Privacy Policy

2.1 Data Controller Information

The legal entity responsible for the collection and processing of personal data under this policy is:

• Commercial Brand: Transfer Pro Madrid
• Website: https://www.transferpromadrid.com
• Operational Headquarters: Madrid, Community of Madrid, Spain
• Official Contact Email: [email protected]
• Concierge Telephone & WhatsApp: +34 645 10 33 30

2.2 Categories of Personal Data Collected

To provide seamless executive transport and fulfill regulatory transport logs in Spain, we process the following categories of data:

• Identification & Contact Data: Full name, primary email address, telephone contact number, company name (for corporate bookings), and billing/invoicing tax details.
• Operational & Itinerary Information: Exact pick-up date, time, and address; destination location; commercial airline flight numbers (utilized solely for real-time delay telemetry); passenger count; and special handling notes.
• Transaction & Payment Data: Transaction verification identifiers and payment status. Card numbers, expiration dates, and CVVs are handled exclusively via the PCI-DSS compliant infrastructure of Stripe and are never stored on Transfer Pro Madrid servers.
• Technical Browsing Data: Standard server logs, IP address, device type, and session metadata captured to ensure connection security and mitigate malicious traffic.

2.3 Purposes of Processing & Legal Basis

We collect and process your personal data under the following legitimate grounds:

• Execution of Contract (Art. 6.1.b GDPR): Processing bookings, allocating vehicles, dispatching chauffeurs, tracking flights, and managing customer communications.
• Legal Obligation Compliance (Art. 6.1.c GDPR): Fulfillment of Spanish fiscal obligations, official electronic invoicing, and compliance with Spanish transport authority registry mandates (VTC service registration regulations).
• Legitimate Interests (Art. 6.1.f GDPR): Preventing fraudulent transactions, protecting network and digital asset integrity, and continually evaluating the quality of our VIP passenger experience.
• Consent (Art. 6.1.a GDPR): Where explicitly provided for optional customer communications or tailored itinerary assistance.

2.4 Third-Party Data Disclosures & Service Processors

Access to personal data is restricted strictly to entities essential for executing the contracted services:

• Assigned Chauffeur: Provided solely with passenger name, contact telephone, flight number, and pick-up/drop-off addresses to ensure on-time meeting and transfer execution.
• Stripe Payment Gateway: PCI-DSS certified payment processor managing tokenized payments and card verifications.
• Hosting & Cloud Infrastructure: Secure enterprise hosting servers ensuring data encryption in transit and at rest.
• Law Enforcement & Judicial Authorities: Strictly where legally compelled by Spanish statutory mandates or court orders.

2.5 Data Retention Periods & Security Safeguards

Personal data related to executed bookings is retained for the durations required by Spanish commercial, fiscal, and transport laws (typically up to 5 to 6 years for accounting books and invoicing records). Operational travel telemetry is purged once journeys are successfully closed.

We implement industry-standard technical and organizational security measures (TLS 1.3 encryption, firewalls, role-based access control, periodic security reviews) to safeguard all data against unauthorized access, accidental alteration, or disclosure.

2.6 Your Legal Rights Under GDPR / RGPD

As a data subject, you hold statutory rights regarding your personal information:

• Right of Access: Obtain confirmation on whether your data is being processed and receive a clear copy.
• Right to Rectification: Request prompt correction of inaccurate or incomplete personal records.
• Right to Erasure («Right to be Forgotten»): Request the permanent deletion of personal data when no longer needed for contractual or statutory tax obligations.
• Right to Restriction of Processing: Request a temporary suspension of data processing under statutory conditions.
• Right to Data Portability: Receive your provided data in a structured, machine-readable format.
• Right to Object: Object to specific processing operations based on legitimate interests.

2.7 Supervisory Authority (AEPD)

If you believe your personal data protection rights have not been adequately respected or handled, you have the right to lodge a complaint with the competent Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
Calle Jorge Juan, 6, 28001 Madrid, Spain
Official Website: www.aepd.es