1. Who we are
MCR Elite Transfers ("we", "us", "our") is the data controller for the personal data described in this policy. We're an executive private hire and airport transfer operator based in Manchester, licensed by Bolton Council.
MCR Elite Transfers is a trading name of MCR Transfers Ltd, company number 14791952, registered office 34 Peveril Street, Bolton, BL3 3LR. Our ICO registration number is [to be added once registered at ico.org.uk].
This policy explains what happens to your personal data when you visit mcrelitetransfers.co.uk, use our booking form, contact us, or book a journey.
2. What data we collect
We collect data you give us directly:
- Booking data: your name, email address, phone number, pickup and drop-off addresses, journey date and time, and any options you select (vehicle size, waiting time, Meet & Greet).
- Contact form data: your name, email address, phone number (if given), and the content of your message.
- Payment data: handled directly by our payment processor, Stripe. We never see or store your full card number, expiry date or CVV — only the payment amount, a Stripe payment reference, and the receipt email you provide.
We also collect some data automatically:
- Address lookups: when you type a pickup or drop-off address into the booking form, that text is sent to Google's Places API to suggest matching addresses, and the selected address is looked up again by our server (with Google) to calculate your fare and driving distance.
- Technical data: standard web server logs (IP address, browser type, pages visited) collected by our hosting provider for security and performance purposes.
3. Why we use it, and our legal basis
- To provide your journey and take payment — necessary to perform our contract with you when you book a transfer.
- To respond to enquiries sent through the contact form — necessary to take steps at your request before entering into a contract, or our legitimate interest in answering questions about our service.
- To calculate accurate fares and driving distances via Google's Places and Distance Matrix APIs — necessary to perform our contract with you.
- To meet our legal and accounting obligations, such as keeping records of payments taken — necessary to comply with the law.
- To keep our website and booking system secure, using technical logs — our legitimate interest in preventing fraud and misuse.
We do not use your data for marketing emails or text messages, and we do not sell your data to anyone.
4. Who we share it with
We share the minimum data necessary with a small number of service providers who help us run our booking system:
- Stripe (payment processing) — receives your payment amount, receipt email, and (entered directly into Stripe's own secure payment form) your card details. See Stripe's privacy policy.
- Google (Places & Distance Matrix APIs) — receives the addresses you enter so we can verify them and calculate distance. See Google's privacy policy.
- Namecheap Private Email (our email provider) — booking confirmations and enquiry notifications are sent through our mailbox hosted with Namecheap.
- Namecheap (web hosting) — our website itself runs on Namecheap's shared hosting servers, which process data as part of running the site.
We may also share your data with our drivers (name, phone number, pickup/drop-off addresses, journey time) so they can complete your booking, and with the police, courts, or regulators where we're legally required to.
5. International transfers
Stripe and Google may process data on servers outside the UK, including in the United States. Where this happens, they do so under recognised safeguards such as the UK's International Data Transfer Addendum or equivalent Standard Contractual Clauses, as set out in their own privacy policies linked above.
6. How long we keep it
- Booking & payment records: kept for 6 years from the end of the tax year they relate to, in line with HMRC's financial record-keeping requirements.
- Contact form enquiries that don't lead to a booking: kept for 12 months, then deleted.
- Server/security logs: kept for a short period (typically weeks) by our hosting provider, then rotated out.
7. Cookies
Our website uses a small number of cookies, mainly set by Stripe and Google Maps to support payment and address lookup. Full details are in our Cookie Policy.
8. How we keep it secure
Booking and payment data is sent over encrypted (HTTPS) connections. Payment card details are handled entirely by Stripe and never pass through our own systems. Access to booking data on our website is restricted to those who need it to run the business.
9. Your rights
Under UK GDPR, you have the right to:
- ask us what personal data we hold about you, and get a copy of it (right of access);
- ask us to correct inaccurate or incomplete data (right of rectification);
- ask us to delete your data, where we're not required to keep it for legal reasons such as tax records (right to erasure);
- object to, or ask us to restrict, certain uses of your data;
- ask for a portable copy of data you gave us, in some circumstances (right to data portability).
To exercise any of these rights, email us at admin@mcrelitetransfers.co.uk. We'll respond within one month.
10. Children
Our services are intended for adults making travel bookings. We don't knowingly collect personal data directly from children.
11. Changes to this policy
We may update this policy from time to time, for example if we start using a new supplier. We'll update the "last updated" date at the top of this page when we do.
MCR Transfers Ltd, trading as MCR Elite Transfers
34 Peveril Street, Bolton, BL3 3LR
Email: admin@mcrelitetransfers.co.uk
If you're unhappy with how we've handled your data, you can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
