Privacy Policy

§ 1 — Controller and Contact

The data controller responsible for personal data processed through this website and our booking operations is KypyWay (hereinafter "KypyWay", "we", "us"). For all privacy-related inquiries, contact us at: [email protected].

§ 2 — Scope of This Policy

This policy applies to:

• Visitors to kypyway.com and its subpages
• Individuals who submit booking requests or contact forms
• Corporate account holders and their designated booking contacts
• Passengers whose journey details are provided by a booking party on their behalf

This policy does not apply to third-party websites linked from our site. We are not responsible for the privacy practices of external parties.

§ 3 — Data We Collect

3.1 — Data you provide directly

When you submit a booking request, contact form, or corporate account enquiry, we collect:

• Full name
• Email address
• Phone number (where provided)
• Pickup and drop-off locations
• Travel date and time
• Number of passengers
• Flight number or border crossing point (where relevant)
• Additional notes you include in the booking
• Company name and billing contact (corporate accounts)

3.2 — Data collected automatically

When you visit kypyway.com, our server logs collect:

• IP address (truncated)
• Browser type and version
• Operating system
• Referring URL
• Pages visited and time of visit

This data is used for server security monitoring and aggregate traffic analysis only. It is not used to profile individual users.

3.3 — Cookies

We use a single functional cookie to store your cookie consent preference (cookieConsent). This cookie contains no personal identifiers and is stored locally in your browser via localStorage. We do not use advertising cookies, third-party tracking cookies, or analytics platforms that set persistent identifiers.

The following table describes the cookie used:

§ 4 — Legal Basis for Processing

We process personal data on the following legal bases under applicable privacy law:

• Contract performance (Art. 6(1)(b) GDPR): Processing booking data to arrange and deliver transport services you have requested.
• Legitimate interests (Art. 6(1)(f) GDPR): Server log analysis for security purposes; fraud prevention; improving service delivery.
• Consent (Art. 6(1)(a) GDPR): Storage of your cookie preference following your explicit choice via the consent banner.
• Legal obligation (Art. 6(1)(c) GDPR): Retaining financial records and invoices as required by Canadian tax law.

§ 5 — How We Use Your Data

We use personal data exclusively for:

• Confirming and fulfilling transport bookings
• Communicating about your booking (changes, confirmations, cancellations)
• Issuing invoices and processing payments
• Responding to enquiries submitted via the contact form
• Managing corporate account relationships
• Maintaining booking records for corporate expense reporting

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use personal data for automated decision-making or profiling.

§ 6 — Data Sharing

Personal data may be shared in the following limited circumstances:

• Assigned drivers: Your name, pickup location, and relevant journey details are provided to the chauffeur assigned to your booking.
• Payment processors: Payment card data is handled directly by our payment processor and is not stored by KypyWay.
• Partner operators: For bookings in secondary coverage areas handled through our partner network, relevant journey details are shared with the coordinating operator under a confidentiality agreement.
• Legal requirements: We may disclose data where required by law, court order, or to protect the safety of persons involved in a journey.

§ 7 — International Transfers

For border crossing runs that involve US-side coordination, journey details may be shared with US-based logistics contacts. Such transfers are made under contractual safeguards. If you are a resident of the European Economic Area, any transfer outside the EEA is made under Standard Contractual Clauses or equivalent mechanisms.

§ 8 — Retention

We retain personal data for the following periods:

• Booking records: 7 years (Canadian tax and audit requirements)
• Contact form submissions not resulting in a booking: 12 months
• Corporate account records: duration of the account plus 7 years
• Server logs: 90 days, then automatically deleted

§ 9 — Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of data we are not required to retain by law.
• Restriction: Request that we restrict processing while a dispute is resolved.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Residents of Quebec may also contact the Commission d'accès à l'information (CAI). EEA residents may contact their national supervisory authority.

§ 10 — Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS/TLS), restricted access controls for staff handling booking data, and regular security reviews of our hosting infrastructure.

No method of transmission over the internet is completely secure. We cannot guarantee absolute security but will notify affected individuals promptly in the event of a data breach affecting their personal data.

§ 11 — Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when the policy was last revised. Material changes will be communicated via the contact email on record for active corporate accounts.

§ 12 — Contact

For privacy-related questions or to exercise your rights: [email protected]

Phone: +1 (416) 555-0284 (operating hours 05:00–23:00 ET)