Privacy Policy

We process data provided by you or by the person who books the service on your behalf, as well as data generated when the website is used and the service is performed. We may receive Passenger data from the client, employer, hotel or other person organising the transport. From the bank or payment service provider we receive data on the completed payment to the extent necessary.

When we receive data about you from another person, we provide this notice within a reasonable period, no later than 30 days, and if we contact you earlier or disclose the data earlier to another recipient, no later than at that time, save for the exceptions prescribed by law. Where the GDPR applies, the one-month period under its Article 14(3) is also taken into account. We ask the client to forward this policy to you, but this does not end the Company's obligation to inform you.

• Limo service Request and contract: first and last name of the User and, where necessary, the Passenger, contact telephone number and/or email, data on the business client and its contact person, origin and destination, the purpose and objective of the journey described without unnecessary private details, date, time and agreed Duration of Transport, number of passengers, number of children and the age needed for an appropriate seat, vehicle, flight number where relevant, necessary special requests, Offer, acceptance of the Offer, Contract Confirmation, price and status of performance or cancellation. The informative estimate on the website is not confirmation of a concluded contract.
• Personalised meet and greet, if you request it: the text on the welcome sign, luggage, cabin settings, the driver's language, the meeting point and a wish to be driven by the same driver. For the sign you may choose initials or another agreed text instead of your full name. The sign may be seen by other persons in the arrivals area.
• Enquiry via the Contact page, including an enquiry for Wayport Rentals: name, contact telephone number and/or email, the service requested, the route or rental period and the content of the enquiry. We will inform you about any additional data needed to conclude and perform a separate contract for vehicle rental without a driver before collecting it.
• Calls and messages: when you contact us by telephone, via WhatsApp, Viber or email, we process your number or address, the content of the message and the necessary written note of the request. This policy does not provide for recording telephone conversations.
• Technical data: when you visit the website, the hosting provider automatically records technical data (e.g. IP address, time of access and browser type) for the operation and security of the website.
• Invoices, payment and complaints: data needed for the invoice, the amount, method and status of payment, the transaction identifier where one is used, the content of the complaint and documents needed to resolve it. We do not ask you to send us your PIN, CVV/CVC or full payment card number via a form or message.

We do not ask for diagnoses, information on treatment, medical records or other unnecessary health data. Please do not enter them in free-text form fields, including the note field. If data revealing a health condition or disability is essential for the requested adaptation of the transport, please contact us first to agree on a safe way of providing it. We process such data only to the extent strictly necessary, on the basis of the separate explicit consent of the person concerned or their authorised legal representative, or another specifically applicable statutory exception. Merely sending a note or accepting the General Terms is not explicit consent. In emergencies, processing is possible to protect vital interests where the person is physically or legally incapable of giving consent, and for a legal claim only to the extent permitted by law.

• Handling the Request, preparing the Offer, and concluding, performing and collecting payment under the contract with you are based on the necessity of taking steps at your request prior to entering into a contract and of performing a contract to which you are a party, in accordance with Article 12(1)(2) of the Law on Personal Data Protection (ZZPL).
• Issuing and keeping invoices, keeping the record of contracted transport, keeping transport documentation and the statutory record of complaints are based on compliance with legal obligations under Article 12(1)(3) ZZPL. We keep documentation on contracted limo transport for two years in accordance with Article 137g(1)(8) of the Law on Road Passenger Transport, with longer retention of certain documents only where there is a specific basis for it.
• We process the data of Passengers for whom the service is booked by another person, and of contact persons of business clients, to the extent strictly necessary on the basis of the legitimate interest of the Company, the client and the Passenger in organising and performing the requested transport. On the same basis we process data needed to respond to general enquiries, for website security, for preventing abuse and for establishing, exercising or defending legal claims. Before processing, we check that these interests are not overridden by the rights and freedoms of the persons concerned, in particular children. The basis is Article 12(1)(6) ZZPL.
• For processing based on consent, Article 12(1)(1) and Article 15 ZZPL apply, and for health data also Article 17 ZZPL. Consent to optional processing is separate from acceptance of the General Terms and may be withdrawn as easily as it was given.

We do not use data for advertising messages, we do not create user profiles and we do not take decisions that produce legal effects or similarly significantly affect you based solely on automated processing. The informative price calculator does not decide on accepting a Request. You conclude the contract directly with the Company by accepting a written or electronic Offer in accordance with the General Terms. We do not use an app for booking transport.

Data marked as mandatory are needed to respond, prepare an Offer, conclude the contract or safely perform the requested service. Without them we may not be able to process a specific Request or provide the service. Other data, including optional meet and greet settings, are not a condition for the basic service.

