Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data CZTransfer collects when you use www.cztransfer.com or book a transfer with us, why we need it, how long we keep it, who else sees it, and what rights you have. It is written to meet the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Czech Act No. 110/2019 Coll. on the processing of personal data.
1. Who is responsible for your data
The data controller is:
S-FAMILY, s.r.o., trading as CZTransfer
Registered office: Nušlova 2295/55, 158 00 Praha 5, Czech Republic
Company ID (IČO): 26711991
Office: Václavské náměstí 37, Prague
Email: cz@cztransfer.com
Phone / WhatsApp / Viber / Telegram: +420 773 477 799
We have not appointed a Data Protection Officer, because the law does not require one for a business of our size and type. For any privacy question, write to cz@cztransfer.com.
2. What data we collect and why
We only collect what we need to arrange your trip and run the website.
| When | What data | Why | Legal basis (GDPR) |
|---|---|---|---|
| You book a transfer or a trip | Name, email, phone number, pick-up and drop-off places, date and time, return trip details, number of passengers, chosen vehicle, payment method, and anything you write in the comment (for example a flight number, child seats or luggage) | To confirm the booking, plan the trip, send the driver to the right place and contact you if your plans change | Art. 6(1)(b): needed to perform our contract with you |
| You send an enquiry through a form, by email or in a messenger | Name, email, phone number, your message, and your messenger account name or number if you use WhatsApp, Viber or Telegram | To answer you and prepare a price offer | Art. 6(1)(b): steps you ask for before a contract |
| You pay | Amount, date, payment method; for PayPal, your name, email and transaction ID; for cryptocurrency, the sending wallet address and transaction ID | To match the payment to your booking and handle refunds | Art. 6(1)(b): performing the contract |
| We issue an invoice or receipt | Name, billing details, service and amount | To keep the accounting and tax records Czech law requires | Art. 6(1)(c): legal obligation |
| You submit a form | Technical data Google reCAPTCHA reads from your browser (IP address, browser data, how you use the page) | To keep spam bots out of our forms | Art. 6(1)(f): our legitimate interest in protecting the forms |
| You visit any page | IP address, browser type, requested page and time, kept in technical server logs | To deliver the website, keep it secure and investigate errors and attacks | Art. 6(1)(f): our legitimate interest in running a secure website |
| You accept analytics cookies | Pages you visit, how you got to the site, approximate location (country/city), device and browser type, a random visitor ID | To see which pages are useful and improve the site | Art. 6(1)(a): your consent |
To book a trip you must give us your name and a way to contact you (phone or email). We cannot arrange a pick-up without them. Everything else is optional.
If you book for other passengers, such as family or colleagues, please let them know about this policy. We do not ask for special categories of data such as health data. If you tell us something like “we need a wheelchair-accessible car”, we use it only to arrange the right vehicle.
3. How long we keep it
| Data | How long |
|---|---|
| Booking and enquiry correspondence (emails, form messages, messenger chats) | 3 years after your trip or our last contact. That is the general limitation period for claims under the Czech Civil Code. After that we delete it. |
| Enquiries that did not lead to a booking | Up to 1 year |
| Invoices and accounting records | As long as Czech accounting and tax law requires, up to 10 years |
| Copies of outgoing website emails in our mail log | The log keeps only the last 250 messages. Older ones are overwritten automatically. |
| Technical server logs | Up to 30 days |
| Analytics data (Google Analytics) | No longer than 14 months, then deleted automatically by Google |
| Your cookie choice | 6 months, then we ask again |
4. Who receives your data
We never sell your data and never pass it to anyone for their own marketing. We share it only with these parties, and only as far as each one needs it:
- Your driver. This is our own driver or, on some routes, a partner transport company that carries out the trip for us. They receive your name, phone number, pick-up details and passenger information.
- Hetzner Online GmbH (Germany). Hosts the website and its database on servers in Finland.
- Reverse-proxy and caching server. All website traffic, including what you type into our forms, passes through a server located in the Republic of Moldova. It delivers the site faster and protects it from attacks. See section 5 on transfers outside the EU.
- Google Ireland Limited (Ireland) and its parent Google LLC (USA). Google Workspace hosts our business email (cz@cztransfer.com), and booking confirmations from the website are sent through it. Google also runs Google Analytics (only with your consent), reCAPTCHA, and the Google Maps and YouTube content embedded on some pages.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), if you pay online by card or PayPal. You enter your card details on PayPal’s own pages and we never see them. PayPal processes your payment as an independent controller under its own privacy statement.
