GoFleet — Privacy Policy

1. What GoFleet is

GoFleet is a technology platform and marketplace that connects travellers, customers, agencies and other users with professionals and providers of travel and related services.

Depending on the service, the GoFleet ecosystem may include:

• transfers and transport,
• taxi and private transfers,
• rent a car,
• activities and experiences,
• day cruises and boats,
• yachts and boat services,
• accommodation and hotels,
• flights and travel services,
• ferry services,
• eSIM and related travel services,
• agency/B2B services,
• partner dashboards,
• booking pages,
• white-label or embedded booking interfaces,
• APIs and integrations.

The website gofleet.gr may be used for corporate, informational and commercial presentation of GoFleet, while other GoFleet infrastructure and domains may be used for bookings, partner services, administration, integrations and other platform functions.

2. Data controller

The controller of personal data for activities covered by this Policy is:

Legal entity: Cloudera Monoprosopi IKE (Cloudera Μονοπρόσωπη Ι.Κ.Ε.)

Trade name / Brand: GoFleet

Tax ID (ΑΦΜ): 802846802

Company registry (ΓΕΜΗ): 183868406000

EUID: ELGEMI.183868406000

Email: support.gofleet@cloudera.gr

Website: https://gofleet.gr

For some services, GoFleet may act as a processor on behalf of a partner. In other cases, the partner may act as an independent controller.

The actual role of each party depends on the specific service, contractual relationship and personal data flow.

3. Who this Policy applies to

This Policy covers data that may be collected from or through:

• visitors to gofleet.gr,
• travellers and customers,
• users who make a booking,
• users who create an account,
• partners and providers,
• agencies and B2B users,
• drivers or partner staff where required,
• users of white-label or embedded booking pages,
• users of GoFleet apps or web apps,
• users who contact support,
• users who submit requests or complaints.

4. Personal data we may collect

Depending on the service, we may collect the following categories of data.

4.1 Identity data

May include:

• full name,
• title or salutation,
• company details,
• professional role,
• username or account identifier.

4.2 Contact data

May include:

• email,
• phone number,
• address,
• company contact details,
• contact details for booking or support.

4.3 Booking data

Depending on the service:

• service date and time,
• number of passengers,
• pickup and drop-off details,
• pickup/drop-off information,
• flight details,
• accommodation details,
• booking reference,
• e-ticket information,
• QR or check-in information,
• vehicle or service details,
• options and extras,
• cancellations and modifications.

4.4 Passenger / guest information

Where needed to perform a service, we may process passenger or guest details entered by the user or by a partner/agency.

A user or partner who enters third-party details must have a lawful basis to provide that data and, where required, must have informed those people.

4.5 Partner data

For partner accounts we may collect:

• contact person name,
• company details,
• email,
• phone,
• billing details,
• bank account details for payouts,
• legal representation details,
• professional licences or certifications where required,
• user details and account activity.

4.6 Payment data

GoFleet may work with specialised payment providers.

Depending on the payment flow, card numbers or other sensitive payment details may be collected and processed directly by the payment provider and not by GoFleet.

GoFleet may receive details such as:

• payment status,
• transaction reference,
• amount,
• currency,
• payment date,
• refund status,
• payment method type,
• details needed for reconciliation or support.

We do not store full card details when they are submitted directly to the payment provider, unless required and permitted by the relevant infrastructure.

4.7 Technical data

May include:

• IP address,
• browser type,
• operating system,
• device information,
• language settings,
• timestamps,
• approximate location derived from technical information,
• referring URL,
• pages visited,
• technical logs,
• authentication/security logs.

4.8 Support communications

When you contact us, we may keep:

• the message,
• the email,
• booking details,
• account details,
• attachments sent,
• contact details,
• information needed to resolve the request.

5. Where we get data from

Data may come from:

• you,
• a partner or provider,
• an agency or B2B user,
• a booking made through GoFleet,
• a white-label or embedded booking page,
• technical systems and cookies,
• payment providers,
• APIs or integrations,
• third-party providers involved in performing the service.

