Privacy Policy

The operator of the etcar.eu website (hereinafter referred to as the "Website") and the data controller is ETCAR SRL, a private limited liability company incorporated and operating under the laws of Belgium and registered with the Brussels Register of Legal Entities (Company Registration Number: BE0711762244).

Registered office: Square Ambiorix 7, 1000 Brussels, Belgium.

Contact details of the data controller: e-mail: office@etcar.eu, telephone: +32 492 123 456.

Data protection contact: ETCAR (office@etcar.eu).

When using the Website and our services, you, as the data subject, may provide us with personal data. We process your personal data in accordance with applicable Belgian and European Union data protection legislation, in particular the General Data Protection Regulation (EU) 2016/679 ("GDPR"). Below we explain what personal data we collect, for what purposes and on what legal basis we process it, with whom we share it, and the rights and other relevant information available to you.

Categories of Personal Data Collected

The personal data we collect and process primarily consists of the information you provide when making a booking, registering an account, or contacting us. This includes, in particular, the following:

Passenger / Customer Identification Data: full name (name of the passenger and/or the person making the booking).

Contact Information: e-mail address and telephone number.

Travel Information: details relating to your journey, such as the departure and arrival location (airport or railway station), flight number, date and time of travel, number of passengers, amount of luggage, number of requested child seats, etc. This information is collected as part of the booking process.

Billing and Company Information: if you use our services on behalf of a company or request an invoice, we collect your billing name (company name), billing address, VAT number (where applicable), and any other information necessary for invoicing.

User Account Information: the Website allows users to register and create a customer account. During registration we collect the information required for this purpose (such as your login e-mail address and password). You may also provide additional information within your account (for example, preferences or previous booking details).

Important: the services provided through our Website and the registration process are available only to persons aged 18 years or older. We do not knowingly collect or process personal data relating to minors.

Communication Data: if you contact us (for example through customer service, e-mail or telephone), we process the personal data provided or generated in connection with such communication (such as your e-mail address and the content of your enquiry).

Automatically Collected Data – Cookies and Log Files: when you visit the Website, we may automatically collect certain technical information relating to your device and browsing activity through cookies or server log files. Such information may include, for example, your IP address, browser type and version, date and time of your visit, actions performed on our Website, and the source from which you accessed the Website (such as a search engine or referring website). This information is not used by itself to identify you, but solely for anonymous or aggregated statistical purposes and to ensure the proper operation of the Website.

Note: We do not collect payment card or banking details directly. Where payment is made online, the payment process is handled exclusively by our secure third-party payment service provider, Saferpay (SIX Payment Services), through its own systems. Consequently, your payment card details are transmitted directly to Saferpay. We receive only confirmation of the payment status or whether the transaction has been completed successfully, and we never have access to your payment card details. Further information regarding Saferpay's privacy and security practices is available on its website at saferpay.com.

Purposes and Legal Bases of Processing

We process your personal data exclusively for specified purposes and on an appropriate legal basis. The purposes and legal bases of our processing activities are as follows:

Provision of Bookings and Performance of the Contract:

Our primary purpose is to organise and provide the passenger transport service requested by you. For this purpose, we process your name, contact details and travel information in order to confirm your booking, assign a driver, monitor your flight if necessary, and communicate with you regarding the service. The legal basis for such processing is Article 6(1)(b) GDPR, as the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.

Customer Communication: We use your contact details to send booking confirmations, notifications relating to your journey, information concerning delays or changes, and to respond to enquiries submitted to our customer service. Such processing is likewise based on Article 6(1)(b) GDPR, as it is necessary for the performance of the contract or for taking pre-contractual steps at your request.

Issuing Invoices and Compliance with Legal Obligations: We process the billing information provided by you in order to issue invoices and comply with our accounting, tax and other statutory obligations. The legal basis for this processing is Article 6(1)(c) GDPR, as the processing is necessary for compliance with a legal obligation to which the data controller is subject.

