Privacy policy

This policy explains what personal data we use when you use ZUM.MD, and especially when you send us a booking request. In short: we only ask for what the carrier needs to call you, we never ask for your card, we don't sell data and we don't use tracking cookies (except partner cookies that you accept in the banner). We measure visits to the website only anonymously, without cookies and without storing your IP address.

Who is responsible for your data

The data controller is FALA NOLEGGI SRL, Via Natale Sandre 22/A, 10078 Venaria Reale (TO), Italia, VAT number IT13160840016, which runs the website zum.md.

ZUM.MD is an intermediary agency, not a carrier: we connect passengers with several types of transport, namely the coaches and minibuses of partner carriers and flights through Kiwi.com. The trips are operated by independent companies.

For any question about your data: zumtransport@gmail.com, phone +373 78 100 991.

What data we use

When you request a coach booking: your phone number (required), your name, email and message (optional), the chosen trip, the date and the number of adults and children.
If we verify your number with a code: your phone number and the code sent via Telegram or SMS.
When you write to us or call us: what you tell us in your message or on the phone (WhatsApp, Viber, email).
Technical data: IP address and browser type, to keep the website secure and stop abuse (for example too many requests from the same number).
Anonymous visit statistics: the pages visited, the time spent on them, where you came from, country and city (approximate), device type, operating system, browser, language, and actions on the site (for example a search or a tap on a phone number). This data is anonymous and your IP address is not stored. Details in the section "Anonymous visit statistics" below.

We never ask for card details or health data. The number of children (and, if needed, their age) is given by the adult making the booking, only to work out the ticket price.

Why we use it and on what legal basis

To pass your request to the chosen carrier and so that the carrier or we can call you to confirm: these are steps taken at your request before a contract of carriage (Article 6(1)(b) of Regulation (EU) 2016/679, GDPR).
To send you a confirmation email, if you gave us your address: same basis.
To answer questions and complaints: same basis, or our legitimate interest in helping you (Article 6(1)(f)).
For security and to prevent abuse (request limits, technical logs): our legitimate interest in protecting the service (Article 6(1)(f)).
For anonymous visit statistics (which pages are read, what works well or badly, where visitors come from): our legitimate interest in understanding and improving the service (Article 6(1)(f)).
When the law requires it (for example a request from an authority): legal obligation (Article 6(1)(c)).

We don't send you advertising and we don't make automated decisions based on your data.

Anonymous visit statistics

To understand how the website is used and to improve it (which pages are read, which searches are made, where people get stuck), we measure visits anonymously, with a system of our own.

What we measure: the pages visited, the time spent on each page and how far you scroll, the site you came from (for example Google or a link), country and city, device type, operating system, browser, language, and some actions: a search made, the booking form being opened, a booking request being sent, a click on a phone number, on WhatsApp or on a flight link.
No cookies and no tools from other companies: we don't set cookies and we don't use third-party tracking services (such as Google Analytics). Only so that every language change or page reload isn't counted as a new visit, your browser keeps a random visit number in the tab's memory (sessionStorage): it contains no personal data and disappears when you close the tab.
An anonymous visitor, valid for one day only: the server works out an anonymous code (a "hash") from your IP address and browser type, using a secret that changes every day. The code cannot be turned back into your IP address, and it cannot link your visits on different days: it only lets us count one person once on the same day.
Your IP address is not stored: we use it only at the moment of the request, to work out the anonymous code and the approximate location, and we don't keep it in the statistics. Country and city are only approximate and may be wrong. The location is worked out on our own server with the free "IP to City Lite" list from DB-IP (CC BY 4.0 licence); the IP address is not sent anywhere.
What we never record: names, phone numbers, email addresses and the secret links of bookings.
The "What stopped you?" question: if, after a search, it looks like you are about to leave the site, we show a small box with a few possible answers and an alternative (the flight or the coach for the same route). If you answer, we save only the answer you chose and, if you like, a short note (at most 140 characters; phone numbers, email addresses and links are removed automatically), with no names or other personal data. Please don't write personal data in the note.
What we don't count: visits by robots, by the ZUM.MD team (when using the admin area) and from devices marked "do not count".
Where the data is: in our own database, on the website's hosting server in the European Union (Italy). We don't sell it or hand it over to third parties, and we don't send it to analytics services run by other companies.
How long we keep it: the raw records for at most 13 months, then we delete them.
Legal basis: our legitimate interest in understanding and improving the service and in protecting it (statistics, security), Article 6(1)(f) GDPR.
Your right to object: you can object at any time by writing to zumtransport@gmail.com or calling +373 78 100 991. We will look at your request and reply within one month.

