monstroid2 monstroid2

LEGAL - RGPD / LOPD-GDD

Privacy Policy

Information on the processing of your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPD-GDD).

Last updated: 16 July 2026.

01

Data Controller

The controller of the personal data collected through the website autosurtransfers.com and the company’s contact channels is:

Company name: [FULL NAME OR LEGAL NAME]
Tax ID (CIF/NIF): [XXXXXXXXX]
Registered address: [STREET, NUMBER, POSTAL CODE, CITY, PROVINCE]
Phone: +34 600 000 000
Email: [CONTACT EMAIL]
Website: booking@autosurtransfers.com

From this point onward, the data controller will be referred to as “Autosur Transfers” or “the company.” Autosur Transfers is not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR, given the volume and nature of the data processed. However, any questions regarding data processing may be directed to the email address indicated above.

02

Purpose of Processing

Your personal data is processed for the following purposes:

• Booking management and confirmation: processing your request, assigning a driver and vehicle, and sending confirmation details (driver's name, meeting point).
• Service delivery: ensuring airport pick-up, real-time flight tracking and transfer to the agreed destination.
• Operational communication: notifying you of any incidents (driver change, delay, change of meeting point) via the same channel used for booking.
• Pre-booking enquiries: responding to requests for information about prices, availability or destinations.

Autosur Transfers does not use your data for marketing communications or commercial newsletters without your prior explicit consent, nor for automated profiling or decisions with significant effects.

03

Personal Data We Collect

Autosur Transfers collects only the personal data strictly necessary to provide the private transfer service. We do not request sensitive data (health, religion, ideology, etc.) or data relating to minors.

Through WhatsApp (our main booking channel):

• Name or alias the customer uses.
• Phone number associated with the WhatsApp account.
• Flight information: date, arrival or departure time, flight number.
• Destination or pickup point.
• Number of passengers
• Special requirements (baby seat).

Through WhatsApp (our main booking channel):

• First and last name.
• Email address.
• Booking information provided in the message.

What we do not collect:

• Payment data or bank card details — the service is paid to the driver at the end of the trip, in cash or by card terminal.
• Real-time geolocation data of the customer.
• Browsing data beyond what is automatically collected by the web server (IP address, browser, operating system), used exclusively for technical and security purposes.

04

Legal Basis for Processing

• GDPR Art. 6(1)(b) — Performance of a contract: processing is necessary to provide the private transfer service you have requested. Without the data listed in Section 2, it is not possible to confirm or carry out the booking.
• GDPR Art. 6(1)(f) — Legitimate interests: to respond to pre-booking enquiries and manage operational incidents during the service, given that you have voluntarily initiated contact with the company.

You may object to processing based on legitimate interests at any time, without affecting the lawfulness of processing carried out prior to that objection.

05

Your Rights

Under GDPR Arts. 15–22 and Spanish data protection law, you may exercise the following rights at any time:

• Access (Art. 15) - Confirm whether we process your data and obtain a copy of it, along with information on purposes, categories, recipients and retention periods.
• Rectification (Art. 16) - Request correction of inaccurate or incomplete data.
• Erasure (Art. 17) - Request deletion of your data when it is no longer needed for the purposes for which it was collected, or when you withdraw consent.
• Restriction (Art. 18) - Request that we suspend processing in certain circumstances, e.g. while accuracy of disputed data is verified.
• Portability (Art. 20) - Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
• Objection (Art. 21) - Object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Withdraw consent - Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

06

How to Exercise Your Rights

To exercise any of the rights above, contact Autosur Transfers at:

Email: [CONTACT EMAIL]
Subject line: "GDPR Rights Request"
Information to include: full name, copy of your ID or passport, and a clear description of the right you wish to exercise.

We will respond within one month of receiving your request. This may be extended by a further two months for complex or multiple requests, with notification within the first month.Exercising your rights is free of charge. If requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, in accordance with GDPR Art. 12(5).

07

Security

Autosur Transfers applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with GDPR Art. 32, including:

• Restricted access to booking data, limited to staff necessary for service delivery
• Encrypted communications via the security protocols of the platforms used (end-to-end encryption on WhatsApp; TLS/HTTPS on the website and email)
• Secure deletion of data once retention periods have elapsed
• No storage of payment data in any company-owned system

In the event of a personal data breach that poses a risk to your rights and freedoms, Autosur Transfers will notify the AEPD within 72 hours of becoming aware of it, in accordance with GDPR Art. 33.

08

Changes to this policy

Autosur Transfers reserves the right to update this privacy policy to reflect changes in law or in the operation of the service. Any significant changes will be communicated via autosurtransfers.com by updating the "Last updated" date at the top of this document.

Quick Links

Terms & Privacy

Quick Links

Terms & Privacy

Quick Links

Terms & Privacy