Privacy Policy

Controller

RIDGI OÜ, trading as Baltic Transfer Company, registry code 16722675. Contact: Kanarbiku tn, Nõmme, Tallinn, Estonia; info@baltic-transfer.com; +372 5599 1555.

Data and purposes

We process the data submitted in transfer, tour, car-delivery and contact forms: name where requested, telephone number, email, route and stop details, date/time, waiting, selected vehicle, options, comments, and vehicle information for car delivery. We use it to answer requests, prepare and confirm bookings, provide the agreed service, communicate with customers, prevent abuse and meet accounting or tax duties.

Legal bases

Processing needed to respond to a request, take steps before a contract and perform a confirmed service is based on GDPR Article 6(1)(b). Accounting and tax retention is based on Article 6(1)(c). Security and rate limiting rely on legitimate interests under Article 6(1)(f). Consent is used only for optional cookies or any future optional marketing activity.

Technical processing and recipients

A route quote may be held in a WordPress transient for about 15 minutes. A pseudonymous HMAC-based IP-derived value is used for rate limiting for up to one hour. Booking and enquiry data are sent to the company email, the customer confirmation email and Telegram for internal notification. The website uses WordPress, hosting, Google Maps/Places and server-side Google Routes. If a customer chooses to pay through a separately sent Stripe Payment Link, payment is completed on Stripe’s external page; the website does not collect or store card number, expiry date or CVC. A physical card terminal supplied by Swedbank may also be used; the website does not receive or store the card details processed through that terminal.

Retention

Quotes are retained for about 15 minutes and rate-limit data for up to one hour. Accounting, tax and contractual records required by law are retained for seven years from the relevant financial year. An ordinary enquiry that does not result in a booking is retained for up to six months. Correspondence and operational data relating to a completed booking may be retained for up to three years where needed for contractual claims or the protection of the parties’ interests.

International transfers

Google, Telegram and Stripe may involve processing outside the EEA. Appropriate safeguards are applied where required by applicable data-protection law.

Rights and contact

You may request access, correction, erasure, restriction, objection or portability where applicable by writing to info@baltic-transfer.com. You may complain to the Estonian Data Protection Inspectorate (AKI).