info@transfernaples.it

Privacy Policy

Last updated: 15 August 2026

This notice explains how Transfer Naples collects and uses the personal data of users of the website www.transfernaples.it and of customers of our chauffeur (NCC) service, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller

The data controller is:

  • Cuono Rea, sole trader operating under the business name Transfer Naples
  • Registered address: Traversa Masseria Cangiano 3 – 80040 San Sebastiano al Vesuvio (NA), Italy
  • Italian VAT and tax number: 09399471219
  • Email: info@transfernaples.it

For any matter concerning your personal data you can write to the email address above.

No Data Protection Officer (DPO) has been appointed: the processing does not fall within the cases of mandatory appointment set out in Article 37 GDPR, as we are not a public authority and we do not carry out large-scale processing of special categories of data or large-scale systematic monitoring.

2. What data we collect

2.1 Data you provide

Quote requests and transfer or tour bookings First name, surname, email address, telephone number, pick-up and drop-off locations, date and time of the service, number of passengers (adults and children), number and type of bags, flight or train number, preferred language, chosen payment method, and any free-text notes you enter in the form.

Invoicing data (only if you request an invoice) Company or individual name, VAT or tax number, certified email (PEC) or SDI recipient code, full address (street, city, province, postcode, country).

Contact form Name, email address and the content of your message.

Job applications ("Work with us") First name, surname, email, telephone, information on the professional requirements you declare (KB certificate, entry in the drivers' register, NCC licence) and any curriculum vitae attached.

Company and agency registration ("For business") Company name, contact person's name, email, telephone and address of the operator.

2.2 Data collected automatically

Browsing data The server hosting this website records, as all web servers do, the IP address, the date and time of the request, the page requested, and the browser and operating system type. This data is used for technical purposes, aggregate statistics and security, and to establish liability in the event of computer crimes against the website.

Cookies and similar tools This website uses technical cookies and tools only. Full details are in our Cookie Policy.

2.3 Data collected during the service

Our vehicles are fitted with a dashcam (road-facing camera) and a GPS system. Details of this processing are set out in section 7 below.

2.4 Data collected through external channels

You can also contact us through our Google Business Profile listing or through our Facebook and Instagram profiles. In that case we receive the data you yourself make available on those platforms (for example your profile name and the content of your message or review). Processing carried out by those platforms is governed by their own privacy notices, over which we have no control; we process only the data you send us in order to answer your request.

3. Why we process your data and on what legal basis

  • Providing quotes, managing bookings and delivering the transport service. Legal basis: performance of a contract or of pre-contractual measures requested by the data subject (Art. 6(1)(b) GDPR). Providing this data is necessary: without it we cannot accept the booking.
  • Answering requests sent through the contact form, by email, telephone or social media. Legal basis: pre-contractual measures or our legitimate interest in replying to those who contact us (Art. 6(1)(b) and 6(1)(f) GDPR).
  • Issuing invoices and complying with tax, accounting and administrative obligations. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
  • Assessing job applications. Legal basis: pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR).
  • Ensuring road safety and establishing or defending legal claims in the event of an accident (dashcam). Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
  • Managing the fleet and assigning vehicles to journeys (GPS). Legal basis: our legitimate interest in organising the business (Art. 6(1)(f) GDPR).
  • Establishing or defending legal claims and handling complaints or disputes. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
  • Ensuring the operation and security of the website. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
  • Measuring the effectiveness of our online advertising campaigns. We use Google Analytics 4 to measure how many bookings are completed and the Google Ads tag to connect them to adverts. We send Google Analytics the amount, the currency and a transaction code, not your identifying details. Legal basis: your consent (Art. 6(1)(a) GDPR), given through the cookie banner and withdrawable at any time via the "Cookie preferences" link in the footer. Providing it is optional: if you refuse, the website works in exactly the same way.

We do not send newsletters, promotional emails or marketing communications, and we do not carry out automated decision-making within the meaning of Article 22 GDPR. The only profiling tool in use is the conversion tag described above, which is activated only with your consent.

4. Who we share your data with

Your data is processed by the controller and by collaborators authorised and instructed pursuant to Article 29 GDPR. It may also be disclosed to the following parties, appointed as processors under Article 28 GDPR where applicable:

  • Aruba S.p.A. (Italy) — website hosting.
  • Supabase Inc. (United States) — infrastructure running the functions that forward the website forms.
  • Resend (Plus Five Five, Inc.) (United States) — service used to send the emails generated by the forms.
  • Google Ireland Limited / Google LLC — the business mailbox where we receive requests, the Google Maps service used in the booking form, our Google Business Profile listing and, subject to your consent, Google Analytics 4 and the Google Ads conversion tag. For the latter, Google acts as an independent controller for the data collected through its own advertising platform.
  • Partner chauffeur (NCC) companies, to which we may entrust the execution of the service where necessary, as provided in our Terms of Service. In that case we disclose only the data strictly needed to carry out the journey (name, telephone number, pick-up point and destination, time, number of passengers and bags).
  • Tax, accounting and legal advisors and other professionals assisting us, within the limits of their respective engagements.
  • Public authorities and supervisory bodies, where disclosure is required by law or necessary to establish or defend a legal claim.

