Privacy Policy

Last updated: 02.07.2026

1. General Information

1.1. This Privacy Policy describes how ALSTA MOBILITY S.R.L. processes personal data in connection with the use of the alsta.ro platform, the booking of transport services and any other interactions with clients, passengers, partners or users of the services provided by Alsta.

1.2. The data controller is ALSTA MOBILITY S.R.L., a Romanian legal entity with its registered office in Bucharest, District 3, Nerva Traian Street, No. 27-33, Office No. 6, Building B, 1st Floor, registered with the Trade Register under no. J2022003208407, having VAT ID RO45676976.

1.3. For any questions regarding the processing of personal data or for exercising the rights provided by the applicable legislation, you may contact us at the following email address: office@alsta.ro .

1.4. Alsta processes personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (GDPR) and the applicable national legislation.

2. Scope and Categories of Data Subjects

2.1. This Privacy Policy applies to all persons whose personal data are processed by Alsta in connection with the use of the website, the booking of transport services or interaction with the services provided by the company.

2.2. This Policy applies, without limitation, to the following categories of data subjects:

  1. individual clients requesting or using Alsta services;
  2. passengers transported as part of the services provided;
  3. representatives, employees or contact persons of companies, public institutions or other entities requesting transport services;
  4. persons for whom a reservation is made by a third party (for example: company, hotel, agency, partner or another client);
  5. users of the alsta.ro website.

2.3. This Policy applies regardless of the method through which the services are requested, including via the website, phone, email, WhatsApp or other communication channels used by ALSTA.

3. Categories of Personal Data Processed

3.1. Depending on the nature of the requested services and the way users interact with Alsta, the following categories of personal data may be processed:

  1. identification data, such as the first and last name of the client or passenger;
  2. contact details, such as phone number and email address;
  3. data related to reservations and transport services, such as pickup location and destination, trip date and time, number of passengers, luggage information or other communicated operational details;
  4. travel-related data, such as flight or train details (flight number, arrival/departure time), when provided for the organization of the service;
  5. billing data, such as first and last name, residence address, company name, company address, VAT ID, Trade Register number or other information required for issuing invoices;
  6. data related to communication with the client, such as information transmitted via email, phone, WhatsApp or other communication channels used;
  7. technical data regarding website usage, such as IP address, device type, browser type or other information collected through cookies or similar technologies.

3.2. Alsta does not intentionally collect or process special categories of personal data (for example: health data, political opinions, religion, etc.), except where such data are voluntarily provided by the data subject and are necessary for the provision of the services.

4. Sources of Personal Data

4.1. The personal data processed by Alsta may be collected directly from the data subject or may be provided by third parties in connection with the request and organization of transport services.

4.2. Depending on the situation, the data may originate from the following sources:

  1. data provided directly by the client or passenger by completing the booking form on the website, via phone, email, WhatsApp or other communication channels;
  2. data provided by companies, public institutions or other entities requesting transport services for employees, collaborators or other persons;
  3. data provided by hotels, travel agencies, partners or other persons who make reservations for passengers;
  4. data generated as a result of communication with the client or passenger regarding the reservation and the provision of services;
  5. data automatically collected through the use of the website, including through cookies or similar technologies.

4.3. In situations where personal data are provided by a person or entity other than the data subject, that person or entity declares that they have the right to transmit the respective data and that they have informed the data subject about the processing of such data in accordance with the applicable legislation.

5. Purposes of Personal Data Processing

5.1. Alsta processes personal data for the following purposes:

  1. managing reservations and providing transport services, including organizing trips, coordinating drivers and communicating with passengers;
  2. communicating with clients or passengers, including sending booking confirmations, trip updates, operational information or responding to requests;
  3. invoicing and managing commercial relationships, including issuing invoices, accounting records and payment administration;
  4. handling requests, incidents or complaints related to the services provided;
  5. complying with applicable legal obligations, including financial-accounting, tax or other obligations required by applicable legislation;
  6. ensuring the security of the website and IT systems, as well as preventing abusive or fraudulent use of the platform;
  7. improving services and user experience, including analyzing how the website is used and optimizing its functionalities.

5.2. Personal data are not used for purposes other than those mentioned above, except where there is a legal obligation or another legal basis that allows such processing.

5.3. SMS communications: By providing your phone number when booking a service through our website or through other communication channels (such as phone, email, or WhatsApp), you consent to receive transactional SMS messages related to your booking, including booking confirmations, driver arrival notifications, and booking updates. Message frequency varies depending on your booking activity. Message and data rates may apply. Your phone number will not be shared or sold to third parties for their own marketing purposes. You may opt out of SMS communications at any time by replying STOP to any message, or by contacting us at office@alsta.ro.

6. Legal Basis for Personal Data Processing

6.1. The processing of personal data by Alsta is carried out in accordance with the applicable legislation and is based on one or more of the following legal grounds:

  1. the performance of a contract or the steps necessary prior to entering into a contract, namely for managing reservations and providing transport services;
  2. compliance with legal obligations applicable to Alsta, including financial-accounting, tax or other obligations required by applicable legislation;
  3. the legitimate interest of Alsta, insofar as it does not override the fundamental rights and freedoms of the data subjects, such as ensuring website security, preventing fraud or improving services;
  4. the consent of the data subject, where required under applicable legislation (for example, for the use of certain types of cookies or similar technologies).