When a partner enters passenger or other third-party data, the partner is responsible for lawful collection and transfer of that data, to the extent required by applicable law and our relationship.

6. Why we use personal data

Personal data may be used for:

• creating and managing accounts,
• creating and managing bookings,
• issuing and managing e-tickets,
• online check-in,
• QR verification,
• communicating with travellers,
• communicating with partners,
• performing services,
• managing cancellations and refunds,
• processing payments,
• partner payouts,
• customer support,
• resolving disputes,
• accounting and tax compliance,
• platform security,
• fraud and abuse prevention,
• improving services,
• technical maintenance,
• analytics,
• sending updates,
• marketing where there is a suitable legal basis,
• complying with legal obligations.

7. Legal bases for processing

Processing is carried out, depending on the case, on one or more of the following GDPR legal bases.

Contract performance

When processing is necessary for:

• a booking,
• providing a service,
• account management,
• payment,
• refund,
• support,
• communication about the booking.

Legal obligation

When processing is required by:

• tax law,
• accounting obligations,
• reporting obligations,
• court or administrative requirements,
• fraud prevention or other legal duties.

Legitimate interests

When necessary for:

• security,
• fraud prevention,
• system protection,
• technical operation,
• business administration,
• defending legal claims,
• improving services,
• limited and lawful business communication where permitted.

Consent

Where required, for example for:

• specific cookies,
• certain forms of marketing,
• optional features,
• other processing that requires prior consent.

Consent may be withdrawn at any time, without affecting the lawfulness of processing before withdrawal.

8. Bookings and partner data

When a booking is made through GoFleet, strictly necessary data may be shared with the partner or provider responsible for performing the service.

For example, depending on the service, we may share:

• passenger name,
• phone,
• email,
• date and time,
• pickup/drop-off,
• flight information,
• number of passengers,
• booking reference,
• ticket or QR information,
• special requirements needed to perform the service.

Sharing is limited to data necessary for that purpose.

The partner may have its own Privacy Policy and GDPR obligations.

9. Roles of GoFleet and partners

GoFleet does not have the same GDPR role for every service.

Depending on the product, contract and data flow:

• GoFleet may be an independent controller,
• the partner may be an independent controller,
• GoFleet may act as a processor on behalf of a partner,
• there may be a shared or different role based on how a service actually works.

Where required, roles and obligations are set out in a contract and/or Data Processing Agreement (DPA).

10. Data Processing Agreements

When GoFleet processes personal data solely on behalf of a partner as a processor, a separate Data Processing Agreement may apply.

The DPA may set out:

• the subject matter of processing,
• duration,
• categories of data,
• categories of data subjects,
• controller instructions,
• technical and organisational security measures,
• subprocessors,
• security incident handling,
• deletion or return of data,
• the parties’ obligations.

11. Special categories of personal data

GoFleet does not seek to collect special categories of personal data unless necessary for a specific service and there is a suitable legal basis.

If, for example, a traveller mentions accessibility needs or another special requirement, that information may be processed only as needed to provide the service and under applicable GDPR rules.

Users should not enter unnecessary sensitive information in free-text fields.

12. Children and minors

GoFleet services may be used for bookings that include minor passengers or guests.

A booking for a minor must be made by a parent, guardian or other person with legal authority to book and provide the necessary details.

GoFleet does not direct account registration services at children without the required parental or other legal authorisation.

13. Cookies and similar technologies

GoFleet may use cookies and similar technologies for:

• website operation,
• session persistence,
• authentication,
• security,
• storing preferences,
• analytics,
• improving user experience,
• marketing where permitted and consent is required.

Strictly necessary cookies may be used without consent when needed to provide a service requested by the user or to operate the website.

For non-essential cookies, prior consent may be requested under applicable law.

Cookie details should be set out in GoFleet’s separate Cookie Policy.

14. Marketing and communications

GoFleet may contact users for operational reasons, such as:

• booking confirmation,
• booking changes,
• cancellations,
• payment information,
• e-tickets,
• check-in,
• security alerts,
• support,
• important service changes.

Operational communications are not necessarily marketing communications.

