Free quote

Privacy policy

Last updated: 15 September 2026

This policy explains how YOU FIRST processes the personal data of people who visit the website, request a quote or travel with us, and of the authors of the reviews displayed on the website, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Controller

The controller is YOU FIRST, VAT number 01277500318. If you have any questions about privacy, you can contact us using the details below.

We have not appointed a data protection officer (DPO), because this is not mandatory for our business.

2. What data we process and why

Quote requests via the form

When you fill in the form, we receive the data you enter: name, phone number, email address, date and time of the service, number of passengers, departure point and destination. We also receive the full address (URL) of the page, including any codes contained in the link (for example, from an advertising campaign), and the language of the website, so that we can reply to you in your language. We use this data to prepare the quote and reply to you and, if you then book, to organise the service. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).

Contact via WhatsApp, phone or email

If you message us on WhatsApp, call us or send us an email, we process your contact details and the information you give us in order to reply to you and organise the service. Legal basis: pre-contractual measures or performance of the contract (Art. 6(1)(b) GDPR).

We do not ask you for health data. If you give us information of this kind, for example about reduced mobility, we use it only to arrange suitable transport, after asking you to confirm your consent explicitly (Art. 9(2)(a) GDPR). You can withdraw your consent at any time, without affecting processing already carried out.

If the form fails to send, the ‘Send on WhatsApp’ button prepares a message containing the data you entered. Nothing is sent to WhatsApp until you tap or click the button, and the message only reaches us when you press Send in the app. The link may remain in your browser history.

Provision of the service and legal obligations

If you book, we use the data needed to organise and carry out the transport: name, contact details, places, dates and times. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Some processing is required by law. We must issue and retain invoices and other tax documents, containing billing details such as the Italian tax code (codice fiscale) or VAT number (Art. 2220 of the Italian Civil Code, Art. 22 of Presidential Decree (d.P.R.) 600/1973 and Art. 39 of d.P.R. 633/1972). We must also complete the service sheet (foglio di servizio) for hire-with-driver services (Art. 11 of Law 21/1992), which records, among other things, the date, times, places of departure and arrival and the details of the people travelling. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

If you are also booking for other people, give us only the data about them that is necessary for the service and refer them to this policy.

Website operation and security

When you visit the website, your browser automatically sends technical data such as your IP address, browser type and the page requested. Cloudflare, our hosting provider, uses this data to show you the pages and to protect the website from attacks. A hidden field in the form helps to discard automated submissions (spam). We do not use this data to profile you. Legal basis: our legitimate interest in running the website securely (Art. 6(1)(f) GDPR).

Statistics, analytics and advertising

The website uses Google and Microsoft tools for statistics, analysis of visits and advertising. We only activate them with your consent, which you can give in the cookie banner by accepting the ‘Analytics’ and ‘Advertisement’ categories.

You can withdraw your consent at any time using the ‘Cookie preferences’ link at the bottom of every page, without affecting processing already carried out. Section 7 sets out the cookies used and what happens before you make your choice.

Visitor statistics (Google Analytics)

If you accept the ‘Analytics’ category, we use Google Analytics 4 to find out how many people visit the website, where they come from, which pages they look at and how they use them.

Google Analytics records page views, page scrolling, clicks on links to other websites, for example WhatsApp, the start and submission of forms (without the content of the fields), file downloads and video views, together with data such as device and browser type, language and approximate location, down to city level. The links recorded do not contain the data you enter in the form.

Google does not log or store the IP address of visitors located in the European Union: it uses it only to derive an approximate location and then discards it. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).

Ad measurement and remarketing (Google Ads)

If you accept the ‘Advertisement’ category, we use Google Ads to find out which ads lead to a contact request and to show our ads to people who have already visited the website (remarketing). We count the following as conversions: a click on a phone number, a click on a WhatsApp link and the submission of the quote form.

