This Privacy Policy explains how PREMIUM TRANSFER BEOGRAD (hereinafter: the Controller) collects, uses, stores and protects personal data of website visitors and transport service users, in accordance with the Serbian Personal Data Protection Act and the General Data Protection Regulation (GDPR) where applicable.

1. Controller details

Business name: PREMIUM TRANSFER BEOGRAD
Company registration number (MB): 66741664
Tax identification number (PIB): 113325163
Registered office: Prve pruge 7, Belgrade, Republic of Serbia
Data protection email: office@premiumtransfer.rs

2. Who this policy applies to

This policy applies to all website visitors, users who submit an enquiry or booking via the form, email, phone, Viber or WhatsApp, and persons whose data is processed in connection with the provision of transport services.

3. Data we collect

We collect only data necessary to provide the service, communicate with you and meet legal obligations:

Identity and contact data: first and last name, email address, phone number.
Booking data: pickup and destination address, date and time of ride, flight number (if provided), vehicle class, number of passengers, notes with your enquiry.
Payment data: payment status and transaction reference (we do not store full card numbers on our website).
Communication: content of messages you send us by email, phone, Viber or WhatsApp regarding your booking.
Technical data: IP address, browser type, operating system, site language, access time and basic server logs.
Cookies: selected language data and, with your consent where required, analytics cookies.

4. Purposes and legal bases

We process your data for the following purposes:

Receiving and processing booking enquiries, sending price offers and confirmations — contract performance and pre-contractual steps.
Organising and performing the transfer, driver contact and ride status updates — contract performance.
Payment collection and payment records — contract performance and legal obligation (accounting).
Responding to questions and complaints — legitimate interest and contract performance.
Website security, abuse prevention and system maintenance — legitimate interest.
Compliance with legal obligations (tax and accounting rules) — legal obligation.
Website analytics — only with consent where applicable.

5. How we collect data

We obtain data directly from you (booking form, email, phone, Viber, WhatsApp), automatically via cookies and technical logs when you visit the site, and through booking confirmation and follow-up communication. Addresses in the form may be auto-completed via Google Places, subject to Google's policy.

6. Cookies

Cookies are small text files stored on your device.

Essential cookies: PHP session for the booking form and core site functions — consent not required.
Site language is determined by the URL path (/, /eng/, /de/, /ru/), not by a separate language cookie.
Analytics cookies: used only if enabled and, where legally required, with your consent.
You may delete or block cookies in your browser settings; blocking essential cookies may affect the booking form.

7. Who we share data with

We do not sell or rent your personal data. We share data only when necessary:

Assigned drivers and partners — to perform the transfer (name, phone, route, time, flight number).
Technical service providers (hosting, email, SMS/Viber/WhatsApp, payment processor) — as data processors under processing agreements and safeguards.
Google LLC — when using Google Places autocomplete and displaying public reviews (per Google's policy).
Competent authorities — when expressly required by law.

8. International data transfers

Some processors (e.g. Google, hosting or email services) may process data on servers outside Serbia. In such cases, appropriate safeguards under applicable law are applied, including standard contractual clauses or adequacy decisions where applicable.

9. Data retention

After the retention period, data is securely deleted or anonymised, unless longer retention is legally required.

Booking and contract data: up to 5 years after service completion, for accounting and legal obligations.
Unfulfilled enquiry data: up to 12 months, unless law requires longer retention.
Server technical logs: up to 12 months, except in case of a security incident.
Cookies: for the duration defined by cookie type or until deleted in the browser.

10. Data security

We apply appropriate technical and organisational measures: HTTPS encryption, access control, protection of the admin area, secure password storage and restricted access to authorised persons only. However, no internet transmission is completely risk-free.

11. Your rights

Under applicable data protection law, you have the following rights:

Right to be informed and to access your data.
Right to rectification of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") where legal conditions are met.
Right to restriction of processing.
Right to data portability.
Right to object to processing based on legitimate interest.
Right to withdraw consent — where processing is consent-based, without affecting lawfulness prior to withdrawal.
Right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs).

12. Children's data

Our services are not intended for persons under 16 without parental or guardian consent. We do not knowingly collect children's data without such consent. If we learn that we have collected a child's data without appropriate consent, we will delete it without delay.

13. Automated decision-making

We do not make decisions that produce legal effects concerning you based solely on automated processing, including profiling within the meaning of applicable data protection law.

14. Changes to this policy

The Controller may update this Policy from time to time. The new version takes effect upon publication on the website. The date of the last update is shown at the top of this page. We recommend checking this page periodically.

15. Contact

For any questions, requests to exercise your rights or remarks regarding personal data processing, contact us at office@premiumtransfer.rs or via the contact details below.