This Privacy Notice is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Decree 101/2018 ("Privacy Code") to describe how personal data of users interacting with movisalento.it and with the services offered by Movi are processed.
1. Data Controller
The Data Controller is Movi Salento, a project run by Simone as proponent, with operating address in Tricase (LE), Italy. Contact channels: email info@movisalento.it · WhatsApp +39 375 787 6484.
A VAT number is being applied for in connection with this project; the full Controller denomination and tax identifier will be updated on this page as soon as available.
2. Nature of the service
Movi operates as a technical intermediary between users seeking a private transfer service in Salento and authorised NCC drivers who provide the service. Movi is not a transport operator, does not enter into transport contracts and is not liable for the execution of the service. Operational, tax and insurance responsibility for the transfer remains with the NCC driver who holds the authorisation.
3. Categories of data processed
3.1 Browsing data
The IT systems hosting the Site automatically acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of internet protocols: IP addresses, browser type, operating system, references to pages visited, access times and visit duration. These data are used solely to obtain anonymous statistical information about the use of the Site and to verify its proper functioning.
3.2 Data provided voluntarily
- Transfer request via WhatsApp: when you click a "Book via WhatsApp" button or a route link, a WhatsApp conversation opens with a pre-filled message. Any data you choose to share in the chat (name, phone number, route, date, time, number of passengers, preferences) is transmitted via the WhatsApp/Meta Platforms Ireland Limited infrastructure and received by the Controller to handle your request.
- "Become a partner" form: NCC drivers interested in joining fill in a form which, on clicking "Open WhatsApp to send", builds a pre-filled message containing: full name, phone, operating area, number and type of vehicles, declaration of holding an active NCC licence, availability range, English knowledge, optional Instagram/Facebook links and free-text message. The message is opened in WhatsApp and sent by the user to the Controller's number.
- "Notify me at app launch" form: the user voluntarily provides their email address to be notified when the Movi app is released. The data is recorded in a Google spreadsheet (Google Sheets) via a Google Apps Script service, and is used solely to send the launch notification.
- Direct email: data communicated in emails sent spontaneously to info@movisalento.it.
3.3 Cookies and tracking tools
The Site uses technical cookies necessary for its operation and, with consent, Google Analytics 4 analytics cookies (with anonymised IP). Full details of all cookies used, purposes, duration and consent management are provided in the Cookie Policy.
4. Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Responding to transfer booking requests and managing the related intermediation with the NCC driver | Art. 6.1.b GDPR (performance of pre-contractual and contractual measures) |
| Evaluation and management of partner NCC driver applications | Art. 6.1.b GDPR (pre-contractual measures at the data subject's request) |
| Subscription to the mailing list for the app launch notification | Art. 6.1.a GDPR (explicit consent) |
| Aggregate statistical analysis on the use of the Site | Art. 6.1.a GDPR (consent given via cookie banner) |
| Compliance with legal obligations (tax, accounting, administrative) and defence of legal claims | Art. 6.1.c GDPR (legal obligation) and Art. 6.1.f (legitimate interest) |
5. Processing methods
Data is processed using electronic tools in compliance with technical and organisational security measures appropriate to the risk, in accordance with article 32 GDPR. Access to the data is limited to the Controller and to specifically authorised persons. The data is not subject to automated decision-making or profiling.
6. Retention period
- Booking request data: 24 months from the last contact, except for retention obligations of longer duration provided for by law.
- Partner application data: 24 months in case of unsuccessful onboarding; for onboarded drivers, for the duration of the intermediation relationship and subsequently for the period required by tax and accounting obligations (10 years).
- App waitlist email addresses: until consent is withdrawn or in any case no longer than 36 months from registration.
- Browsing and analytics data: in accordance with the times indicated in the Cookie Policy (maximum 14 months).
7. Recipients of the data
Personal data may be communicated to the following parties, in connection with the purposes set out above:
- Partner NCC drivers to whom the transfer request is forwarded for booking and contact purposes. Drivers act as independent data controllers as regards the performance of the transport service;
- Technology providers appointed as Data Processors pursuant to article 28 GDPR: Vercel Inc. (platform hosting and cookieless aggregate analytics), Google Ireland Ltd (analytics), WhatsApp Ireland Ltd / Meta Platforms Ireland Ltd (communication);
- Consultants and professionals assisting the Controller in legal, tax and accounting matters;
- Competent authorities in compliance with legal obligations or orders of the authority.
