Translations are provided for convenience. The Czech version of legal documents remains authoritative. Čeština

PERSONAL DATA PROCESSING POLICY

for drivers and fleets – the “Weyo Driver” mobile application and the “Weyo Fleet” web portal

Who this policy is intended for: This policy is intended for drivers, Carriers, Fleets and users of the “Weyo Driver” mobile application and the “Weyo Fleet” web portal (see Section 3 for details). If you are a passenger using the “Weyo Passenger” application, the processing of your personal data is governed by the separate Personal Data Processing Policy for Passengers, available at https://withweyo.com/pravni/privacy_policy.

1 Personal data controller

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter “GDPR”) is:

Trans Flow s.r.o.

Company identification number (IČO): 24026760
Registered office: Holečkova 789/49, Smíchov, 150 00 Praha 5
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 437203
E-mail: gdpr@withweyo.com
Website: https://withweyo.com

(hereinafter the “Controller” or “we”).

The Controller has not appointed a data protection officer (DPO). For all matters concerning the processing of personal data and the exercise of data subjects’ rights, the Controller may be contacted using the contact details above.

2 Introduction

The “WEYO” platform is a digital platform through which passengers in the Czech Republic order passenger transport from independent carriers. Within the platform, the Controller acts as a taxi service intermediary within the meaning of Section 2(10) and Section 21e of Act No. 111/1994 Coll., on Road Transport (hereinafter the “Road Transport Act”). Transport (hereinafter a “Ride”) is provided by a carrier holding the relevant authorisation to conduct business (hereinafter the “Carrier”) through a driver. The Carrier is either a driver conducting business on their own account or a Fleet.

The “Weyo Driver” mobile application for the iOS and Android operating systems is intended for drivers. The “Weyo Fleet” web portal, including the fleet registration (onboarding) process, is intended for carriers managing vehicles and drivers (hereinafter collectively the “Application”). Through the Application, the Controller provides registration and verification of drivers, vehicles and fleets, intermediation of Ride offers, settlement and payouts, communication, support and safety features (hereinafter the “Service”).

This policy describes what personal data we process in connection with the use of the Application and provision of the Service, for what purposes, on what legal basis, for how long, to whom we disclose it and what rights data subjects have. It forms an integral part of the Controller’s information obligations under Articles 13 and 14 GDPR.

3 Who this policy is intended for

This policy is intended in particular for the following categories of data subjects:

Drivers – natural persons registered in the Weyo Driver application who provide Rides, either as Carriers on their own account or on behalf of a Fleet; the policy also applies to applicants for registration and former drivers;
Fleets – Carriers (legal entities or natural persons conducting business) that manage vehicles and drivers through the Weyo Fleet portal; where the Carrier is a legal entity, we process the personal data of the natural persons acting on its behalf;
Users of the Weyo Fleet portal – statutory bodies, contact persons, administrators and other Fleet personnel to whom the Fleet assigns access and a role;
Vehicle operators and owners – where they are natural persons, to the extent of the data relating to the vehicle registered in the Application.

Drivers and Fleets are also referred to collectively in this policy as “Partners”; all the persons listed above are also referred to as “users”. Only a holder of a taxi driver’s authorisation may work as a taxi driver (Section 21c of the Road Transport Act), and this authorisation may only be granted to a person over 21 years of age; the Weyo Driver application is therefore not intended for persons who do not meet these conditions.

4 Roles of the Controller and Fleets, and mutual disclosure of data

In relation to personal data processed through the Application, Trans Flow s.r.o. acts as a controller that independently determines the purposes and means of processing.

A Fleet is an independent controller in relation to its drivers, users and vehicles. In particular, it is responsible for the lawfulness of the data about drivers and vehicles that it enters into the Application and for the processing of data that the Controller makes available to it through the Weyo Fleet portal. The Fleet must inform its drivers and users of the transfer of their data to the Controller and refer them to this policy.

