PrivateTransfers.ro
Privacy policy
How we collect, use and protect your personal data, in accordance with the GDPR.
Last updated: 23 September 2026
Protecting your data matters to us. This policy explains what data we collect, for what purposes, on what legal basis, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
1. Data controller
The data controller is MSP MOBILITY S.R.L., registered office at Bd. Regele Ferdinand I al României nr. 31, Bl. B4, Et. 7, Ap. 32, Iași, jud. Iași, România, J2026043734005, sole registration code 55173440.
For any request regarding your personal data you can contact us at booking@privatetransfers.ro.
2. What data we collect
To provide the transfer service, we collect the data needed for the booking:
- identification and contact data: first and last name, e-mail address, phone number;
- journey details: pickup address, destination address, date and time, number of passengers and bags;
- flight number and, optionally, address access details (building, entrance, landmark);
- payment data, to the extent needed to process the payment;
- your correspondence with us and any requests or complaints;
- the reviews and feedback about the service that you send us;
- if you accepted marketing cookies and arrived from a Google ad, that ad's click identifier, kept alongside the booking so the campaign can be measured.
3. How we collect data
We collect data directly from you, when you complete the booking or contact form, e-mail or call us, through cookies strictly necessary for the site to work and, if you agree, through analytics and marketing cookies (see the Cookie policy).
4. Purposes of processing
- making the booking and providing the transfer service;
- communicating with you about the booking (confirmations, changes, support);
- processing payments and issuing accounting documents;
- meeting legal obligations (accounting, tax);
- handling complaints and defending our rights;
- sending marketing communications, only with your consent;
- publishing the reviews you send us on this site, with your first name and the initial of your surname only.
5. Legal basis
- performance of the transfer contract – art. 6(1)(b) GDPR;
- compliance with legal obligations – art. 6(1)(c) GDPR;
- our legitimate interest (security, service improvement, defending rights) – art. 6(1)(f) GDPR;
- your consent, for marketing communications – art. 6(1)(a) GDPR;
- our legitimate interest in publishing the reviews we receive, in the abbreviated form above and which you may object to at any time – art. 6(1)(f) GDPR.
6. Data recipients
We may disclose data, as needed for the purposes above, to:
- partner suppliers/carriers and drivers who actually perform the journey;
- payment processors and banks, principally NETOPIA Financial Services S.A. for online card payments;
- IT service providers (hosting, e-mail) acting as processors;
- Google Ireland Limited (Google Ads), only if you accepted marketing cookies and arrived from a Google ad: the click identifier, the booking's value, your e-mail address and phone number, the last two irreversibly transformed (SHA-256 hash) before they leave us, so we can tell which campaign brought the booking;
- public authorities, where required by law.
7. International transfers
Data is generally processed within the European Economic Area. If a service provider processes data outside the EEA, we ensure the transfer benefits from appropriate safeguards (for example the standard contractual clauses approved by the European Commission).
8. Data retention
We keep data only as long as necessary for the purposes for which it was collected: booking data, for the duration of the contractual relationship and thereafter in line with statutory archiving periods (including accounting and tax periods); marketing data, until consent is withdrawn. Once these periods expire, data is deleted or anonymised.
9. Your rights
As a data subject, you have the following rights, which you can exercise by writing to us at the contact address:
- right of access (art. 15);
- right to rectification (art. 16);
- right to erasure (art. 17);
- right to restriction of processing (art. 18);
- right to data portability (art. 20);
- right to object (art. 21);
- right not to be subject to automated decision-making (art. 22);
- right to withdraw your consent at any time, without affecting the lawfulness of prior processing.
10. Data security
We apply reasonable technical and organisational measures to protect data against unauthorised access, loss or disclosure, including encrypted connections and need-to-know access control.
11. Children's data
The services are aimed at adults. We do not knowingly collect minors' data without a legal guardian's consent. Data about children being carried is provided by the adult making the booking.
14. Changes to this policy
We may update this policy. The current version is published permanently on this page, with the date of the last update.
