Privacy Policy

1. Who is responsible

1.1 Protso OÜ is the controller for personal information used to operate protso.com, handle enquiries and administer its bookings and customer relationships. Estonian registry code: 14404876. Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Järvevana tee 9, 11314, Estonia. Contact team@protso.com for privacy requests, quoting only the information needed to identify the matter.

1.2 This notice covers website visitors, customers, travellers, people booking for others and representatives of agencies or service providers who use our website. An OTA, payment provider or transport operator may also process information for its own purposes under its own privacy notice. Their involvement does not remove our responsibilities for our own processing.

2. Information we collect and its sources

2.1 When you search or enquire, we process the route or destination, travel dates, passenger numbers, currency, contact details and the message you submit. When you book, the information may also include traveller names, telephone numbers, pickup and drop-off addresses, flight or train references, ages needed for child seats or activity eligibility, luggage, service options and booking references.

2.2 We receive information directly from you and, where relevant, from the lead booker, your travel agent, an OTA or the supplier involved in your service. Please make this notice available to people whose details you provide and ensure you have authority to arrange their travel. If someone else supplied your details, you can ask us about the source and the information held.

2.3 Customer and agency accounts use email verification and session credentials. Service messages, uploaded attachments, operational records, changes, cancellations, complaints and payment references may be stored with a booking. Connection information, such as IP addresses, browser details, request times and error or security records, is also processed when systems deliver or protect the service.

3. Why we use information and our legal bases

3.1 For a customer who contracts with us, we use necessary information to respond to requested enquiries, quote, accept and administer bookings, coordinate pickup, handle payment, send service updates and arrange refunds: steps before a contract and performance of that contract under GDPR Article 6(1)(b). Without essential contact and travel information we may be unable to arrange the requested service.

3.2 For travellers booked by another person and business representatives, coordinating the requested journey and communicating with the authorised booker generally relies on our legitimate interests in providing the service, taking account of the traveller’s rights. Security, prevention of payment abuse, service quality investigations and the establishment or defence of legal claims may also rely on legitimate interests under Article 6(1)(f). You can object to processing based on legitimate interests.

3.3 We use relevant records to meet accounting, taxation, regulatory and lawful disclosure obligations under Article 6(1)(c). Where we request consent for a genuinely optional purpose, Article 6(1)(a) applies and consent can be withdrawn. Agreeing to booking terms does not itself give consent for unrelated marketing or optional tracking.

4. Payments

4.1 Card payments are handled through Stripe’s checkout service. We receive booking-related payment information such as transaction references, amount, currency, payment status and refund or dispute information. Do not send full card numbers, card security codes or banking passwords to us in ordinary messages.

4.2 Stripe also processes information for payment security and its own regulatory purposes. Its applicable privacy information is available at https://stripe.com/privacy. Your bank and payment network have their own processing responsibilities.

5. Travel suppliers and other recipients

5.1 Information needed to deliver your booking is shared with the relevant transport operator, driver, tour operator or guide. This may include the lead traveller’s name and contact details, journey times, flight reference, meeting point, passenger and luggage requirements and relevant service instructions. Information is also exchanged with your authorised agent or OTA where needed to administer that booking.

5.2 Authorised personnel and technical providers support hosting, booking databases, account access, communications, payment processing, address search and message translation. The website uses Vercel for hosting, Supabase-backed booking services, Stripe for checkout and Google-derived address search. Company email communications use Microsoft services. Message translation may involve a translation service provider.

5.3 Professional advisers, insurers, payment-dispute handlers and public authorities may receive relevant records where necessary and lawful. Requests for information about a booking must be verified before personal details are disclosed. A supplier needs service information, not unrestricted access to every customer record.

6. Address search, content and external services

6.1 When you type a pickup or destination, the entered location and relevant search context are processed to suggest and resolve places using Google-derived location services. Avoid entering unrelated personal or medical information into location fields.

6.2 Some pages load fonts or images from external services, including Google Fonts or Unsplash. Delivering these resources involves a network request that can disclose connection information such as an IP address and browser information to the resource provider. External service policies include https://policies.google.com/privacy and https://unsplash.com/privacy.

6.3 External links take you to services with their own privacy practices. This notice does not replace those services’ notices.

