Legal
Privacy Policy
Last updated: 10/27/2026
1. Who we are
Costa Taxi CY ("we", "us") is the trading name "costataxicy travel" (sole proprietor: Georgios Kesidis), a Cyprus-registered private-hire operator based at Diagorou 20, Kato Paphos 8042, Cyprus, business registration 637476. This policy explains what personal data we collect when you use our website, mobile web app, iOS/Android app, or booking services, and how we handle it in line with the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018.
2. Data we collect
When you book or contact us we collect: full name, email address, phone number, pickup and drop-off addresses, date and time of travel, number of passengers, flight number (if provided), vehicle preference and any notes you include. When you use the app on your device we automatically receive: IP address, browser type, operating system, referring URL, timestamps, coarse location (only if you tap 'Use my location'), and installation events (whether you added the app to your home screen). We do not collect or store payment card numbers — all card payments are processed inside the vehicle by our regulated in-car terminals, or in-browser directly by Stripe (see Section 5).
3. Legal basis for processing
We rely on the following GDPR bases: (a) performance of a contract — to deliver the transfer you booked; (b) legitimate interest — to prevent fraud, improve the service, and analyse aggregate usage; (c) consent — for optional features like push notifications and marketing emails, which you can opt in / out of at any time; (d) legal obligation — to keep booking and tax records as required by Cypriot law.
4. How we use your data
We use your data only to: confirm and deliver your booking; communicate with you (SMS / WhatsApp / email) about your ride; issue receipts; provide customer support; comply with legal obligations; and, if you opt in, send you occasional service updates. We do NOT sell your data, we do NOT share it with advertisers, and we do NOT use it for automated decision-making that produces legal effects.
5. Third-party services
We use a small number of trusted third-party sub-processors: (a) Google Maps / Places (address autocomplete + route calculation — Google's own privacy policy applies); (b) Stripe (card payments — Stripe stores card details, not us); (c) Resend (transactional email delivery); (d) CallMeBot / Meta WhatsApp (booking notifications); (e) OpenAI (only for our AI trip-planning helper, if you use it — chat text is sent to OpenAI, never your booking data); (f) MongoDB Atlas (our encrypted database, hosted in the EU); (g) VAPID Web Push (for browser notifications, only if you opt in). (h) Google Tag Manager and Google Ads (measurement of ad clicks and completed bookings: booking reference and value; email and phone are hashed for enhanced conversions). Each sub-processor is bound by a Data Processing Agreement and processes data only on our instructions.
6. Push notifications
If you tap 'Enable notifications' or install our iOS/Android app, we ask your OS for permission to send push notifications about your booking status, driver arrival, and occasional promotional offers. Push tokens are anonymous device identifiers — we cannot use them to see anything else on your device. You can revoke this permission at any time in your device or browser settings, or by messaging us.
7. Cookies & local storage
Our website uses strictly-necessary cookies (language preference, login session), localStorage entries (recent searches, saved addresses, your cookie choice) and, only if you accept cookies, the Google Tag Manager / Google Ads tag, which measures ad clicks and completed bookings. See our Cookie Policy for details.
8. Data retention
Booking records are kept for 7 years to comply with Cyprus tax law. Contact-form messages are kept for 12 months. Push subscriptions are kept until you unsubscribe. Recent-address entries in localStorage are stored on your device only — you can clear them at any time. On request we will delete all personally-identifiable data outside our legal retention window.
9. Your rights (GDPR)
You have the right to: (a) access — request a copy of your data; (b) rectification — correct anything inaccurate; (c) erasure — ask us to delete your data (subject to Section 8); (d) portability — receive your data in a machine-readable format; (e) restriction — pause our use of your data; (f) objection — object to any legitimate-interest processing; (g) withdraw consent at any time; (h) lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (www.dataprotection.gov.cy). To exercise any of these rights email support@costataxicy.com — we respond within 30 days.
10. Children
Our service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Security
Data is transmitted over TLS 1.3, stored in an encrypted EU-based MongoDB Atlas cluster, and access is limited to authenticated Costa Taxi staff on a need-to-know basis. Passwords are stored using bcrypt. We conduct regular security reviews.
12. International transfers
Some sub-processors (e.g. Stripe, OpenAI) are US-based. Where data leaves the EEA we rely on the EU Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework, which are recognised by the European Commission.
13. Changes to this policy
We may update this policy from time to time. Material changes will be announced on this page and, if you have provided an email, notified to you directly. The 'Last updated' date at the top always reflects the current version.
14. Contact
Data controller: Costa Taxi CY, registered address Diagorou 20, Kato Paphos 8042, Cyprus. Email: support@costataxicy.com · Phone: +357 99 940 234. For urgent data-protection matters mark your email 'GDPR request' in the subject line.