We do not sell your personal data. The only disclosure for advertising purposes is the one to Google described above, which happens only if you have accepted the "marketing" category in the cookie banner.

5. Transfers outside the European Economic Area

Some of the providers listed above (Supabase, Resend, Google) are established in the United States or may process data on servers located outside the European Economic Area. Such transfers take place on the basis of the safeguards set out in Chapter V GDPR: the European Commission's adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework for providers that adhere to it and, additionally or alternatively, Standard Contractual Clauses adopted by the European Commission, together with supplementary measures.

You may request a copy of the safeguards in place by writing to info@transfernaples.it.

6. How long we keep your data

  • Booking and service delivery data: for the duration of the relationship and thereafter for 10 years from completion of the service, to comply with civil-law and tax obligations (Art. 2220 of the Italian Civil Code and VAT legislation).
  • Tax and invoicing documents: 10 years from issue.
  • Requests sent through the contact form or by email that do not result in a booking: 24 months from the last meaningful contact.
  • Job applications and CVs: only for as long as the selection process lasts, after which the data and any attachments are deleted. We do not maintain an archive of unsolicited applications.
  • Company and agency registration data: for the duration of the commercial relationship and for 10 years thereafter.
  • Dashcam recordings: see section 7.
  • Browsing data and server logs: according to the hosting provider's technical retention periods, ordinarily no longer than 12 months.
  • Cookie consent: your choice is stored on your device for 6 months, after which the banner will be shown again.

Once these periods expire, data is deleted or irreversibly anonymised, without prejudice to further retention where necessary to establish or defend a legal claim, and only for as long as required for that purpose.

7. Dashcam and GPS on board

7.1 Dashcam

Our vehicles may be fitted with a road-facing dashcam, installed for road safety purposes and to document how any accident occurred.

  • The camera does not film the passenger compartment and is not pointed at passengers.
  • Recording is on a continuous loop: footage is automatically overwritten and kept for a maximum of 72 hours.
  • Footage is not reviewed as a matter of routine. It is extracted and retained beyond that period only in the event of an accident, collision or dispute, for the time strictly necessary to establish or defend a legal or insurance claim, and in any case no longer than the resolution of the dispute.
  • Audio is not recorded.
  • Footage is not disseminated, published or disclosed to third parties, other than to insurance companies, the competent authorities and appointed lawyers in the cases described above.
  • The short-form notice required by the Italian Data Protection Authority's ruling on video surveillance is displayed inside the vehicles.

Legal basis: our legitimate interest in road safety and in establishing or defending legal claims (Art. 6(1)(f) GDPR).

7.2 GPS

Our vehicles are fitted with satellite tracking used for fleet management and for assigning vehicles to journeys (real-time vehicle position, to identify the nearest vehicle and estimate arrival times).

  • The system locates the vehicle, not the passenger.
  • No route history attributable to an individual journey or customer is retained: the data is used in real time and is not stored for the purpose of reconstructing movements.
  • Location data is not used for remote monitoring of drivers' work activity; should such processing ever be introduced, it will be preceded by the steps required under Article 4 of Italian Law 300/1970.

8. Your rights

At any time, and within the limits set by law, you may exercise the following rights:

  • Access (Art. 15 GDPR) — find out what data we process and obtain a copy of it.
  • Rectification (Art. 16 GDPR) — correct inaccurate data or complete incomplete data.
  • Erasure (Art. 17 GDPR) — obtain deletion of your data, except data we are required by law to keep.
  • Restriction (Art. 18 GDPR) — ask for processing to be suspended pending verification.
  • Portability (Art. 20 GDPR) — receive the data you provided in a structured format and transmit it to another controller.
  • Objection (Art. 21 GDPR) — object at any time, on grounds relating to your particular situation, to processing based on legitimate interest.
  • Withdrawal of consent (Art. 7(3) GDPR) — where processing is based on consent, withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, write to info@transfernaples.it stating which right you wish to exercise. We will reply within one month of receiving your request; this period may be extended by two further months for particularly complex requests, in which case we will inform you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

9. Complaint to the supervisory authority

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy – garante@gpdp.it – www.garanteprivacy.it) — or with the supervisory authority of the Member State where you habitually reside or work, or to bring proceedings before the courts.

10. Security

We apply technical and organisational measures appropriate to protect data against destruction, loss, alteration, unauthorised disclosure or access: encrypted connection to the website via HTTPS, transmission of forms over encrypted channels, mailbox access protected by individual credentials and multi-factor authentication, and access restricted to authorised persons only.

No system, however, is absolutely secure: please do not enter unnecessary data in the free-text fields of our forms (for example the notes field), and in particular do not enter data concerning health, ethnic origin, political or religious opinions or other special categories within the meaning of Article 9 GDPR.

11. Children

This website and our services are not intended for children under 16, who cannot make bookings on their own. A booking involving minors must be made by a parent or by a person exercising parental responsibility, who also provides any data relating to the minors travelling (name and number, for the purpose of allocating child seats and a suitable vehicle). If you believe a child has provided us with personal data, please write to us and we will delete it.

12. Changes to this notice

This notice may be updated to reflect legislative changes or the introduction of new services. The version in force is always published on this page, together with the date it was last updated. In the event of substantial changes we will make this evident on the website and, where processing is based on consent, we will ask you to express it again.