- Blockchain networks, if you pay in cryptocurrency. A blockchain transaction is public and permanent by design, and we cannot change or delete it.
- Messenger providers (WhatsApp / Meta Platforms Ireland, Rakuten Viber, Telegram), but only if you choose to contact us that way. Their own privacy terms apply.
- AddToAny (USA). Provides the “share” buttons. Their script loads from AddToAny’s servers, which therefore see your IP address. AddToAny does not set tracking cookies by default.
- Our accountant and public authorities. Our accountant processes invoice data. Courts, police or tax authorities get data only when the law obliges us to provide it.
5. Transfers outside the EU
Some of the recipients above are outside the European Economic Area:
- USA (Google, AddToAny, Meta): Google LLC and Meta Platforms are certified under the EU–U.S. Data Privacy Framework, which the European Commission has recognised as giving adequate protection. Otherwise transfers rely on the Commission’s Standard Contractual Clauses.
- Republic of Moldova (reverse-proxy server): Moldova has no EU adequacy decision. The transfer relies on the Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Traffic between your browser and the proxy, and between the proxy and our server in Finland, is encrypted.
You can ask us for a copy of the safeguards that apply to a particular transfer.
6. Cookies
A cookie is a small file your browser stores for a website. We use as few as possible.
| Cookie | Set by | Purpose | Lifetime | Needs consent? |
|---|---|---|---|---|
| PHPSESSID | cztransfer.com | Keeps your booking details between the steps of the order form | Until you close the browser | No, strictly necessary |
| cz_consent | cztransfer.com | Remembers whether you accepted or rejected analytics cookies | 6 months | No, strictly necessary |
| _GRECAPTCHA | google.com | reCAPTCHA spam protection for our forms | 6 months | No, needed to protect the forms |
| _ga, _ga_<ID> | Google Analytics | Tells visits apart so we can count visitors and see which pages they use | Up to 2 years | Yes. Set only after you click “Accept” |
As required by Czech Act No. 127/2005 Coll. on electronic communications (§ 89(3)), Google Analytics stays in a cookie-less, consent-denied mode until you click “Accept” in the cookie banner. In that mode it stores nothing on your device.
Pages with an embedded YouTube video or Google Map load that content from Google. Google may set its own cookies when you play the video or use the map. Google’s privacy policy applies to that content.
Change your mind at any time: open cookie settings. You can also delete cookies in your browser settings.
7. Your rights
Under the GDPR you have the right to:
- Access. Find out whether we hold data about you and get a copy (Art. 15).
- Rectification. Have wrong or incomplete data corrected (Art. 16).
- Erasure. Have your data deleted when we no longer need it or you withdraw consent, unless the law obliges us to keep it, as it does for invoices (Art. 17).
- Restriction. Ask us to pause using your data while a dispute about it is resolved (Art. 18).
- Portability. Receive the data you gave us in a common machine-readable format (Art. 20).
- Objection. Object to processing based on our legitimate interest (Art. 21).
- Withdraw consent at any time, as easily as you gave it. Withdrawing does not affect processing that took place before (Art. 7(3)).
To use any of these rights, email cz@cztransfer.com. We reply within one month. It is free of charge. We may ask you to confirm your identity first, for example by writing from the email address you booked with.
Right to complain. If you think we handle your data unlawfully, you can complain to the Czech supervisory authority: Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also complain to the authority in the EU country where you live or work.
8. Automated decisions and profiling
We make no decisions about you by automated means alone, and we do not build profiles of our customers. Prices come from fixed route tariffs, not from data about you.
9. How we protect your data
The website is served only over encrypted HTTPS. The database cannot be reached from the internet. Administrative access to the server is limited to a few people and requires a cryptographic key. Booking data is accessible only to the people who handle your trip. If a data breach happens that puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you without undue delay.
10. Children
Our services are booked by adults. We do not knowingly collect data directly from children under 16. If a child travels with you, we only need to know their age to fit the right child seat.
11. Changes to this policy
We will update this page when our services or the law change. The date at the top shows the current version. If we make a significant change that affects data we already hold about you, we will tell you by email.