Data Retention Privacy Policy 2026 – My Private Transfers
TLDR
This policy explains what personal information My Private Transfers collects when you book a private airport transfer or chauffeur service, how long we keep it, and what happens when it is no longer needed. We operate under the Australian Privacy Principles (APPs) and retain different types of records for different periods, from flight details deleted shortly after your trip to invoice records kept for seven years for tax and accounting compliance. You can request access to, correction of, or deletion of your personal information at any time by contacting us.
Last updated: 2025
Applies to: All bookings made through My Private Transfers (ABN 98 629 501 313), including airport transfers, cruise transfers, corporate transport, event transport, day tours, and private car or bus charters across South East Queensland and our associate network.
Our Commitment
My Private Transfers is a private airport transfer and chauffeured limousine service based in Brisbane (86 Brookes St, Fortitude Valley QLD 4006), with branch offices on the Gold Coast and in Toowoomba. We serve Brisbane, Gold Coast, Sunshine Coast, Ipswich, Logan, Toowoomba, Byron Bay, and surrounding areas, with associate network coverage in other Australian capitals.
Because our service is private and door-to-door, we understand that our customers, whether families, business travellers, or tourists, trust us with information that goes beyond a simple pickup address. Flight numbers, home addresses, child seat requirements, corporate itineraries, hotel stays, and payment details all pass through our booking process. We take that trust seriously.
This data retention privacy policy sets out exactly what we collect, why we need it, how long we keep it, and how you can ask us to change or delete it. We follow the Australian Privacy Principles as set out by the Office of the Australian Information Commissioner (OAIC) and aim to write this policy in plain language that anyone can understand.
What Personal Information We Collect
When you request a quote, make a booking, or travel with My Private Transfers, we may collect the following categories of personal information:
Booking and trip details. Your name, phone number, email address, pickup and drop-off addresses, date and time of transfer, number of passengers (adults and children), flight or cruise details, and your booking reference number.
Vehicle and equipment requirements. Vehicle type requested (Economy or Premium), child seat or baby capsule requirements (we provide these free for children aged 0 to 7), luggage count, and whether you need an enclosed trailer for surfboards, golf clubs, or oversized gear.
Payment and invoicing. Payment method, transaction reference, invoice records, refund or cancellation details, and corporate billing information. We do not store full credit card numbers on our systems. Card payments are processed through third-party payment processors (SecurePay and PayPal), and we retain only the transaction reference and last four digits for reconciliation.
Communication records. Booking confirmations, SMS or email correspondence between you and our team, pickup coordination messages, change requests, and any complaint or feedback you provide.
Special requirements. Accessibility needs, mobility support notes, medical appointment context, or any other details you share so we can match you with the right vehicle, driver, and equipment.
Operational records. Driver assignment, trip status, meet-and-greet notes (for example, which carousel or arrivals hall your driver will meet you at), and trip completion records.
Quote requests. Route, passenger count, luggage details, date, and contact information submitted through our online quote tool.
We collect only the information reasonably necessary to provide, coordinate, and improve our transfer services. This principle, known as data minimisation, is central to Australian Privacy Principle 3.
Why We Collect Each Category
Every piece of information we collect serves a stated purpose:
Data category | Purpose |
|---|---|
Name, phone, email | Confirm your booking, coordinate your pickup, send trip updates, provide post-trip support |
Pickup and drop-off addresses | Deliver your door-to-door transfer and calculate route and pricing |
Flight or cruise details | Monitor your arrival time, coordinate meet-and-greet at the terminal, adjust for delays |
Passenger count and child seat needs | Assign the correct vehicle, install free child restraints (infant capsule, convertible, or booster) |
Luggage and trailer requirements | Ensure adequate vehicle capacity and arrange enclosed trailers when needed |
Payment and transaction records | Process your payment, issue receipts, manage refunds, meet tax and accounting obligations |
Communication records | Provide pickup coordination, handle change requests, resolve complaints |
Special requirements | Accommodate accessibility, mobility, or medical appointment needs |
Driver assignment and trip status | Manage operations, ensure driver accountability, handle disputes |
We do not collect information we do not need. For example, we do not require passport numbers, frequent flyer details, or health diagnoses unless you choose to share context relevant to your transfer.