The ZZPL applies to the Company's processing. The GDPR additionally applies where the conditions of its Article 3 are met, in particular in connection with services targeted at persons located in the EU. In that case, contractual processing, consent and legitimate interest are also assessed under Article 6(1)(b), (a) and (f) GDPR, and health data under Article 9 GDPR. Processing to comply with obligations under Serbian regulations is not automatically based on Article 6(1)(c) GDPR; instead, an appropriate basis is determined separately for that regime, including legitimate interest where its conditions are met.

According to the described mode of operation, the website does not use cookies for tracking or analytics. For certain functions, browser storage for the current session (sessionStorage) is used. The consent rules also apply to this technology. Without consent we use it only to the extent strictly necessary for the service or function you have explicitly requested.

• wp-intro: remembering that the intro animation has been shown is an optional function and is not activated before your prior consent. If you do not give consent, you can still use the website and send a Request.
• wp-guest: temporarily remembers the meet and greet settings you choose, so that they can be carried over into your Request form. Without consent it may be used only to the extent strictly necessary for this explicitly requested function. The data are not used for tracking or advertising.

Data in sessionStorage remain in the browser for the duration of the tab session and can be deleted through the browser settings. Closing the tab normally ends the session, but session restore depends on the browser. The settings from wp-guest are delivered to the Company when you send a Request. This does not exclude the separate sending of the address text and technical data to the Photon service while typing, as described in section 5.

According to the described setup, fonts and maps are loaded from our website, while Photon is used for address suggestions. When you click a link to Google Maps, Apple Maps, Waze, WhatsApp or Viber, their service opens, which processes data in accordance with its role and privacy policy. You use these links at your own choice. This does not exclude the Company's responsibility for the data it sends or receives through those channels.

• The Company's authorised dispatcher and administration access data according to their business duties, in order to handle Requests, organise rides, collect payment and keep records. Accounting receives the data needed for invoices and statutory records. Engaged staff process data on the Company's instructions and subject to a confidentiality obligation.
• The driver performing a specific ride receives the welcome sign text, the contact needed for the meeting, the pick-up locations and time, the destination, relevant flight information and necessary operational instructions. The driver is also given access to the documentation that must by law be kept in the vehicle, including the contract of carriage. The driver does not get access to the entire mailbox, enquiry history or data for other rides. Health data, where lawfully processed, are limited to the necessary instruction for the specific assistance.
• Netlify, Inc. (USA) provides website hosting and form handling and processes Request data and necessary technical data on our behalf.
• The provider of business email and calendar services processes messages, contacts, attachments and the ride schedule.
• Photon is software for address suggestions based on OpenStreetMap data. If the public service operated by komoot is used, then while you type, before the form is sent, the text of the entered address is sent to that service, and with a direct connection from the browser also the IP address and technical request data. The separate name, telephone and email fields are not sent to this service, but personal data you enter yourself in the address field may become part of the query.
• Banks and payment service providers receive the data needed for payment. External accountants and IT support providers process data to the extent of their engagement. Lawyers and insurers receive the necessary data when a specific claim or dispute needs to be resolved. We provide data to competent state authorities where there is a legal obligation or another applicable legal basis. We do not automatically share data with all of the listed categories.

If you choose to communicate via WhatsApp or Viber, those services process the communication and technical data according to their own rules. To a business client that booked and paid for the transport we provide only the data needed to confirm performance and for billing, without unnecessary private or health data of the Passenger.

With providers that process data on our behalf we conclude data processing agreements in accordance with Article 45 ZZPL and, where applicable, Article 28 GDPR. Independent controllers are responsible for their own processing. Upon request, we provide the User with more detailed information on specific recipients in accordance with the law.

