Skip to content
Holiday2Transfer

Privacy policy

Last updated: September 30, 2026

Data controller

Controller: 2TRANSFER SOLUTIONS S.L., tax ID (NIF) ESB22676118, Camino Bahía Grande 7, 11130 Chiclana de la Frontera (Cádiz), España. Registered in the Cádiz Commercial Register (Registro Mercantil), section 8, sheet CA-67054, entry 1ª.

Contact for any privacy matter: info@holiday2transfer.com or +34 607 11 80 59. We have not appointed a Data Protection Officer (DPO) because it is not mandatory; that email address is the privacy contact point.

Data we process

We process the following categories of data:

  • Identification and contact: first name, surname, email address and phone number.
  • Trip data: origin, destination, date and time, flight or train number, passengers, luggage, child seats and any instructions you give us.
  • Booking and payment data: reference, amount and payment status. Your card details are collected directly by Stripe and do not pass through our servers.
  • Communications: messages, enquiries and group or quote requests.
  • Technical data: IP address, device, browser and security logs.
  • Cookie preferences: anonymous identifier, version, date and decision.
  • Analytics data, only if you accept analytics cookies.

Where the data comes from

You provide the data yourself when you book, contact us or use the site. If you book for other people, you must inform them of this policy and have their permission to give us their data.

What we use your data for

  • Booking and payment management: managing your booking, charging for the transfer, sending you the confirmation and documents, and letting you view, change or cancel your booking.
  • Customer service and requests: helping you by phone, WhatsApp or email and answering your enquiries and group or quote requests.
  • Security and anti-fraud: protecting the site and its forms against abuse and automated submissions (Cloudflare Turnstile) and preventing payment fraud.
  • Analytics: measuring how the website is used in order to improve it, only with your consent.
  • Legal compliance: meeting commercial, tax and other legal obligations, responding to requests from authorities and defending ourselves against claims.

Legal basis

  • Performance of a contract (art. 6(1)(b) GDPR): managing the booking and payment, and pre-contractual steps you request, such as a group quote.
  • Consent (art. 6(1)(a) GDPR): analytics. You can withdraw it at any time without affecting earlier processing.
  • Legitimate interest (art. 6(1)(f) GDPR): the security of the site, fraud prevention and defence against claims. The Turnstile check on forms is a technical resource necessary for their security and does not require consent.
  • Legal obligation (art. 6(1)(c) GDPR): commercial and tax obligations and cooperation with authorities.

Recipients and processors

We do not sell your data. We share it, only as far as necessary, with:

  • The authorised partner carriers that carry out your transfer: they receive the data needed to provide it (name, phone number, pickup and destination, date, time, flight or train and passengers).
  • The 2Transfer booking platform, which manages bookings.
  • Stripe, which processes the payment.
  • Cloudflare (network, security and the Turnstile check on forms) and Railway (site hosting), as infrastructure providers.
  • Trustpilot, if you click to see reviews on the site or, where applicable, to invite you to rate the service.
  • Google Analytics and Microsoft Clarity, only if you accept analytics cookies.
  • Meta (Facebook and Instagram) and Google Ads, only if you accept advertising cookies.
  • Authorities, where the law requires it.

Each provider processes data according to its role (as a processor or as its own controller, as the case may be) and with the safeguards provided for in the GDPR.

International transfers

Some of these providers (for example Stripe, Google, Microsoft, Meta, Cloudflare, Railway or Trustpilot) may process data outside the European Economic Area, including in the United States. In that case, the transfer takes place with the safeguards provided for in the GDPR, such as European Commission adequacy decisions or standard contractual clauses. You can ask us for information about these safeguards at info@holiday2transfer.com.

Retention

We keep data for as long as the relationship lasts and, afterwards, blocked for the periods required by law.

  • Booking data: for the applicable statutory commercial and tax periods.
  • Requests and enquiries (leads): 12 months.
  • Cookie consent: while it is valid and for the limitation period of possible liabilities.
  • Analytics data: governed by the cookie policy.

Once these periods have passed, we delete or anonymise the data.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as the right not to be subject to decisions based solely on automated processing, by writing to info@holiday2transfer.com and stating the right you are exercising. If we have reasonable doubts about your identity, we may ask you to prove it. We will reply within the legal time limit (one month, which may be extended in the cases the law provides for).

You can withdraw your analytics consent at any time with “Change my cookie choice”.

If you believe your rights have not been honoured, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Automated decisions

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The Turnstile check is a technical control against automated submissions.

Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration. If a security breach occurred that posed a risk to your rights, we would notify the supervisory authority and, where required, you, in accordance with the GDPR.