Operation and Security of the Website: We process certain technical information (including IP addresses, log data and cookie-related information) in order to ensure the secure operation of the Website, prevent abuse, identify technical errors and improve system performance. The legal basis for this processing is Article 6(1)(f) GDPR, based on our legitimate interest in maintaining the security, integrity and proper functioning of our online services.

Website Analytics and Service Improvement: Subject to your consent where required, we analyse how visitors use our Website in order to improve its functionality, user experience and performance. Such processing may involve analytical cookies and similar technologies. Where consent is required under applicable law, the legal basis is Article 6(1)(a) GDPR. Where anonymous statistical information is processed without identifying individuals, such processing may also be based on our legitimate interests under Article 6(1)(f) GDPR.

Direct Marketing: If you have expressly consented to receiving marketing communications, we may use your e-mail address to send newsletters, promotional offers and information about our services. The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before such withdrawal.

Where permitted by applicable law, we may also send information about services similar to those previously purchased by you on the basis of our legitimate interest under Article 6(1)(f) GDPR. In every such communication, you will always have the opportunity to opt out of future marketing messages free of charge.

Recipients of Personal Data

We treat your personal data confidentially. Your personal data is not sold or otherwise disclosed to third parties for their own marketing purposes.

However, in order to provide our services and fulfil our legal obligations, we may share your personal data with the following categories of recipients:

Drivers and Transport Partners: In order to perform the booked transport service, we provide the driver or contracted transport partner with the information necessary for the execution of your journey (such as your name, telephone number, pick-up location, destination, flight details and any special requests). These recipients may process your personal data solely for the purpose of providing the transport service on our behalf.

IT and Hosting Service Providers: We use external service providers for website hosting, maintenance, software operation, data storage and technical support. Such service providers process personal data only in accordance with our documented instructions and are bound by appropriate confidentiality and data processing obligations.

Payment Service Providers: Online payments are processed securely through Saferpay (SIX Payment Services) or other authorised payment service providers. These providers process payment-related information as independent data controllers in accordance with their own privacy policies.

Accounting and Tax Advisors: Where necessary, personal data contained in invoices and accounting documents may be made available to our accountants, tax advisors and auditors for the purpose of fulfilling accounting and tax obligations.

Public Authorities and Courts: We may disclose personal data where required by applicable law or where disclosure is necessary to comply with a legal obligation, court order, official request or regulatory investigation.

Professional Advisers: Where necessary, personal data may also be shared with lawyers, insurance companies or other professional advisers in connection with the establishment, exercise or defence of legal claims.

Transfers of Personal Data Outside the European Economic Area (EEA)

As a general rule, we process and store your personal data within the territory of the European Economic Area (EEA).

However, certain service providers engaged by us (for example, providers of analytical, cloud-based or technical services) may process personal data outside the EEA or may make it accessible from third countries. Where such transfers occur, we ensure that they take place only where an appropriate level of protection is guaranteed in accordance with Chapter V of the GDPR.

Where personal data is transferred to a country that has not been the subject of an adequacy decision by the European Commission, such transfer will be based on appropriate safeguards, including, where applicable:

the Standard Contractual Clauses (SCCs) adopted by the European Commission;
other transfer mechanisms permitted under the GDPR; or
your explicit consent, where required by law.

You may request further information regarding the safeguards applied to international data transfers by contacting us using the contact details provided in this Privacy Policy.

Data Retention Period

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable legal obligations.

The retention periods applied by us are generally as follows:

Booking and Transport Data: We retain booking-related personal data for the period necessary to perform the transport service and to handle any complaints, claims or disputes arising from the booking. Thereafter, such data may be retained for the applicable statutory limitation period.

Accounting Documents and Invoices: Personal data contained in invoices and accounting records is retained for the period required under applicable Belgian accounting and tax legislation.

Customer Service Correspondence: Communications exchanged with our customer service are retained only for as long as reasonably necessary to respond to enquiries, resolve complaints and protect our legitimate interests.

User Account Data: If you have created a customer account, we retain your account data until you delete your account or request its deletion, unless we are legally required to retain certain information for a longer period.

