Data Controller & Data Protection Officer (DPO)
The data controller responsible for the collection and processing of personal data across the Voyager Private platform is:
Categories of Personal Data Collected
We process strictly necessary data categories tailored to executive VIP carriage and concierge curation:
Legal name, international phone number, encrypted email address, VIP booking preferences, and tax residency identifiers (for statutory EU DAC7 / AEAT Form 238 reporting).
High-precision WGS84 GPS coordinates are sampled strictly during active missions for route verification, telematics handshake PIN confirmation, and emergency SOS incident auditing.
Biometric signatures (Face ID, Touch ID, Windows Hello) are processed exclusively on the client device's Secure Enclave. Voyager Private servers store only the public cryptographic credential and never receive raw biometric data.
Card numbers and bank credentials are tokenized directly via PCI-DSS Level 1 certified gateways (Stripe, CaixaBank). No primary account numbers (PAN) are ever stored on Platform servers.
Legal Grounds for Data Processing (GDPR Art. 6)
- Contractual Performance (Art. 6(1)(b) GDPR): Processing is necessary to match passengers with chauffeurs, route vehicles, authenticate telematics handshakes, and process escrow disbursements.
- Legal Compliance (Art. 6(1)(c) GDPR): Mandatory reporting to the Spanish VTC Electronic Communications Registry (RD 1076/2017), tax reporting under European Council Directive (EU) 2021/514 (DAC7), and fiscal retention under the Spanish General Tax Act (Ley 58/2003).
- Legitimate Interests (Art. 6(1)(f) GDPR): Fraud detection, telematics anomaly monitoring, chauffeur verification, and passenger safety telemetry.
- Explicit Consent (Art. 6(1)(a) GDPR): Optional analytics cookies and optional personalized heritage travel recommendations.
Data Retention & Cryptographic Lifecycle
We apply strict automated retention schedules to minimize data exposure:
Your Legal Rights & Global Privacy Inquiries
Under Chapter III of the GDPR and the CCPA/CPRA, you hold sovereign rights regarding your personal data:
If you believe our processing infringes your rights, you have the statutory right to lodge a formal complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD), Jorge Juan 6, 28001 Madrid, Spain (www.aepd.es).