7. Messages, translation and automated processing

7.1 Booking communications may be automatically translated to help customers and service teams understand one another. Message text and the language required may be processed by a translation service. The original message can be consulted; ask us to verify important pickup, cancellation or safety instructions if a translation is unclear.

7.2 Automated tools also support search, price calculations, payment status and operational routing. A displayed quote depends on the search and service information. If an automated result appears wrong or affects your booking, contact us for review by a person. This notice does not authorise a new use of messages for unrelated marketing or a new solely automated decision with legal or similarly significant effects.

8. Sensitive information and children

8.1 We generally need practical assistance requirements, not a complete medical history. Please do not upload unnecessary identity documents, health records or other sensitive information. If an arrangement requires health-related information, contact us so that we can determine a suitable collection method and a valid special-category condition, such as explicit consent where appropriate. Ordinary booking acceptance is not that consent.

8.2 Bookings must be made by an authorised adult. Information about children is used where needed to arrange their travel, lawful restraints or age-related participation conditions. Only provide the details necessary for that purpose.

9. International processing

9.1 Our services involve destinations and technology providers in different countries. Relevant booking information may need to be sent to the supplier in the destination country, and technology providers may process information outside the European Economic Area. Storage in one region does not necessarily mean that every support or subprocessing operation stays in that region.

9.2 For restricted transfers, the applicable mechanism must be identified: for example an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses, with additional measures where required. Specific contract-necessity exceptions are limited and are not a blanket basis for routine overseas outsourcing.

9.3 The published provider arrangements describe their transfer mechanisms: Vercel at https://vercel.com/legal/dpa and Supabase at https://supabase.com/legal/dpa. These describe those providers’ services, not every destination supplier. Contact team@protso.com for information about recipients and applicable safeguards for your booking, and to request a copy where available, subject to necessary redactions.

10. How long information is kept

10.1 Retention depends on the purpose and applicable obligations. Accounting source documents subject to Estonian retention rules are generally retained for seven years from the end of the financial year to which they relate. This does not mean every message or browser record needs to be retained for seven years.

10.2 Other booking and support records are assessed according to completion of the service, outstanding refunds or disputes, applicable claim periods and legal retention duties. Unconverted enquiries are assessed according to whether follow-up is still reasonably needed; account information according to the continuing relationship and associated obligations. Security records are assessed according to investigation and protection needs.

10.3 When the purpose and any legal need end, information should be deleted or anonymised. A legal hold or unresolved dispute can justify longer retention of relevant records. This notice does not promise that closing an account instantly erases financial records or all backup copies. Contact us for a retention assessment or erasure request concerning your information.

11. Marketing and your choices

11.1 Booking confirmations, pickup instructions and necessary service messages are operational communications. They are separate from advertising. A purchase, enquiry or acceptance of these Terms does not automatically enrol you in marketing.

11.2 If we offer marketing subscriptions, the relevant permission or other legally permitted basis and an opt-out must be provided. You may object to direct marketing at any time by contacting team@protso.com; withdrawing marketing permission does not cancel an existing booking.

12. Your data protection rights

12.1 Subject to the applicable conditions, you may request access and a copy, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent for processing that relies on consent without affecting its earlier lawful use. Rights are not absolute; for example, an accounting obligation or a legal claim may require some records to remain.

12.2 Email team@protso.com with your request. We may seek proportionate information to verify your identity and protect other travellers’ data. We normally respond within one month. If a lawful extension of up to two further months is needed because of complexity or the number of requests, we explain it within the first month. Where a request cannot be fulfilled, we explain the reason and available complaint rights.

12.3 You may complain to the Estonian Data Protection Inspectorate at https://www.aki.ee/en or the supervisory authority in the country of your habitual residence, work or alleged infringement. You do not have to waive a complaint right or first accept our conclusion.

13. Security and updates

13.1 Keep verification codes and account or payment links private, use trusted devices and sign out of shared devices. Let us know promptly if you suspect unauthorised use of your account or booking. No internet service can promise absolute security.

13.2 This notice is dated and versioned. Material new processing requires appropriate information and, where necessary, a new legal basis or consent; publishing an updated notice alone does not supply consent. Cookies and similar browser storage are described in the separate Cookie Policy.