Privacy Policy

1. Data Controller

Aurum Transfers Limited ("we", "us", or "our") is the data controller responsible for your personal data. We are registered under the Jamaica Data Protection Act, 2020.

Contact: privacy@aurum-transfers.com

2. What Data We Collect

• Booking data: Name, email, phone number (WhatsApp), flight details, pickup/destination addresses, passenger count, special requests.
• Payment data: PayPal transaction references (we do not store card numbers).
• Communication data: WhatsApp messages related to your booking, reviews and ratings.
• Directory data: Business listing information including business name, address, description, and contact details (for directory users).
• Device data: Browser type, IP address (for fraud prevention and analytics).
• Consent records: We record when, how, and what you consented to for each communication channel (email, WhatsApp, SMS). This includes the timestamp, source of consent, and your country for compliance with local regulations.

3. How We Use Your Data

• To process and fulfill your transfer booking
• To send transactional booking updates via email, WhatsApp, and SMS (based on your opt-in preferences)
• To track your flight for delay protection
• To connect you with your assigned driver
• To process payments and issue refunds
• To manage directory listings and subscriptions
• To send Directory engagement emails to owners of claimed listings (every four days) summarising listing performance and explaining the referral program. Legal basis: contract / legitimate interest tied to the listing relationship. One-click unsubscribe in every email; unsubscribing does not affect billing or security notices. Full referral terms: /referral-terms.
• To administer the Aurum Directory referral program. Click events and signup events are recorded server-side; IP addresses are hashed with a daily-rotating salt and never stored raw.
• To send marketing communications (only with separate explicit consent, via email only, limited to one per week)

4. Communication Channels and Consent

We communicate through three channels: email, WhatsApp, and SMS. Each channel requires your explicit consent before we send any messages beyond essential transactional notifications related to an active booking.

Email

Transactional emails (booking confirmations, reminders) are sent based on contractual necessity. Marketing emails require your explicit opt-in and include an unsubscribe link in every message.

WhatsApp

We use the WhatsApp Business API with Meta-approved message templates for booking confirmations and reminders only. You must explicitly opt in during booking. You can opt out at any time by replying STOP. We do not send marketing messages via WhatsApp.

SMS

SMS is used for brief transactional alerts only (e.g., confirmation reference, pickup reminders). You must explicitly opt in. Reply STOP to any SMS to opt out. We do not send marketing messages via SMS.

5. International Compliance

We serve customers worldwide and comply with applicable data protection and electronic messaging laws in each jurisdiction:

• Jamaica:Data Protection Act, 2020 — consent required for commercial messages; data subject rights enforced.
• United States:Telephone Consumer Protection Act (TCPA) — prior express written consent required for SMS marketing; transactional SMS permitted for active bookings.
• European Union / United Kingdom:General Data Protection Regulation (GDPR) / UK GDPR + PECR — explicit opt-in required for all electronic marketing; lawful basis required for all processing; 72-hour breach notification.
• Canada:Canada's Anti-Spam Legislation (CASL) — express or implied consent required for commercial electronic messages; unsubscribe mechanism mandatory.
• Australia:Spam Act 2003 + Privacy Act 1988 — consent required for commercial messages; sender identification and unsubscribe mechanism mandatory.

When your country of residence is unknown, we default to the most restrictive standard (GDPR-level) to ensure maximum protection.

6. Cookies

We use essential cookies for site functionality (session management, booking flow). We use analytics cookies (Google Analytics) to understand site usage. We use partner attribution cookies (30-day duration) for referral tracking. You can manage cookie preferences through your browser settings.

7. Data Retention

• Booking data: retained for 7 years for financial and legal compliance.
• Tracking data (driver GPS): retained for 30 days after ride completion.
• Consent records: retained for the duration of the business relationship plus 2 years.
• Notification audit logs: retained for 2 years.
• Search query logs: anonymized (IP and user agent stripped) after 90 days.

8. Your Rights

Depending on your jurisdiction, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request erasure of your data (with exceptions for legal and financial obligations)
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)

We process erasure requests within 30 days per GDPR Article 17. To exercise any of these rights, email privacy@aurum-transfers.com.

9. Cross-Border Data Transfer

Your data may be processed by our service providers (Supabase, PayPal, WhatsApp/Meta, Google) who operate servers outside Jamaica. We ensure appropriate safeguards are in place in accordance with the Jamaica Data Protection Act and, where applicable, GDPR standard contractual clauses.

10. Data Security

We use industry-standard security measures including encrypted connections (TLS), application-level encryption for stored tokens, row-level database security, and role-based access controls. In the event of a data breach, we will notify the Jamaica Information Commissioner and affected individuals within 72 hours, in compliance with both the Jamaica Data Protection Act and GDPR requirements.

11. Third-Party Services

Our platform may include links to third-party services and affiliate partners. These third-party sites have their own privacy policies, and we are not responsible for their data practices. We encourage you to review their policies before providing personal information.

12. Advertising and Third-Party Vendors

Aurum Transfers Limited displays advertising provided by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visits to our sites and/or other sites on the Internet.

How to Opt Out

• Personalized advertising from Google: google.com/settings/ads
• Digital Advertising Alliance (US): aboutads.info/choices
• Your Online Choices (EU): youronlinechoices.eu

Cookies Used by Advertising Partners

Google AdSense places the following cookies for ad serving, fraud prevention, and frequency capping: __gads, __gpi, IDE, NID. For the full list, see our Cookie Policy.

13. Your California Privacy Rights (CCPA / CPRA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising.

Aurum Transfers does not sell personal information in the traditional sense. However, our use of Google AdSense may constitute "sharing" under the CPRA. To opt out, visit Do Not Sell or Share My Personal Information.

Our site also responds to the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal, we automatically opt you out of sale/sharing without further action.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

15. Contact

For privacy inquiries: privacy@aurum-transfers.com

WhatsApp: +1 (876) 815-6674