Your customer account

If you create an account ("My tickets") we use:

Your email address (required): to send you the sign-in link and to show you the booking requests made with that email. There is no password to store.
Name and phone (optional): only if you give them, to pre-fill requests.
A technical session cookie (zum_account), saved only when you sign in: it lasts 30 days or until you press "Sign out" and is used to recognise you. It is not a tracking cookie.
Sign-in with Google (optional): if you choose "Continue with Google", Google tells us your email address (already verified) and your name; we do not receive your password or any other data from your Google account. The button is provided by Google: while it loads (only on the "My account" page) Google may process data such as your IP address and use its own cookies, under its privacy policy. If you prefer, use the email link.
Technical data such as the IP address and browser type of sign-in attempts, for security and against abuse, for at most 30 days.

Legal basis: performing the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in security (point (f)). We keep account data until you delete it and, if you do not use it, for at most 24 months after your last sign-in. You can delete the account at any time from its page: we delete the email and the access; booking requests already made are kept for the period stated in this notice. ZUM.MD does not collect payments from customers and the account holds no card data.

The carrier operating the chosen trip, by email and/or WhatsApp. The carrier uses the data for the booking and the journey as an independent controller, under its own rules.
Our technical providers, only as far as needed to run the service: website hosting, the mailbox (Google Gmail) and, if phone verification is active, the services that send the code (Telegram or Twilio).
Authorities, only when the law requires it.

We never sell or rent your data to anyone.

Transfers outside the European Union

Many partner carriers are based in the Republic of Moldova or in other countries outside the EU. When you request a booking with one of them, we send them your data because this is necessary for you to get the seat you asked for (Article 49(1)(b) and (c) GDPR). Some technical providers (for example Google or Twilio) may process data in the United States, with the safeguards required by the GDPR (EU–US Data Privacy Framework or standard contractual clauses).

Flights: Kiwi.com

The flight search starts on ZUM.MD, but you see, book and pay for flights on Kiwi.com. The data you enter there is processed by Kiwi.com (and, for the partner link, Travelpayouts) under their own policies. We don't receive your flight or payment data. If you use the AirHelp link (compensation for delayed or cancelled flights), you go to the AirHelp website, sometimes through a Travelpayouts partner link: the data you enter there is processed by AirHelp (AirHelp Germany GmbH, Berlin) under its own policy; we do not receive it.

How long we keep it

Booking requests: at most 24 months from the travel date, then we delete them.
Phone verification codes and login attempts to the admin area: at most 30 days.
Messages you send us: as long as needed to reply, at most 24 months.
Anonymous visit statistics (raw records): at most 13 months, then we delete them.

Your rights

You can ask us at any time to see your data, correct it, delete it, restrict its use, receive it in a portable format and object to processing based on legitimate interest. Write to zumtransport@gmail.com: we reply within one month.

If you think your data is not being used correctly, you can lodge a complaint with the Garante per la protezione dei dati personali (Italy, garanteprivacy.it), with the data protection authority of the EU country where you live or, in the Republic of Moldova, with the National Center for Personal Data Protection (datepersonale.md).

Cookies

The public website doesn't set its own cookies, not even for statistics. Cookies from our partner Travelpayouts (affiliate links) only switch on if you accept them in the banner, and you can change your mind at any time. Details in the Cookie policy. If you sign in to your customer account we save a single technical session cookie (zum_account), needed to recognise you: see the Cookie policy.

Changes

We may update this policy when the service or the law changes. The date at the top shows the latest update. The terms of the service are in the Terms and conditions.

A service of FALA NOLEGGI SRL · Via Natale Sandre 22/A, 10078 Venaria Reale (TO), Italia · VAT no. IT13160840016