Privacy policy

Last updated 7 November 2026
On this page +

Privacy notice

This notice explains how we process the personal data of visitors to blacklimo.app and of people who book a chauffeur service, under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003.

1. Data controller

Black Limo Società Cooperativa (“Blacklimo”), Piazza della Libertà 11, 00065 Fiano Romano (RM), Italy, VAT IT17103381004. For any privacy request: support@blacklimo.app.

2. What data we process

  • Booking data: pick-up and drop-off addresses, date and time, return trip if any, number of passengers and bags, chosen vehicle, flight or train number and notes for the chauffeur (if you enter them).
  • Contact data: the passenger’s first name, last name, email and phone number.
  • Invoice data (only if you request an invoice): company or personal name, VAT number or tax code, SDI code or PEC, address.
  • Payment data: card details are entered directly in Stripe’s forms and never pass through our servers. We only receive the outcome, the amount and a payment reference.
  • Customer area sign-in (optional): the email you sign in with, a temporary sign-in code sent by email (stored only in hashed form and valid for 10 minutes) or, if you choose “Sign in with Google”, the email, name and identifier Google gives us. They are only used to show you the rides booked with that email.
  • Browsing data: IP address and technical device data logged by the server for security and, only with your consent, statistics and advertising data collected with Google cookies (see section 8). For our own statistics we also count anonymously the pages visited, the booking steps, where the visit came from, the country estimated from the device’s time zone, the device type (phone or computer), the ad campaign and keyword you came from, the choice made in the cookie banner, the towns searched, the vehicle chosen and the names of form fields left incomplete (never their content), with no cookies, no IP address and no data that identifies you.
  • Email for offers and reminders (only if you tick the optional box in the passenger details): your email address and the search you were making (addresses, date, passengers), saved as soon as you tick the box, even if you then do not complete the booking.
  • Bookings from ChatGPT: you can also book from our ChatGPT plugin. From there we receive only the trip details you ask for (addresses, date and time, return trip if any, passengers and bags); your first name, last name, email and phone, only when you confirm the booking; and, if you give them, the flight number, notes for the chauffeur and the number of child seats and boosters. Nothing else. Our server does not read the conversation: it receives only these parameters, never the text of your messages.
  • Handling your booking and providing the service (quote, confirmation, trip communications, chauffeur contact): performance of a contract, Art. 6(1)(b) GDPR.
  • Collecting payment and preventing fraud: performance of a contract and legitimate interest, Art. 6(1)(b) and 6(1)(f).
  • Invoicing and tax/accounting obligations: legal obligation, Art. 6(1)(c).
  • Website security and defending our rights: legitimate interest, Art. 6(1)(f).
  • Usage statistics and advertising measurement (Google Analytics, Google Ads, Reddit Ads, ChatGPT Ads): only with your consent, Art. 6(1)(a), which you can withdraw at any time.
  • Review request after your ride: the day after the ride we send you a single email asking for your opinion on Google, about services similar to the one you bought (Art. 130(4) of the Italian Privacy Code). You can object at any time with the link in the email or by writing to us.
  • Offers and reminders by email: only with your consent, Art. 6(1)(a) GDPR and Art. 130 of the Italian Privacy Code, given by ticking the optional box (never pre-ticked). We send at most one reminder if you do not complete a booking you started and, from time to time, offers on our services. In return for your consent you get a 2% welcome discount on your first paid booking: you can book at the same list price without giving it. You can withdraw it at any time with the “Unsubscribe” link in every email or by writing to us; withdrawing does not affect discounts already received.

Booking and contact data are required to book: without them we cannot provide the service. Consent to analytics and marketing cookies is optional and the website works even if you refuse.

4. Who receives the data

We do not sell your data. Only the providers needed for the service process it on our behalf, as data processors:

  • Hostinger International Ltd: website and database hosting, on servers in France (EU), and sending of confirmation emails.
  • Stripe Payments Europe Ltd (Ireland): online payments. If you choose PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) processes the data needed for the payment as an independent controller, under its own privacy notice. The same applies to Klarna (Klarna Bank AB, Sweden) if you choose to pay with Klarna.
  • Google Ireland Ltd: company mailbox (Google Workspace); address suggestions (Google Maps Platform), which receives the text typed in the address field; with your consent, Google Analytics and Google Ads.
  • Reddit, Inc.: with your consent, measurement of our campaigns on Reddit (Reddit Ads pixel).
  • OpenAI: with your consent, measurement of our campaigns in ChatGPT (ChatGPT Ads pixel), including the hashed contact details described in section 8.
  • OpenAI, as a technical recipient: if you book from ChatGPT, what you write in the chat passes through OpenAI before the parameters described in section 2 reach our server. OpenAI processes your messages under its own privacy notice; we do not receive the conversation.
  • OpenStreetMap-based services: route distance and time (OSRM router) and, only if Google is unavailable, address search (Nominatim). Requests are sent from our server and contain coordinates or the address text, not your contact details.
  • Telegram: internal messaging we use to give our chauffeurs, in a group reserved to the team, the details needed to carry out the ride (passenger name and phone, addresses, times, flight and notes).
  • OpenFreeMap: tiles of the route mini map, loaded by your browser.
  • Chauffeurs and NCC partners assigned to your ride, who receive the data needed for the trip (name, phone, times, addresses, flight and notes).
  • Tax advisers and authorities, where required by law.