With enhanced conversions, the Google tag may detect the email address entered in the form (not the name, phone number or other addresses). Before sending it to Google, it converts it into a code (SHA-256 hash) that does not show the address in plain text, but it remains personal data, because it allows Google to link it to a Google account. Google compares this code with those of Google accounts in order to attribute the conversion to the ad that generated it. The same code may also be sent to Google Analytics.

This processing takes place only with consent to the ‘Advertisement’ category. Since the Google tag is activated only with consent to the ‘Analytics’ category, both consents are required for this data to be sent to Google.

With consent to the ‘Advertisement’ category alone, the website may nonetheless store in your browser the Google Ads cookies listed in section 7, which are read and sent to Google only if you also accept the ‘Analytics’ category. If you accept only the ‘Analytics’ category, Google Ads receives only the cookieless signals described in section 7. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).

Session analysis (Microsoft Clarity)

We use Microsoft Clarity to understand how the pages are used and to fix problems with the website. Clarity creates heatmaps, which show where people click and how far they scroll, and recordings of browsing sessions, which replay movements, clicks and scrolling on the pages.

Clarity also receives the IP address, from which it derives the country, and collects the page visited, the referring website and technical data about the device, such as browser, language, time zone and screen size. With the settings we use, it masks the content of form fields, numbers and email addresses, which are not sent to Microsoft.

Clarity is activated only if you accept the ‘Analytics’ category: before you make your choice, or if you refuse, it is not loaded and does not collect any data. With consent, Clarity uses cookies to link the pages of the same visit into a single recording and to recognise subsequent visits. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).

When it is activated, the Clarity script also contacts Microsoft's clarity.ms and bing.com domains, which may store or read the MUID cookie, a browser identifier that Microsoft also uses for advertising, and the other Microsoft cookies listed in section 7. Only if you also accept the ‘Advertisement’ category may Microsoft share Clarity data with Microsoft Advertising, its own advertising service.

If you withdraw your consent, Clarity deletes the cookies it has stored on our website and is no longer loaded on subsequent pages. If your browser sends the Global Privacy Control signal, Clarity does not record your browsing.

Cookie banner and loading of tools (CookieYes and Google Tag Manager)

We use CookieYes to display the cookie banner, apply your choices and keep proof of them. On your first visit, CookieYes assigns your browser a random identification code, stored in the cookieyes-consent cookie, and for every page viewed it sends a log to its own servers containing this code, the date and the time. When you make a choice in the banner, CookieYes records on our behalf the date, the page, the country, the IP address with its last part masked, the identification code and the categories accepted or rejected.

Legal basis: for proof of the consents received, the obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR); for the operation of the banner and the recording of refusals, our legitimate interest in managing your choices correctly and being able to document them (Art. 6(1)(f) GDPR).

Google Tag Manager, which we use to load the Google and Microsoft tools, is only downloaded after you have accepted the ‘Analytics’ or ‘Advertisement’ category. When downloading the CookieYes script and, after consent, the Google script, your browser communicates technical data such as the IP address and browser type to these providers. Legal basis: our legitimate interest in managing the website's tools in an orderly and controlled manner (Art. 6(1)(f) GDPR).

Reviews

To show what our customers think, we display some reviews published on Google, copied to our website with the author's name, profile picture, text and rating. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). If you are the author of a review and do not want it to appear on the website, write to us and we will remove it.

Defence of our rights

Where necessary, we use data to defend our rights in the event of disputes. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). On request, we will explain to you how we have balanced our legitimate interests against your rights.

3. Mandatory and optional data

In the form, only your name and email address, marked with an asterisk (*), are mandatory: without this data we cannot reply to you. The other fields are optional, but they make the quote more accurate. Without the data required by law for the service sheet and for tax documents, we cannot accept the booking.

Consent to non-necessary cookies is optional: if you refuse it, you can still use the entire website, including the quote form.

