Village Covoit is committed to protecting your personal data and the security of your payments to the highest standards.
Payment Card Industry Data Security Standard
Village Covoit fully delegates card data collection to PCI DSS Level 1 certified providers (Stripe, PayPal). No card number (PAN), CVV or banking authentication data ever transits or is stored on our servers.
Full tokenisation
No card numbers pass through our servers. Stripe/PayPal collect card details directly via their PCI DSS Level 1 certified SDKs.
HTTPS/TLS everywhere
All communications are encrypted with TLS 1.2+. Data never travels in plain text.
Secured API keys
Payment secret keys are stored server-side only and never exposed on the client.
Signed webhooks
Stripe/PayPal webhooks are validated by cryptographic signature before any processing.
Restricted access
Payment settings require an administrator role. Sensitive data is protected by access controls.
Transaction logging
All transactions are recorded with status and amount for full auditability.
United Kingdom General Data Protection Regulation — Data Protection Act 2018
Minimal collection
We only collect the data strictly necessary to run the car-sharing service.
Right of access & portability
You can request an export of all your personal data at any time from your profile.
Right to erasure
You can request the deletion of your account and your personal data.
Explicit consent
Non-essential cookies require your consent. You can withdraw it at any time.
Encrypted data
Your personal data is stored securely and is never sold to third parties.
Data Protection Officer
For any GDPR question, contact us via our contact page.
PCI DSS v4.0 & UK GDPR / DPA 2018 · Updated 27/10/2026 · For formal certification, consult a PCI SSC approved QSA / a qualified DPO. Supervised by the ICO.