1. Data Controller

Elevelon S.r.l. · Sole shareholder

Via Mineo, 33 — 95125 Catania (CT), Italy

VAT no., tax code and Catania Companies Register no. 06169490874 · REA CT-473902 · Certified e-mail (PEC) elevelon@pec.it

Runs this website under the Rome Private Transfers trademark, used under licence.

Email: privacy@romeprivatetransfers.com

2. Types of personal data collected

• Identity and contact data (name, surname, email, phone).
• Booking and travel data (route, timing, flight number, number of passengers, operational notes).
• Technical browsing data (IP address, user-agent, system logs).
• Payment and transaction data handled by authorized providers.
• Communication data sent through forms, email, or support channels.

3. Purposes and legal bases

• Booking management and service execution (Art. 6.1.b GDPR).
• Administrative, accounting, and tax compliance (Art. 6.1.c GDPR).
• Customer support and service protection (Art. 6.1.f GDPR).
• Marketing communications only where consent is required (Art. 6.1.a GDPR).

4. Processing methods and security

Data is processed through adequate technical and organizational measures, proportionate to the risk level.

Data access is limited to authorized personnel and duly appointed parties.

5. Recipients and external processors

Data may be shared with technical and professional providers required to deliver the service (hosting, email, payments, support), appointed as processors where required under Art. 28 GDPR.

In particular, payment data is processed by Stripe, Inc. as a PCI-DSS certified payment processor (stripe.com/privacy).

The data required for each service is shared with the licensed NCC carrier that performs it, a party to the contract of carriage, which processes it as an independent data controller for the performance of the transport.

6. Transfers outside the EU

Where required, transfers to non-EU countries are carried out in compliance with GDPR using appropriate safeguards (e.g. Standard Contractual Clauses).

7. Retention period

• Contractual and administrative data: for as long as needed to provide the service and meet legal obligations.
• Accounting and tax data: according to applicable legal retention periods.
• Marketing data: until consent withdrawal or objection.

8. Data subject rights

Data subjects may exercise rights of access, rectification, erasure, restriction, portability, and objection (Arts. 15-22 GDPR), and may lodge a complaint with the competent supervisory authority.

9. Privacy contact

For privacy requests and rights exercise: privacy@romeprivatetransfers.com

10. Policy updates

This policy may be updated over time. The latest version is published on this page.