Privacy policy
Last updated: 13 August 2026
This Policy explains how Reflatech OÜ collects and uses personal data when you use our booking platform (the “Platform”). It forms part of our Terms and Conditions.
1. Who is responsible for your data
The data controller is:
Reflatech OÜ
Registry code: 17328561
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Juhkentali tn 8, 10132
E-mail: contact@tunisiashuttle.com
We are established in Estonia and process personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”) and the Estonian Personal Data Protection Act.
2. What data we collect
2.1 Booking data — the information you give us to arrange a transfer: full name, e-mail address, telephone number, pick-up and drop-off addresses, date and time of travel, flight or ferry number, number of Passengers, luggage details, child-seat requests, and any special requirements or notes you add.
2.2 Payment data — the amount, currency, date, payment status and a masked reference to the payment method. Full card details are entered directly with our payment provider and are never received or stored by us.
2.3 Communications — e-mails, messages and support tickets you send us, and our replies, including any complaint you make.
2.4 Technical data — IP address, browser type and version, device type, language, pages visited and the time of visit, collected through server logs and cookies. See section 8.
2.5 We do not deliberately collect special categories of data. If you volunteer health or mobility information because it affects your transfer (for example, a wheelchair or an assistance animal), we process it only to arrange the journey and only with your explicit consent, given when you enter it.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating, confirming and administering your Booking; passing the journey details to the Transport Provider | Performance of a contract — GDPR Art. 6(1)(b) |
| Contacting you about your Booking (confirmations, driver details, changes, delays) | Performance of a contract — Art. 6(1)(b) |
| Taking payment and issuing refunds | Performance of a contract — Art. 6(1)(b) |
| Keeping accounting records and invoices | Legal obligation — Art. 6(1)(c), Estonian Accounting Act |
| Handling complaints, disputes and insurance claims; establishing or defending legal claims | Legitimate interests — Art. 6(1)(f) |
| Preventing fraud, abuse and chargeback fraud; keeping the Platform secure | Legitimate interests — Art. 6(1)(f) |
| Improving routes, pricing and service quality through aggregated analysis | Legitimate interests — Art. 6(1)(f) |
| Sending marketing e-mails, and using analytics or marketing cookies | Consent — Art. 6(1)(a), withdrawable at any time |
| Arranging accessibility or medical-related requirements you have told us about | Explicit consent — Art. 9(2)(a) |
Where we rely on legitimate interests, we have weighed them against your rights and concluded that the processing is limited to what you would reasonably expect when booking a transfer.
4. Who we share it with
4.1 The Transport Provider. To perform your Booking we send the assigned Tunisian transport company the details it needs to collect you: your name, telephone number, pick-up and drop-off addresses, date and time, flight number, Passenger and luggage counts, and any special requirement you have asked us to pass on. We do not send it your payment details.
4.2 Our payment provider, Stripe, which processes the transaction as an independent controller under its own privacy policy.
4.3 Service providers acting on our instructions as processors — hosting, e-mail delivery, customer support tooling and analytics. They are bound by data processing agreements under GDPR Art. 28.
4.4 Professional advisers, insurers and authorities, where necessary to obtain advice, handle a claim, or comply with a legal obligation.
We do not sell personal data, and we do not share it for third-party advertising.
5. Transfers outside the European Economic Area
Transfer Services take place in Tunisia, so the booking details described in clause 4.1 are transferred to a Transport Provider located outside the EEA. Tunisia is not currently covered by a European Commission adequacy decision.
That transfer is made under GDPR Art. 49(1)(b), because it is necessary for the performance of the contract between you and us: without sending the driver your name, telephone number and pick-up address, the transfer you booked cannot be carried out.
In addition, our agreements with Transport Providers require them to use your data solely to perform your journey, to keep it confidential, to apply appropriate security measures, and to delete it once it is no longer needed for that purpose or for their own legal obligations.
6. How long we keep it
| Data | Retention period |
|---|---|
| Booking and transaction records | 7 years from the end of the financial year, as required by the Estonian Accounting Act |
| Support and complaint correspondence | 3 years from the last message, or longer if a dispute is ongoing |
| Marketing consent and mailing list data | Until you withdraw consent, then 1 year to record the withdrawal |
| Server logs and technical data | 12 months |
| Cookie data | See section 8 |
Where data is no longer needed, it is deleted or irreversibly anonymised.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase your data where it is no longer necessary, where you withdraw consent, or where you successfully object (this does not override our legal duty to keep accounting records);
- restrict processing while a dispute about accuracy or legitimate interests is resolved;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability — receive the data you gave us in a structured, machine-readable format;
- withdraw consent at any time, without affecting processing carried out before the withdrawal.
To exercise any of these rights, write to contact@tunisiashuttle.com. We respond within one month. We may ask you to confirm your identity before acting on a request.
8. Cookies
We use:
- Strictly necessary cookies — session, security, load balancing and language preference. These are required for the Platform to work and are set without consent.
- Analytics cookies — only if enabled, and only with your consent, to understand how the Platform is used.
- Marketing cookies — not currently used. If introduced, they will be set only with your consent.
You can refuse non-essential cookies through your browser settings, and delete cookies through your browser at any time. Strictly necessary cookies cannot be switched off if you want to use the Platform.
9. Security
We use TLS encryption in transit, access controls limiting booking data to staff who need it, and reputable hosting and payment infrastructure. No system is perfectly secure, but where a breach is likely to result in a risk to your rights, we will notify the Estonian Data Protection Inspectorate within 72 hours and inform you where the risk is high.
10. Children
The Platform is not directed at children, and we do not knowingly collect data from a person under 16 making a booking. Children may of course travel as Passengers; their details are provided by the adult making the Booking and are used only to arrange the journey and any required child seat.
11. Changes to this Policy
We may update this Policy. The current version is always published on this page with its date. Where a change materially affects how we use your data, we will inform you by e-mail or through a notice on the Platform.
12. Contact
Reflatech OÜ — Registry code 17328561
Harju maakond, Tallinn, Kesklinna linnaosa, Juhkentali tn 8, 10132
contact@tunisiashuttle.com