This notice explains what personal data X8 Eszközkezelő és Szolgáltató Kft. processes on its website (booking, quote requests, contact, “My bookings”), in the related e-mails, and when dealing with you by phone or on WhatsApp: for what purpose, on what legal basis, for how long, who has access to it, and what your rights are.

1. The controller

Name: X8 Eszközkezelő és Szolgáltató Kft. (X8 Kft.)
Registered office and postal address: 2724 Újlengyel, Petőfi Sándor utca 48., Hungary
Company registration number: 13-09-169768
Tax number: 24915001-2-13
Data protection matters: office@x8ltd.com
Phone: +36 20 246 5855

2. What data we process, why, and on what legal basis

2.1. Booking and quote requests via the booking form

Data: name, phone number, e-mail address, company name (optional); trip details (type, date, time, pickup location, destination, intermediate stops, return trip, number of passengers, luggage, child seats, meet-and-greet; for airport transfers flight number and direction); notes; the language of the booking; the price and the price acceptance details; booking number and status.
Data recorded by us: internal notes, the message sent to you, the time of approval or rejection and the staff member who decided.
Purpose: assessing the booking, concluding and performing the contract (vehicle and driver assignment, pickup, communication), confirmation, calendar and wallet entries.
Legal basis: entering into and performing the contract (Article 6(1)(b) GDPR).

Please do not enter health data or other special categories of data in the notes field. If you have a special need (for example accessible travel), a short mention is enough; we will agree on the details with you.

2.2. Company quote request

Data: company, site, headcount and shifts, start date, contact person’s name, e-mail address, phone number (optional), stops and shift pattern, interest in live tracking and boarding check.
Purpose: preparing a quote and route plan, getting in touch.
Legal basis: steps prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in communicating with the company’s contact person (Article 6(1)(f) GDPR).

2.3. Contact form

Data: name, e-mail address, phone number (optional), message.
Purpose: replying to your enquiry.
Legal basis: our legitimate interest in replying to your enquiry (Article 6(1)(f) GDPR); if the enquiry concerns entering into a contract, steps prior to entering into a contract (Article 6(1)(b) GDPR).

2.4. “My bookings”

If you enter your e-mail address on the “My bookings” page and there is a booking for it, we send you a sign-in link valid for 7 days; the link shows the status of the bookings for that address. We do not store an account or password. Legal basis: performance of the contract (Article 6(1)(b) GDPR).

2.5. Calendar and phone wallet

In the confirmation e-mail we send a calendar file (.ics), and buttons let you save the trip to Apple Wallet or Google Wallet; the calendar and wallet links are valid for 120 days. When you save to Google Wallet, the trip details (for example time, number of passengers, flight number, from, to, booking number) are sent to Google and stored in the Google Wallet service – this only happens if you choose that button, and Google’s own privacy terms also apply. The Apple Wallet pass is downloaded to your device from our server.

2.6. Abuse and bot protection

On the booking form and the other forms we use Cloudflare Turnstile against mass automated submissions: for the check, your IP address and technical data of your browser are sent to Cloudflare. We count submissions per IP address – for “My bookings” requests and e-mail sending, based on a one-way encoded fingerprint of the e-mail address – for a short time (10 minutes to 1 hour). Legal basis: our legitimate interest in the security of the service (Article 6(1)(f) GDPR).

2.7. Cookies and local storage

Cookie choice (x8-cookie-consent, in the browser’s local storage): remembers what you have consented to; it stays in your browser until you delete it.
Language cookie (NEXT_LOCALE): remembers the selected language (Hungarian / English).
Sign-in cookie (payload-token): only for our staff signing in to the admin area; it is not created for visitors.
Visitor statistics: this category in the cookie banner is only switched on with your consent. If we switch statistics on, we use the Plausible Analytics service; without consent the measuring code is not even loaded. Legal basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time with the cookie icon shown in the corner of the screen.
We do not use advertising, remarketing or social media tracking cookies.

2.8. Phone and WhatsApp

If you contact us by phone or on WhatsApp (+36 70 267 0000), we process your phone number and messages for the purpose of the booking and dealing with your request (Article 6(1)(b) GDPR). When you use WhatsApp, the provider’s own privacy rules also apply.

2.9. Invoicing

We process and retain the data shown on invoices in accordance with accounting and tax legislation (Article 6(1)(c) GDPR – compliance with a legal obligation).

3. Who has access to the data

The data is accessible to the X8 staff who handle bookings. The following providers take part in the processing on our behalf:

Diavox Kft. (1204 Budapest, Vécsey utca 30., Hungary; company registration number: 01-09-926932; tax number: 14939435-2-43) – development, operation and maintenance of the website and the booking management systems, providing the calendar and wallet features.
DigitalOcean, LLC (105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA) – server and database; the server is located in Frankfurt (Germany).
MailerSend, Inc. (228 Park Ave S, PMB 54955, New York, NY 10003-1502, USA) – delivery of system e-mails (the recipient’s e-mail address and the content of the e-mail).
Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) – bot protection (Turnstile) on the booking form and the other forms (IP address, technical browser data).
Google (Google Wallet) – only if you choose the “Google Wallet” button in the confirmation e-mail (see section 2.5).
Plausible Analytics – visitor statistics, only if we switch it on and only with your consent (see section 2.7).

We only disclose data to authorities or courts where required by law.

4. Transfers outside the European Union

Our server is located in Frankfurt, in the European Union. DigitalOcean, MailerSend and Cloudflare are companies registered in the United States. Where data is transferred outside the European Economic Area, the GDPR rules on international transfers apply; we will inform you of the safeguards used on request.

5. How long we keep the data

Booking, quote request and contact data: for as long as necessary to perform the contract, deal with your request and comply with our legal obligations.
Invoices and accounting records: for the period required by accounting law.
Outgoing e-mails in the sending queue: deleted immediately after successful sending, otherwise after 7 days at the latest.
Submission counters (IP address, encoded e-mail fingerprint): deleted no later than two days after they expire.
Cookie choice: in your browser until you delete it.

6. Data security

Only signed-in staff have access to the data. The website is available over an encrypted (HTTPS) connection. The approval, price acceptance, “My bookings”, calendar and wallet links are signed links that expire.

7. Your rights

You have the right to:

request information about and access to your data;
request rectification of your data;
request erasure of your data where there is no legal obligation to retain it;
request restriction of processing;
receive your data in a portable format where processing is based on a contract or consent;
object to processing based on legitimate interest;
withdraw your consent at any time.

You can submit your request to office@x8ltd.com or by post; we will reply without undue delay and at the latest within the time limit set by law.

8. Remedies

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; www.naih.hu), and you can also go to court. Please contact us first so that we can try to resolve the matter together.

9. Changes

This notice is effective from the day it is published on the website. We update it when the service changes; the current version is always available on this page.

Privacy notice