4. Who receives the data

The data is processed by YOU FIRST, by the people authorised to manage bookings and services and, only to the extent necessary, by the following parties. A processor processes data on our behalf and in accordance with our instructions. An independent controller decides for itself how to process the data it receives, in accordance with its own privacy policy. For Google Ads and Microsoft Clarity, we decide together with the provider on the collection of data on our website and its transmission; what the provider does with the data after receiving it is its own responsibility.

  • Cloudflare, Inc. (USA), processor: hosts the website and the form and helps to protect them from attacks. On its own behalf, it also uses technical traffic data in aggregated form for the security of its own network.
  • Resend, a service of Plus Five Five, Inc. (USA), processor: delivers the requests sent via the form to our mailbox.
  • Gmail, a service of Google Ireland Limited (Ireland): the mailbox in which we receive requests and from which we reply to you. Google processes data in accordance with its own terms and its own privacy policy.
  • WhatsApp, a service of WhatsApp Ireland Limited (Ireland), if you choose to use it to contact us: processes data in accordance with its own privacy policy.
  • Google Ireland Limited (Ireland), processor for Google Tag Manager, Google Analytics and enhanced conversions: loads the measurement tools on the website and produces the visitor statistics.
  • Google Ireland Limited (Ireland), independent controller for Google Ads, only with your consent: with the ‘Analytics’ category, it receives the cookieless signals described in section 7; if you also accept the ‘Advertisement’ category, it measures ad conversions and manages remarketing lists.
  • Microsoft Ireland Operations Limited (Ireland), for Microsoft Clarity, only with your consent to the ‘Analytics’ category: produces the heatmaps and session recordings. Microsoft states that it acts as an independent controller for Clarity and also uses the data for its own purposes, as described in its own privacy policy. If you also accept the ‘Advertisement’ category, it may use Clarity data for Microsoft Advertising.
  • CookieYes Limited (United Kingdom), processor: manages the cookie banner and keeps proof of consent choices.
  • Anyone who carries out technical maintenance of the website and the form on our behalf, acting as a processor.
  • Banks and payment service providers, if you do not pay in cash.
  • Advisers who handle our accounting and tax obligations, such as our accountant.
  • Public authorities and oversight bodies, where required by law.

We do not sell your data. Apart from the cases described in this policy, we do not disclose it to third parties for their own commercial purposes.

5. Transfers outside the European Economic Area

Cloudflare and Resend are US companies: Resend stores data in the United States and Cloudflare may also process it in other countries within its network. These transfers are based on the EU-US Data Privacy Framework, which the European Commission recognised as adequate in Decision (EU) 2023/1795 and in which both companies are listed as participating as at the date of this update. In any case, they are also based on the European Commission's standard contractual clauses included in their data processing agreements.

Google and WhatsApp may also process data outside the European Economic Area, as described in their privacy policies. For Gmail, Google Tag Manager, Google Analytics and Google Ads, data may be transferred to Google LLC, the group's US company, which participates in the Data Privacy Framework; Google also uses standard contractual clauses.

Microsoft also stores Clarity data in the United States and may transfer it to Microsoft Corporation, the group's US company, which participates in the Data Privacy Framework; Microsoft also uses standard contractual clauses.

CookieYes Limited is based in the United Kingdom, which the European Commission recognises as a country with an adequate level of protection, under a decision renewed in December 2025. Standard contractual clauses apply to any transfers to CookieYes's suppliers in other countries.

You can ask us for a copy of the safeguards adopted by writing to the email address given in section 1.

