Privacy Policy

1. Who We Are

AA Transfers (“we”, “us”, “our”) is a private hire and chauffeur service based at Clover Ave, Exeter EX4 2PU, United Kingdom. We are the controller of the personal data described in this Policy.

This Policy explains what we collect when you book a journey or create an account, why we collect it, who we share it with, how long we keep it and what you can ask us to do about it. It is written in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

2. What We Collect

When you make a booking we collect:

• Your name, telephone number and email address
• Your billing address, which we are required to record
• The pickup and drop-off addresses, any additional stops, and their map coordinates
• The date and time of travel, number of passengers and items of luggage
• Your flight number, departure airport and scheduled arrival time, where you give them to us
• The vehicle class you chose, the price, the payment status and the time you accepted our Terms

If you create an account, we also store your password in hashed form — we never see or keep the password itself — together with any saved address details, so that you do not have to re-enter them.

To run the journey we record operational details such as the driver assigned to you and the vehicle registration. Our web server keeps standard access logs, which include IP addresses, for security and troubleshooting.

We do not collect special category data, we do not profile you, and we make no automated decisions that produce legal or similarly significant effects.

3. Why We Use It, and on What Basis

We use your data to perform the contract you enter into when you book: to price the journey, confirm it, send your driver to the right place at the right time, take payment and deal with any problem afterwards. Without this data we cannot provide the service.

We rely on our legitimate interests to keep the service secure, prevent fraud and misuse, and keep records of what was agreed in case of a dispute. We rely on a legal obligation to retain financial records for the periods required by UK tax law.

We do not send marketing email or SMS, and we do not sell, rent or trade your personal data.

4. Cookies and Website Analytics

This website sets no cookies of its own and uses no analytics or advertising trackers. Our separate Cookie Policy explains this in full, including the one third-party map embedded on our contact page.

5. Who We Share It With

We share the minimum necessary with the following, each acting on our instructions or as an independent controller for their own service:

• Your driver — name, telephone number, pickup and drop-off details and flight number, so the journey can be carried out
• Google — route distances and travel times, and our scheduling calendar
• Ordnance Survey — address and postcode lookup while you type an address
• PayPal — payment processing; card details are handled by them and never reach our systems
• Our email provider — delivery of booking confirmations and account emails
• Our hosting provider — storage of the systems on which the above runs

Some of these providers may process data outside the United Kingdom. Where that happens, the transfer is covered by UK adequacy regulations or by the standard contractual protections required under UK data protection law.

We will also disclose data where we are legally required to do so, for example to a public authority acting within its powers.

6. How Long We Keep It

We keep booking and payment records for six years from the end of the tax year in which the journey took place, which is the period required for UK tax and accounting purposes and matches the limitation period for contract claims.

Account details are kept until you ask us to close the account. Server access logs are kept for a short period and then deleted. Password reset links expire automatically and are not retained afterwards.

7. Your Rights

Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased where we no longer need it, to restrict or object to how we use it, and to receive certain data in a portable format.

Where our use is based on legitimate interests, you may object at any time and we will stop unless we have compelling grounds to continue. Exercising any of these rights is free, and we will respond within one month.

To make a request, contact us using the details in section 9. We may need to verify your identity before we act, so that we do not disclose your data to someone else.

8. Security

Access to booking data is restricted to the people who need it to run the service. Passwords are stored only as cryptographic hashes, payment card details never reach our systems, and traffic between your browser and our systems is encrypted in transit.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office, and you directly where the risk is high.

9. Contact and Complaints

For any question about this Policy, or to exercise your rights, contact us by email at info@aatransfer.co.uk, by telephone or WhatsApp on +44 7464 425 425, or by post at AA Transfers, Clover Ave, Exeter EX4 2PU.

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk. We would ask you to raise the matter with us first so that we have the chance to put it right.

10. Changes to This Policy

We may update this Policy to reflect changes in how we work or in the law. The current version is always the one published on this page, and the effective date is shown at the top.