Privacy policy

1. Who is responsible

Express Transfer GmbH, Hulfteggstrasse 5, 8400 Winterthur, Switzerland
E-mail: contact@expresstransfer.ch · WhatsApp: +41 76 218 98 64

For all questions about your data, please write to contact@expresstransfer.ch.

2. Which data we process

• Booking data: your name, mobile number and e-mail address; if you book for someone else, the passenger's name and, if you give them, the passenger's mobile number and e-mail address; pickup and destination addresses, stops, date and time, return journey, flight number and arrival time, number of passengers, luggage, child seats, your comments, the vehicle class, the price and any voucher code. For company accounts also the company name and billing details.
• Payment data: payments are processed by Stripe. We receive the payment status, the amount and limited card details such as the card type and the last four digits. We never see or store your full card number.
• Communication: your messages by e-mail, WhatsApp, SMS, phone or through our request forms, and our replies.
• Ride data: the status of your ride (for example "chauffeur on the way", "arrived", "completed") with times, as recorded in our booking system.
• Website data: technical data that every visit creates (IP address, browser, date and time, pages requested), which our hosting provider logs for operation and security. Statistics with Google Analytics and advertising measurement with Google Ads only take place if you accept them in the cookie banner; our own record of how visitors find us works without cookies and is described in section 6.
• Address suggestions: when you type into an address field, the text you type is sent to Google to show you matching addresses.

3. Why we process your data

• To carry out your booking: dispatching the ride to a chauffeur, confirmations and messages about your ride, following your flight, invoices and payment. (For customers in the EU: GDPR art. 6(1)(b), performance of a contract.)
• To answer your questions and send you offers you ask for (GDPR art. 6(1)(b), pre-contractual steps).
• To meet legal duties, in particular accounting and tax rules (GDPR art. 6(1)(c)).
• To run a secure website, prevent misuse and fraud, handle complaints and defend legal claims, and to ask you for a review after your ride (our legitimate interests, GDPR art. 6(1)(f); you can object at any time).
• To know which ways lead visitors and customers to us, with our own record described in section 6 (our legitimate interest, GDPR art. 6(1)(f); you can object at any time).
• To measure visits, bookings and the effect of our advertising with Google Analytics and Google Ads — only with your consent (GDPR art. 6(1)(a)); you can withdraw it at any time.

We do not make automated decisions about you, and we do not sell your data.

We need the booking data marked as required in the booking form to carry out your ride. Without them we cannot accept the booking.

4. Who receives your data

We only pass on the data that each recipient needs for its task:

• Partner chauffeur companies (Switzerland) that carry out your ride: passenger name and mobile number, pickup and destination, date and time, flight number, luggage, child seats and your comments.
• Web Solutions Workshop Ltd (EasyTaxiOffice), London, United Kingdom: our booking and dispatch system, including booking e-mails and the Express Transfer app. It processes the data on our behalf; the data are stored in the United Kingdom.
• Stripe Payments Europe, Limited (Ireland) and Stripe Payments UK Ltd (United Kingdom): payment processing; data are also processed by Stripe, LLC (USA).
• Twilio Ireland Limited (Ireland): text messages (SMS) about your booking; data are also processed by Twilio Inc. (USA).
• Hostinger International Limited (Cyprus): hosting of our website and our e-mail, servers in Europe.
• Google Ireland Limited (Ireland), with Google LLC (USA): address suggestions and maps (for these Google is itself responsible for the data it receives); Google Analytics and Google Ads only with your consent.
• WhatsApp Ireland Limited (Ireland), with WhatsApp LLC (USA): if you write to us on WhatsApp.
• Apilayer Data Products GmbH (Vienna, Austria), Aviationstack: only your flight number and date, so that we can follow your flight.
• IT service providers that support our internal work (for example office, e-mail and AI software). They only receive the data needed for the task and are bound to confidentiality.
• Our fiduciary in Switzerland for accounting, and authorities or courts where the law requires it.

Text messages (SMS): only if you tick the SMS box when booking, we send text messages about that booking to the phone numbers you entered, for example the booking confirmation, chauffeur details and "on the way" / "arrived" messages, up to 5 messages per booking. SMS are optional; you can book without them. Message and data rates may apply. Reply STOP to opt out or HELP for help, or write to contact@expresstransfer.ch. We never share mobile numbers or consent to text messages with third parties or affiliates for marketing purposes.

5. Data abroad

Some recipients process data in the United Kingdom, in the EU (Ireland, Cyprus, Austria) or in the USA. The Swiss Federal Council recognises the UK and the EU countries as providing adequate data protection. In the USA we only use companies certified under the Swiss-U.S. Data Privacy Framework (Stripe, LLC; Twilio Inc.; Google LLC; WhatsApp LLC), which the Federal Council also recognises; where a transfer, including to other IT service providers, is not covered this way, the provider's standard contractual clauses apply. Disclosing data abroad can also be necessary to carry out your booking, for example when you travel to or from a place outside Switzerland.

6. Cookies, statistics and advertising

• Necessary cookies keep the booking form working and store your cookie choice. They are always active.
• Statistics (Google Analytics 4) only with your consent: we see how visitors use our website and how many bookings are completed, without names or addresses. According to Google, Google Analytics 4 does not log or store IP addresses. The data are kept for 14 months.
• Advertising (Google Ads) only with your consent: we measure whether a visit from a Google ad leads to a booking. If you arrive through a Google ad, we keep Google's click ID in a cookie on our own site for 90 days. If you have accepted advertising cookies and pay for a booking, we also send Google your e-mail address and mobile number in pseudonymised (hashed) form, so that Google can recognise whether the booking followed a click on one of our ads ("enhanced conversions"). Google does not receive these data in plain text.

