Privacy Policy
Last updated: 2 October 2026
We respect your privacy. This policy explains what personal data we collect when you book rides and hotel rooms, why we collect it, who we share it with and what your rights are. It complies with the GDPR (Regulation (EU) 2016/679).
1. Data controller
The controller of your personal data is Move and Stay Solutions BV (Perk25A hotel), Koekoeksweide 25A, 1820 Perk, Belgium, VAT number: BE1002585268.
Contact for data protection matters: movestaysol@gmail.com, phone +32 469 225 171.
2. What data we collect
- Ride bookings: name, email, phone number, pick-up and drop-off addresses, date and time, number of passengers and luggage, flight number and notes for the driver.
- Room bookings: name, contact details, dates of stay, number of guests and your requests.
- Online check-in: series and number of your identity document (see section 4).
- Customer account: email, password (stored only in encrypted form), booking history, billing details; for business accounts also company name, address and VAT number.
- Payments: card payments are processed by Stripe. We never see or store full card numbers — we only receive a payment confirmation.
- Contact: the content of messages you send via the contact form, email, phone, WhatsApp or Messenger.
- Technical data: IP address, browser and device type, security logs and — if you consent — analytics and advertising data from cookies (section 8).
3. Purposes and legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): accepting and carrying out your ride or stay, managing your account, payments, booking notifications by email and SMS.
- Legal obligation (Art. 6(1)(c) GDPR): invoicing, accounting and tax, registration of hotel guests.
- Legitimate interest (Art. 6(1)(f) GDPR): website security and fraud prevention, answering your enquiries, establishing and defending legal claims.
- Consent (Art. 6(1)(a) GDPR): analytics and marketing cookies, and longer storage of identity document data in your customer account. You can withdraw your consent at any time; this does not affect processing carried out before withdrawal.
4. Online check-in and guest registration
For online check-in we only collect the series and number of your identity document (ID card, passport or residence card). We do not require or accept photos or scans of the document. We process this data to perform the hotel contract, register your stay and protect our legitimate interests.
- By default we keep identity document data for no longer than 90 days after the end of your stay, after which it is permanently deleted or anonymised.
- Longer storage in your customer account is only possible with your voluntary consent, to make future bookings easier. If you withdraw consent, we delete this data within 30 days (except data we must keep on another legal basis, e.g. for accounting).
5. Recipients of data
We share data only when it is necessary to provide the service or required by law. We use trusted providers who process data on our behalf:
- our website hosting provider (Movecloser, European Union);
- Stripe — card payment processing;
- Twilio — booking notifications by SMS;
- Google — email, Google Maps (route planning and ride pricing, map on the website) and, with your consent, Google Analytics and Google Ads;
- Peppyrus — sending e-invoices via the Peppol network (business customers);
- our accountant — for accounting documents;
- Meta (WhatsApp, Messenger) — if you choose to contact us through these channels;
- public authorities — where required by law.
We drive all rides ourselves — we do not share your data with external drivers or transport companies. We do not sell your personal data.
6. Transfers outside the EEA
Some providers (e.g. Google, Stripe, Twilio, Meta) may process data in the United States or other countries outside the European Economic Area. Such transfers are based on a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or on standard contractual clauses approved by the Commission.
7. How long we keep data
- booking data — for the duration of the contract and then until the limitation period for possible claims expires;
- invoices and accounting records — for the period required by Belgian accounting and tax law;
- account data — until your account is deleted (you can ask for this at any time);
- identity document data — as described in section 4;
- customer messages — until the matter is resolved, then for a maximum of 2 years;
- cookie data — for the periods listed in section 8.
8. Cookies
We use cookies that are necessary for the website to work and, with your consent, analytics and marketing cookies. On your first visit a banner lets you choose the categories. You can change your choice at any time via the “Cookie settings” link in the website footer.
| Category | Purpose | Examples |
|---|
| Necessary | login, cart and booking, language choice, remembering your consent, security | movestay_cookie_consent, pll_language, wordpress_logged_in_*, woocommerce_*, __stripe_mid, __stripe_sid |
| Analytics (with consent) | anonymous visit statistics that help us improve the website (Google Analytics) | _ga, _ga_* (up to 2 years) |
| Marketing (with consent) | measuring the effectiveness of Google Ads | _gcl_au, gclid (up to 90 days) |
Without your consent, Google tools run in restricted mode (Google Consent Mode) and do not store analytics or advertising cookies.
9. Your rights
You have the right to:
- access your data and receive a copy;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”);
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw your consent at any time.
To exercise these rights, email movestaysol@gmail.com. We will reply without undue delay and within one month at the latest.
You also have the right to lodge a complaint with a supervisory authority: in Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels (www.dataprotectionauthority.be). You may also contact the authority in your country of residence.
10. Security
We use technical and organisational measures to protect your data: encrypted connections (HTTPS), encrypted passwords, a firewall and security scanner, and access to data limited to authorised persons only.
11. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
12. Changes to this policy
We may update this policy, for example when we introduce new services. The current version is always available on this page, with the date of the last change shown at the top.
