Last updated: 01/10/2026
At uTransfer we take the protection of your data seriously. This policy explains what personal data we process when you visit utransferservices.com, book a transfer or contact us, why we use it, who we share it with and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).
1. Who is the data controller?
| Controller | Pascal Florit Luna (trading as uTransfer) |
|---|---|
| Tax ID (NIF) | 43223152B |
| Address | Carrer de Sevilla, 8, 07013 Palma, Balearic Islands, Spain |
| info@utransferservices.com | |
| Phone / WhatsApp | +34 610681347 |
| Website | utransferservices.com |
2. What personal data do we process?
- Identity and contact details: first name and surname, email, phone number, country of residence.
- Booking details: pickup point and destination (for example, your accommodation address), date and time, flight number, number of passengers and suitcases, vehicle type, the name to be shown on the meet & greet sign, need for child seats (with the children’s approximate age) and any comments you add.
- Payment and billing data: billing address and, if you request an invoice, tax ID or company details. We do not store your card details: payments are processed directly by the secure payment gateway (WooPayments/Stripe).
- Communications: messages you send us by email, WhatsApp, phone or website forms.
- Technical and browsing data: IP address, browser and device type, pages visited, how you reached our site and cookies, as explained in our Cookie Policy.
Other people’s data. If you book on behalf of other passengers, you confirm that you have informed them and are entitled to provide their data so we can perform the service.
Special category data. We do not ask for health data. If you choose to tell us about a specific need (for example, reduced mobility or a wheelchair), we will use it only to adapt your transfer, with your explicit consent, and delete it once the service has been provided.
3. Why do we use your data, on what legal basis and for how long?
| Purpose | Legal basis | Retention |
|---|---|---|
| Managing your booking and providing the transfer, including flight tracking and contact with the driver | Performance of a contract (Art. 6.1.b GDPR) | While the service is provided and then for the legal periods listed below |
| Charging, invoicing and meeting accounting and tax obligations | Legal obligation (Art. 6.1.c GDPR) | 6 years (Spanish Commercial Code) and any periods required by tax law |
| Answering your enquiries before or after booking (website, email, WhatsApp) | Pre-contractual steps or your consent (Art. 6.1.a and b GDPR) | Until the enquiry is resolved and for a maximum of 1 year |
| Handling incidents, complaints, cancellations and refunds | Performance of a contract and our legitimate interest in defending our rights (Art. 6.1.f GDPR) | Until legal claims expire (generally 5 years) |
| Sending you offers and news about our transfer, excursion and chauffeur services | Customers: legitimate interest (Art. 21.2 LSSI). Others: your consent | Until you unsubscribe (link in every email or by writing to info@utransferservices.com) |
| Asking for your feedback after your trip | Legitimate interest in improving our service | Up to 1 year after the service |
| Protecting the website against spam, fraud and attacks | Legitimate interest (Art. 6.1.f GDPR) | Only as long as necessary (security logs, usually a few months) |
| Analytics, measurement and advertising through cookies | Your consent (Art. 22.2 LSSI) | As described in the Cookie Policy; you can withdraw it at any time |
We do not make automated decisions or create profiles that produce legal effects on you.
Fields marked as mandatory in the booking form are required to provide the service; without them we cannot confirm your transfer.
4. Who do we share your data with?
We never sell your data. We only share it when necessary:
- Partner drivers and licensed transport companies: some transfers are carried out by a licensed partner driver or company. We only give them the essential data (name, phone, flight number, pickup place and time, passengers and luggage), under a duty of confidentiality and solely to perform your transfer.
- Service providers (data processors): web hosting (Hostinger), shop and payment platform (WooCommerce / Automattic – WooPayments, powered by Stripe), Google services (Google Maps for addresses, and Google Analytics), WhatsApp (Meta), security and anti-spam (Wordfence), email and our accountants. All of them process data on our instructions and with the safeguards required by the GDPR.
- Public authorities: the Spanish Tax Agency, law enforcement, courts or other competent authorities, when required by law.
5. International data transfers
Some providers (such as Google, Meta/WhatsApp, Stripe or Automattic) may process data outside the European Economic Area, mainly in the United States. In those cases the transfer relies on the EU-US Data Privacy Framework, the Standard Contractual Clauses approved by the European Commission or other appropriate safeguards under the GDPR. You can ask us for more information at info@utransferservices.com.
6. What are your rights?
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent without affecting processing carried out before the withdrawal.
To do so, email info@utransferservices.com with the subject “Data protection”, stating which right you wish to exercise and providing a way for us to verify your identity. We will reply within one month (extendable by two further months in complex cases).
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency or the supervisory authority in your country of residence.
7. Minors
Bookings must be made by persons aged 18 or over. Minors travel under the responsibility of an adult, and we only process the minimum information about them (for example, their approximate age to prepare the right child seat).
8. Security
We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), PCI-DSS certified payment gateways, restricted access to information, backups and website protection tools.
9. Cookies
We use our own and third-party cookies. You can see the details and change your preferences in our Cookie Policy.
10. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The current version will always be published on this page with its update date.