw your consent at any time with effect for the future (Article 7(3) GDPR) without affecting the lawfulness of prior processing. Given the sensitivity of such data, bolttech applies appropriate technical and organisational security measures in accordance with Article 32 GDPR.
c. Obligation to provide data and consequences of non-provision — Article 13(2)(e) GDPR
The following table indicates, for each data category, whether its provision is mandatory and the consequences if you choose not to provide it:
Data category | Mandatory? | Consequences of non-provision |
Identification and contact data (name, address, e-mail, telephone number, date of birth) | Required to enter into the contract | It is not possible to produce a quote or administer a policy. The service cannot be provided. |
Vehicle data (registration plate, model, fuel type, etc.) | Required to enter into the contract | Without this information it is not possible to assess the vehicle risk or produce a quote. The service cannot be provided. |
Personal and socio-economic data (marital status, residence, employment) | Required to enter into the contract | The insurer(s) cannot assess the risk profile. A quote cannot be produced. |
Driving record (licence category, issue date, accidents, claims) | Required to enter into the contract | The insurer(s) cannot assess the risk profile. A quote cannot be produced. |
Health data | Required to enter into the contract, where applicable | If you have a recorded health-related restriction and do not disclose it, any policy issued may be void (Article L113-8 of the French Insurance Code) or the indemnity reduced (Article L113-9 of the French Insurance Code). |
Consent for marketing purposes | Optional | No impact on the quote or the policy. You will not receive marketing communications from bolttech. |
Consent to non-essential cookies | Optional | Non-essential cookies will not be placed. Platform functionality may be limited. |
5. Data sharing and recipients
Your personal data may be shared with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate safeguards:
Insurers and insurance partners
To provide the insurance intermediation service, we share your personal data with the insurer(s) whose products are available on the Platform. They use the data to produce quotes and — if you conclude a contract — to issue and administer your motor insurance policy. These insurers act as independent controllers of the data processing. Details can be found in your quote and your insurance documentation.
Service providers acting as processors
We engage external processors to support the operation of the Platform, including IT hosting, security monitoring, analytics and customer support. All processors are subject to data processing agreements meeting the requirements of Article 28 GDPR. Processors may process personal data only in accordance with bolttech’s documented instructions.
Supervisory and public authorities
We may disclose personal data to the ACPR, the CNIL, the French tax administration (DGFiP), TRACFIN, law enforcement authorities or the courts, where required by law or necessary to prevent or investigate unlawful acts.
5a. Collection of data from third parties and insurance sector databases
If you apply for insurance through the Platform, the insurers to which your data is transmitted may need to obtain additional data on your state of health or personal circumstances from third parties (e.g. previous insurers or, where relevant, treating physicians) or to consult insurance sector databases, including the files managed by AGIRA (Association pour la gestion des informations sur le risque en assurance), the Insured Vehicles File (Fichier des Véhicules Assurés — FVA) provided for in Articles L451-1 et seq. of the French Insurance Code, and the anti-fraud arrangements coordinated by ALFA (Agence pour la lutte contre la fraude à l’assurance), for the purposes of verifying insurance history, assessing risk, handling claims and preventing and combating insurance fraud. Such collection is permitted only insofar as it is necessary for risk assessment or claims handling.
The collection from third parties of health data covered by professional secrecy (in particular from physicians, who are bound by medical secrecy under Article L1110-4 of the French Public Health Code and Article 226-13 of the French Criminal Code) takes place only with your prior explicit consent pursuant to Article 9(2)(a) GDPR, on the basis of a sufficiently specific release from secrecy. You have the right to ask the insurer to be informed of each individual data collection and to object to specific requests. You may withdraw your consent at any time with effect for the future; withdrawal does not affect the lawfulness of prior processing, but may lead the insurer to reassess your insurance cover.
The processing of personal data by the partner insurers is governed by their respective privacy notices, referred to at the beginning of this notice.
6. Automated decision-making and profiling — Article 22 GDPR
6.1 Pricing in risk assessment
When the insurer’s quote calculation engine processes your data to determine an indicative premium, the decision may be supported by automated processing. Whether this amounts to a decision based solely on automated processing within the meaning of Article 22(1) GDPR depends on the individual insurer. Where this is the case, the processing is based on Article 22(2)(a) GDPR (necessity for entering into the contract) or Article 22(2)(c) GDPR (your explicit consent). You have the right to obtain human intervention, to express your point of view and to contest the decision (Article 22(3) GDPR).
6.2 Fraud detection
Automated processing is used to support fraud detection and prevention within the quotation process. These processes are conducted always with human involvement and only then can produce decisions that have legal or similarly significant effects on you.
7. International data transfers
The personal data we collect or receive about you may be transferred to and processed by recipients located inside or outside the European Economic Area (EEA), including other bolttech group locations, for example in Singapore, Hong Kong or Malaysia, where the level of data protection may not correspond to that applicable in France or the EEA.
Where we are required to do so, including for transfers of personal data to recipients in countries outside the EEA for which no adequacy decision exists, such transfers are made pursuant to legally permitted mechanisms ensuring an adequate level of protection, such as the EU Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, supported where necessary by a transfer impact assessment and supplementary measures.
Further information on the third countries to which personal data may be transferred, and on the safeguards applicable to a specific third-country transfer, is available on request at [email protected].
8. Data retention
Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected, subject to applicable statutory, regulatory and contractual retention obligations.