Our Data Retention Schedule
Different types of records serve different purposes and are subject to different legal obligations. We do not apply a single blanket retention period. Instead, each category has its own retention logic, trigger, and action.
Data category | Retention period | Trigger (when the clock starts) | Action at expiry |
|---|---|---|---|
Quote requests (not converted to booking) | 90 days | Date quote was generated | Deleted from active systems |
Booking and trip details | 12 months after trip completion | Date of trip completion | Archived, then deleted after accounting retention period ends |
Flight and cruise details | 7 days after trip completion | Date of trip completion | Deleted |
Pickup and drop-off addresses | 12 months after trip completion | Date of trip completion | De-identified or deleted |
Child seat and equipment notes | Duration of booking only (unless you maintain an ongoing account) | Trip completion or account closure | Deleted |
Payment and invoice records | 7 years | Date of transaction or invoice | Deleted or de-identified (retained to meet ATO and ASIC requirements) |
Communication records (booking coordination) | 12 months after trip completion | Date of trip completion | Deleted |
Complaint and dispute records | 2 years after resolution, or longer if legally required | Date complaint is resolved | Archived, then deleted |
Refund and cancellation records | 7 years (linked to financial records) | Date of refund or cancellation | Deleted or de-identified |
Marketing preferences and consent records | Until you withdraw consent | Date of consent or withdrawal | Consent record deleted; suppression record retained to prevent recontact |
De-identified analytics (e.g., route demand data) | Retained ongoing | Not applicable (no individual is identifiable) | No individual deletion required |
Corporate account and billing records | 7 years after contract ends | Contract end date or last invoice | Deleted or de-identified |
A note on cancellations: If you cancel a booking, we retain the cancellation and any associated refund records for the periods stated above. Our cancellation and refund policy explains the refund windows (100% refund more than 48 hours before pickup, 50% between 24 and 48 hours, no refund within 24 hours). The financial records from that process follow tax retention rules.
How We Delete, De-identify, or Archive Your Information
These terms mean different things, and we want to be clear about how we use them.
Deletion means we remove the information from our systems so it cannot be retrieved. When we say we delete data, we mean it is permanently removed from our active booking and communication systems.
De-identification means we strip or alter identifying details so the remaining information cannot reasonably identify you. For example, we may retain the fact that a transfer occurred on a particular route on a particular date for demand planning purposes, without retaining your name, contact details, or address.
Archiving means we move older records out of our active systems into restricted-access storage. Archived records are accessible only to authorised staff for legal, accounting, or dispute purposes.
Legal hold means we pause scheduled deletion because of a dispute, investigation, complaint, court order, or audit. If a legal hold applies to your records, we will retain them until the hold is lifted and then apply the standard retention action.
Backups
When data is deleted from our active systems, copies may temporarily remain in encrypted system backups. Our backup cycle overwrites or purges old backup data within 90 days of deletion from live systems. We review our backup practices regularly to ensure personal information no longer needed is not retained indefinitely in backup storage.
Who Can Access Your Information
Access to your personal information within My Private Transfers is limited to staff and drivers who need it to deliver your service:
Our booking and operations team can access your booking details, contact information, and trip requirements to coordinate your transfer.
Your assigned chauffeur receives only the information needed for your specific trip: your name, pickup and drop-off locations, flight details, passenger count, child seat requirements, luggage notes, and any special requirements. Drivers do not have access to your payment details, booking history, or account records.
Our accounts team can access payment and invoice records for billing, refunds, and tax compliance.
All our chauffeurs are government-accredited in Queensland and operate under confidentiality obligations.
