Privacy Policy

Edition 3. Effective from the date it is published.

1. Who is responsible for your data

Your data is processed by VIKI KIMO PRO, S.L. ("Let's GO"), NIF B75955716, registered office at Avenida 348, nº 36, 1º, 08860 Castelldefels, Barcelona, Spain, with its office at Carrer de Vilamarí, 60, 08015 Barcelona, Spain.

For anything about your data, write to info@letsgo-transfer.com.

This policy follows Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

2. Whom this policy is about

• passengers, and anyone who books a ride through Let's GO, including hotel and business staff who book for others;
• guests for whom a hotel or a business books a ride, and anyone for whom another person books one;
• drivers, and the carriers they drive for (the holders of the transport licence), whose relationship with Let's GO is also governed by the Let's GO Driver Agreement;
• visitors to the website;
• staff of hotels and of fleets who use a Let's GO account for their organisation.

3. What Let's GO collects

3.1. From a passenger or anyone who books: name, e-mail address, telephone number, a password kept only as a hash, and the language of the app. A profile photograph, if you upload one. If you sign in with Google or Apple, the name and e-mail address that account gives. For each booking: the pickup, destination and stop addresses and their coordinates, the time, the flight, train or ship number if you give one, extras, the price, the payment method, and, if you accepted advertising cookies, the campaign marks of the advertisement that brought you. Messages exchanged with the driver. Ratings and reviews. The token that lets the app send you notifications, and the list of devices you are signed in on, with their IP address, app or browser and app version. At registration, the IP address and the browser or app that registered. Each acceptance of Let's GO's documents: which document, which edition, in what language, from what device and when. For an invoice to a business: its name and tax details. Messages you exchange with Let's GO support. For a card you save: only its last four digits and the payment provider's reference for it. With your permission, the passenger app uses your phone's location to show where you are, to suggest a pickup and to look up nearby addresses; Let's GO's server receives the position for these look-ups and keeps them for up to one day, and keeps a position longer only as the pickup of a booking.

3.2. From a person someone else books a ride for - a guest of a hotel or a business, or anyone booked by another person: the name, telephone number and flight number the person who booked gives, so that the driver can meet the right person, and the payment if the guest pays by link. Whoever books is responsible for having the right to give Let's GO that data and for telling the person about this policy.

3.3. From drivers and carriers:

• identity: full name, identity document, date of birth where the tax rules in section 7 require it, a photograph shown to passengers, contact details;
• driving licence: number, class, expiry date and a copy;
• the carrier's status as an individual or a company, tax number, tax address and country of tax residence, VAT position and tax regime, social security position, and, for a company, its representative;
• the transport licence (in Spain, the VTC authorisation): number, issuing authority, holder, the vehicles it covers, and a copy; certificates of tax and social security registration;
• each vehicle: make, model, colour, year, plate, registration certificate, inspection (ITV) and insurance, with their expiry dates;
• for a driver employed by a carrier: the confirmation signed by the licence holder, with the holder's and the driver's details;
• the vehicle's position while the driver is online and during a trip, including when the app is in the background, sent every few seconds, and the route driven during a trip;
• trips, earnings, the invoices issued in the carrier's name, ratings, the orders a driver declined or returned, and the figures of the booking limits described in the Driver Agreement;
• messages exchanged with passengers and with Let's GO support, and the records of waiting at the pickup and of any correction to them;
• the payout account is opened with the payment provider, which collects the identity and bank details it needs itself.

3.4. From a visitor to the website: the choice made in the cookie banner, kept in your browser. After you accept: Google Analytics 4 events, and the campaign marks of an advertisement that brought the visit (utm_*, gclid, gbraid, wbraid), with conversions reported to Google Ads. On payment pages, the payment provider's own scripts. The sign-in buttons of Google and Apple.

3.5. From the passenger app: when it first opens, the app asks whether you agree to analytics. Until you answer, it sends nothing. If you agree, it sends to Firebase Analytics events about a booking and a payment - the booking's identifier, its amount and the car class - with the installation identifier and device data Firebase collects itself. Your answer is kept on the phone, and you can change it in the app's settings. The answer itself - whether you agreed or not - and the phone's platform (Android or iOS) are also sent to Let's GO's server, without your account and without any identifier of the phone or of the installation, and there, as section 3.6 describes, the answer is only added to the daily count. The driver app has no analytics.

3.6. For security and to keep the service running: IP addresses and networks, used to limit the rate of requests and to block abuse; technical crash reports sent to Sentry, in the EU, with addresses, coordinates, telephone numbers, e-mail addresses, card numbers and tokens removed before sending; a daily count of answers to the cookie banner and to the passenger app's analytics question, with no identifier, for which the IP address is used as a key for up to one day.

3.7. Where it comes from. Most of this data comes from you. Some comes from others: from the hotel, business or person who booked a ride for you; for a driver employed by a carrier, from that carrier; from Google or Apple when you sign in with them; from the payment provider, which tells Let's GO whether a payment went through and whether a payout account is ready; and from your phone, with your permission.

Let's GO does not store card numbers: cards are handled by the payment provider.

