Privacy policy

Data controller

Manvir Singh Purewal (tax ID 53315208N), Carrer de la Dàlia, 2-4, 08860 Castelldefels (Barcelona). Email: info@vemarotransfers.com · phone +34602881011. We have not appointed a data protection officer; for any question about your data, write to info@vemarotransfers.com.

What data we process

Account (optional): first name, surname, email, phone and language, and your encrypted password (we never see it). You don't need one to book: without an account we keep as the customer the name, email and phone you give us when booking.

Bookings: pick-up and drop-off addresses, dates and times, passengers and luggage, flight number, notes for the driver and, if you book for someone else, the passenger's name and phone. If you give us someone else's data, you must have informed them first.

Invoicing: if you ask for a full invoice, name or company name, tax ID and address.

Payment: processed by Stripe. We only receive the result, the amount, the method (card, Apple Pay, Google Pay or PayPal) and a reference; never your card number.

Requests: what you send us through the tailored-service and change-request forms.

Access to «Manage my booking»: we send a one-time code to the booking email. We only store an encrypted fingerprint of the code (it expires after 10 minutes) and an access log without IP addresses, deleted after 90 days.

Browsing: our own cookieless measurement (see below) and, only if you accept them, analytics and advertising cookies. When you search for an address, the text you type is sent from your browser to Mapbox to suggest results.

Why we use it and on what legal basis

Managing your account, quoting, charging and providing the service, informing the driver and sending you service emails (confirmation, driver assigned, changes, cancellation): performance of the contract (art. 6.1.b GDPR).

Issuing and keeping invoices and responding to requests from the authorities (tax, transport or courts): legal obligation (art. 6.1.c GDPR).

Preventing payment fraud, protecting the website from abuse, detecting and fixing technical errors (Sentry) and handling your requests and complaints: legitimate interest (art. 6.1.f GDPR).

Measuring website use anonymously and in aggregate (our cookieless measurement) and understanding demand we cannot serve (quotes without personal data): legitimate interest (art. 6.1.f GDPR). You can object at any time.

Measuring with Google Analytics, measuring and personalising ads with Google and Meta, and remembering which campaign you came from: consent (art. 6.1.a GDPR), which you can withdraw at any time from «Cookie preferences».

We do not send you marketing emails without your prior consent (art. 21 LSSI) and we do not take automated decisions that significantly affect you: prices are calculated by a system using the published rates, the same for everyone.

Which data are mandatory

To book we need your name, email and phone and the journey details; without them we cannot provide the service. Full invoicing data are only needed if you ask for that type of invoice.

How long we keep it

Account: while it is active. If you ask us to delete it, we close it and block the data the law requires us to keep. Customers without an account: the data go with their bookings (periods below). If you later create an account with the same email and confirm it, your earlier bookings move to it.

Bookings, payments and invoices: 6 years from the service (art. 30 of the Spanish Commercial Code) and, in any case, the tax limitation periods (4 years, General Tax Law).

Requests and complaints: until resolved and then for the limitation period of any related claims.

Cookieless measurement: events, 90 days; the salt that generates the day's identifier is destroyed after 48 h, so it can no longer be linked to anyone. Daily summaries are anonymous.

Quote log (no personal data): 400 days. Your cookie choice: 12 months.

«Manage my booking» codes and access: codes and sessions, one day after they expire; the access log (no IP), 90 days.

Who we share it with

With the assigned driver: the passenger's name and phone, the journey, time, flight number and notes, only to provide the service.

With providers that process data on our behalf (processors, under a contract compliant with art. 28 GDPR): Supabase (database and authentication, hosted in the European Union), Vercel (web hosting), Resend (email delivery), Mapbox (address search and routing), OpenFreeMap (maps, when shown), Sentry (error detection on the website and server, with data hosted in the European Union and nothing that identifies you) and, with your consent, Google (Google Analytics and Google Ads) and Meta (Meta pixel).

Stripe Payments Europe, Ltd. (Ireland) processes payments and, to prevent fraud, also acts as an independent controller; so does PayPal if you pay with PayPal.

With the tax authorities, transport authorities, courts and law enforcement when required by law. We do not sell your data.

International transfers

Some providers (Vercel, Resend, Mapbox, Sentry, Google, Meta and their group companies) may process data in the United States. They do so under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) when certified and, otherwise, under standard contractual clauses approved by the Commission.

Our own cookieless measurement

To know how many people visit the website, from which country and city, how they arrive, at which booking step they run into problems and how much we use map services, the website sends our server the page you visit, your browser language and, on the first page, the referring website and campaign. It uses no cookies and stores nothing on your device.

On the server, your IP address is only used at that moment to infer country and city and, together with the browser type and a random key that changes every day, to compute an anonymous identifier for the day. The IP is not stored, and the key is destroyed after 48 h. Paths are stored without booking references.

You can object by turning off «Anonymous measurement» in «Cookie preferences». We also honour your browser's Global Privacy Control signal.

Your rights

You can access, rectify and erase your data, object to or restrict its processing, request portability and withdraw your consent at any time, without affecting earlier processing, by writing to info@vemarotransfers.com. We will reply within one month. If needed to verify your identity, we will ask for additional information.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Minors

You must be of legal age to create an account and book. Minors may travel as passengers in bookings made by a responsible adult.

Security and changes

We apply appropriate technical and organisational measures: encrypted connections, role-based access control, change logs and providers with guarantees. If we change this policy, we will say so on this page with its update date.