Data is not disseminated and is not communicated to parties other than those listed.
8. International data transfers
Some of the providers listed above (in particular Google and Meta) may process personal data in countries located outside the European Economic Area, in particular in the United States. Such transfers take place on the basis of the Standard Contractual Clauses adopted by the European Commission and, where applicable, the Data Privacy Framework certification, ensuring an adequate level of protection.
9. Data subject rights
As a data subject, you have the right, pursuant to articles 15-22 of GDPR, to:
- access your personal data;
- request its rectification or erasure;
- request restriction of processing;
- object to processing on legitimate grounds;
- receive the data concerning you in a structured and interoperable format (portability);
- withdraw your consent at any time, without prejudice to the lawfulness of processing based on consent before withdrawal.
To exercise your rights write to info@movisalento.it. We will respond within the time required by applicable law (usually within 30 days).
10. Complaint to the supervisory authority
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if you believe that the processing of your data infringes applicable law. For more information: www.garanteprivacy.it.
11. Data processing through the Movi app
In addition to the above (relating to the website and WhatsApp bookings), this section describes the processing that takes place when you use the Movi mobile app.
11.1 Data processed through the app
- Account data: name, email address, phone number, role (passenger or driver) and, if provided, profile photo and public nickname (@handle).
- NCC driver data (drivers only): NCC licence details (number, issuing municipality, expiry), vehicle data (make, type, plate, capacity), operating areas, languages spoken.
- Ride data: pick-up and destination, date and time, number of passengers and luggage, optional indicative budget, notes for the driver, offer prices and final price, reviews and ratings.
- Location data (GPS):only with your consent through the operating-system permission and only on your action — for the "use my location" feature and, for the driver, to signal arrival at the meeting point. You can deny or withdraw the permission at any time from your device settings.
- Push notifications: a technical identifier (token) to send you operational updates about the ride.
- Technical and diagnostic data: in case of app errors or crashes, technical information about the device and the fault, solely for stability and security purposes.
11.2 Legal bases
Provision of the intermediation service through the app (account, requests, offers, passenger–driver matching, rides) and sending operational notifications: performance of the contract (art. 6.1.b GDPR). Use of GPS location: consent (art. 6.1.a), withdrawable at any time. Security, prevention of abuse and fraud, diagnostics: legitimate interest(art. 6.1.f). Verification of drivers' NCC licence requirements: performance of the contract / legal obligation.
11.3 Data shared between passenger and driver
Due to the nature of the service, some data is shared with the other party of the ride: the driver who accepts is shown your name and the data needed for the ride; a phone contact is made available only during the pickup phase, solely for coordination. The passenger is shown the driver's name, rating, vehicle and plate. The nickname/ride name is private data of the passenger and is not shown to the driver.
11.4 Providers and services used by the app
For the operation of the app we rely, in addition to the providers already listed for the website, on the following parties (data processors or independent controllers):
- Google Ireland Ltd. / Google LLC (Firebase and Google Cloud): authentication, database, cloud functions and file storage (functions hosted in the European region).
- 650 Industries, Inc. (Expo): sending push notifications.
- Functional Software, Inc. (Sentry): error and crash reporting.
- Google Maps Platform: route estimation, place search and address geocoding.
- Stripe Payments Europe, Ltd.: card payment handling, only when and if activated. Currently payments in the app are made in cash, directly between the parties, and we do not process card data.
11.5 Retention, transfers, rights and minors
The sections already present in this policy on retention period, international data transfers (guaranteed by adequacy decisions or Standard Contractual Clauses), data subject rights and complaint to the Garante also apply to the app. You may request at any time the deletion of your account and app data at the contacts indicated. The app is reserved for those who are at least 18 years old; we do not knowingly collect data from minors.
12. Changes to this notice
This notice may be updated at any time to reflect any regulatory or organisational changes. The date of last update is shown at the top of the document. Please review it periodically.
Document drafted on the basis of the public guidelines of the Italian Data Protection Authority and widely used professional templates. For specific cases, dedicated legal advice is recommended.