4. Why, and on what legal basis

• To perform the contract with you: your account; pricing and placing a booking; taking payment; putting the passenger and the driver in touch and showing the ride; the invoices; answering you. For drivers and carriers: registration, offering orders, payouts, trip records, and the other duties of the Driver Agreement.
• Because the law requires it: tax and accounting records, including invoices; the checks on carriers and drivers that transport rules require; the annual report on carriers to the tax authority under section 7; answering lawful requests from authorities.
• Because Let's GO has a legitimate interest: keeping the service secure, preventing fraud and abuse, enforcing the terms of use, including dealing with messages and comments that break them, operational alerts about failures, crash reports, recording what staff do in the admin panel, and establishing or defending legal claims.
• With your consent, and only with it: analytics and advertising on the website, analytics in the passenger app, and marketing messages. You can withdraw consent at any time, as easily as you gave it.

Messages between a passenger and a driver are part of the ride. Let's GO staff who handle bookings can see them in the booking's record and use them only to deal with a complaint, a dispute about the ride, an incident, a suspicion of fraud or abuse, or a request from an authority, on the basis of Let's GO's legitimate interest in resolving these fairly or, where an authority asks, of a legal obligation. They are not used for marketing or to assess how a driver works, and they are kept for the period in section 9.

What you must give. To book, you must give your name, e-mail address and telephone number and pay by card; without them a booking cannot be made. A carrier and its drivers must give the information and documents that transport and tax law and the Driver Agreement require; without them no orders are offered. Everything else, including consent to analytics and marketing, is up to you.

5. Decisions taken by automated means

For passengers: the price is calculated automatically from the route, the expected journey time, the car class and the extras (for a car with a driver by the hour or by the day, from its hourly or daily price), and a driver is found automatically. Let's GO does not build profiles of passengers.

For drivers and carriers, some decisions are automated, and one of them is profiling:

• orders are offered first to the nearest online driver of the right car class, and listed for all such drivers at the same time;
• how many bookings a driver can hold depends on a personal factor calculated from the bookings the driver completed and returned in the last 180 days - this is profiling;
• orders paid by card are offered only once the carrier's payout account is ready;
• a booking to be paid by link can be accepted by a driver before it is paid, but the trip does not start until it is paid;
• a booking held by a fleet without a driver is offered to all drivers some hours before the pickup;
• a shift ends automatically when the telephone has stopped responding for several hours;
• a booking that overlaps in time with one the driver already holds is refused, and a booking held for the next 2 hours keeps immediate orders and rentals from being offered to that driver;
• an order a driver declined or returned is not offered to that driver again, and the same order is offered to the same driver no more than 3 times;
• pickups outside Spain are not accepted.

The Driver Agreement (Annex 2) sets out how each one works. Ratings are averaged and shown, and have no automatic effect. No decision to suspend or end a driver's or a carrier's access is taken by an automated system alone. A driver or carrier can ask info@letsgo-transfer.com for an explanation and for a review by a person.

6. Who else sees it

Between the people on a ride: the driver sees the passenger's name, telephone number, the addresses and the flight number; the passenger sees the driver's name, telephone number, photograph, vehicle, plate and position and, once the app shows it, the carrier's name. The driver sees their own average rating; ratings and comments are seen by Let's GO staff and are not published. Once invoices are issued in the carrier's name, the invoices a customer receives show the carrier's name, tax number and address.

Hotels and businesses: their staff see the bookings made for their organisation, with the guest's name, telephone number and flight number, and can cancel them and send the tracking link; the owner of the account sees a statement that can be exported.

Fleets: a fleet sees, for its own drivers' trips, the pickup, destination and stops with their coordinates, the times, the price and the payment method, but not the passenger's name or telephone number; it also sees its drivers' names, telephone numbers, availability, rating and the status and expiry of their documents. When a booking held by the fleet is released to all drivers, the fleet's staff receive an e-mail with its pickup time and address.

Business partners that book for travellers send the traveller's name and telephone number and receive the driver's name, telephone number, vehicle, plate and a link showing the vehicle's position. Anyone who holds a ride's tracking link sees the same.

Companies that do part of the work for Let's GO, each under a contract that binds them to it:

• Stripe: payments, refunds, payouts to carriers, and the identity checks a payout account requires;
• Google: maps, address search and routes; notifications and, with your consent, analytics in the passenger app (Firebase); analytics and advertising on the website, with your consent (Google Analytics 4, Google Ads); sign-in; and the e-mail Let's GO sends, through Google Workspace;
• Apple: sign-in, for those who use it, and the delivery of notifications to iPhones;
• Sentry: crash reports, on servers in the EU;
• providers of services based on artificial intelligence: they help Let's GO staff handle requests, look after bookings and keep the service running, and receive only the data a given task needs;
• the providers of the servers, the database, the files and the backup copies, in the EU;
• Telegram: alerts to Let's GO's staff about failures and about events in the service; some alerts contain a booking's number, amount and addresses.

Authorities: the tax authority, including the annual report under section 7; courts, the police, and transport, consumer or data protection authorities, where the law requires it.

Let's GO does not sell personal data and does not pass it to anybody for their own marketing.