Data category | Retention period |
Quote data — no policy issued | 60 days from the date of the quote |
Insurance-related data (all categories) | Term of the contract + 2 years (two-year limitation period, Article L114-1 of the French Insurance Code), without prejudice to longer applicable limitation periods (in particular for personal injury or litigation) |
Health data (harmonised EU codes shown on the driving licence) | Term of the contract + 2 years |
Accounting and tax records | 10 years (Article L123-22 of the French Commercial Code); 6 years under Article L102 B of the French Tax Procedure Code |
AML/CFT-related data and records | 5 years from the end of the business relationship (Article L561-12 of the French Monetary and Financial Code) |
Marketing data | Until consent is withdrawn or, at the latest, 3 years after your last contact |
Technical and log data | 365 days, thereafter anonymised |
Dealer reference data (order number, dealer ID) | Term of the contract + 2 years (aligned with insurance-related data) |
When data is no longer required, it is securely deleted or anonymised. Should technical constraints prevent immediate deletion, further use of the data is restricted until deletion.
9. Your rights
Under the GDPR and the French Data Protection Act, you have the rights listed below. bolttech will respond to your request free of charge within one (1) month of receipt. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests; in that case bolttech will inform you of the extension, stating the reasons, within the initial one-month period in accordance with Article 12(3) GDPR. Requests that are manifestly unfounded or excessive may be refused or made subject to a reasonable fee pursuant to Article 12(5) GDPR.
To exercise a right, please contact bolttech at [email protected], providing sufficient information to verify your identity.
Right | Scope and conditions |
Right of access — Art. 15 GDPR | You have the right to obtain confirmation as to whether your data is being processed, as well as a copy of that data and information on how it is processed. |
Rectification — Art. 16 GDPR | You may request without undue delay the rectification of inaccurate personal data or the completion of incomplete personal data. |
Erasure — Art. 17 GDPR | You may request erasure where: the data is no longer necessary; consent has been withdrawn and no other legal basis exists; you object and no overriding legitimate grounds exist; the data has been unlawfully processed. Subject to the exceptions in Article 17(3) GDPR, including compliance with legal obligations (in particular the retention obligations under Article L123-22 of the French Commercial Code, tax legislation and AML/CFT legislation). |
Restriction — Art. 18 GDPR | Request restriction of processing where: accuracy is contested; the processing is unlawful; the data is needed by you to establish, exercise or defend legal claims; you have objected and verification of the grounds is pending. |
Data portability — Art. 20 GDPR | You have the right to receive your data in a structured, commonly used and machine-readable format, or to have it transmitted directly to another controller, where the processing is based on consent or a contract and is carried out by automated means. |
Objection — Art. 21 GDPR | Objection to processing based on legitimate interests (Article 6(1)(f) GDPR): bolttech will cease the processing unless compelling legitimate grounds exist. Objection to direct marketing (Article 21(2) GDPR): bolttech must cease the processing immediately, without any balancing of interests being required. |
Right not to be subject to automated decisions — Art. 22 GDPR | Right not to be subject to decisions based solely on automated processing — including profiling — which produce legal or similarly significant effects. See section 6 for the rights relating to insurance risk assessment. |
Withdrawal of consent — Art. 7(3) GDPR | Consent to processing based on consent (marketing, non-essential cookies and any consent to the collection of health data from third parties) may be withdrawn at any time. Withdrawal does not affect the lawfulness of prior processing. |
Lodge a complaint — Art. 77 GDPR | CNIL — Commission Nationale de l’Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr. |
Judicial remedy — Art. 79 GDPR | Without prejudice to the right to lodge a complaint with the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), you have the right to an effective judicial remedy before the competent French courts, including the court of the place where you reside, if you consider that your rights under the GDPR have been infringed by non-compliant processing. |
10. Changes to this privacy notice
This privacy notice may be updated to reflect changes in applicable legal requirements or in bolttech’s processing activities. Material changes will be communicated before they take effect via the Platform or by other appropriate means. The date at the top of this notice indicates when it was last updated.
11. Cookies and tracking technologies
The Platform uses cookies and similar tracking technologies in accordance with Article 82 of the French Data Protection Act, the CNIL’s guidelines and recommendation on cookies and other trackers, and Article 6(1)(a) GDPR. Cookies necessary for the operation of the Platform are placed without consent. Non-essential cookies (analytics, personalisation) are placed only on the basis of your prior express consent.
You can withdraw or adjust your cookie preferences at any time via the cookie management tool on the Platform. Detailed information on the cookies used and on managing your preferences can be found in our cookie policy at [cookie policy URL – to be inserted].
12. Further information
For matters not expressly addressed in this privacy notice, please refer to bolttech’s global privacy notice at https://bolttech.io/privacy-notice-global/.
Propulsé par
Bolttech Europe Brokerage SAS est un courtier d'assurance immatriculé au Registre unique des intermédiaires en assurance, banque et finance (ORIAS) sous le numéro 21001112 et soumis au contrôle de l'Autorité de contrôle prudentiel et de résolution (ACPR). La société est immatriculée au Registre du commerce et des sociétés (RCS) de Paris sous le numéro 892 665 811. Siège social : 43 rue de Liège, 75008 Paris (France).
Nous vous invitons à consulter la notice d'information ainsi que les conditions générales du contrat afin de prendre connaissance de l'intégralité des garanties, conditions, exclusions et franchises applicables. Les informations figurant sur ce site sont fournies à titre indicatif et n'ont pas de valeur contractuelle. Il appartient au client de lire attentivement les conditions générales de nos produits et de prendre ses décisions en connaissance de cause.