Privacy Policy

1) Personal data we process

• Website and consent data: IP address, browser/device data, timestamps, language preference, cookie_consent choices, and analytics identifiers only if analytics is enabled and accepted.
• Customer account data: first name, last name, email, phone, address, preferred language, password hash, account/session identifiers, and Google or Apple OAuth identifiers if used.
• Booking and passenger data: pickup and drop-off addresses, route, dates, times, flight number, passenger count, luggage, selected vehicle, child-seat or pet requests, public booking references, ride notes and special requests.
• Payment, refund and invoice data: amount, currency, payment status, provider references, refund/dispute status, invoice details and VAT/accounting records. We do not store full card numbers or CVV.
• Benefit data: identity activation and WELCOME eligibility, account-owned WELCOME, REWARD and PROMO issuance, completed/settled/refunded booking history, reward progress, and benefit hold, release, consumption, expiry and revocation status.
• Support and contact data: messages, contact details and any files or screenshots you choose to send us.
• Partner onboarding data: company and contact details, VAT/VIES check data, authorised-representative confirmation, service/onboarding email acknowledgement, documents, vehicle data/photos, IBAN/payout details, service areas and application status.
• Dispatch, proof and admin data: assigned partner/driver, operational status, ride proof events, timestamps, admin actions, security logs and troubleshooting records.

2) Purposes and legal bases

• Bookings, account access, passenger coordination, payment and invoices: contract performance or steps before a contract (GDPR Art. 6(1)(b)).
• Accounting, tax, payment, refund and legal record keeping: legal obligation (Art. 6(1)(c)).
• Fraud prevention, platform security, dispatch quality, support, dispute handling, service improvement and limited operational logging: legitimate interests (Art. 6(1)(f)).
• Benefit administration: determine WELCOME eligibility; issue account-owned WELCOME, REWARD or PROMO benefits; track completed, fully settled, cancelled and refunded history; hold, release and consume one benefit at checkout; prevent duplicate use, fraud and abuse; reconcile refunds and rewards; and maintain customer/admin audit and legal-compliance records. These activities use the contract, legal-obligation and legitimate-interest bases already described above, as applicable to the record.
• Partner onboarding, document review, payout setup and eligibility checks: contract/pre-contract steps, legal obligations and legitimate interests, depending on the record.
• Analytics cookies and Google Analytics, if configured: consent (Art. 6(1)(a)); analytics is blocked until analytics consent is granted.
• Promo or offer emails: only with separate opt-in if such marketing is implemented. Transactional account and booking emails are not marketing.
• Special category data is not requested. If you voluntarily include sensitive details in notes or support messages, we process only what is necessary for the transfer, support, legal claim or safety purpose.

3) Recipients and service providers

• Assigned partners, operators or drivers receive the booking details needed to perform the ride.
• Website hosting and execution: Vercel. Database hosting: Neon. They process the data needed to provide these services; configured regions for these services are described below.
• Payment providers: Stripe and myPOS process online payments and refunds where used.
• Email and mailbox providers: Brevo for transactional email sending and Google Workspace for business mailboxes.
• Maps and route services: Google Maps Platform for address lookup, maps and route support.
• Analytics: when configured and permitted through Cookie settings, Google Analytics receives sanitized page information and confirmed-booking measurements described in section 7.
• Authentication and checks: Google OAuth, Apple OAuth and EU VIES may be used where relevant.
• Professional advisers, authorities, banks, card schemes or courts may receive data where required for accounting, legal claims, compliance, fraud prevention or dispute handling.

4) International transfers and provider regions

Google describes processing data on servers in different countries, including outside your country of residence, in its Privacy Policy. Requests about our recipients and international transfers can be sent to privacy@oddotransfer.com.

The confirmed Vercel function region is Washington, D.C., United States (iad1), and the configured Neon database region is Frankfurt, Germany. These settings describe those services only; they do not mean all processing, support, backups or subcontractors are confined to the EU.