6.2. Where data processing is based on consent, the data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

7. Disclosure of Data to Third Parties

7.1. For the provision of services and the fulfillment of the purposes described in this Privacy Policy, Alsta may transmit or allow access to certain personal data to third parties, to the extent necessary.

7.2. Depending on the situation, data may be disclosed to the following categories of recipients:

  1. drivers or collaborators involved in providing the transport services;
  2. authorized subcontractors or partners providing transport services on behalf of Alsta;
  3. payment service providers for processing online payments (for example, the payment processor Stripe);
  4. IT and technical service providers, including hosting providers, software maintenance providers or system security service providers;
  5. public authorities or state institutions where disclosure is required by law or by a lawful request from a competent authority.

7.3. Alsta ensures that any third party processing personal data on its behalf provides appropriate safeguards regarding data protection and compliance with the applicable legislation.

8. International Data Transfers

8.1. In certain situations, personal data may be transferred to or accessed from outside the European Economic Area (EEA) when ALSTA uses service providers or IT systems operated by entities located in other jurisdictions.

8.2. In such cases, Alsta ensures that the transfer of data is carried out in accordance with the applicable data protection legislation, including through the use of appropriate safeguards such as:

  1. adequacy decisions issued by the European Commission;
  2. standard contractual clauses approved by the European Commission;
  3. other mechanisms provided for by applicable legislation.

8.3. International data transfers may occur, for example, in the context of using technical service providers, payment providers or IT infrastructure providers that operate internationally.

9. Personal Data Retention Period

9.1. Alsta retains personal data only for the period necessary to fulfill the purposes for which they were collected, as well as to comply with applicable legal obligations.

9.2. Depending on the type of data and the purpose of processing, the retention period may vary. For example:

  1. data related to reservations and transport services are retained for the period necessary to organize and provide the service, and subsequently for managing possible requests or complaints;
  2. data used for invoicing and accounting records are retained in accordance with the applicable financial and accounting legislation, generally for a period of up to 10 years;
  3. data related to communications with clients may be retained for the period necessary to manage requests and to ensure continuity of the commercial relationship;
  4. technical data collected through the website are retained in accordance with the cookie policy or for the period necessary to ensure the security of IT systems.

9.3. Upon the expiration of the applicable retention periods, personal data will be deleted or anonymized, except where their retention is necessary for complying with legal obligations or for defending the legitimate rights and interests of ALSTA.

10. Personal Data Security

10.1. Alsta implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure or accidental or unlawful destruction.

10.2. These measures may include, but are not limited to, access control to data, the use of secure IT systems, internal data protection procedures and staff training regarding confidentiality obligations.

10.3. Access to personal data is limited to authorized persons who require such information to perform their duties in connection with the provision of services.

10.4. Although Alsta makes reasonable efforts to protect personal data, the transmission of information via the internet or other electronic means cannot be guaranteed to be completely secure.

11. Rights of Data Subjects

11.1. Individuals whose personal data are processed by Alsta benefit from the rights provided by the applicable data protection legislation.

11.2. In accordance with Regulation (EU) 2016/679 (GDPR), data subjects mainly have the following rights:

  1. right of access - the right to obtain confirmation that their personal data are being processed and to receive information regarding such processing;
  2. right to rectification - the right to request the correction of inaccurate data or the completion of incomplete data;
  3. right to erasure (“right to be forgotten”) - the right to request the deletion of personal data under the conditions provided by applicable legislation;
  4. right to restriction of processing - the right to request the limitation of the processing of personal data in certain situations;
  5. right to data portability - the right to receive personal data in a structured format and to transmit those data to another controller, where technically feasible;
  6. right to object - the right to object to the processing of personal data in certain situations;
  7. right to withdraw consent, where the processing is based on consent;
  8. right to lodge a complaint with the competent data protection supervisory authority.

11.3. To exercise these rights, data subjects may submit a request to Alsta using the e-mail address indicated in this Privacy Policy.

11.4. Alsta will respond to such requests in accordance with the deadlines and conditions provided by the applicable legislation.

12. Cookies and Similar Technologies

12.1. The website alsta.ro uses cookies and other similar technologies to ensure the proper functioning of the platform, to improve the user experience and to analyze how the website is used.

12.2. Cookies are small files that are stored on the user’s device when accessing the website and which allow the recognition of the device and the storage of certain information about user preferences.

12.3. The cookies used may include, without limitation:

12.4. Detailed information regarding the types of cookies used, their purposes and the ways users can manage their preferences are available in the Cookies Policy published on the website.

13. Changes to the Privacy Policy

13.1. Alsta reserves the right to modify or update this Privacy Policy whenever necessary, in order to reflect changes in the way personal data are processed, legislative changes, or updates to the services provided.

13.2. The updated version of the Privacy Policy will be published on the website alsta.ro, and the changes will take effect from the date of publication, unless applicable legislation provides otherwise.

13.3. Continued use of the website or the services provided by Alsta after the publication of an updated version of the Privacy Policy constitutes acceptance of these changes.

14. Contact Information

14.1. For any questions regarding this Privacy Policy or for exercising the rights provided by data protection legislation, data subjects may contact Alsta using the following contact details:

Email: office@alsta.ro

Phone: +4 021 555 1787

This document has been translated from the Romanian version. In the event of any discrepancies, inconsistencies or interpretation differences between versions, the Romanian version shall prevail.