6. How long we keep data

  • Requests and messages that do not result in a booking: 12 months from the last contact.
  • Copy of requests held by Resend, including the email subject line with name and route: 30 days, after which it is deleted in accordance with the service's rules.
  • Messages, emails and other data used to organise a service that has been provided: 24 months from the date of the service, to handle any complaints.
  • Invoices, receipts and other accounting and tax documents, together with the data they contain: 10 years from the date of recording, as provided for by civil and tax law.
  • Service sheet: the original remains on board the vehicle for at least 15 days, as provided for by law. The original and the copy kept at the vehicle depot (rimessa) are disposed of 12 months after the date of the service.
  • Technical browsing data: apart from the statistics described in section 2, we do not keep logs of visits; Cloudflare keeps such logs for the security of its own network in accordance with its own privacy policy. The website does not have its own database: form requests reach us only by email.
  • Technical logs of requests to Google Tag Manager: deleted by Google within 14 days.
  • Google Analytics data linked to individual visitors, including the email address in hashed form: in accordance with the Google Analytics settings, a maximum of 14 months. Aggregated statistical reports may remain available for longer.
  • Data used by Google Ads for conversions and remarketing: cookies for the duration stated in section 7; in remarketing lists, each visitor remains for the period set in our Google Ads account, up to a maximum of 540 days from their last visit; otherwise, in accordance with the rules of Google, which processes this data as an independent controller.
  • Microsoft Clarity: session recordings, 30 days; saved or labelled recordings, click data and heatmaps, 9 months. Data used for Microsoft's own purposes is retained by Microsoft in accordance with its own privacy policy.
  • Proof of consent and banner logs held by CookieYes: for the duration of the choice (12 months) and, in the event of a dispute, until it has been concluded.
  • Cookies: for the duration stated in the list in section 7, unless you delete them from your browser sooner.
  • Reviews displayed on the website: at most for as long as they remain published on Google, or until the author asks us to remove them.

When the period expires, we delete the data. If a dispute, tax audit or other inspection is in progress, we retain the necessary data until it has been concluded.

Cookies are small text files that a website stores in the browser and reads back on subsequent visits. The same rules apply to similar tools, such as browser storage or scripts that collect information about the device.

How we classify cookies

In the banner, cookies and similar tools are divided into categories according to the following criteria:

  • ‘Necessary’: cookies needed to run the website securely and to remember your cookie choices. They are always active and do not require consent (Art. 122 of the Italian Privacy Code).
  • ‘Analytics’: cookies and tools that produce statistics and analysis of visits using Google Analytics and Microsoft Clarity. They do not have the characteristics that would allow them to be treated as equivalent to technical cookies, so we use them only with your consent.
  • ‘Advertisement’: cookies that measure the results of Google Ads advertisements and enable remarketing, including by means of third-party cookies. They are profiling cookies and we use them only with your consent.
  • ‘Functional’ and ‘Performance’: the banner also includes these categories, but the website does not currently use any tools that fall within them.

The banner and your choices

On your first visit, a banner asks for your consent. You can accept all cookies, reject them just as easily or choose category by category. Categories other than ‘Necessary’ remain disabled until you accept them.

Your choice is stored in the cookieyes-consent cookie for 12 months, after which the banner is shown to you again.

You can change or withdraw your consent at any time using the ‘Cookie preferences’ link at the bottom of every page. To remove cookies already stored immediately, you can also delete them in your browser settings.

What happens before you make your choice

Until you make a choice, and if you refuse, the website sets consent for statistics, advertising and additional features to denied, both for Google tools (using Google Consent Mode) and for Microsoft Clarity (using Clarity's consent interface). This setting applies to all visitors, wherever they are located.

  • Your browser only downloads the banner script from CookieYes: as with any downloaded resource, it communicates technical data such as the IP address and browser type to CookieYes. Google Tag Manager is not loaded. CookieYes stores the cookieyes-consent cookie and logs every page viewed, as described in section 2.
  • Once it is loaded after consent, Google states that Tag Manager does not collect or retain information about website visitors, apart from aggregated data on how tags are functioning and technical logs of requests, which are deleted within 14 days.
  • Google Analytics and Google Ads remain blocked: they are not loaded, do not store cookies and do not receive any data.
  • Microsoft Clarity remains blocked: it is not loaded, does not store cookies and does not collect any data.

