Platform Privacy Policy

1. Who is the data controller

For data collected by the booking page itself (cookies, captcha, IP for fraud and rate-limiting), Dot360 is the controller. For data you submit to make a booking (name, email, phone, pickup/drop-off addresses, flight number, payment), the Operator you are booking with is the controller; Dot360 acts as a processor and transmits the data to that Operator's system.

2. What we collect

• Booking data — name, email, phone, pickup/drop-off, date, passengers, optional flight number and notes. Stored in the Operator's system; we hold a short-lived copy only to relay it to them.
• Technical data — IP address, user agent, request timestamps, captcha verification result. Used for fraud detection, rate limiting, and abuse investigation. Retained for 90 days.
• Payment data — handled entirely by Stripe; we never see or store card numbers. We retain a Stripe PaymentIntent id for reconciliation.

3. Legal basis

Booking data: performance of a contract (your booking). Technical data: legitimate interest (security and fraud prevention). Payment data: contractual necessity. Captcha: legitimate interest in protecting the service.

4. Who we share with

• The Operator you are booking with, so they can fulfil the transfer.
• Stripe (payment processor) for card payments.
• Cloudflare or hCaptcha for spam protection — these providers see your IP + a short-lived challenge token.
• Google Maps for address autocomplete — your typed text and approximate location are sent to Google. See Google's privacy policy.
• Email providers we use to deliver booking confirmation messages.

We do not sell personal data. We do not use your booking data for advertising.

5. International transfers

Stripe and Google may process data outside the EEA under Standard Contractual Clauses. Operators are typically within the EEA; check the Operator's own policy if this matters to you.

6. Cookies

We use only functional cookies needed for the booking page to work (session, captcha challenge). No advertising or analytics cookies are set by the Platform. The Operator's installation may set additional cookies in their own admin tools, which are out of scope here.

7. Your rights (GDPR)

You have the right to access, rectify, erase, or restrict processing of your personal data, and the right to object and to data portability. To exercise these rights for booking data, contact the Operator. To exercise them for Platform-level data (audit logs, captcha records), email privacy@dot360.io. You may also lodge a complaint with your national data-protection authority.

8. Retention

Audit logs (per-request): 90 days. Booking records: held in the Operator's system per their retention policy. Email confirmations: held by your email provider per their policy.

9. Changes to this policy

We may update this policy as the Platform evolves. The "Last updated" date at the top reflects the most recent change. Material changes will be highlighted on the booking page.