Last updated: 30 August 2026
Malaga VIP Transfers ("we", "us", "our") is a private hire transfer operator based in Malaga, Andalusia, Spain, and is the data controller for the personal data described in this policy. Our website is malagaviptransfers.com.
You can contact us about this policy or your data via WhatsApp or by email at malagaviptransfers@gmail.com.
When you submit a booking request, we collect your name, email address, and phone number; journey details (pickup location, destination or hourly-hire area, date, time, passenger count); flight number for airport transfers; luggage details (number of suitcases and carry-on bags, child seats if requested); your vehicle and toll-road preference; any special requests you add; and the estimated price shown to you at the time of booking. When you use the contact form instead, we collect your name, email address, phone number, and message. In both cases we also automatically record the page you submitted from and the submission time. We may also collect anonymous website usage data via Google Analytics 4, once that is enabled on this site.
We process your data on the following legal bases under Article 6 of the GDPR: performance of a contract (to arrange and fulfil your transfer once booked); legitimate interest (to respond to enquiries and maintain service records); and, where applicable, consent (for optional analytics cookies). You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
We use your information only to: confirm and fulfil your transfer booking; communicate with you about your booking, by WhatsApp and/or email; and provide your price confirmation and driver details. We do not use your data for unsolicited marketing. We do not sell your data, and do not share it with any third party except as described below.
We share limited data with: the driver assigned to your journey (name, pickup location, destination, time); Google, whose Sheets and Gmail services we use to record bookings and send ourselves notifications; and, where you message us there, WhatsApp/Meta. Our website hosting provider and content delivery network also process basic technical data (such as IP address and browser information) as an ordinary part of serving the site, regardless of which provider we use.
Some of the third parties listed above (Google, Meta/WhatsApp) may process data outside the European Economic Area, including in the United States. Where this occurs, transfers are made on the basis of the recipient's certification under the EU-US Data Privacy Framework, or Standard Contractual Clauses approved by the European Commission, as applicable to that provider.
We retain booking and enquiry records for up to 24 months from the date of your journey (or from your enquiry, if no booking follows), for service-quality, dispute-handling, and repeat-customer purposes. Where Spanish tax and accounting rules require us to keep limited financial/invoicing information for longer, we retain only that information for the legally required period (generally up to 6 years) and delete the rest on the schedule above. You may request earlier deletion at any time, subject to any legal obligation we have to keep a record.
Our services are intended for adults who can enter into a booking with us. We do not knowingly collect personal data from children, though a child's name may appear in a booking (e.g. when a child seat is requested) as information provided by the adult making that booking.
We do not use automated decision-making or profiling that produces legal or similarly significant effects. Every booking price and journey detail is reviewed by a person before it's confirmed to you.
If you are based in the EU or UK, you have the right to access, correct, delete, or restrict processing of your personal data, and the right to data portability and to object to processing based on legitimate interest. Contact us via WhatsApp or email to exercise these rights. We will respond within 30 days.
If you believe your data has been handled unlawfully, you have the right to lodge a complaint with your local data protection supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. EU residents may also contact the supervisory authority in their own country of residence.
Our website is served over HTTPS. Booking and enquiry data is stored using Google's Sheets and Gmail services, protected by Google's account and infrastructure security. In the unlikely event of a personal data breach affecting your information, we will notify the AEPD and any affected individuals where required under Articles 33 and 34 of the GDPR.
We may update this policy. The date at the top of this page reflects the most recent revision.
