Privacy & cookies

1. Who is responsible

The data controller is 1st.Limo. Questions about your data: hello@limotrips.dk.

2. What we collect

• When you book: your name, email address, phone number (if you give it), where you are staying or want to be picked up, the number and type of travellers, how you want to be updated (email, SMS or WhatsApp) and any discount code you use.
• Payment: the amount, status and PayPal's transaction reference. Card and account details are handled by PayPal — we never see them.
• After your trip: your rating and comment, if you choose to give one.
• Private tour requests: the details you write in the request form.
• Accounts: if you create one, your name, email and a securely hashed password — or, if you sign in with Google or Facebook, the account ID they give us.
• Hotel QR codes: when you scan a partner hotel's code, we count the scan for that hotel. The count doesn't identify you.

3. Why we use it

• To deliver your trip — pickup, entry tickets, the passenger list for the driver, confirmation, reminders and the live-bus link (GDPR art. 6(1)(b): contract).
• To keep accounts and records required by Danish bookkeeping law (art. 6(1)(c)).
• To improve our trips from your ratings, prevent fraud, and to credit the partner hotel whose guest you are (art. 6(1)(f): our legitimate interest).
• Marketing emails only if you have said yes — and you can say no again at any time (art. 6(1)(a): consent).

4. Who sees it

• Your driver sees the passenger list for the day: names, number of guests, pickup point and phone number.
• Partner hotels: if you are picked up at a partner hotel, its reception can see your name, email, trip date and number of guests — so they can help you on the day and so we can settle their commission.
• Service providers who process data on our behalf:
  • Supabase — database hosting in the EU (Stockholm, Sweden)
  • Vercel — website hosting
  • Resend — sending emails
  • Twilio — sending SMS and WhatsApp messages, if you choose them
• PayPal processes your payment as an independent data controller under its own privacy policy.
• Maps: map tiles are loaded from OpenFreeMap, which receives your IP address when a map is shown. Our minibuses report their position through Mapon, our fleet system — this is about the bus, not about you.

Some of these providers are based in the US. Where data leaves the EU/EEA, it is covered by the EU–US Data Privacy Framework or the EU's standard contractual clauses.

5. How long we keep it

• Bookings and payment records: five years after the end of the financial year, as Danish bookkeeping law requires.
• Ratings: kept with the booking; comments can be deleted on request.
• Private tour requests that don't lead to a booking: deleted after 12 months.
• Accounts: until you ask us to delete yours.

6. Cookies

We only use cookies that the site needs to work — no analytics, no advertising:

• trips_customer — keeps you signed in to your account (30 days).
• trips_hotel — remembers the partner hotel whose QR code you scanned, so we can pre-select your pickup and credit the hotel (30 days).
• trips_oauth_state — a short-lived security cookie when you sign in with Google or Facebook.

On the payment page, PayPal sets its own cookies to process the payment securely.

7. Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and get it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to hello@limotrips.dk — we answer within a month. Some data we must keep by law (see section 5).

You can also complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

See also our terms & conditions.