Privacy Policy

Last updated: April 13, 2026

1. Data Controller

Aurum Transfers Limited ("we", "us", or "our") is the data controller responsible for your personal data. We are registered under the Jamaica Data Protection Act, 2020.

Contact: privacy@aurum-transfers.com

2. What Data We Collect

Booking data: Name, email, phone number (WhatsApp), flight details, pickup/destination addresses, passenger count, special requests.
Payment data: PayPal transaction references (we do not store card numbers).
Communication data: WhatsApp messages related to your booking, reviews and ratings.
Directory data: Business listing information including business name, address, description, and contact details (for directory users).
Device data: Browser type, IP address (for fraud prevention and analytics).
Consent records: We record when, how, and what you consented to for each communication channel (email, WhatsApp, SMS). This includes the timestamp, source of consent, and your country for compliance with local regulations.

3. How We Use Your Data

To process and fulfill your transfer booking
To send transactional booking updates via email, WhatsApp, and SMS (based on your opt-in preferences)
To track your flight for delay protection
To connect you with your assigned driver
To process payments and issue refunds
To manage directory listings and subscriptions
To send marketing communications (only with separate explicit consent, via email only, limited to one per week)

4. Communication Channels and Consent

We communicate through three channels: email, WhatsApp, and SMS. Each channel requires your explicit consent before we send any messages beyond essential transactional notifications related to an active booking.

Email

Transactional emails (booking confirmations, reminders) are sent based on contractual necessity. Marketing emails require your explicit opt-in and include an unsubscribe link in every message.

We use the WhatsApp Business API with Meta-approved message templates for booking confirmations and reminders only. You must explicitly opt in during booking. You can opt out at any time by replying STOP. We do not send marketing messages via WhatsApp.

SMS

SMS is used for brief transactional alerts only (e.g., confirmation reference, pickup reminders). You must explicitly opt in. Reply STOP to any SMS to opt out. We do not send marketing messages via SMS.

5. International Compliance

We serve customers worldwide and comply with applicable data protection and electronic messaging laws in each jurisdiction:

Jamaica: Data Protection Act, 2020 — consent required for commercial messages; data subject rights enforced.
United States: Telephone Consumer Protection Act (TCPA) — prior express written consent required for SMS marketing; transactional SMS permitted for active bookings.
European Union / United Kingdom: General Data Protection Regulation (GDPR) / UK GDPR + PECR — explicit opt-in required for all electronic marketing; lawful basis required for all processing; 72-hour breach notification.
Canada: Canada's Anti-Spam Legislation (CASL) — express or implied consent required for commercial electronic messages; unsubscribe mechanism mandatory.
Australia: Spam Act 2003 + Privacy Act 1988 — consent required for commercial messages; sender identification and unsubscribe mechanism mandatory.

When your country of residence is unknown, we default to the most restrictive standard (GDPR-level) to ensure maximum protection.

6. Cookies

We use essential cookies for site functionality (session management, booking flow). We use analytics cookies (Google Analytics) to understand site usage. We use partner attribution cookies (30-day duration) for referral tracking. You can manage cookie preferences through your browser settings.

7. Data Retention

Booking data: retained for 7 years for financial and legal compliance.
Tracking data (driver GPS): retained for 30 days after ride completion.
Consent records: retained for the duration of the business relationship plus 2 years.
Notification audit logs: retained for 2 years.
Search query logs: anonymized (IP and user agent stripped) after 90 days.

8. Your Rights

Depending on your jurisdiction, you have the right to:

Access your personal data
Correct inaccurate data
Request erasure of your data (with exceptions for legal and financial obligations)
Restrict processing
Data portability
Object to processing
Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)

We process erasure requests within 30 days per GDPR Article 17. To exercise any of these rights, email privacy@aurum-transfers.com.

9. Cross-Border Data Transfer

Your data may be processed by our service providers (Supabase, PayPal, WhatsApp/Meta, Google) who operate servers outside Jamaica. We ensure appropriate safeguards are in place in accordance with the Jamaica Data Protection Act and, where applicable, GDPR standard contractual clauses.

10. Data Security

We use industry-standard security measures including encrypted connections (TLS), application-level encryption for stored tokens, row-level database security, and role-based access controls. In the event of a data breach, we will notify the Jamaica Information Commissioner and affected individuals within 72 hours, in compliance with both the Jamaica Data Protection Act and GDPR requirements.

11. Third-Party Services

Our platform may include links to third-party services and affiliate partners. These third-party sites have their own privacy policies, and we are not responsible for their data practices. We encourage you to review their policies before providing personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact

For privacy inquiries: privacy@aurum-transfers.com

WhatsApp: +1 (876) 815-6674