1. Controller and contact
The controller for the processing described here is Atas Alpin Taxi OG, Wallpachgasse 19/Top 1, 6020 Innsbruck, Austria. Contact us at info@atas-alpin.com or +43 676 7739494.
This policy covers our website, contact and booking forms, booking tracking and enquiries through our Google Ads lead forms. External platforms also process data under their own privacy policies.
2. Enquiries and transfer bookings
When you contact us, request a quote or book a transfer, we process your details to answer your enquiry, prepare an offer and organise the journey. This includes your name, email address, phone number, language and message. For bookings, we also process pickup and destination addresses, dates and times, any return trip, flight number, passenger numbers, luggage, child seats, vehicle choice, price, booking reference and optional instructions.
Journey enquiries and bookings are processed under Article 6(1)(b) GDPR (steps at your request before a contract and contract performance). General enquiries are processed under Article 6(1)(f) GDPR, based on our legitimate interest in responding to your message. Legally required accounting records are processed under Article 6(1)(c) GDPR.
Fields marked as required are needed to handle the enquiry or organise the trip; without them we may be unable to do so. Additional instructions are optional. Please provide only information needed for the journey and do not include identity document copies or sensitive health information in free-text fields. This website does not collect credit card details for online payment.
If you book for other people, please make this policy available to them. We receive their details from you and use them to organise the transfer.
3. Enquiries through Google Ads
When you submit a lead form in one of our Google ads, we receive the contact details and answers you provide, such as your name, phone number, email address, route or travel date. The source of this information is the Google form you submitted.
We use these details to contact you about your transfer enquiry and prepare a suitable offer under Article 6(1)(b) GDPR. Submitting the form does not make a booking or automatically subscribe you to a newsletter. We do not sell your contact details.
Google also processes data as a controller when providing its platform. For users in the European Economic Area, Google Ireland Limited, Dublin, Ireland, is generally responsible. Google's policy explains its processing and possible international transfers.
4. Communication and carrying out your transfer
We use your contact and booking details for questions, confirmations and changes. Our dispatch team and the assigned driver or contracted transport partner receive the information needed for your journey, particularly your name, contact details, route, pickup time and relevant instructions. The basis is Article 6(1)(b) GDPR.
We may use WhatsApp for journey and status notifications; our internal dispatch team may also receive necessary booking details through WhatsApp. WhatsApp processes phone numbers, message content and technical communication data. The EEA provider is WhatsApp Ireland Limited, Ireland. Messages are transmitted through our connected WhatsApp interface. If you do not want us to contact you directly through WhatsApp, please tell us by phone or email.
Our WhatsApp links lead to an external platform. Once you open them, WhatsApp's own privacy policy applies.
5. Website operation, security and storage
Website requests involve necessary connection data, including your IP address, time, requested URL, browser and device information, and error or status information. We use this to deliver the website, resolve errors and prevent abuse. To limit abusive form requests, we also use a hash derived from connection details and, where relevant, contact details. The basis is Article 6(1)(f) GDPR and our legitimate interest in a secure and reliable website.
We use IT, hosting and communication service providers to operate, maintain and support the website and communications. We store enquiry, customer and booking data using Supabase. Our database project is located in Frankfurt, Germany (eu-central-1). This does not mean that all provider processing takes place only in Germany: support and subprocessors may involve international transfers.
Access is limited to people and service providers who need it for their work. Tax advisers, legal advisers and competent authorities may also receive data where needed to meet legal obligations or establish, exercise or defend legal claims.
6. Google Maps and address suggestions
Optional Google maps, address suggestions and journey-time calculations are activated only when you explicitly enable Google Maps features. Once enabled, Google receives your IP address, technical browser data and addresses, search terms or coordinates used for these features. The provider is Google Ireland Limited, Dublin, Ireland; Google companies outside the EEA may also process this information.
This optional transfer is based on consent under Article 6(1)(a) GDPR and, where device access is involved, section 165(3) Austrian TKG 2021. Make your choice in the cookie banner; Google Maps starts disabled. You can enter addresses manually without Google suggestions. Change your choice at any time using ‘Cookie settings’ in the footer, the cookie icon in the booking area or the button in this section. Withdrawal disables embedded maps and prevents further Google Maps requests initiated by us, while keeping your form entries. It does not reverse transfers already made.
7. Optional live location sharing
During your transfer, booking tracking lets you share your current location to help you and your driver find each other. Collection starts only when you activate sharing and allow location access in your browser. We process coordinates, timestamps and the associated booking. Your location can be shown to dispatch, your assigned driver and on the enabled Google map.
Your optional location sharing is based on Article 6(1)(a) GDPR. You can stop transmission using the stop control or your browser's location permissions. Withdrawal does not affect the lawfulness of earlier processing. You can book without sharing your live location. A pickup location entered manually is booking data processed under Article 6(1)(b) GDPR.
The live feature stores the latest reported position, rather than a continuous movement history. Live positions are intended to be deleted when the booking is completed or cancelled. A location saved as the pickup address remains separately part of the booking records.
9. How long we keep data
We keep enquiry and communication data for as long as needed to handle and document your request. If a booking follows, the necessary details become part of the contract records. Data is deleted when its purpose ends unless a retention obligation or specific legal reason requires us to keep it.
Under section 132 Austrian BAO, tax-relevant books, records and supporting documents generally have to be retained for seven years from the end of the relevant calendar year, and longer where required for pending proceedings. This period does not apply to every preliminary enquiry or live position. Evidence needed for legal claims is retained according to the specific claim, limitation period or end of proceedings. Technical logs are needed only for their operational or security purpose; backup copies may remain until their scheduled overwrite.
10. International transfers
Google, WhatsApp and Supabase may process data outside the EEA, particularly in the United States. Their privacy and contractual information describe their transfer mechanisms. Depending on the recipient and processing, these include adequacy decisions under Article 45 GDPR or appropriate safeguards, particularly EU standard contractual clauses under Article 46 GDPR. The EU-US Data Privacy Framework applies only to certified US recipients and covered transfers.
You can request information about the safeguards applicable to our providers, and a copy or a link to them, at info@atas-alpin.com.
11. Your rights
Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future without affecting the lawfulness of processing before withdrawal.
Right to object: where processing relies on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving a reason.
To exercise your rights, contact info@atas-alpin.com. You may also complain to a supervisory authority, particularly in your place of residence, work or the alleged infringement. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.
12. Automation and updates
Our website calculates transfer prices using the route, vehicle and selected services. We do not make solely automated decisions with legal or similarly significant effects within Article 22 GDPR or carry out related profiling. We update this policy when our services or processing change. The revision date appears at the top of this page.
