What personal data do we process?

We process the following personal data:

• identification data, which in the case of the customer means in particular the name;
• contact data, which means personal data that allows us to contact you, in particular e-mail address and telephone number;
• data on your orders, payments and data on complaints;
• data on your chosen payment methods;
• data relating to the location of a particular customer application user.

Why do we process personal data and what authorizes us to do so?

As part of our activity, we process personal data for various purposes and to various extents:

• based on the performance of the contract,
• based on our legitimate interest,
• or due to the fulfillment of a legal obligation

What kind of processing we can carry out without your consent depends on the purpose of the respective processing. In the case of the above processing purposes, your personal data is not processed on the legal basis of the consent of the person concerned.

Processing based on contract performance

Mediation of orders for contractual transport of people from customers

In the case of mediation of an order from a customer to a specific provider of contracted passenger transportation, the Company processes the customer's personal data based on the customer's order for services, either made using the customer application or by phone.

These personal data include name, telephone number, address of the beginning and end of the transport, and other data necessary for the execution of the order.

The data is processed for 2 years after the execution of the order.

Providing information to the customer about their placed orders using the application

Based on the contractual relationship, the customer who uses the application has the opportunity to see the history of his orders.

In this case, he has access to his personal data, such as date and time, address of the start and end of the transport, price, ratings.

The data is processed during the period of use of the application.

Records of persons authorized to order transportation for contracted billing companies

If it is necessary to register persons authorized to order transport for contractual billing companies, their personal data is processed on the basis of a contract between a specific contractual transport provider and contractual partner.

These personal data include first name, last name, telephone number, billing information and e-mail address.

The data is processed for 10 years.

Payment for services provided using the application

Existing customers can also pay for the provided services using the application, while the Company does not process payment card data, but uses the option of a payment gateway.

For the purpose of issuing an invoice, personal data in the scope of name, surname, telephone number, billing data and e-mail address are processed.

The data is processed for 10 years.

Processing based on legitimate interest

Customer communication

In the case of communication with an existing customer, the processing of the customer's personal data takes place without the customer's consent, as the legal basis for the processing of his personal data (to the extent necessary) is the Company's legitimate interest, for example, improving the quality of the services provided, informing the customer about new goods and services in order to promote their sales .

In accordance with Recital 47 of the Regulation, the operator has carefully assessed whether he can use a legitimate interest as the legal basis for processing, i.e. whether the data subject can, at the given time and in the context of obtaining personal data (when purchasing services), reasonably expect that the processing of his personal data for this purpose can to carry out.

Personal data of the customer are processed in the scope of name, telephone number and e-mail address.

The data is processed for a period of 2 years from the last use of the Company's services.

Evaluation of the customer by dispatch workers or persons providing passenger transportation

In the legitimate interest of protecting the property and safety of the operator and affected persons, the Company allows dispatch workers or persons providing passenger transportation to record an assessment of the customer's behavior and thereby protect the property and safety of other persons providing contractual transportation.

The customer's personal data is processed in the scope of name and telephone number.

The data is processed for 2 years.

Camera system

The purpose of the camera system is to monitor the movement of people for the purpose of protecting the Company's property, and for possible proceedings on misdemeanors and crimes.

The legal basis is the legitimate interest in protecting the safety and property of the Company.

The categories of personal data that are processed in this system are the likeness of a person, a record of a person's actions in a certain place at a certain time in the Company's premises.

Cameras can be placed in the Company's headquarters, while the premises are marked as such in the case of their monitoring, including informing the affected person through a notification. The processing time for recordings from the camera system is 30 days, if the recording is not used in the proceedings of a misdemeanor or criminal offense or for other proceedings.

Processing based on the fulfillment of legal obligations

The company must fulfill certain statutory obligations. If we process your personal data precisely for this reason, we do not need to obtain your consent for such processing. We process your identification and contact data and data on purchases on this legal basis, and the following laws are in particular:

• Law no. 250/2007 Coll. on consumer protection as amended
• Law no. 222/2004 Coll. on value added tax as amended
• Law no. 431/2002 Coll. on accounting as amended

For these purposes, we process personal data for a maximum of 10 years.

Categories of beneficiaries

As part of the mediation of contractual passenger transport services, we will provide your personal data to our contractual partner. As long as the given type of processing is not occasional, we have concluded intermediary contracts with contractual billing companies that regulate the processing of personal data on their side.

Based on our legal obligations, your personal data may be provided to public authorities in accordance with the relevant legal regulations.

Driver documents

We require documents from drivers and their businesses proving that the driver and the vehicle may carry passengers. Which documents are required depends on the country in which the driver operates:

• driving licence;
• identity document in European Union countries, where the driver may be a foreign national;
• taxi driver card in European Union countries;
• vehicle registration certificate;
• taxi certificate or taxi sticker for the vehicle, where the country requires one;
• certificates of the tax identification number and the VAT number of the business in Slovakia;
• receipt printed by the printer in the vehicle in Slovakia, where the vehicle is equipped with a printer;
• photographs of the vehicle and a portrait photograph of the driver;
• in Brazil additionally a criminal-record certificate and a photograph of the driver with the driving licence.