7. Reporting on carriers to the tax authority

Council Directive (EU) 2021/514 (DAC7) requires Let's GO to collect and check information about each carrier paid through Let's GO, and to report it once a year to the Spanish Tax Agency, which may share it with the tax authorities of other EU countries: the carrier's name, address, tax number, date of birth (individuals), VAT number and registration number (companies), the account it is paid into where Let's GO has it, and the amounts paid in each quarter. Let's GO keeps this information for the period those rules require.

8. Where it is kept

The servers of the service are in the European Union. Stripe, Google and Apple are based in the United States, and data reaches them there; those transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for companies certified under it, and on the Commission's standard contractual clauses. Telegram's servers may be outside the European Economic Area. Providers of services based on artificial intelligence may be located outside the European Economic Area; in that case the transfer relies on a European Commission adequacy decision or on the Commission's standard contractual clauses.

9. How long it is kept

• An account you delete: the ride history is anonymised rather than erased, because rides are accounting records. Document copies, notification tokens, the profile photograph, the registration IP address and user agent, and licence numbers are removed within 30 days.
• Bookings that were completed, cancelled or failed, with their payments and reviews: 7 years, the period tax law requires.
• Messages between a passenger and a driver: 1 year.
• Messages with Let's GO support: 1 year after the last message.
• The route a vehicle drove: 1 year.
• A working driver's document copies: 1 year after the driver's last trip.
• Notification tokens: 6 months without use.
• Sign-in sessions: 7 days. Sign-in links: 1 day.
• The vehicle's current position: 2 minutes, in a cache that expires by itself.
• Sealed identity data kept for tax purposes: 7 years.
• Advertising click identifiers (gclid, gbraid, wbraid): 90 days. Campaign names (utm_*) stay with the booking.
• Invoices: for at least the period tax and commercial law require; they stay after an account is deleted.
• The record of what staff do in the admin panel: kept without a time limit, because it is a record of staff actions.
• Records of your acceptance of Let's GO's documents: for as long as the account exists and, after that, for as long as they may be needed as evidence in a claim.
• Server logs, crash reports and alerts to staff: for as long as needed to investigate faults and abuse.
• Backups: daily and weekly copies, so deleted data can remain in a backup for up to 94 days before it is overwritten.

10. Your rights

You can ask Let's GO for a copy of your data, for a correction, for erasure, for a restriction of processing, for your data in a portable form, and you can object to processing based on a legitimate interest. You can withdraw consent to analytics, advertising and marketing at any time.

To use any of these rights, write to info@letsgo-transfer.com from the address of your account, or delete your account in the app's settings. Let's GO answers within one month and sends a copy of your data as a file when you ask for it.

If you think your data has been handled wrongly, you can complain to the Spanish data protection authority, the AEPD (www.aepd.es).

11. Security

Card numbers never reach Let's GO's servers. Passwords are kept only as a hash. Access to the data is limited to named staff, and what staff do in the admin panel is recorded. Crash reports have personal details removed before they are sent.

12. Cookies, and what the apps store

The website keeps in your browser what it needs to work, and nothing else until you agree:

• refreshToken: keeps you signed in; 7 days;
• lg_session_hint: tells the page whether you are signed in; 7 days;
• NEXT_LOCALE: the language you chose; 1 year;
• letsgo_cookie_consent_v1: your answer to the cookie banner; until you change it;
• repeat_order: the details of a ride you chose to book again; until you book it;
• small records that make the site easier to use, such as your favourite addresses, the names you gave your guests and a draft of the booking you are making; until you delete them or, for the draft, until you close the page;
• on the payment pages and the pages where you manage your cards, the payment provider's own cookies, which it uses to prevent fraud.

Only after you accept the banner:

• Google Analytics 4 cookies (_ga, and _ga_ followed by an identifier), set by Google to measure visits; up to 2 years;
• letsgo_campaign_v1: the campaign marks of the advertisement that brought you; 30 days.

You can change your choice at any time through "Cookie Settings" at the foot of the website. If you withdraw consent, the campaign marks kept in your browser are removed.

The apps store what they need to keep you signed in and to send notifications. The passenger app asks separately before it sends anything to analytics, as section 3.5 describes.

13. Marketing

Messages about a booking are part of the service; they are not marketing and cannot be turned off while you have bookings.

Offers and news are sent only to people who agreed to receive them. Today they are sent by hand through Google Workspace. To stop them, write to info@letsgo-transfer.com. Before Let's GO starts using a bulk mailing service, this policy will name it.

14. Children

An account requires you to be 18 or older. Let's GO does not knowingly collect data about children, except the fact that a child seat was booked. If a child's data reaches Let's GO through a booking made by an adult, it is kept as part of that booking and no longer.

15. Changes to this policy

When what Let's GO does with data changes, this policy changes with it, and the new edition is published on the website and in both apps with its date. Where a change needs your consent, Let's GO asks for it.

16. Contact

info@letsgo-transfer.com. VIKI KIMO PRO, S.L., Avenida 348, nº 36, 1º, 08860 Castelldefels, Barcelona, Spain.