1. Data Controller

Elevelon S.r.l. · Sole shareholder

VAT no., tax code and Catania Companies Register no. 06169490874 · REA CT-473902

Address: Via Mineo, 33 — 95125 Catania (CT), Italy · Certified e-mail (PEC) elevelon@pec.it

Email: privacy@milanairporttransfer.it

2. Types of personal data collected

• Identity and contact data (name, surname, email, phone).
• Booking and travel data (route, timing, flight number, number of passengers, operational notes).
• Technical browsing data (IP address, user-agent, system logs).
• Payment and transaction data handled by authorized providers.
• Communication data sent through forms, email, or support channels.

3. Purposes and legal bases

• Booking management and service execution (Art. 6.1.b GDPR).
• Administrative, accounting, and tax compliance (Art. 6.1.c GDPR).
• Customer support and service protection (Art. 6.1.f GDPR).
• Marketing communications only where consent is required (Art. 6.1.a GDPR).

4. Processing methods and security

Data is processed through adequate technical and organizational measures, proportionate to the risk level.

Data access is limited to authorized personnel and duly appointed parties.

5. Recipients and external processors

Data may be shared with technical and professional providers required to deliver the service (hosting, email, payments, support), appointed as processors where required under Art. 28 GDPR.

In particular, payment data is processed by Stripe, Inc. as a PCI-DSS certified payment processor (stripe.com/privacy).

The data required for the service is shared with the licensed NCC carrier that performs it, with which the contract of carriage is concluded, as an independent data controller for the performance of the transport.

6. Transfers outside the EU

Where required, transfers to non-EU countries are carried out in compliance with GDPR using appropriate safeguards (e.g. Standard Contractual Clauses).

7. Retention period

• Contractual and administrative data: for as long as needed to provide the service and meet legal obligations.
• Accounting and tax data: according to applicable legal retention periods.
• Marketing data: until consent withdrawal or objection.

8. Data subject rights

Data subjects may exercise rights of access, rectification, erasure, restriction, portability, and objection (Arts. 15-22 GDPR), and may lodge a complaint with the competent supervisory authority.

9. Privacy contact

For privacy requests and rights exercise: privacy@milanairporttransfer.it

10. Policy updates

This policy may be updated over time. The latest version is published on this page.