• Enquiries and Offers that did not result in a contract are kept for no longer than six months from the end of communication on the specific enquiry. Documentation on contracted limo transport, including the Offer, acceptance, confirmation, amendments and the transport record, is kept for two years. For the regular calculation of this period, we start from the end of the specific transport or its final cancellation. Continued cooperation or a new ride does not automatically extend the period for previous rides.
• We keep accounting documents for at least five years from the last day of the business year to which they relate, under Article 28 of the Law on Accounting. Electronic invoices issued and received between private sector entities are kept for ten years from the end of the year of issue, under Article 15 of the Law on Electronic Invoicing. Invoices issued or received by the public sector are kept permanently in the electronic invoicing system. We keep VAT records and supporting documentation until the expiry of the applicable limitation period for assessing and collecting VAT under Article 47 of the Law on Value Added Tax. The longer period applies only to documents subject to that obligation.
• We delete duplicate Requests in Netlify Forms no later than 30 days after receipt, after checking that the necessary data have been transferred to the business records. We remove operational copies held by drivers and in the calendar no later than 30 days after the end of the ride, after securely transferring the mandatory documentation to an archive with restricted access. These periods are a proposed internal rule of the Company and not statutory periods.
• We keep the record of consumer complaints for at least two years from the submission of the complaint, under Article 63 of the Law on Consumer Protection. If there is a specific dispute, incident, outstanding claim or request from an authority, we set aside only the necessary data and keep them for as long as they are needed for that procedure and for exercising or defending a legal claim, applying the relevant limitation periods. We consider a request for erasure even before the regular period expires, but we do not delete data we are still lawfully required to keep.
• Data in sessionStorage are kept for the duration of the tab session, as explained in section 4. Data on optional meet and greet settings and special assistance that are not part of the mandatory documentation are removed once no longer needed, as a rule within seven days after the service is performed. Technical and security logs under the Company's control are kept for up to 90 days, except for records set aside for a specific incident.
• When the period expires, we delete the data or irreversibly anonymise them. Merely moving a message to an archive folder or restricting access does not constitute deletion and does not provide a basis for unlimited retention. In backups, data are deleted in the established cycle, are isolated from regular use until then, and when a system is restored, previous deletion instructions are applied again.

In accordance with the ZZPL, and where applicable the GDPR, you have the right to:

• obtain information on whether we process your data and a copy of that data;
• request rectification of inaccurate data or completion of incomplete data;
• request erasure of data where there is no longer a basis for processing it;
• request restriction of processing;
• receive the data you provided to us in a structured, commonly used and machine-readable format and transmit them to another controller, where processing is automated and based on consent or contract, and request direct transmission where technically feasible;
• object to processing based on legitimate interest, on grounds relating to your particular situation. In that case we stop that processing unless we demonstrate overriding grounds prescribed by law or a need to establish, exercise or defend a legal claim;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal, where processing is based on consent. Withdrawal does not affect processing that has another independent legal basis.

Send your request to office@wayport.rs or by post to the Company's address. Under the ZZPL we respond without delay and no later than 30 days from receipt of the request. Owing to the complexity or number of requests, this period may be extended by a further 60 days, with a reasoned notice within the first 30 days. Where the GDPR applies, the basic period is one month and may be extended by a further two months under the conditions of Article 12(3) GDPR. If both regimes apply, we act within the shorter applicable period.

Handling requests is, as a rule, free of charge. We ask for additional information to verify identity only where there is reasonable doubt and only to the extent necessary, without routinely requesting a copy of an identity document. If we do not act on a request, we state the reasons and information on legal remedies within the statutory period. Manifestly unfounded or excessive requests are handled in accordance with the statutory exceptions, with the burden of proof on the Company.

If you believe that processing is not in accordance with the law, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Beograd, www.poverenik.rs, and seek judicial protection. Where the GDPR applies, you also have the right to lodge a complaint with the competent supervisory authority in the EU, in particular in the state of your habitual residence, place of work or place of the alleged infringement, in accordance with Article 77 GDPR.

The website uses an encrypted HTTPS connection. The Company restricts access according to business duties and binds authorised persons to confidentiality. It applies appropriate access protection to business accounts, and measures proportionate to the risk for the archive, devices and backups. In the event of a personal data breach, it assesses the consequences and documents the incident. Where the statutory conditions are met, it notifies the Commissioner without undue delay, where feasible within 72 hours of becoming aware of it, as well as the persons whose rights and freedoms may be exposed to a high risk. Where the GDPR applies, it also acts under Articles 33 and 34 of that regulation.

Requests to conclude a contract are sent by adults. A minor may be a Passenger in accordance with the General Terms and safety rules, with appropriate authorisation from a parent or guardian where required. We collect only the data necessary for the specific transport and an appropriate seat, as a rule the number of children and the required age, without routinely collecting dates of birth, personal identification numbers (JMBG) or copies of documents. A child's health data are processed only under the special conditions set out in section 2. A person who books transport is not considered, merely by booking, to be authorised to give consent on behalf of every Passenger.

We amend this policy when the manner of processing or the regulations change. The current version is available on this page with its effective date. Before a new purpose of processing or another material change, we provide the necessary notice, and where consent is required, we obtain it before such processing begins. Continued use of the website is not considered consent. Please also read our Terms of Use.

This policy enters into force on the day of its publication on the website.