Privacy Policy

Who is responsible for your data

The controller of your personal data is ANDELONICA LTD (Reg. No. HE 478024), a company registered in the Republic of Cyprus and trading as Gravitas, Stavrovouniou 11, Taliadoros Panthea Court, Floor 2, Office 202, Mesa Geitonia 4007, Limassol, Cyprus.

For any question about this policy or your data, write to [email protected] or call +357 96 780 800. We answer data requests within 30 days.

What we collect

• Booking details: your name, phone number, email address, pickup and drop-off addresses, date and time, flight number (if you give one), vehicle class, number of passengers, child seat requests and any notes you add.
• Payment information: the amount, currency and payment status. Card and cryptocurrency details are entered on the payment provider's side — we never see or store your card number.
• Account data, if you create one: your email address and your booking history.
• Technical data: IP address, browser and device type, pages viewed. This is standard server and security logging.
• Location: only if you press "use my location" in the booking form. Your browser asks for permission first, and we use the coordinates solely to fill in the pickup address.

Why we process it, and on what legal basis

We do not sell your data, do not share it with advertising networks and do not use it for automated decision-making or profiling.

Who else processes your data

We use a small number of service providers. Each of them only receives what it needs to do its job.

Transfers outside the European Economic Area

Your booking data is stored in the European Union. Some of the providers above (Google, Telegram, Plisio) operate outside the EEA. Where that happens, transfers rely on the European Commission's standard contractual clauses or an adequacy decision, and only the minimum necessary data is sent.

How long we keep it

• Booking and payment records: six years from the end of the relevant tax year, as Cyprus accounting and tax law requires.
• Enquiries and correspondence: up to two years after the conversation ends.
• Email verification codes: minutes — they are deleted as soon as they are used or expire.
• Analytics data: up to 14 months, and only if you consented.
• Technical and security logs: up to 12 months.

Your rights

Under the GDPR you may:

• ask for a copy of the data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, where we are not required by law to keep it;
• ask us to restrict processing, or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent — for analytics, at any time, through the cookie settings link in the footer. Withdrawing consent does not affect processing that already took place.

Complaints

Write to us first at [email protected] — most issues are resolved quickly. You also have the right to complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (https://www.dataprotection.gov.cy/, [email protected]), or to the supervisory authority in your own country of residence.

Security

Traffic to the site is encrypted with HTTPS. Access to the booking database is restricted to authorised staff, protected by row-level security rules, and administrative actions require a separate login. Payment card data never reaches our servers.

Children

The service is intended for adults. We do not knowingly collect data from children. If you book a ride for a family, we ask only for the age of the child, and only in order to fit the correct child seat as Cyprus law requires. That information is deleted with the booking record.

Changes to this policy

If we change how we handle data, we update this page and the date at the top. Material changes affecting your rights will be communicated to you directly where we have your contact details.