What happens if you accept

  • ‘Analytics’ category only: Google Analytics and Clarity are activated with their cookies, including the Microsoft third-party cookies shown in the list. The Google tag also includes Google Ads, which, however, does not store or read cookies. Google Ads receives only cookieless signals: date and time, browser type, referring page, consent status, a random number generated on each page and an indication of whether the page address contained an ad click code, with the click codes redacted. Like any request, the signal reaches Google with the device's IP address. If you arrive from an ad, the click codes may be added to the addresses (URLs) of the pages you open on the website, instead of being stored in a cookie.
  • ‘Analytics’ and ‘Advertisement’ categories: Google Ads cookies, remarketing and the sending of the email address to Google in hashed form for enhanced conversions are added. Microsoft may also share Clarity data with Microsoft Advertising.
  • ‘Advertisement’ category only: the Google tag and Microsoft Clarity remain blocked, so Google Analytics, Google Ads and Microsoft receive no data from the website. However, Google Tag Manager may store in your browser the _gcl_au cookie and, if you arrive from an ad, the _gcl_aw, _gcl_gb and _gcl_gs cookies and the _gcl_ls entry, which are read and sent to Google only if you also accept the ‘Analytics’ category.

List of cookies

Necessary cookies, which do not require consent:

  • cookieyes-consent (CookieYes, first-party cookie): stores a random identification code and the choices you make in the banner. Duration: 12 months.
  • __cf_bm (Cloudflare, first-party cookie), only if protections against automated programs are active: distinguishes real visitors from automated programs. Duration: 30 minutes of inactivity.
  • cf_clearance (Cloudflare, first-party cookie), only if a security check is carried out: remembers that the check has been passed. Duration: normally 30 minutes.

Analytics cookies and Microsoft cookies linked to Clarity, only with your consent to the ‘Analytics’ category:

  • _ga (Google Analytics, first-party cookie): distinguishes visitors by means of a random identifier. Duration: 2 years.
  • _ga_BHMSY6GCJS (Google Analytics, first-party cookie): stores the state of the browsing session. Duration: 2 years.
  • _clck (Microsoft Clarity, first-party cookie): stores the identifier assigned by Clarity and the related preferences. Duration: 1 year.
  • _clsk (Microsoft Clarity, first-party cookie): links the pages visited into a single recording. Duration: 1 day.
  • CLID (Microsoft Clarity, third-party cookie on the clarity.ms domain): records when Clarity first saw the browser on a website that uses it. Duration: approximately 1 year.
  • MUID (Microsoft, third-party cookie on the clarity.ms and bing.com domains): identifies the browser on Microsoft websites and services; Microsoft uses it for statistics, the operation of its services and advertising. Duration: approximately 13 months.
  • SM (Microsoft, third-party cookie on the c.clarity.ms domain): synchronises the MUID cookie across Microsoft domains. Duration: browser session.
  • MR (Microsoft, third-party cookie on the c.bing.com domain): indicates whether to refresh the MUID cookie. Duration: approximately one week.
  • SRM_B (Microsoft, third-party cookie on the c.bing.com domain): stores the same identifier as the MUID cookie. Duration: approximately 13 months.
  • ANONCHK (Microsoft, third-party cookie): indicates whether the MUID identifier has been passed to other Microsoft services; for Clarity, it is always set to 0. Duration: approximately 10 minutes.

