Privacy Policy

This policy explains how Executive Airport Transfer (“we”, “us”, “our”) collects and uses personal data when you use executive-airport-transfer.co.uk or book a journey with us. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

The data controller is Executive Airport Transfer, run by Paul Fullerton, Unit 17, Lea Green Business Park, Eurolink, St Helens WA9 4TR, United Kingdom. For any privacy question or request, please write to us at the address above.

What we collect

Booking details you enter in our booking form: your name, email address, a contact phone number for the journey, pick-up and drop-off addresses, dates and times, flight or sailing numbers, number of passengers and luggage, any special requirements, and any notes you add.
Payment information. Payments are taken by our payment providers (Stripe and PayPal). We receive confirmation that you have paid, but we never see or store your full card details.
Messages you send us, for example by email.
Website usage data such as pages visited, device and browser type and approximate location, collected by analytics cookies only if you accept them in our cookie banner.
Technical data such as your IP address, which our hosting and security services process automatically to deliver the website and protect it from abuse.

We do not ask for special category data. If you tell us about a medical or accessibility need (for example for a hospital journey), we use it only to plan your journey, with your consent.

How and why we use it (lawful basis)

To quote, confirm and carry out your journey, including tracking your flight so we can adjust your pick-up time: performance of a contract.
To send booking confirmations, reminders and updates about your journey, and to answer your questions: performance of a contract and our legitimate interests in running our business.
To keep accounting and tax records: legal obligation.
To keep the website secure and prevent fraud or spam: legitimate interests.
To understand how the website is used and improve it with analytics: consent, which you can withdraw at any time.

We do not send marketing emails or texts unless you have asked us to, and we never sell your data.

Cookies

Strictly necessary cookies make the website and booking form work, and are set without consent. Analytics cookies (Google Analytics, loaded through Google Tag Manager) are set only after you accept them in our cookie banner. You can change or withdraw your choice at any time using the cookie settings link on the website. Full details of every cookie we use are in our Cookie Policy.

Who we share it with

We share personal data only with the service providers we need to run the business, under contracts that require them to protect it:

WP Engine: website hosting.
Cloudflare: website delivery and security.
Google: Google Analytics and Google Tag Manager (only with your consent); Google Maps, used by the booking form to find addresses and calculate routes; Google Fonts; and Google reCAPTCHA, if used, to block spam on forms.
Stripe and PayPal: payment processing. These providers also act as controllers for their own fraud-prevention and legal purposes.
Our email and booking-management tools, used to receive bookings and contact you about your journey.

We may also share data where the law requires it, for example with HMRC or the police.

International transfers

Some of these providers are based in, or store data in, the United States or other countries outside the UK. Where this happens, the transfer is protected by UK adequacy regulations (including the UK–US Data Bridge) or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

Booking and payment records: 6 years from the end of the tax year they relate to, for accounting and tax purposes.
Enquiries that do not lead to a booking: deleted within 12 months.
Analytics data: kept by Google Analytics for up to 14 months.

Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted, where we no longer need to keep it;
restrict or object to how we use it, including use based on our legitimate interests;
receive your data in a portable format; and
withdraw your consent at any time, without affecting anything done before you withdrew it.

To use any of these rights, please write to us at the address above. We will reply within one month. There is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page.

Last updated: 2 November 2026