For marketing communications, where required, a suitable legal basis is used and an opt-out is provided.

Users may ask to stop marketing communications at any time.

15. Payments

Payments may be made through third-party payment providers used by GoFleet and/or its partners.

Payment providers may process personal and financial data under their own policies and legal obligations.

GoFleet receives only the data needed for:

• payment confirmation,
• booking,
• refunds,
• reconciliation,
• payouts,
• customer support,
• fraud prevention,
• accounting or legal obligations.

16. Partner payouts

Partner payouts may require:

• payee details,
• company details,
• bank details,
• transaction information,
• tax details.

These details may be shared with payment providers, banks, accountants or other necessary partners as needed to make the payment and comply with law.

17. Who may receive data

Personal data may be shared, as necessary, with:

• partners who perform the service,
• payment providers,
• cloud hosting providers,
• infrastructure providers,
• email/SMS/notification providers,
• analytics providers,
• customer support systems,
• fraud/security providers,
• software/API providers,
• accountants and professional advisers,
• legal advisers,
• insurers where required,
• public authorities or courts when required by law.

GoFleet does not sell users’ personal data to third parties for independent commercial exploitation.

18. Sub-processors and technology providers

GoFleet may use third-party technology providers to run the platform.

They may provide services such as:

• hosting,
• databases,
• cloud infrastructure,
• payments,
• email,
• SMS,
• push notifications,
• analytics,
• monitoring,
• security,
• backups,
• APIs,
• customer support.

When a provider acts as a processor, GoFleet takes appropriate contractual and technical measures required by the GDPR.

Where required, subprocessors are bound by relevant data protection contractual obligations.

19. International transfers

Some technology or commercial providers may be located outside the European Economic Area.

When personal data is transferred outside the EEA, GoFleet takes measures required by the GDPR, which may include:

• an adequacy decision of the European Commission,
• Standard Contractual Clauses (SCCs),
• appropriate supplementary measures,
• another lawful transfer basis where provided.

20. Retention of personal data

GoFleet keeps personal data only for as long as needed for the purpose it was collected or as required by law.

Retention periods may differ by data category.

Examples:

• Account data — account management,
• Booking data — performing and managing bookings,
• Payment records — payments, reconciliation and legal obligations,
• Tax/accounting data — tax and accounting compliance,
• Support communications — support and dispute resolution,
• Security logs — security and abuse prevention,
• Marketing preferences — managing marketing consent/preferences.

Where legal retention duties apply, data may be kept longer.

After the required period, data is deleted, anonymised or securely destroyed according to technical capability and legal requirements.

21. Security

GoFleet applies appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• loss,
• destruction,
• alteration,
• disclosure,
• unauthorised use.

Measures may include, depending on the system: authentication, access controls, encryption where applied, logging, monitoring, backups, security updates, staff access limits, infrastructure protection and incident response procedures.

No online service can guarantee absolute security.

22. Personal data breach incidents

If an incident may lead to a personal data breach, GoFleet applies procedures for:

• detecting the incident,
• limiting impact,
• investigation,
• remediation,
• risk assessment,
• documentation,
• notifying competent authorities where required,
• notifying affected individuals where required by the GDPR.

When GoFleet acts as a processor, the related contractual obligations to notify the relevant controller also apply.

23. Automated decision-making

GoFleet does not intend its services for decisions that produce legal or similarly significant effects solely by automated means, unless this is specifically stated and the required notices and rights are provided.

Technical mechanisms may be used for:

• fraud detection,
• security,
• availability,
• ranking or content presentation,
• operational automation.

Where automated decision-making under Article 22 GDPR applies, the rights provided by law are made available.

24. Reviews and user-generated content

When a user submits:

• a review,
• a rating,
• a comment,
• a photo,
• a description,
• other content,

GoFleet may process the related data to operate the service.

The user must have the necessary rights for any third-party personal data included in their content.

Moderation or anti-fraud mechanisms may apply to protect the reliability of the platform.

25. White-label and embedded booking services

GoFleet may provide booking interfaces that appear on partner websites or digital environments.