5) Retention

• Invoices, accounting, payment and refund records: 10 years.
• Booking records linked to payment, invoice, refund, dispute or accounting: up to 10 years.
• Benefit issuance, redemption, reward-progress and reconciliation records follow the retention period of the associated account, booking, payment, refund or financial/audit record; records needed for financial reconciliation, disputes or legal compliance may therefore be kept up to 10 years.
• Operational ride notes, driver notes and special requests: normally 3 years, unless needed for a dispute, legal claim, accounting or security reason.
• Customer account data: active account plus 3 years of inactivity, unless accounting or legal records must be retained longer.
• Support messages: normally 24-36 months after case closure.
• Rejected partner applications: normally 12 months, unless fraud, dispute or legal reasons require longer.
• Approved partner records and documents: for the partner relationship plus the required legal/accounting period.
• Security logs: normally 30-90 days; longer only for incident, fraud, dispute or legal reasons.
• Cookie choices: cookie_consent records the current purposes, version and timestamp for 183 days from a newly saved choice. Reading an existing valid choice does not renew its expiry.
• This cookie records the latest choice, not an independent chronological record of all past consent decisions.
• Where reviews evidence is enabled, a separate server record documents your explicit approval, refusal or withdrawal: the displayed reviews notice and interface revisions, language, server time, preceding decision and original choice expiry. A random browser proof is stored as a hash on the server and linked to the current decision. These records contain no account, booking, contact details, full IP address or review content; they do not record consent on behalf of review authors.
• Reviews evidence remains within the original choice period, at most 183 days. Expired records become eligible for the bounded deletion procedure, unless a separate documented, time-limited hold applies. This describes the retention rule, not confirmation that a production deletion schedule is already operating or that backup copies are immediately erased.
• An earlier valid reviews choice without this separate evidence remains an earlier choice, not a newly recorded consent. A dedicated reviews confirmation is required before new embedded review loads. Reviews-only actions preserve the unrelated saved choices and their original expiry; a missing or invalid evidence record stops only reviews loading.
• Google review content: held temporarily on our server to answer the request and in page memory for display. Review-data requests use no-store; we do not persist the review content in an application cache, database, cookies, localStorage or sessionStorage. Page data is discarded when the consent change or expiry is processed, or the component is removed or replaced.
• Analytics duplicate-prevention record: oddo_analytics_purchases_v1 stores up to 100 hashed transaction identifiers in sessionStorage for the browser-tab session. An in-memory record also operates while the page is running, including if storage is unavailable. Withdrawal clears the in-memory record and attempts to remove the sessionStorage entry. They reduce repeat measurements in that context, not across every browser, session or device.
• Reviews request controls: shared operational counters and monthly allocation records contain periods, authorisation references, limits and reserved-attempt totals, not authors, review content, IP addresses, users or bookings. Monthly records remain after the period ends to prevent a reset of consumed allowance and support reconciliation. They are separate from consent choices and review content; month-end is not an automatic physical deletion date.
• Author-image caches: Google and your browser manage image caching separately from our no-store review-data requests. Withdrawing reviews permission does not clear those caches.

6) Your GDPR rights and DSAR process

• You may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent where applicable.
• Send requests to privacy@oddotransfer.com. We may verify your identity and ask for enough information to locate the relevant records.
• The current system does not provide confirmed self-service account deletion or export. Requests are handled manually through internal systems where needed.
• Deletion requests may not remove invoices, accounting, payment, refund, fraud, dispute or legal records that must be kept by law or for legal claims. In those cases, processing is limited to the required purpose.
• You may lodge a complaint with the CNPD Luxembourg if you believe your data protection rights have been infringed.
• Review authors may contact privacy@oddotransfer.com to object to our redisplay or exercise their other applicable rights. Please identify the review and the action requested; do not send unnecessary booking or identity documents. We assess the request and explain the action we can take. This is not an automated per-review removal service. ODDO cannot delete the original Google review or all copies held by Google or browsers.