Through the Weyo Fleet portal, within the permissions of individual users, we make available to the Fleet in particular:

Identification and contact details of the Fleet’s drivers, the status of their registration and verification, and documents uploaded by the Fleet or driver in connection with the Fleet;
Data on the Fleet’s vehicles and their assignment to drivers;
An overview of Rides provided by the Fleet’s drivers, operational overviews and data on a driver’s suspension or restriction to the extent that it relates to cooperation with the Fleet;
Financial overviews, in particular earnings, fees, settlements and payouts.

We do not disclose detailed incident reports to the Fleet unless this is necessary to resolve the incident or fulfil the Fleet’s obligations as a carrier. Access to data in the Weyo Fleet portal is technically restricted to data on the drivers and vehicles of the relevant Fleet.

The following disclosure of data is also necessary to carry out a Ride:

To the passenger – before the Ride begins, the driver’s name and photograph, vehicle details (make, model, colour, registration number), identification of the Carrier, the vehicle’s real-time location and estimated time of arrival, and, where applicable, the driver’s average rating; after the Ride, confirmation of transport. Disclosure of these data and sending the confirmation are conditions that the Carrier must meet to provide a Ride ordered electronically under Section 21(6) of the Road Transport Act;
To the driver and Carrier – passenger data necessary to carry out the Ride (name, pickup location and destination, Ride notes, price and payment method). The Carrier is an independent controller in relation to these data and is contractually required to use them only to carry out the Ride, fulfil its legal obligations and protect its legal claims.

If a passenger uses the feature for sharing a Ride, the persons to whom the passenger sends the link can use the location-sharing web page during the Ride to follow the vehicle’s location, route and estimated time of arrival and see the driver’s name and vehicle details (make, model, colour, registration number). The link has a limited validity period and stops displaying the location once the Ride ends.

We retain the confirmation of transport, which the Carrier is required to keep for at least 3 years (Section 21(7) of the Road Transport Act), in the Application for the Carrier as its processor.

5 What personal data we process

5.1 Registration, identification and contact data

First name and surname, date of birth, e-mail address and telephone number;
The driver’s profile photograph displayed to passengers;
For persons conducting business, business name, company identification number (IČO), tax identification number (DIČ), registered office and details of the authorisation to conduct business (concession for road passenger transport operated using vehicles designed to carry no more than 9 persons, including the driver);
Bank details for payouts;
Login credentials and identifiers (password stored only as a cryptographic hash, verification codes, passkeys), account settings and language;
For Weyo Fleet portal users, name, contact details, job position, assigned role and permissions, and invitations.

5.2 Documents, authorisations and verification results

Photographs and data from identity documents (identity card or passport) and driving licences, in particular document number, date of birth, validity and issuing country;
Data on the taxi driver’s authorisation (taxi driver card, its number and validity);
The sex recorded in the identity document, only if the driver chooses to provide Rides in a category reserved exclusively for female drivers, where that category is available;
Verification results – the outcome of automated document reading, checks of data consistency and age, checks against the register of invalid documents and any manual assessment, and the date and method of verification.

The legal bases for processing data from documents are performance of a contract, the Controller’s legal obligation as a taxi service intermediary, and the Controller’s legitimate interest (see Section 6). If a driver voluntarily provides a photograph (copy) of their identity card for verification, they thereby consent to a copy being made within the meaning of Section 39(c) of Act No. 269/2021 Coll., on Identity Cards. We use only the data from the document that are necessary for verification.

The Controller does not require an extract from the Criminal Register and does not process personal data relating to criminal convictions and offences under Article 10 GDPR. The driver’s good character and reliability are assessed by the competent authority when granting the taxi driver’s authorisation. The Controller verifies only the existence and validity of that authorisation.

5.3 Vehicle data

Registration number, vehicle identification number (VIN), make, model, colour and vehicle category;
Vehicle documents (e.g. vehicle registration certificate, proof of entry in the register of taxi vehicles);
Technical vehicle data obtained from the road vehicle register and the results of their verification;
Assignment of the vehicle to a driver and Fleet.