Our own record of how visitors find us (no cookies; not shared). To see which ways lead visitors to us (for example a search engine, an advertisement, a link on another website or an AI assistant) and which of them lead to bookings, our website keeps its own record on our own web server.

For every page you open we record: the time, the page, the name of the website you came from (not its full address), the campaign details contained in the link you followed and whether that link carried an advertising click ID (not the ID itself), your type of device (phone, tablet or computer) and your browser language. With it we keep two more things for a short time: a random visit number (see below) and two keys calculated from your IP address — one of them together with your browser identification — with a secret that changes every day. We do not store your IP address or your browser identification in this record. The visit number, the keys and the secret of that day are normally deleted within 48 hours; the other details of a page view are deleted after 90 days at the latest.

When you use the booking form, we also record how far you get in it: which steps were shown or pressed (the trip step, prices requested, prices shown, not available or not loaded, a vehicle class tapped, "Continue", the details step, "Book and pay", the hand-over to the payment page, a return from it without payment, a completed booking), in which kinds of field you made an entry and which kind of field the form marked as missing or incorrect after "Book and pay" (for example "name", "phone", "flight number", "terms" — only the kind of field), whether you went back a step and whether you tapped a WhatsApp, phone or e-mail link inside the form. We do not record what you type or select there, your route, the date, the vehicle class, the price or a booking reference in these entries. They are kept as one entry per visit — after "Deny", one entry per day for your internet connection and browser — with the time, the seconds between the steps, the booking page used, the way you arrived (source, the page you entered on, the website you came from, the campaign of the link and, for an advertisement, its ad group and keyword), your type of device and your browser language, for at most 90 days. The visit number and the keys that link such an entry to your page views and to a booking are normally deleted within 48 hours.

In your browser, for the open tab only (session storage, not a cookie), our website keeps: a random visit number, how you arrived the first time and the latest time (time, page, the website you came from, campaign details, whether the link carried an advertising click ID), up to 30 pages you opened and, after a booking, its reference and whether a payment was made — at most until our server has confirmed them. The visit number is sent to our server with every page you open; when you book, the other details are sent with it. All of this is deleted when you close the tab. If you choose "Deny" in the cookie banner or do not allow statistics in its settings — or if your browser sends the "Global Privacy Control" signal and you have not chosen "Accept" — nothing of this is stored on your device and what was stored is removed. Our record on our server — the page views and the steps of the booking form — continues in that case, without the visit number.

If you book, we keep with your booking reference for at most 24 months: the time, the way you arrived (source, the page you entered on, the website you came from, the campaign of the link and, for an advertisement, its ad group and keyword), the pages you opened before booking, your type of device, your browser language, whether a payment was made (not the amount) and how the booking was matched to its page views. The booking reference connects this entry with your booking. Until the visit number and the keys are deleted (normally within 48 hours), the entry is also linked to its page views through them. Where your browser kept no visit number, or where it shows no arrival from another website or link, we match the booking with the page views that came from the same internet connection in the 24 hours before — first those of the same browser, otherwise those of another browser on that connection.

This record is kept on our web server. We do not pass it on to anyone except the service providers named in section 4 (our hosting provider, and the IT tools with which we read and evaluate it, including AI software); we do not combine it with data from other websites and we do not use it for advertising profiles. Copies can remain in backups of our server until those backups are deleted.

This is based on our legitimate interest in knowing where our customers come from (for customers in the EU: GDPR art. 6(1)(f)). You can object at any time. With the link "Switch off our own record in this browser" nothing more is recorded for this browser; our server deletes the page views and the booking-form entries recorded under this tab's visit number and those it can still assign to your current internet connection and browser; and one cookie (et_source_off, one year) remembers your choice. The switch needs cookies to be allowed in your browser. If you write to contact@expresstransfer.ch, we delete the entry kept with your booking.

Our own record is switched off in this browser. Switch it on again

You can change or withdraw your consent at any time with the button "Manage consent" below. The current list of cookies with their purpose and duration is shown below as well.

7. How long we keep data

• Booking, invoice and payment records: 10 years from the end of the financial year, as required by Swiss accounting law (art. 958f of the Swiss Code of Obligations). Messages that belong to a booking are kept with it.
• Questions and offer requests that did not lead to a booking: deleted after 2 years at the latest.
• Statistics in Google Analytics: 14 months.
• Our own record of how visitors find us (section 6): page views and the steps of the booking form at most 90 days — their visit number and keys normally no longer than 48 hours; the entry kept with a booking at most 24 months.
• Other data: only as long as needed for the purpose for which we collected them, or as long as the law requires.

8. Security

Our website and the booking form use encrypted connections. Only the people who need your data for your ride have access to it. Our service providers are bound by contract to confidentiality and data protection.

9. Your rights

You can ask us at any time for information about the data we hold about you (art. 25 FADP), and have incorrect data corrected. You can ask us to delete your data or object to its processing, unless we must keep it by law or need it to carry out your booking. You can receive the data you gave us in a common electronic format (art. 28 FADP), and withdraw a consent at any time with effect for the future. Write to contact@expresstransfer.ch; we may ask you to prove your identity.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you live in the EU, you also have the rights under the GDPR (access, rectification, erasure, restriction, data portability, objection) and can complain to the data protection authority of your country.

10. Changes

We update this policy when our processing changes. The current version is always published on this page.