In those cases, personal data may be processed by more than one party, depending on how the service works.

The Controller/Processor relationship is determined by the actual operation and, where required, by the relevant contract or DPA.

26. APIs and integrations

GoFleet may connect to third-party systems through APIs or other integrations.

Through these, data necessary for the following may be exchanged:

• availability,
• bookings,
• ticketing,
• payments,
• customer information,
• operational management,
• cancellations,
• refunds.

Exchange is limited to data required for that purpose.

27. Third-party websites

GoFleet may include links to third-party websites or services.

GoFleet does not control those third parties’ privacy policies or practices.

Before providing personal data to a third-party website, you should review its Privacy Policy.

28. Your rights

Under the GDPR, where applicable, you may have the following rights:

• right to be informed,
• right of access,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to object,
• right to data portability,
• right to withdraw consent,
• right not to be subject to certain automated decisions.

These rights are not absolute and may be subject to legal limitations.

29. How to exercise your rights

To submit a request about your personal data, you may contact:

Email: support.gofleet@cloudera.gr

Subject: GDPR / Privacy Request

Where necessary, the request should include enough information for us to identify it and protect personal data from unauthorised disclosure.

Additional information may be requested to confirm the requester’s identity.

GoFleet will respond within the time limits set by the GDPR.

30. Complaint to the supervisory authority

If you believe processing of your personal data breaches data protection law, you may contact us first.

You also have the right to lodge a complaint with the competent supervisory authority.

For Greece:

Hellenic Data Protection Authority (HDPA / ΑΠΔΠΧ)

A complaint may be submitted under the procedures of that authority.

31. Processing by partners

GoFleet partners are responsible for complying with applicable personal data protection law to the extent they act as independent controllers.

For example, a partner performing a transfer, cruise, activity, rental or other service may need to process customer details for:

• performing the service,
• communication,
• check-in,
• ticketing,
• safety,
• tax obligations,
• handling complaints or claims.

In such cases, the partner may apply its own Privacy Policy.

32. Data provided by agencies or other professionals

When an agency, travel professional or other partner uses GoFleet to book for a customer or traveller, that agency or partner is responsible for providing the required notices and for the lawful transfer of data they enter into the platform, according to their role and applicable law.

GoFleet does not require entry of data that is not necessary for the service provided.

33. Legal and tax obligations

Some data may need to be retained or disclosed to comply with:

• tax law,
• accounting obligations,
• invoicing duties,
• obligations to public authorities,
• court or administrative proceedings,
• fraud prevention and handling duties.

In those cases, an erasure request may not be fulfilled immediately for all of the data.

34. Legal claims

GoFleet may retain certain data when necessary to establish, exercise or defend legal claims or disputes.

Retention is limited to data necessary for that purpose.

35. Changes to this Privacy Policy

GoFleet may change this Privacy Policy when:

• services change,
• technology changes,
• partners or processors change,
• the law changes,
• transparency improvements are needed.

The latest version will be published on the relevant GoFleet page.

For material changes, additional notice may be provided where required.

36. Relationship with the Terms of Use

This Privacy Policy is part of GoFleet’s wider legal framework and should be read together with:

• the General Terms of Use,
• the Cookie Policy,
• any Partner Terms,
• any Data Processing Agreement,
• specific terms for a particular service.

Where a specific service has additional terms on personal data processing, those may apply in addition.

37. Contact for privacy matters

For personal data matters you may contact:

GoFleet — Privacy

Cloudera Monoprosopi IKE (Cloudera Μονοπρόσωπη Ι.Κ.Ε.)

Email: support.gofleet@cloudera.gr

Website: https://gofleet.gr

38. Controller details

Cloudera Monoprosopi IKE (Cloudera Μονοπρόσωπη Ι.Κ.Ε.)

Brand: GoFleet

Tax ID (ΑΦΜ): 802846802

Company registry (ΓΕΜΗ): 183868406000

EUID: ELGEMI.183868406000

Email: support.gofleet@cloudera.gr

Website: https://gofleet.gr

Last updated: 30 September 2026