Google advertising cookies, only with your consent to the ‘Advertisement’ category. The _gcl cookies may be stored even without consent to the ‘Analytics’ category; the others also require that consent:

  • _gcl_au (Google Ads, first-party cookie): links visits to ads in order to measure conversions. Duration: 90 days.
  • _gcl_aw (Google Ads, first-party cookie): stores the click code (gclid) if you arrive at the website from a Google ad. Duration: 90 days.
  • _gcl_gb and _gcl_gs (Google Ads, first-party cookies): store other information about the click on an ad that is needed to measure conversions. Duration: 90 days.
  • IDE (Google, third-party cookie on the doubleclick.net domain): used for advertising, remarketing and security. Duration: 13 months in the European Economic Area and the United Kingdom.
  • test_cookie (Google, third-party cookie on the doubleclick.net domain): checks whether the browser accepts cookies. Duration: 15 minutes.
  • ar_debug (Google, third-party cookie on the doubleclick.net, googleadservices.com and google-analytics.com domains): used to check that ad measurement is working. Duration: 90 days.
  • NID (Google, third-party cookie on the google.com domain): stores preferences and information used by Google, including for advertising. Duration: 6 months.

Third-party cookies are stored on the providers' domains, can be set only if the browser accepts them and are managed by Google and Microsoft in accordance with their own privacy policies. Microsoft does not publish the duration of its third-party cookies: the durations given are approximate.

In addition to cookies, Google Ads uses the browser's local storage (the _gcl_ls entry) for the same information about ad clicks. Clarity, with your consent, uses the tab's session storage (the _cltk entry), which is cleared when you close the tab.

Browsers may reduce the actual lifetime of cookies: for example, Chrome limits it to 400 days and Safari may delete cookies set by scripts after 7 days without visits.

Technical security cookies

Depending on the protections that are active, Cloudflare may set technical security cookies to distinguish real visitors from automated programs: __cf_bm, which expires after 30 minutes of inactivity, and cf_clearance, which normally lasts 30 minutes. For the same purpose, it may run a brief automatic check in your browser. These cookies are not used to profile you and do not require consent (Art. 122 of the Italian Privacy Code and the Cookie Guidelines of 10 June 2021 issued by the Garante, the Italian Data Protection Authority).

Browser settings

You can also block or delete cookies in your browser settings. If you also block necessary cookies, the banner may reappear on every visit and some of the website's protections may ask you to complete an additional check. Instructions for the most popular browsers:

The website contains links to external services: WhatsApp, Google Maps, the reviews on Google and the website of the web agency mentioned at the bottom of the page. When you open one of these links, the external service receives browsing data such as your IP address and the referring website, and processes it in accordance with its own privacy policy.

Privacy policies and settings of the statistics, advertising and consent management providers:

9. Your rights

At any time, you can ask us for:

  • access to your data and a copy of it (Art. 15 GDPR);
  • rectification of inaccurate or incomplete data (Art. 16 GDPR);
  • erasure of your data, except data that we are required by law to retain (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR);
  • portability of the data you have provided to us, in a commonly used format, for processing based on your request, the contract or your consent (Art. 20 GDPR).

Withdrawal of consent

You can withdraw the consent you have given us at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR). For cookies and for statistics and advertising tools, use the ‘Cookie preferences’ link at the bottom of every page; for other consents, write to us.

Right to object

On grounds relating to your particular situation, you can object at any time to processing based on our legitimate interest: the security and technical operation of the website, including the cookie banner and Google Tag Manager, the publication of reviews and the defence of our rights (Art. 21 GDPR).

To exercise your rights, write to us: it is free of charge. We will reply within one month; in more complex cases we may extend this period by a further two months, informing you within the first month. To protect your data, we may ask you to confirm your identity. Email:

10. Complaints to the Garante

If you believe that the processing of your data does not comply with the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority; Piazza Venezia 11, 00187 Rome) or with the supervisory authority of the European Economic Area country in which you live or work, or in which the alleged infringement took place. You can also take legal action. Garante website: www.garanteprivacy.it

11. Automated decision-making

We do not make decisions based solely on automated processing, including profiling: quotes and bookings are handled by people.

Google Ads remarketing, which is active only with your consent, uses visits to the website to choose who to show our ads to, but does not produce legal effects or similar effects concerning you.

12. Changes to this policy

We may update this policy. The version in force is always published on this page, with the date of the last update at the top.

Back to the home page