Privacy Policy — CaronTour

Last updated: 1 January 2025 | ICO Registration No: ZA123456

1. Who We Are

CaronTour Ltd ("we", "us", "our") is registered in England and Wales (Company No. 08123456) and is registered with the Information Commissioner's Office. We are the data controller for personal data collected via this website.

2. What Data We Collect

We collect personal data in the following ways:

Booking information: name, email address, phone number, pick-up and drop-off addresses, flight number, payment details.
Contact enquiries: name, email, phone and the content of your message.
Website usage: IP address, browser type, pages visited (via cookies — see Section 7).
Reviews: if you submit a review, we store your name and rating.

3. How We Use Your Data

To process and manage your booking.
To send booking confirmations, receipts and driver details.
To respond to enquiries and provide customer support.
To comply with legal and regulatory obligations.
To send service updates and offers where you have consented.
To improve our website and services using anonymised analytics.

4. Legal Basis for Processing

We process your data on the following legal bases (UK GDPR Article 6):

Contract performance — to fulfil the transport booking you have made.
Legitimate interests — to prevent fraud, improve our services and conduct analytics.
Legal obligation — to comply with HMRC, licensing and insurance requirements.
Consent — for marketing communications, where obtained.

5. Data Sharing

We do not sell your personal data. We may share it with:

Assigned drivers — name and pick-up/drop-off details only.
Payment processors — Stripe or similar, operating under their own privacy policies.
IT service providers — hosting, email services, under data processing agreements.
Law enforcement — where required by law or to protect safety.

6. Data Retention

We retain booking records for 7 years for legal and accountancy purposes. Contact enquiries are retained for 2 years. You may request deletion of non-essential data at any time.

7. Cookies

We use the following categories of cookies:

Essential cookies: required for the booking form and session management. Cannot be disabled.
Analytics cookies: we use anonymised analytics to understand how visitors use our site. You may opt out via your browser settings.

8. Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure ("right to be forgotten") where applicable.
Object to or restrict certain processing.
Data portability (receive your data in a machine-readable format).
Withdraw consent at any time where processing is based on consent.

To exercise any right, contact us at privacy@carontour.co.uk. We will respond within 30 days.

9. Security

We use SSL encryption for all data in transit and apply appropriate technical and organisational measures to protect personal data from unauthorised access, disclosure or destruction. Payment card data is handled solely by our PCI-DSS-compliant payment processor and is never stored on our servers.

10. Complaints

If you have concerns about how we handle your personal data, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.

11. Changes to This Policy

We may update this policy from time to time. The current version will always be published here. Material changes will be communicated by email to registered customers.