1. Controller and data
i.A. Trading srl is the controller. Depending on use, we may process identity and contact details, language, account ID, route addresses, dates and times, passenger and luggage information, vehicle, flight number, journey notes, price, payment and booking status, assigned driver and operational history.
Technical providers may create limited security logs. Stripe receives card details directly; we do not store the full card number.
2. Purposes and legal bases
Data is used for quotes, bookings, accounts, payments, dispatch, support, security, fraud prevention, legal claims and statutory duties.
- Pre-contractual steps and contract for quotes, accounts and transport.
- Legal obligations for records that must be retained.
- Legitimate interests for security, fraud prevention and legal claims.
- Consent only where expressly requested.
3. Recipients and WhatsApp
Access is limited to authorised staff and our own drivers. Depending on the feature, processors may include Supabase, Vercel, Stripe and routing or geocoding providers.
WhatsApp contact is optional and user-initiated. The QR code is generated locally from our public number; displaying it sends no booking data to WhatsApp. Opening or scanning the wa.me link is then handled by WhatsApp under its terms. We do not automatically send confirmations through Meta.
4. Transfers and retention
Where a provider processes data outside the EEA, required transfers must use an adequacy decision or appropriate safeguards. Data is kept only as needed for bookings, accounts, support, security, disputes and legal duties, then deleted or anonymised subject to mandatory retention.
5. Security and browser storage
Administrative access is authenticated and role-restricted. Row-level security separates passenger records, privileged keys stay server-side, payment webhooks are signed, sensitive inputs are validated and HTTPS is used. Functional storage may remember language and authenticated sessions; no advertising profiling is required for booking.
6. Fare calculation and rights
Fares may be calculated from route, duration, vehicle and active pricing rules; this is not significant personal profiling. Subject to applicable conditions, you may request access, correction, deletion, restriction or portability, object, or withdraw consent. Mandatory retention may limit a request.