5. Transfers outside the European Union

Some providers (Google, Stripe, Reddit, OpenAI) belong to groups based in the United States and may process data outside the EU. Such transfers rely on the EU-U.S. Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission. Telegram may process messages outside the EU: we use it only for internal communication with the chauffeur, which is necessary to perform the service you requested (Art. 49(1)(b) GDPR).

6. How long we keep data

  • Paid bookings and invoice data: 10 years, as required by Italian civil and tax law (Art. 2220 Civil Code).
  • Incomplete bookings (payment never completed): 24 months, for customer support, handling any disputes and preventing fraud (legitimate interest).
  • Bookings from ChatGPT: no difference, the same periods apply: incomplete bookings are anonymised after 24 months (730 days), paid ones after 10 years (3653 days), with the same deletions described below.
  • At the end of these periods we automatically delete first name, last name, email, phone, notes and invoice data, and reduce the addresses to the town name: only anonymous data remain (date, route, vehicle, price), used for statistics, which cannot identify you.
  • Consent to offers and reminders: 24 months from your latest activity with us (a new consent or a paid booking), then the address is deleted; the search saved for the reminder is deleted after 24 months. If you unsubscribe, we keep only the address and the date of the request, so as not to write to you again.
  • Emails exchanged with us: as long as needed to handle the request, and no longer than the retention period of the related booking.
  • Your cookie choice: 12 months, then we ask for consent again.
  • Google Analytics data: for the period set in the service, at most 14 months.
  • Customer area: the sign-in session lasts 60 days (or until you sign out); the email code 10 minutes; the sign-in record is deleted after 24 months without sign-ins.
  • Technical caches of routes and addresses (coordinates and searched text only, no contact data): 24 hours to 7 days.

7. Security

The website only uses encrypted connections (HTTPS). Booking data is stored outside the public area of the server and the back office is password-protected. We do not record personal data in application logs.

8. Cookies and similar technologies

On your first visit a banner asks for your consent. You can change your mind at any time from the “Cookie preferences” link at the bottom of every page.

  • Technical (always on): they store your cookie choice, keep you signed in to the customer area (only if you sign in) and make booking and payment work (including Stripe’s anti-fraud tools). The “Sign in with Google” button loads Google’s services only on the sign-in page. No consent is required.
  • Analytics (with consent): Google Analytics 4, for statistics on visits and website use.
  • Marketing (with consent): Google Ads, to measure bookings generated by our campaigns. With this consent, at payment time your email and phone are sent to Google in hashed form to attribute conversions correctly (“enhanced conversions”). We also use the Reddit Ads pixel (Reddit, Inc.), which is loaded only with this consent and receives the pages visited, the price view and the amount and code of the paid booking, never your name, email or phone. In the same way we use the ChatGPT Ads pixel (OpenAI): if you arrive from one of our ads in ChatGPT, it stores the click code in a cookie and receives the pages visited, the price view and the amount and code of the paid booking. With this consent the OpenAI pixel also automatically detects the details you enter in the site’s forms and sends them to OpenAI to attribute bookings to its ads (“advanced matching”): email, phone, first and last name in hashed form and, if you give them for an invoice, country, city and postcode. Again only with this consent, when the booking is paid we also send it to OpenAI from our server (“Conversions API”) with the same details plus IP address, browser type, the click code and the pixel cookie, so measurement works even if your browser blocks the pixel. These technical details are deleted from our systems right after sending, and in any case within 7 days.

If you refuse, Google only receives anonymous technical signals without cookies (Google Consent Mode).

9. Your rights

You may at any time request access to your data, rectification, erasure, restriction of processing, data portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to support@blacklimo.app. You can withdraw your cookie consent at any time, without affecting processing already carried out. We reply within 30 days.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country of residence.

10. Minors

Bookings must be made by adults. We do not knowingly collect data about minors, except passenger information provided by the person booking for them.

11. Changes

We may update this notice to reflect changes to the service or the law. The date of the last update is shown at the top of the page.

Ready to go?

Get the price of your transfer or of your chauffeur by the hour and book in seconds.

Get a price