Privacy Policy

1. Introduction and Data Controller

Milan 2 Airport ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services.

It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018).

The data controller (titolare del trattamento) is:

• Milan 2 Airport Transfer LLC
• Viale Abruzzi, 94 — 20131 Milano (MI), Italy
• Email: info@milan2airport.com
• Phone: +39 334-795-6963

We have not appointed a Data Protection Officer. All privacy enquiries are handled at the contact details above.

2. Information We Collect

2.1 Personal Information

We may collect the following personal information when you use our services:

• Contact Information: Name, email address, phone number
• Booking Information: Pickup and drop-off locations, dates, times, flight numbers
• Payment Information: Payment method preferences (we do not store credit card details)
• Communication: Records of your correspondence with us

2.2 Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address and browser information
• Device information (type, operating system)
• Usage data (pages visited, time spent)
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your personal information for the following purposes:

• Service Provision: To process and manage your bookings
• Communication: To confirm bookings, send updates, and respond to inquiries
• Customer Support: To assist you with any issues or questions
• Service Improvement: To analyze and improve our services
• Legal Compliance: To comply with applicable laws and regulations
• Marketing: With your consent, to send promotional materials

4. Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our contract with you
• Legal Obligation: Compliance with legal requirements
• Legitimate Interests: Improving our services and preventing fraud
• Consent: For marketing communications (you can withdraw consent at any time)

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: Drivers and transportation partners to fulfill your booking
• Technology Providers: Companies that help us operate our website and services
• Legal Authorities: When required by law or to protect our rights

All third parties are contractually bound to protect your data and use it only for the specified purposes.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit (SSL/TLS)
• Secure servers and databases
• Access controls and authentication
• Regular security assessments

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services and fulfill our contractual obligations
• Comply with legal and tax requirements
• Resolve disputes and enforce our agreements

Specifically:

• Booking records: 10 years from the date of the transfer, as required by Italian accounting and tax law (art. 2220 Civil Code; D.P.R. 600/1973)
• Contact form messages: 24 months from the last exchange, then deleted
• Analytics data: 14 months, the retention period configured in Google Analytics 4
• Your cookie choice: 180 days, after which we ask you again
• Marketing consent: until you withdraw it

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, write to info@milan2airport.com. We reply within one month, as required by Article 12(3) GDPR. Exercising your rights is free of charge.

If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the Italian supervisory authority:

• Garante per la protezione dei dati personali
• Piazza Venezia 11, 00187 Roma, Italy
• www.garanteprivacy.it — garante@gpdp.it

9. Cookie Policy

This section is our full cookie policy, drawn up in accordance with the guidelines on cookies and other tracking tools issued by the Garante per la protezione dei dati personali (decision no. 231 of 10 June 2021, doc. web 9677876).

9.1 What we use and when

Cookies and similar technologies (such as browser local storage) are small pieces of data saved on your device. We divide them into three groups:

• Strictly necessary — required for the website to work. These are installed on the legal basis of our legitimate interest in delivering a functioning, secure service (Article 6(1)(f) GDPR) and, for the storage itself, under art. 122 of the Italian Privacy Code, which exempts technical tools from the consent requirement. They cannot be switched off.
• Analytics — help us understand how the site is used. Installed only with your consent (Article 6(1)(a) GDPR).
• Marketing — would let us measure advertising and show our offers elsewhere. Not currently in use, and in any case only with your consent.

No analytics or marketing tool is loaded before you give consent. We use Google Consent Mode v2, which keeps every optional storage category in a denied state until you choose otherwise.

9.2 Strictly necessary

9.3 Analytics — consent required

Analytics is delivered through Google Tag Manager (container GTM-MBB729TQ). Google Tag Manager does not itself set cookies; it only loads the tools listed above once you have consented. We do not use analytics data to identify you or to contact you.

9.4 Marketing

We do not currently run any advertising or remarketing tags. The category is kept in the preferences panel so that, if that ever changes, nothing can start without your explicit consent.

9.5 Changing or withdrawing your choice

You can change your mind at any time, and withdrawing consent is as easy as giving it. Use the button below, or the Cookie Preferences link in the footer of any page.

Manage cookie preferences

Your choice is stored for 180 days, after which we will ask again. You can also delete cookies through your browser settings, although blocking strictly necessary cookies will stop parts of the site from working.

9.6 Transfers outside the EU

Google Analytics, Google Tag Manager, Google Maps and reCAPTCHA are provided by Google Ireland Limited, which may transfer data to Google LLC in the United States. Those transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, to which Google LLC is certified. See section 12 for more detail.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these websites. We encourage you to review their privacy policies.

11. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

12. International Data Transfers

Your booking and contact data is stored on servers located within the European Economic Area (EEA).

Some of the technical services we rely on may transfer data to the United States:

• Google Ireland Limited (Analytics, Tag Manager, Maps, reCAPTCHA), which may transfer data to Google LLC

These transfers take place under the adequacy decision adopted by the European Commission on 10 July 2023 concerning the EU–US Data Privacy Framework. Google LLC appears on the list of certified organisations maintained by the U.S. Department of Commerce. Where the adequacy decision does not apply, transfers are covered by the European Commission's Standard Contractual Clauses.

You may request a copy of the safeguards in place by writing to info@milan2airport.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact the data controller:

• Milan 2 Airport Transfer LLC
• Registered office: Viale Abruzzi, 94 — 20131 Milano (MI), Italy
• VAT number (P.IVA): [TO BE CONFIRMED BEFORE PUBLICATION]
• Privacy enquiries: info@milan2airport.com
• Bookings: booking@milan2airport.com
• Phone: +39 334-795-6963

You also have the right to lodge a complaint with the Garante per la protezione dei dati personali — see section 8 for their contact details.