Privacy Policy

1. Who we are

The "Operator" is the transfer service company displayed on this site. Their identification details, including legal name and registered office, are visible in the site footer.

2. What data we collect

• Booking data: name, contact (email, phone, WhatsApp), pickup and drop-off locations, date and time, passenger count, vehicle preference, optional flight number, special requests.
• Payment data: processed directly by Stripe (PCI-DSS compliant); we do not store card details.
• Technical data: IP address, browser type, page visits (anonymous analytics, no profiling).
• Communication: messages exchanged via WhatsApp, email, or platform chat related to bookings.

3. Purposes of processing

• Fulfilment of the transfer booking (legal basis: contract performance, GDPR Art. 6(1)(b)).
• Driver dispatch and route planning.
• Invoicing and Spanish tax compliance (legal basis: legal obligation, GDPR Art. 6(1)(c)).
• Customer service and dispute resolution.
• Anonymous service improvement (legal basis: legitimate interest, GDPR Art. 6(1)(f)).

4. Sub-processors

To deliver the service, we share the necessary minimum of data with:

• ORYX Platform (Digital Energy SL): hosting, booking platform — Spain (EU)
• Stripe Payments Europe Ltd.: payment processing — Ireland (EU)
• Twilio Ireland Ltd.: SMS notifications — Ireland (EU)
• Railway (Railway Corp.): infrastructure hosting — USA (Standard Contractual Clauses Module 3 in place)

All sub-processors are bound by Data Processing Agreements compliant with GDPR Art. 28.

5. Data retention

• Booking and customer data: 5 years (Spanish accounting and tax law obligations).
• Marketing communications: until unsubscribe or 24 months of inactivity.
• Technical logs: 12 months for security audit purposes.

6. Your rights (GDPR Art. 15-22)

You have the right to:

• Access the data we hold about you
• Rectify inaccurate data
• Request deletion ("right to be forgotten") subject to legal retention obligations
• Restrict processing
• Receive your data in a portable format
• Object to processing based on legitimate interest
• Lodge a complaint with the Spanish Data Protection Authority (AEPD)

To exercise these rights, contact the Operator using the email shown in the site footer. Responses are provided within 30 days.

7. Cookies

The site uses only strictly necessary technical cookies for session management and security. No tracking, advertising, or third-party profiling cookies are set without explicit consent. Analytics, when enabled, is anonymous and aggregated.

8. Security

Personal data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is restricted by role-based authentication. Security incidents affecting personal data are notified to the AEPD within 72 hours and to affected users without undue delay (GDPR Art. 33-34).

9. Children

The booking service is not intended for use by children under 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data, contact us for immediate deletion.

10. Changes to this policy

This policy may be updated. The version in force at the time of a booking applies to that booking. Material changes are notified via the site at least 30 days in advance.

11. Contact

Data subject requests, complaints, and questions about this policy: contact the Operator using the email shown in the site footer. For Data Processor matters (ORYX Platform / Digital Energy SL): dpo@ory-x.com.

Note for site owners: This template covers the typical EU/Spain GDPR requirements for VTC transfer services. Replace it with your own Privacy Policy (reviewed by your data protection officer or legal team) by setting your custom URL in the ORYX fleet admin panel → "My website" → Footer settings.