Polityka prywatności
Ostatnia aktualizacja: 16 października 2026
To tłumaczenie ma charakter informacyjny i nie jest prawnie wiążące. W razie wątpliwości lub rozbieżności obowiązuje wyłącznie wersja hiszpańska: przeczytaj wersję hiszpańską.
This policy explains how we process the personal data of people who visit the website and book with us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: Hanane Elmrrouchi Zizi, trading as Canaries Transfers.
- Spanish ID number (DNI): 60981973A
- Address: Avenida Escaleritas 132, 2.º B, 35011 Las Palmas de Gran Canaria, Las Palmas (España)
- Privacy contact: booking@canariestransfers.com
2. What data we process
- Booking data: first name and surname, email, phone number, language, and travel details: flight, dates and times, accommodation or address, number of passengers and extras (for example, child seats).
- Payment data: the method used, the amount and the transaction reference. Full card details are processed directly by the payment provider; we do not receive them.
- Communications: what you write to us when you contact us or ask for a change or a cancellation, and our replies.
- Email from the booking form: the email address you type when you start a booking, even if you do not finish it.
- Technical data: IP address, browser, pages visited, and technical and error logs, plus the data collected by cookies as set out in our cookie policy.
Booking data is needed to provide the service; without it we cannot accept the booking. If you book for other people, you must tell them about this policy.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Managing the booking and providing the transfer: confirming it, taking payment, passing it to the transport company that carries it out, sending you reminders and notices, and handling changes and cancellations. | Performance of the contract (Art. 6(1)(b) GDPR). |
| Issuing invoices and meeting accounting and tax obligations. | Legal obligation (Art. 6(1)(c) GDPR). |
| Answering your enquiries by email, phone, WhatsApp or the contact form. | Pre-contractual steps or performance of the contract (Art. 6(1)(b)) and our legitimate interest in helping you (Art. 6(1)(f)). |
| Reminding you of a booking you left unpaid and knowing which bookings are not completed, using the email typed in the form. | Legitimate interest in helping you complete your booking and improving the process (Art. 6(1)(f)). |
| Sending you, as a customer, messages about services similar to the ones you booked (for example, the offer of your return transfer) and asking for your opinion of the service. | Legitimate interest and Article 21(2) of the Spanish LSSI-CE. You can object at any time, easily and free of charge. |
| Showing you prices in the currency of your country, which we work out from your IP address on our own server, without keeping it or sending it to third parties. For this we use the "IP to Country Lite" database of IP Geolocation by DB-IP, licensed under CC BY 4.0. | Legitimate interest in showing you clear prices (Art. 6(1)(f)). |
| Protecting the website, preventing fraud and spam (for example, with reCAPTCHA or the anti-fraud checks of payments) and detecting technical errors. | Legitimate interest in the security of the service (Art. 6(1)(f)). |
| Measuring the use of the website with analytics cookies. | Consent (Art. 6(1)(a)), which you can withdraw at any time. |
We do not make decisions based solely on automated processing that have legal effects on you, nor do we create profiles for that purpose.
4. How long we keep it
- Booking data and invoices are kept for as long as the relationship lasts and then for the periods required by law (generally six years for accounting records and four for tax records) and for as long as needed to deal with any claims.
- The email from an unfinished booking form is kept for up to one year.
- Enquiries are kept for as long as needed to answer them and resolve any issues.
- Cookie data is kept for the period stated in the cookie policy.
5. Who we share it with
We do not sell your data. We only share it when necessary:
- With the transport company that carries out your transfer: name, phone number, flight, dates, accommodation, passengers and extras.
- With the providers that supply services to us as data processors, under contract and with safeguards: website hosting; email delivery (Twilio SendGrid); payments (Stripe and PayPal); invoicing (Holded); search of the hotel or address of your transfer (Google Maps Platform, with what you type in the search box); security and anti-spam (Google reCAPTCHA); error monitoring (Sentry); and analytics (Google Tag Manager and Google Analytics, only with your consent).
- With WhatsApp (Meta), if you contact us or we contact you through that channel.
- With public authorities, courts and law enforcement, when required by law.
6. International transfers
Some of these providers (such as Twilio SendGrid, Stripe, Google, Sentry or Meta) may process data in the United States or other countries outside the European Economic Area. In those cases, the transfer is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the provider is certified, or by the standard contractual clauses approved by the European Commission.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to booking@canariestransfers.com or to our postal address. To object to marketing messages, simply reply to any of them saying so, or write to that address.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.
8. Security
We apply appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), access restricted to authorised staff, payments through certified providers and protected passwords. Only the staff and providers who need your data to provide the service can access it.
9. Children
Bookings must be made by adults. Data about children travelling (for example, to request child seats) is provided by the adult making the booking.
10. Changes to this policy
We may update this policy to reflect changes in the law or in our service. The current version, with its date, will always be published on this page.