Legal information

Privacy Policy

1. Data Controller

The controller of personal data is VIP Transfers Sp. z o.o., ul. Szlak 77/222, 31-153 Kraków, Poland, entered in the Polish Register of Entrepreneurs (KRS) under number 0000775527, Tax ID (NIP) 6793181754, REGON 382759022, contact: kontakt@viptransfers.pl, tel. +48 574 254 347.

2. Data We Collect

  • Identification data: first name, surname, email, phone
  • Booking data: route, date, passengers, preferences
  • Payment data: full card data (number, CVV code, authentication credentials) is processed and stored exclusively by the payment operator Stripe Inc. (PCI DSS Level 1 standard) in the form of a card token. On the VIP Transfers side we store only payment identifiers/references (the client and payment-method identifiers in Stripe), payment status and — where Stripe provides them and they are displayed — the card brand and last 4 digits. The token enables settlement of the service and future merchant-initiated (off-session) charges — see section 7
  • Location data: driver's GPS position during the performance of an assignment
  • Technical data: IP address, device type, application version

3. Purposes and Legal Bases of Processing

  • Provision of transport services (Article 6(1)(b) GDPR — performance of a contract)
  • Payment settlement, including storing the payment method and charges to the saved card (Article 6(1)(b) GDPR — performance of a contract)
  • Issuing and retaining invoices and other accounting documents (Article 6(1)(c) GDPR — legal obligation)
  • Pursuing amounts due and preventing abuse (Article 6(1)(f) GDPR — legitimate interest)
  • Client communication and handling of complaints (Article 6(1)(b) and (f) GDPR)
  • The VIP Club programme (Article 6(1)(b) or (a) GDPR)
  • Analytics and service improvement (Article 6(1)(f) GDPR — legitimate interest)
  • Direct marketing (with consent — Article 6(1)(a) GDPR)

4. Data Recipients

Data may be shared with:

  • The payment operator — Stripe Inc. (a processor acting under a data processing agreement, Article 28 GDPR; saving and storing the payment method, carrying out charges)
  • IT service providers — hosting, email (processors acting under data processing agreements, Article 28 GDPR)
  • The transport partner / driver assigned to an assignment — to the extent necessary to perform the ride; the partner/driver is a separate recipient acting as an independent controller, on the basis of Article 6(1)(b) and (f) GDPR

We do not sell personal data to third parties.

5. International Data Transfers

Payment data may be processed by Stripe Inc., based in the United States, which involves a transfer of data outside the European Economic Area. The transfer takes place on the basis of safeguards under Article 46 GDPR — standard contractual clauses — or Stripe's participation in the EU-US Data Privacy Framework. A copy of the relevant safeguards can be obtained at kontakt@viptransfers.pl.

6. Your Rights

Under the GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability and objection.

Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. You may withdraw marketing consent by writing to kontakt@viptransfers.pl or using the unsubscribe link in our messages.

You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Poland).

To exercise these rights, contact us at: kontakt@viptransfers.pl.

Account deletion is available within the mobile application (Profile → Delete account).

7. Card Saving and Merchant-Initiated Charges

When paying by card and when selecting the "card after the ride" model, your payment method (card token) is saved with the operator Stripe for the purpose of performing the contract. The transaction that initiates card storage is authenticated by your bank (Strong Customer Authentication / 3D Secure), which is the technical and legal basis for the validity of subsequent merchant-initiated (off-session) charges.

The saved card may be charged by VIP Transfers without your renewed active participation in the following cases:

  • the amount due for the service under the "card after the ride" model (after the completed transfer),
  • a cancellation fee in accordance with the Cancellation Policy (where cancellation falls within a charged threshold),
  • a no-show fee (passenger fails to appear),
  • previously agreed surcharges: additional stops, extended waiting time, route change, and — following documentation and prior notice — damage or necessary cleaning of the vehicle.

After each charge you receive a receipt and an invoice by email. The legal basis for processing data in connection with these charges is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interest — pursuing amounts due and preventing abuse). The authorisation to save the card and make off-session charges is a separate payment authorisation (mandate) towards the payment operator and the card schemes; it should not be equated with a legal basis for processing data under the GDPR. You may remove the saved payment method for the future at any time, subject to amounts already due. The payment processor is Stripe Inc.

8. Retention Period

We retain contractual data for the duration of the service and the limitation period for any claims. We retain accounting documents (including invoices) for the period required by tax and accounting law — as a rule 5 years counted from the end of the year in which the tax obligation arose. Other data is retained no longer than 5 years from the last activity.

The saved card token is held by Stripe for as long as the payment method remains active, until it is removed by the client or after the card expires — regardless of the general retention periods on the VIP Transfers side.