Third-Party Disclosure
We share personal information with third parties only where necessary to provide our service or meet legal obligations:
Third party | What is shared | Why |
|---|---|---|
Payment processors (SecurePay, PayPal) | Payment card details, transaction amount | To process your payment securely. We do not store full card numbers. |
Associate transfer operators (other Australian cities) | Booking details, contact information, trip requirements | To coordinate transfers outside our direct service area when you book a multi-city itinerary through us |
Cloud hosting and IT service providers | System data (encrypted) | To operate our booking and communication systems |
Accountants and auditors | Financial records | Tax, accounting, and audit compliance |
Law enforcement or regulators | As required by law | To comply with court orders, legal obligations, or regulatory requests |
We do not sell your personal information. We do not share your details with unrelated marketing companies.
Overseas Disclosure
Our associate network covers Australian capitals (Sydney, Melbourne, Hobart, Adelaide, Perth, Darwin, Cairns). When you book a transfer through us that is fulfilled by an associate operator in another Australian city, your booking details are shared with that operator. We do not currently transfer personal information to recipients outside Australia as part of standard operations. If this changes, we will update this policy and seek your consent where required.
Your Rights
You have the right to:
Access your information. Ask us what personal information we hold about you. We will respond within 30 days.
Correct your information. Ask us to update or correct any details that are wrong or out of date.
Request deletion. Ask us to delete personal information we no longer need. We will honour deletion requests unless the information must be retained for legal, tax, accounting, dispute, or fraud-prevention reasons. If we cannot delete certain records, we will explain why and tell you when they will be deleted under our retention schedule.
Withdraw marketing consent. Opt out of marketing communications at any time. We will add you to our suppression list to ensure we do not contact you again for marketing purposes.
Make a complaint. If you believe we have mishandled your personal information, contact us first. If you are not satisfied with our response, you can lodge a complaint with the OAIC at oaic.gov.au.
To exercise any of these rights, contact us directly by phone, email, or through our website.
How This Policy Applies to Different Customer Types
Families
Family airport transfer bookings often include children’s details, child restraint requirements, home addresses, holiday accommodation details, and flight times. We take particular care with this information. Child seat and equipment notes are deleted after your trip is completed unless you maintain an ongoing account and ask us to save preferences. Home addresses used for door-to-door pickups follow our standard 12-month retention and deletion schedule. Learn more about travelling with children and our free child seat service.
Corporate Travellers
Corporate bookings can reveal executive travel patterns, client meeting locations, and billing relationships. For corporate account holders, we apply the same retention schedule but extend financial record retention to 7 years after the contract ends. We can arrange dedicated account management with restricted access to traveller profiles on request. Read more about our corporate chauffeur services and their benefits.
Cruise, Tourist, and Event Passengers
Holiday and cruise transfer bookings can reveal when a home is unoccupied and where a traveller is staying. Event transfers for weddings, conferences, or festivals may involve group passenger lists and venue addresses. We apply the same retention periods to these bookings and delete trip-specific location details within 12 months of your transfer.
Medical Travellers
Transfers to medical appointments may involve sensitive context. We do not require or record medical diagnoses. Any notes you provide about mobility support, accessibility needs, or appointment timing are retained only for the duration of your booking and deleted after your trip unless a complaint or dispute requires longer retention.
Legal Basis and Compliance
My Private Transfers operates under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Key principles underpinning this policy:
APP 1 requires open and transparent management of personal information, including a clearly expressed and up-to-date privacy policy (source).
APP 3 requires that we collect only information reasonably necessary for our functions.
APP 11.2 requires us to take reasonable steps to destroy or de-identify personal information once it is no longer needed for any purpose for which it may be used or disclosed, unless an exception applies (source).
Australian business records must generally be kept for five years under ATO guidance (source), and financial records for at least seven years under ASIC requirements.