Marketing Data: Where processing is based on your consent, we retain your personal data for marketing purposes until you withdraw your consent or object to receiving further marketing communications.

Technical Logs and Analytics Data: Technical logs, cookie-related information and analytical data are retained only for the period necessary for technical, security and statistical purposes, in accordance with our Cookie Policy and applicable legal requirements.

Once the applicable retention period has expired, your personal data will be securely deleted or irreversibly anonymised unless further retention is required by law or is necessary for the establishment, exercise or defence of legal claims.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with the processing of personal data, taking into account the nature of the data, the purposes of processing and current technological standards.

Such measures include, among others:

protection of our IT systems against unauthorised access;
encrypted communication where appropriate;
access control and authorisation management;
regular software updates and security maintenance;
internal confidentiality obligations applicable to employees and contractors;
selection of service providers offering adequate guarantees regarding data protection and information security.

Despite all reasonable efforts, no method of electronic transmission or storage can be guaranteed to be completely secure. Nevertheless, we continuously review and improve our security measures in order to minimise the risks associated with the processing of personal data.

Rights of Data Subjects

In accordance with the GDPR, you have the following rights regarding the processing of your personal data:

Right of Access – You have the right to obtain confirmation as to whether we process your personal data and, where that is the case, to access such personal data together with information concerning the processing.

Right to Rectification – You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to Erasure ("Right to be Forgotten") – Under the conditions laid down in the GDPR, you may request the deletion of your personal data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw your consent and no other legal basis for processing exists.

Right to Restriction of Processing – In certain circumstances, you may request that we restrict the processing of your personal data.

Right to Data Portability – Where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and, where technically feasible, to have that data transmitted directly to another data controller.

Right to Object – You have the right to object, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on our legitimate interests. You also have the unconditional right to object at any time to the processing of your personal data for direct marketing purposes.

Right to Withdraw Consent – Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

To exercise any of the above rights, please contact us using the contact details provided in this Privacy Policy. We will respond to your request within the time limits prescribed by the GDPR.

Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the provisions of the GDPR or other applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In Belgium, the competent supervisory authority is:

Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit)

Rue de la Presse 35 / Drukpersstraat 35
1000 Brussels
Belgium

Telephone: +32 (0)2 274 48 00

Website: https://www.dataprotectionauthority.be

You also have the right to seek a judicial remedy if you consider that your rights under applicable data protection legislation have been violated.

Cookies

Our Website uses cookies and similar technologies to ensure its proper operation, improve user experience and analyse Website traffic.

Cookies are small text files stored on your device when you visit the Website.

The cookies used on our Website may include the following categories:

Strictly Necessary Cookies – essential for the operation of the Website and the provision of its core functions.
Preference Cookies – enable the Website to remember your selected settings and preferences.
Statistics / Analytics Cookies – help us understand how visitors use the Website in order to improve its performance.
Marketing Cookies – may be used, subject to your consent where required, to display relevant advertisements or measure the effectiveness of marketing campaigns.

Where required by applicable law, non-essential cookies will only be placed on your device after obtaining your prior consent through our cookie banner.

You may modify your cookie preferences at any time through the cookie settings available on the Website or by changing your browser settings.

Further information regarding the cookies used on our Website is available in our Cookie Policy.

Automated Decision-Making

We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

Amendments to this Privacy Policy

We reserve the right to amend or update this Privacy Policy from time to time in order to reflect changes in our services, applicable legal requirements or data processing practices.

The latest version of the Privacy Policy will always be published on our Website, together with the date of its latest update.

Where required by law, we will notify users of material changes by appropriate means.

Contact Information

If you have any questions regarding this Privacy Policy or the processing of your personal data, or if you wish to exercise your rights as a data subject, please contact us:

ETCAR SRL

Registered office:
Square Ambiorix 7
1000 Brussels
Belgium

E-mail: office@etcar.eu

Telephone: +32 492 123 456

Website: https://etcar.eu