Privacy notice: what information we collect and how it is used
The controller, information collected, purposes, legal bases, recipients, international transfers, retention and your rights.
Controller
The controller is:
Market Grow
Höttinger Gasse 13/Top 7, 6020 Innsbruck, Austria
Commercial register: FN 643292v · Innsbruck Commercial Court
Because the controller is established in Austria, the EU General Data Protection Regulation applies to this processing.
Information collected
- Transfer request: name, phone, email, pickup, destination, date, approximate time, flight number when supplied, round-trip details, traveler count, child seats, special luggage and notes.
- Attribution: the page, referrer and campaign parameters connected with the request, when present.
- Consent record: the decision stored with the request, including date and time.
- Review information: review text, rating and display name when a review is submitted.
- Not requested: card details, identity documents or special-category data.
Purposes and legal bases
Trip information is used to answer the request and arrange the requested transportation under Article 6(1)(b) GDPR. Service emails are part of that requested service, not advertising. Attribution information is used in aggregate under legitimate interests to understand which pages generate useful requests. Reviews are published only with consent. OAXWAY does not send marketing, create advertising profiles or make automated decisions about travelers.
Recipients
The minimum information needed to perform the ride is shared with the independent operator after a booking is confirmed. Supabase provides EU-hosted database and file infrastructure; Cloudflare protects and delivers the website; Resend, accessed through Lovable, delivers service email. Personal information is not sold or shared for third-party advertising.
International transfers
The database and files are hosted in Ireland. Operational information sent to the operator in Mexico is necessary to perform the contract requested by the traveler under Article 49(1)(b) GDPR. Transfers involving US-based infrastructure providers rely on the EU–US Data Privacy Framework or applicable standard contractual clauses.
Retention
Unconfirmed requests are retained while there is a reasonable possibility of resuming them and to document the consent under which they were handled. Confirmed bookings are retained for potential service claims and applicable Austrian accounting and tax obligations, which can require seven years. Published reviews remain until removed. The exact retention period for unconfirmed requests is still to be finalized and will be published as a specific period.
Your rights
You may request access, correction, deletion, restriction, objection and portability, and may withdraw consent where it is the legal basis. Use the contact page or write to the controller's postal address. You may also complain to the Austrian Data Protection Authority or the authority where you live.
Changes to this notice
A revised version will be published here with its date. Changes are not applied silently or retroactively to information collected under different conditions.