From 10 December 2026, APP entities that use automated decision-making involving personal information will need to disclose additional details in their privacy policies (source). We will update this policy to reflect any new requirements as they take effect.
International Travellers
If you are visiting Australia from a jurisdiction with its own data protection laws (such as GDPR in Europe or UK GDPR), we apply our Australian retention schedule as the baseline. Where your home jurisdiction provides stronger protections for specific data types, we aim to accommodate reasonable requests. Contact us if you have questions about how your information is handled under your local privacy framework.
Definitions
Personal information. Information or an opinion about an identified individual, or an individual who is reasonably identifiable.
Sensitive information. A subset of personal information that includes health data, racial or ethnic origin, political opinions, and biometric data. It receives stronger protections under the APPs.
Data minimisation. The principle of collecting only the personal information reasonably necessary for the stated purpose.
Legal hold. A directive to preserve records that may be relevant to litigation, investigation, or audit.
Overseas disclosure. When personal information is transferred to a recipient outside Australia.
De-identification. Altering or removing identifying details so information cannot reasonably identify a specific person. The OAIC notes that de-identified information can sometimes become identifiable again when combined with other data, so genuine de-identification requires care.
APP entity. An organisation or agency covered by the Australian Privacy Principles under the Privacy Act 1988.
Frequently Asked Questions
How long does My Private Transfers keep my booking details after my trip?
Booking and trip details are retained for 12 months after your trip is completed, then archived. Payment and invoice records are retained for 7 years to meet Australian tax and accounting requirements. Flight and cruise details used for meet-and-greet coordination are deleted within 7 days of trip completion.
Does My Private Transfers store my credit card number?
No. Full credit card details are processed by our third-party payment processors (SecurePay and PayPal). We retain only the transaction reference and last four digits for reconciliation and refund purposes.
Can I ask My Private Transfers to delete my personal information?
Yes. Contact us by phone, email, or through our contact page. We will delete personal information we no longer need. Some records (payment, invoice, complaint, and refund records) may need to be retained for legal, tax, or dispute reasons. We will explain what can and cannot be deleted and when remaining records will be removed under our schedule.
What happens to my data if I cancel a booking?
If you cancel, we retain the cancellation record and any associated refund or payment records for 7 years (tax and accounting compliance). Other booking details (pickup address, flight number, child seat notes) follow the standard retention schedule and are deleted within 12 months of the cancellation date unless linked to an active dispute or complaint.
Who sees my booking details?
Your booking details are accessible to our booking and operations team and your assigned chauffeur. The chauffeur receives only the information needed for your specific trip. Payment details are handled by our accounts team and third-party payment processors. We do not share your information with unrelated marketing companies.
What about child seat and special requirement information?
Child seat requirements and special requirement notes are retained only for the duration of your booking and deleted after your trip. If you have an ongoing account and ask us to save preferences for future bookings, we retain those preferences until you ask us to remove them or close your account.
Does My Private Transfers use my information for marketing?
We may send you marketing communications only if you have opted in. You can withdraw consent at any time, and we will add you to our suppression list. The suppression record is kept to ensure we do not recontact you for marketing purposes.
What if I am booking through a corporate account?
Corporate account records, including traveller profiles, billing records, and invoices, are retained for 7 years after the contract ends. We can arrange restricted access to traveller profiles on request. Corporate travel managers should review this policy and contact us with any specific requirements.
How does this policy apply to associate operators in other cities?
When you book a transfer through us that is fulfilled by an associate operator in another Australian city, we share your booking details with that operator to coordinate your trip. Associate operators are expected to handle your information in accordance with their own privacy obligations under Australian law. We do not transfer personal information outside Australia as part of standard operations.
How can I make a privacy complaint?
Contact us first through our contact page. We will investigate and respond within 30 days. If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.
This policy is current as of 2025 and will be updated as Australian privacy law evolves. For booking terms and conditions, see the My Private Transfers terms of use. For questions about bookings, child seats, luggage, or transfers, contact us.