We process the documents primarily to verify that the driver, their business and the vehicle meet the conditions for providing taxi services under the applicable transport regulations and under the contract on the basis of which the driver uses the application. In addition, we publish the approved portrait photograph of the driver and the approved photograph of the vehicle as the profile picture of the driver and of the vehicle that users see in the applications. The legal bases are the performance of the contract and compliance with our legal obligations; we neither ask for nor use consent for this purpose.

When a driver uploads a new document, we delete the previously uploaded file once the new document is confirmed; anything that deletion misses is cleaned up by daily automated maintenance. References to previous uploads may remain in our internal history of changes. We keep documents and the values read from them while the driver account is active. After the account is closed we keep them only for as long as the law requires and then delete them.

Automated decision-making and profiling

Documents that a driver uploads in the app are read by an automated system. It extracts the data printed on the document and compares it with the data the driver has in their profile.

A document may be approved automatically only if every check that applies to it passes: it is the expected kind of document, the image is in focus, for text documents it is also legible, the issuing-country rule is satisfied where one applies, the issue date is already in the past where the kind of document requires it, no expiry date read from the document has passed and, for kinds of document that carry an expiry, one is present, and every compared value is exactly equal to the value in the driver profile.

Some categories are never approved automatically: the portrait photograph of the driver, the photograph of the driver with the driving licence, the photograph of the vehicle, the criminal-record certificate and the printed receipt. No document is ever rejected automatically: every document that does not pass all the checks is reviewed by a person who sees both the document and the differences found.

A driver may at any time ask for an automatic approval to be reviewed by a person, express their point of view and contest the decision. No profiling takes place in the Company; the system only reads printed data and compares it with stored data.

Transfer of personal data to recipients outside the EU

Driver documents are stored and read automatically on Amazon Web Services in regions of the European Union (Ireland and other EU regions), on the basis of the Amazon Web Services data processing addendum, under which Amazon Web Services acts as a processor. No transfer to third countries takes place in the processing of documents.

Cross-border transfer of driver documents and of the values read from them to third countries (outside the EU) is not carried out.

What rights do you have in the processing of personal data?

Just as we have our rights and obligations when processing your personal data, you also have certain rights when processing your personal data. These rights include:

Right of access

Basically, you have the right to know what data we process about you, for what purpose, for how long, where we obtain your personal data, to whom we disclose it, who processes it besides us, and what other rights you have related to the processing of your personal data. You can learn all that in this document. However, if you are not sure which personal data we are processing about you, you can ask us to confirm whether the personal data concerning you is or is not being processed by us, and if so, you have the right to access these personal data. As part of the right of access, you can ask us for a copy of the processed personal data, while we will provide you with the first copy free of charge and the next copy with a fee.

Right to rectification

If you find that the personal data we process about you is inaccurate or incomplete, you have the right to have it corrected or supplemented without undue delay.

Right to erasure

In some cases, you have the right to have your personal data deleted. We will delete your personal data without undue delay if any of the following reasons are met:

• we no longer need your personal data for the purposes for which we processed them;
• you revoke your consent to the processing of personal data, while it is data for which your consent is necessary for processing and at the same time we have no other reason why we need to continue processing this data;
• you exercise your right to object to the processing of personal data that we process on the basis of our legitimate interests and we find that we no longer have any such legitimate interests that would justify this processing
• you believe that the processing of personal data carried out by us is no longer in accordance with generally binding regulations.

But please keep in mind that if it is one of these reasons, it does not mean that we will immediately delete all your personal data. This right does not apply if the processing of your personal data is still necessary for the fulfillment of our legal obligation or the determination, exercise or defense of our legal claims.

Right to restriction of processing

In some cases, in addition to the right to deletion, you can use the right to restrict the processing of personal data. This right allows you in certain cases to request that your personal data be marked and that these data are not the subject of any further processing operations - in this case, not forever (as in the case of the right to erasure), but for a limited time.

Right to portability

You have the right to obtain from us all your personal data that you yourself have provided to us and which we process based on your consent and on the basis of the performance of the contract. We will provide you with your personal data in a structured, commonly used and machine-readable format. In order to be able to transfer the data easily at your request, it can only be data that we process automatically in our electronic databases.

The right to object to processing

You have the right to object to the processing of personal data based on our legitimate interest. Regarding marketing activities, we will stop processing your personal data without further conditions; in other cases, we will do so, unless we have serious legitimate reasons for continuing such processing.

The right to file a complaint

Exercising your rights in the above-mentioned ways does not in any way affect your right to file a complaint with the relevant authority. You can exercise this right in particular if you believe that we are processing your personal data unlawfully or in violation of generally binding legal regulations. You can submit a complaint against our processing of personal data to the Office for the Protection of Personal Data, located at Hraničná 12, 820 07 Bratislava.

How can individual rights be exercised?

In all matters related to the processing of your personal data, whether it is a request for information, exercising a right, filing a complaint or any other type of request, you can submit it in writing to the address of the registered office of DANUBIASOFT s.r.o., Račianska 88B, 831 02 Bratislava.

We will process your request without undue delay, but within one month at the most. In exceptional cases, especially due to the complexity of your request, we are entitled to extend this deadline by another two months. Of course, we will inform you about such a possible extension and its justification.

Person responsible for personal data protection

The company does not have a designated person responsible for the protection of personal data. The main activity of the company is not processing operations, which, due to their nature, scope or purposes, would require regular and systematic monitoring of the affected persons on a large scale. The company does not process special categories of data on a large scale.