Privacy policy

Controller

Drivecab Nasr Limousine

Owner: Lugman Abdullah Nasr

Address:
c/o Lugman Abdullah Nasr
Bändlistrasse 73
8064 Zurich

For data protection enquiries, please use the address above or the contact options described on this website (e.g. booking or enquiry form).

What data do we process?

Depending on how you use our services, we may process the following categories of personal data:

• Identity and contact data: e.g. first and last name, telephone number, email address.
• Booking and trip details: e.g. pick-up and destination (text), date and time, vehicle choice, passengers/luggage (transfer), duration (hourly booking), optional notes, estimated price in CHF, and technical helper data (e.g. Google place IDs, calculated distance).
• Usage and connection data: e.g. IP address, date and time of access, requested resources, user agent, technical error logs — where collected in server logs or for security and stability.
• Communication data: content and metadata of enquiries you send via forms or other contact channels.
• We do not make solely automated individual decisions with legal effect or similarly significant effects on you, and we do not run advertising profiling.

Purposes and legal bases

• Providing and securing this website (including abuse prevention, e.g. basic rate limiting): overriding private interest pursuant to Art. 31 (1) FADP.
• Processing your ride or booking request, generating a price estimate, and communicating with you to prepare and perform the service: directly related to the conclusion or performance of a contract pursuant to Art. 31 (2) (a) FADP.
• Storing request data in our database for handling, follow-up and internal organisation: likewise in connection with contract preparation or performance, or an overriding private interest in orderly business operations pursuant to Art. 31 FADP.
• Sending confirmation or information emails to the address you provide: in connection with contract preparation or performance pursuant to Art. 31 (2) (a) FADP.
• Using processors (hosting, database, email delivery, mapping/routing) to operate the site and these features: performance of the contract or overriding private interest pursuant to Art. 31 FADP; for Google Maps/Places, your use of those features may also constitute consent to transfer inputs to Google where required.

Website, server logs and security

When you visit this site, the hosting provider and/or our servers automatically process technical information (including IP address, time, requested URL, browser identifier) to deliver content, maintain IT security (detecting attacks or faults) and prevent abuse. Processing is based on legitimate interests and is proportionate; we do not run additional tracking or marketing analytics beyond what is described here.

Booking and enquiry form

When you submit the form, the data you enter is sent to our servers. We use it to handle your request, contact you and — where applicable — prepare the transport. Mandatory fields are marked as such; without them we usually cannot process the request. Transmission is encrypted (HTTPS) where your browser supports it.

Email, database and optional WhatsApp

After you submit a request, we may send confirmations or follow-up questions to your email and forward a copy or summary to our internal operations mailbox. Request data may be stored in a PostgreSQL database (provider: Neon), including request language, full form payload (JSON), email address and estimated amount. Email is sent via Infomaniak Network SA, based in Geneva (Switzerland). If operator notifications include a WhatsApp link, you open a service provided by Meta Platforms Ireland Ltd.; WhatsApp’s terms and privacy notices apply.

Google Maps (Places Autocomplete, Distance Matrix)

Address suggestions and route/time estimates may transmit inputs (search terms, place IDs) from our servers to Google LLC or affiliates. Google may use cookies or similar technologies and process data in the USA or other countries. See Google’s Privacy Policy. Do not use these features if you do not wish data to be sent.

Processors and service providers

We use carefully selected processors that handle data only on our instructions and to the extent required. Specifically: hosting and CDN (Vercel Inc., USA, with EU edge delivery); database hosting (Neon Inc., configured EU region) for booking, status and technical analytics events; rate-limit store (Upstash, Inc., EU region) for short-term abuse prevention (see dedicated section); email delivery via Infomaniak Network SA (based in Geneva, Switzerland; SMTP and mail hosting); mapping and routing (Google LLC, USA — see dedicated section); performance measurement (Vercel Speed Insights, cookieless); and — only with your consent — Google Analytics 4 (Google LLC, USA).

Information on how Neon processes data is available in Neon — Privacy Policy.

Abuse protection (rate limiting)

To protect this website and its endpoints (in particular the booking form, address search, and admin login) against automated attacks, spam and excessive requests, we operate access limits. For this purpose, an external counter service (Upstash, Inc., EU region) stores your IP address together with a time window of typically 60 seconds; entries are discarded automatically once the window expires. The data is not linked to booking or contact details and is not retained long term. The legal basis is our overriding private interest in IT security pursuant to Art. 31 FADP.

International transfers

Where recipients (e.g. Google, hosting or email providers) process data outside Switzerland, we ensure — where required — an adequate level of data protection (e.g. EU standard contractual clauses, recognised certifications or adequacy decisions) or rely on another statutory exception. Further details are available on request.

Retention

We keep personal data only as long as necessary for the purposes described or as required by law (e.g. commercial or tax retention). Server logs are typically rotated or anonymised after a short period. Booking enquiries may be kept longer for order handling and customer communication; deletion occurs when the purpose no longer applies and no legal duties prevent it.

Security

We implement appropriate technical and organisational measures to protect data against unauthorised access, loss or misuse (e.g. TLS, access restrictions, system maintenance). Absolute security cannot be guaranteed on the internet.

Cookies and local storage

This site may use technically necessary mechanisms required for operation (e.g. session, language, security). We do not use advertising tracking cookies unless separately added later with consent.

Cookie consent

On your first visit you will be asked which cookie categories you wish to allow. Necessary cookies (language preference, admin login) are essential for the site to function and cannot be disabled. Analytics and marketing cookies are not currently set, but are reserved for future use and will only be activated with your explicit consent. You can withdraw your consent at any time by clearing cookies and local storage for this domain in your browser settings.

Analytics and statistics services

This website uses the following services to analyse usage behaviour:

• DriveCab first-party analytics — when individual pages are viewed and when the booking form is submitted, an event is sent to our own endpoint (/api/track) and stored in our database. Recorded fields: requested path, referrer, UTM campaign parameters, language version, country code and device category. Instead of a persistent identifier we use a daily-rotating, irreversible hash of IP address, user agent and a daily-mixed secret (SHA-256, truncated to 16 characters). No cookies are set, no data is shared with third parties, and identification of individual visitors is not intended.
• Vercel Speed Insights — technical performance measurement, cookieless.
• Google Analytics 4 (GA4) — only loaded with your consent (marketing category). GA4 sets cookies. More information: policies.google.com/privacy.

Your rights

• Information on whether and which personal data we process about you;
• Rectification of inaccurate data;
• Erasure, restriction of processing or provision in a common electronic format, where the statutory requirements are met;
• Objection to processing based on legitimate interests, on grounds relating to your particular situation, where provided by law;
• Withdrawal of consent with effect for the future, without affecting the lawfulness of processing before withdrawal;
• Further rights may apply under the FADP depending on the case.

To exercise your rights, contact the controller. We may ask for additional information to verify your identity.