7) Cookies, local storage, maps and analytics

• Essential cookies and storage support sessions, language, booking state, payment flow, security and core website operation.
• Google Maps address lookup and route features used for booking are separate from the optional Google reviews choice.
• After a completed transfer, ODDO TRANSFER invites clients to share their experience and rate the service on Google. Leaving a review is voluntary; clients freely choose their rating and the content of their comments.
• Google reviews: to display feedback about ODDO TRANSFER, we obtain the public business rating and review count, plus authors’ display names, ratings, review text, publication dates, profile and review links, and available profile photos from Google Places. These are data the authors published on Google. A visitor’s permission to load them is not the authors’ consent to our reuse.
• We display up to three reviews in the relevance order supplied by Google, with Google and author attribution and links to the source. We do not select reviews by star rating. The review display does not automatically link Google profiles to our booking records. The displayed reviews are a selection, not all customer feedback.
• When embedded reviews are available, ratings, reviews and author photos remain off until you allow External content — Google reviews in Cookie settings. They are not needed to book. Your browser requests the data from our site when the permitted section becomes visible, or on loading if visibility detection is unavailable; our server retrieves it from Google without forwarding your consent cookie.
• A shared request allowance or a temporary service interruption may pause new review loads. The Google profile link remains available, and this pause does not affect booking. A monthly allowance renewal does not override a separate suspension of embedded reviews.
• Your browser loads displayed author photos directly from Google’s image servers. These requests disclose your IP address and technical connection information to Google. We omit the referring page address; this does not hide your IP address.
• You can withdraw the reviews choice independently of Analytics in Cookie settings. This removes displayed reviews and photos, stops new loads and attempts to cancel a pending request; late responses are ignored. It cannot undo requests already sent. Following an author, review or business-profile link opens Google without giving consent to optional purposes on our site.
• This policy update does not activate Google Analytics. The following analytics description applies only if the service is separately enabled and you give the relevant permission.
• Analytics measures website use and server-confirmed online bookings when configured and enabled through the separate Analytics choice. Page information excludes query parameters, masks manage/pay tokens and leaves the referrer field empty. The Google tag loads directly from Google; measurement requests pass through our website’s analytics proxy to Google and involve technical connection information. This integration keeps advertising storage, advertising user data, ad personalisation and Google signals disabled.
• After the server confirms paid or deposit-paid status, the purchase event includes a SHA-256 transaction identifier derived from the booking ID and one generic Private transfer item (quantity 1). The identifier is pseudonymous, not anonymous. Where the authenticated response supplies a validated total and currency, booking_value_gross and currency are also sent; otherwise the event has no amount. The gross total includes VAT and any unpaid balance: it is not cash received or net revenue. Standard purchase value and item price are not sent.
• The booking event does not include names, contact details, route, travel dates, raw booking IDs, public booking references or payment-session tokens. Browser-side submission is not proof of receipt by Google.
• Withdrawing Analytics permission disables further measurements from this integration, attempts to clear known _ga cookies, clears its in-memory duplicate-prevention record and attempts to remove its sessionStorage entry. It does not retract data already sent to Google. Reviews permission does not enable Analytics or marketing.

For Google’s processing, see its Google Privacy Policy

For choices and storage details, see our Cookie Policy

8) Marketing, rewards and data minimisation

• Rewards may be visible inside the customer account or dashboard.
• Benefit eligibility and lifecycle processing does not create a new marketing consent, cookie category or analytics purpose.
• Promo or offer emails require a separate opt-in if implemented. Welcome/account emails are transactional and should not contain promotional offer content without such opt-in.
• ODDO TRANSFER does not collect a customer profile gender field in the current profile flow.
• Please do not include unnecessary sensitive information, such as health, religion, ID documents or other special category data, in free-text notes unless strictly needed for your transfer.

9) Security

We use technical and organisational measures appropriate to the risk, including access controls, authentication/session controls, HTTPS, limited operational access, logging for security and troubleshooting, and administrative controls for partner documents and payment/refund workflows.

10) Updates

We may update this Privacy Policy when the service, providers, legal requirements or internal processes change. The latest version is available on this page.