Privacy Policy - mobility

Bookline collects only the personal data needed to operate the conversational assistant on behalf of our mobility clients. This includes identification details (name, phone number, email if you give it, and your messaging profile name or username), the content of your conversations (call transcripts and WhatsApp, SMS, Instagram and web chat messages), the details of your request (for example dates, number of people, pickup address, comments and special requests) and operational metadata such as timestamps. We do not ask for sensitive categories of data; if you mention any yourself, for example an allergy in a booking comment, it is used only to handle your request. We never sell personal data.

Data is collected when you contact a Bookline client by phone, WhatsApp, SMS, Instagram or web chat. The purposes are: (i) to handle your request on the client's behalf, including passing your booking to the client's reservation system; (ii) to send you messages related to your request, such as a booking link (sent only if you agree during the call, one message per request), confirmations, changes, reminders and satisfaction surveys; (iii) where the client uses it, to send you promotional WhatsApp messages on its behalf, which you can stop at any time; (iv) to provide operational analytics to our clients; and (v) to comply with legal obligations. The client you contacted is the data controller and Bookline processes the data on its behalf. The legal bases are the performance of a contract or pre-contractual steps, the legitimate interest of the client, your consent where it is required, and legal obligation.

Bookline applies industry-standard technical and organisational measures, including transport encryption (TLS), encryption at rest, role-based access controls, audit logging, and regular security reviews. Our infrastructure is hosted in the European Union. Sub-processors are bound by data-processing agreements aligned with GDPR requirements.

Call records, transcripts and messages are removed from our active systems after 12 months and then kept in a restricted-access archive. Contact and booking details are kept while the client you contacted uses Bookline, unless you or the client ask for them to be deleted. Specific retention periods may be set in our agreements with each client.

Your data is shared with the client you contacted and with its reservation or dispatch system. It is also processed by sub-processors that we need to provide the service: cloud hosting, telephony, speech recognition and synthesis, artificial intelligence models that understand and answer your messages, messaging providers (WhatsApp, SMS and Instagram), email, analytics and error monitoring. Some of these providers are based in the United States, so your data may be transferred outside the European Economic Area; these transfers are covered by Standard Contractual Clauses or another mechanism approved under the GDPR. Mobile information is not shared with third parties or affiliates for marketing or promotional purposes.

You have the GDPR rights of access, rectification, erasure, restriction, portability, and objection, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority (in Spain, the AEPD). You can stop promotional messages at any time by replying STOP or using the opt-out option in the message. To exercise any of these rights in connection with Bookline's processing, contact dpo@bookline.ai. To exercise them against the client you contacted, address your request directly to that controller.