Privacy notice
This notice explains what data VIORO Transfer handles when you plan a transfer, send a request or pay, who receives it and how long it is kept. It is a draft until a lawyer has reviewed it.
Example document of a portfolio site: it is not a real offer or contract.
Who is responsible
Not filled in for this example.
Not filled in for this example.
What data we handle
For each type of data: what it is, why we use it, on what basis, who receives it, how long we keep it and how it is deleted.
Contact details
- What
- Your name, email address, phone number and the optional note.
- Why
- To handle your request or order, to contact you about the trip and to send you emails about it.
- Legal basis
- Not filled in for this example.
- Who receives it
- Cloudflare (hosting and database), Brevo (sends our emails), our operator.
- How long we keep it
- Not filled in for this example.
- Deletion
- On request the operator anonymises the booking: contact details are replaced by neutral values.
Trip details
- What
- Pickup, stop and destination addresses, date and time, flight number, passengers, luggage, child seat details, vehicle class and your notes about the trip.
- Why
- To price the trip, assign a vehicle and carry out the transfer.
- Legal basis
- Not filled in for this example.
- Who receives it
- Cloudflare, Brevo (in the emails about your trip), our operator.
- How long we keep it
- Not filled in for this example.
- Deletion
- On request the operator anonymises the booking: addresses, flight number and free text are replaced. The reference number, dates, vehicle classes, prices and the journal of events remain.
Address search
- What
- The address text you type and the place you pick. Our server sends it to Google for suggestions, address details and the road distance. We do not store coordinates; we store only the address you choose for a booking.
- Why
- To suggest addresses, check that they are in Lithuania and measure the road for the price.
- Legal basis
- Not filled in for this example.
- Who receives it
- Google Maps Platform.
- How long we keep it
- We keep nothing from the search itself. What Google keeps is governed by Google’s terms.
- Deletion
- Nothing to delete on our side after the search; the address chosen for a booking is deleted as described for trip details.
Price and payment
- What
- The price, payment status, payment and refund reference. Card details are entered on the payment provider’s page and do not reach us.
- Why
- To charge and refund correctly and to keep a record of the order.
- Legal basis
- Not filled in for this example.
- Who receives it
- Not filled in for this example.
- How long we keep it
- Not filled in for this example.
- Deletion
- Prices and payment references remain after anonymisation; contact details do not.
Record of accepted terms
- What
- The time you accepted the Terms and the versions of the Terms and the Privacy notice that applied.
- Why
- To show which version applied to your booking.
- Legal basis
- Not filled in for this example.
- Who receives it
- Cloudflare, our operator.
- How long we keep it
- Not filled in for this example.
- Deletion
- Stays with the anonymised booking.
Emails we send you
- What
- Your name and email address and the text of the message (trip details, price, payment link, confirmation, refund).
- Why
- To tell you what happened to your request or order.
- Legal basis
- Not filled in for this example.
- Who receives it
- Brevo (sends and logs the emails).
- How long we keep it
- Not filled in for this example.
- Deletion
- On anonymisation, unsent emails are cancelled. Emails already sent stay in your mailbox and in Brevo’s logs until Brevo deletes them.
Operator notification in Telegram
- What
- Only the booking reference and a link to the operator area, with no name, phone number or addresses.
- Why
- To let our operator know that a request has arrived.
- Legal basis
- Not filled in for this example.
- Who receives it
- Telegram (outside the EEA).
- How long we keep it
- Not filled in for this example.
- Deletion
- The message holds no contact details, so anonymisation does not change it.
Protection against abuse
- What
- A one-way hash of your IP address made with a secret key (the address itself is not stored), counters of attempts and a hidden form field that only bots fill in. For operator sign-in: failed attempts per hashed address.
- Why
- To stop spam and repeated attempts and to keep the site and the operator area safe.
- Legal basis
- Not filled in for this example.
- Who receives it
- Cloudflare.
- How long we keep it
- Counters are removed by a periodic cleanup of rows older than 24 hours. Failed sign-in attempts are removed after a successful sign-in.
- Deletion
- Removed by the cleanup described above.
Server logs
- What
- Our own logs hold only the booking reference and an error code, never a name, phone number, address or email. The hosting provider may keep its own technical request logs (for example IP address and time); how long is not yet confirmed.
- Why
- To find and fix faults and to keep the service secure.
- Legal basis
- Not filled in for this example.
- Who receives it
- Cloudflare.
- How long we keep it
- Not filled in for this example.
- Deletion
- Logs hold no contact details, so anonymisation does not change them.
Backups
- What
- Copies of the database that the hosting provider keeps for recovery. They hold everything listed above as it was at that time.
- Why
- To restore the service after a fault.
- Legal basis
- Not filled in for this example.
- Who receives it
- Cloudflare.
- How long we keep it
- Not filled in for this example.
- Deletion
- Anonymisation does not reach backups: the data in them disappears when the backup expires.
Legal basis
Not filled in for this example.
Accepting the Terms when you send a request is a separate step: it records which version of the Terms applied. It is not presented as your consent to data processing. The basis for each type of data is set out above.
Who receives your data and transfers outside the EU
These providers receive data from us. The sources were read on 2026-10-30 from the providers’ public pages; they are not a legal assessment.
Not filled in for this example.
Cloudflare (Pages, Functions, D1)
- Role
- Hosts the site and stores the database.
- Data
- All booking data listed above and standard request data.
- Contract and transfer outside the EU
- Not filled in for this example.
- Checked
- Checked 2026-10-30: the sources read contain nothing on this provider, so no link is given.
Google Maps Platform (Places, Routes)
- Role
- Address suggestions, address details and road distance.
- Data
- The address text you type, the place you pick and the route points. Sent from our server, not from your browser.
- Contract and transfer outside the EU
- Governed by the Google Maps Platform terms for the European Economic Area.
- Checked
- Read 2026-10-30 (terms last modified 2026-10-28).
Brevo (email)
- Role
- Sends our emails.
- Data
- Your name, email address and the text of the email.
- Contract and transfer outside the EU
- Brevo states that it stores data in the EU; some of its sub-processors are in the USA under the EU–US Data Privacy Framework.
- Checked
- Read 2026-10-30 from search results; the page itself was not opened in full.
Telegram (operator notification)
- Role
- Tells our operator that a request has arrived.
- Data
- The booking reference and a link only.
- Contract and transfer outside the EU
- Telegram is outside the EEA. Its policy gives no EU guarantees for bot messages, so nothing but the reference and a link is sent.
- Checked
- Read 2026-10-30.
Not filled in for this example.
- Role
- Takes the payment and makes refunds.
- Data
- The amount, the order reference and the payment details you enter on its page. Card numbers do not reach us.
- Contract and transfer outside the EU
- Not filled in for this example.
- Checked
- Checked 2026-10-30: no provider is chosen yet, so there is nothing to verify.
How long we keep data and how it is deleted
Not filled in for this example.
On request, the operator can anonymise a booking: contact details, addresses, flight number and free text are replaced by neutral values, and the booking reference, dates, vehicle classes, prices and the journal of events remain.
Your rights
Not filled in for this example.
Not filled in for this example.
Cookies and tracking
We set no cookies for visitors and use no analytics or advertising. See the Cookies notice.
Google address suggestions
Address suggestions and routes come from Google Maps Platform. Our server sends the address text you type and the place you choose to Google; your browser does not connect to Google for this, and we do not store coordinates. Google terms: https://cloud.google.com/terms/maps-platform/eea/maps-service-termsNot filled in for this example.
Version
Privacy notice version: draft-1. Each booking records the version that applied.