5.4 Operational data and location

The driver’s availability status (logging in to receive Rides and logging out) and the time spent in that status;
The precise location of the driver’s device, only while the driver is logged in to receive Rides and during a Ride;
Ride offers, their acceptance, rejection or cancellation, and data on completed Rides (pickup location and destination, route, times, distance, price);
Ratings and feedback from passengers, complaints and their handling;
Records of breaches of contractual terms, warnings, restrictions, account suspension or termination and their review.

5.5 Financial data

Earnings, intermediation fees (commissions), balances, settlements, invoices and payouts;
Account identifiers at the payment service provider and the results of payout-recipient verification;
Data that the Controller, as a platform operator, is required to obtain and report to the tax authority (in particular name, address, date of birth, tax identification number and the country that issued it, VAT identification number, company identification number (IČO), financial account identifier, total consideration, number of Rides, and fees and commissions withheld by the Controller, for each quarter of the reportable period);
Subscription and rewards data, where available in the Application.

5.6 Communication, support and safety

The content of messages exchanged between the driver and passenger in the Application;
The content of communications with customer support and the Controller;
Safety incident reports and related documentation.

5.7 Technical and operational data

IP address, device identifier and type, operating system, browser type and version, Application version;
Device identifier (token) for sending notifications (push notifications);
Login session data, logs of access and changes in the Application and Weyo Fleet portal, and the date and time of activity;
Limited error and diagnostic reports (technical codes, versions, platform);
Data on consents given and acceptance of contractual terms, including their history.

5.8 Sources of personal data

We obtain personal data primarily directly from the driver or Weyo Fleet portal user and from use of the Application. We may also obtain them:

From the Fleet that invites the driver to the Application or enters data and documents on the driver’s behalf;
From public information systems – the register of invalid documents of the Ministry of the Interior of the Czech Republic (using the document number) and the road vehicle register of the Ministry of Transport of the Czech Republic (using the VIN);
From passengers (ratings, complaints, incident reports);
From the payment service provider (payout-recipient verification results and payment status).

The Controller does not intentionally process special categories of personal data under Article 9 GDPR (e.g. health data or biometric data). Document verification does not use biometric facial recognition. Users must not enter such data into the Application. If such data nevertheless appear (e.g. in an incident report), we process them only to the extent necessary to resolve the incident and protect rights.

6 Purposes of processing and legal bases

We process personal data only for specific, explicit and legitimate purposes, on the following legal bases within the meaning of Article 6 GDPR:

Purpose of processing	Categories of data	Legal basis
Registration and management of driver, Fleet and Weyo Fleet portal user accounts, login and permissions management	Registration, identification and contact data, technical data	Article 6(1)(b) GDPR – performance of a contract
Verifying that the Ride will be provided by a Carrier holding a concession, a driver holding a taxi driver’s authorisation and a taxi vehicle, as required by Section 21e(1) of the Road Transport Act	Documents, authorisations, vehicle data, verification results	Article 6(1)(c) GDPR – legal obligation (Section 21e(1) of the Road Transport Act) and Article 6(1)(b) GDPR
Verifying the driver’s identity and the authenticity of documents, including checks against the register of invalid documents	Documents, verification results	Article 6(1)(f) GDPR – legitimate interest in passenger safety and fraud prevention
Intermediation of Rides – Ride offers and allocation, navigation, communication with the passenger	Operational data, location, Ride data, contact details	Article 6(1)(b) GDPR – performance of a contract
Providing the passenger with data on the Carrier, driver and vehicle and sending confirmation of transport	Driver’s name and photograph, vehicle and Carrier data	Article 6(1)(b) GDPR – performance of a contract, in conjunction with Section 21(6) of the Road Transport Act
Making data available to the Fleet through the Weyo Fleet portal	Data on the Fleet’s drivers and vehicles, Rides, financial overviews	Article 6(1)(b) GDPR – performance of the contract with the Fleet and driver, and Article 6(1)(f) GDPR – legitimate interest in managing the vehicle fleet and fulfilling the carrier’s obligations
Keeping records of transport services arranged through the platform	Carrier data, driver’s name, registration number, time and place of the start and end of the Ride, price	Article 6(1)(c) GDPR – legal obligation (Section 21e(2) of the Road Transport Act)
Ride settlement, calculation of earnings and fees, payouts, issuing documents and bookkeeping	Financial data, Ride data	Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (accounting and tax legislation)
The platform operator’s reporting obligation to the tax authority (DAC7) – collecting and verifying data and reporting them once a year to the Specialised Tax Office	Identification and financial data required by law	Article 6(1)(c) GDPR – legal obligation (Act No. 164/2013 Coll., on International Cooperation in Tax Administration)
Ride ratings, ensuring Service quality and compliance with contractual terms, including warnings, restrictions or termination of cooperation	Ratings, complaints, Ride data, records of breaches of terms	Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR – legitimate interest in a high-quality and safe Service
Safety features – Ride sharing by the passenger, incident reporting, Ride categories with a female driver	Ride data, location, communications, sex recorded in the identity document	Article 6(1)(b) GDPR (features selected by the driver) and Article 6(1)(f) GDPR – legitimate interest in the safety of drivers and passengers
Protecting life and health in an emergency	Identification data, location, Ride data	Article 6(1)(d) GDPR – vital interests
Securing the Application, preventing and detecting fraud and misuse, keeping operational and access logs	Technical and operational data, Ride and payment data	Article 6(1)(f) GDPR – legitimate interest in security and proper operation
Operational notifications related to the Service (e-mail, SMS, push notifications)	Contact details, device token	Article 6(1)(b) GDPR – performance of a contract
Handling enquiries, complaints and claims, and conducting disputes	Identification and contact data, Ride data, communications	Article 6(1)(b), (c) and (f) GDPR (performance of a contract, legal obligations, legitimate interest in protecting rights)
Fulfilling obligations towards public authorities (e.g. authorities exercising state specialist supervision in road transport, the Police of the Czech Republic, courts, tax authorities)	Data to the extent required by legislation	Article 6(1)(c) GDPR – legal obligation
Sending commercial communications about our own similar services	Name, e-mail, telephone number	Article 6(1)(f) GDPR – legitimate interest; Section 7(3) of Act No. 480/2004 Coll.
Sending marketing communications beyond those described above, if introduced	Name, e-mail, telephone number	Article 6(1)(a) GDPR – consent
Statistics, analysis of usage and development of the Application	Technical and operational data and Ride data, in aggregated or pseudonymised form	Article 6(1)(f) GDPR – legitimate interest in improving the Service

Providing personal data for registration, verification and intermediation of Rides is a contractual and, in part, statutory requirement. Without these data, a driver, vehicle or Fleet cannot be activated in the Application. Where consent is the legal basis, giving consent is voluntary and it may be withdrawn at any time with effect for the future.

Where we base processing on a legitimate interest, we have assessed that users’ interests or fundamental rights and freedoms do not override that interest. Further information about this assessment may be obtained from the Controller on request.

Right to object: You may object at any time to processing based on a legitimate interest on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving a reason.

7 Safety features

The Application includes or may include features supporting Ride safety. Where available in the Application, the following applies:

Incident reporting and emergency assistance – when an incident is reported or an emergency feature is used, we process Ride data, location and the content of the report. In an emergency, we may disclose these data to the components of the integrated rescue system;
Ride category with a female driver (Women for Women) – a female driver who chooses to drive in this category provides the sex recorded in her identity document. This information is used exclusively to verify eligibility for this category. In this category, the driver may report that a passenger does not meet its conditions. We process the report and related Ride data for review by an authorised member of the Controller’s staff.

8 Personal data retention periods

We retain personal data only for the time necessary to fulfil the stated purposes:

Category / purpose	Retention period
Driver, Fleet and Weyo Fleet portal user account data	For the duration of the account or access; after its cancellation, only data necessary to protect legal claims, for the limitation period (3 years) extended by 1 year to bring a claim
Photographs of identity documents and driving licences	For the duration of the account; after its cancellation, without undue delay and no later than within 3 months
Driver, authorisation and vehicle verification results	For the duration of the account and 3 years after the last Ride arranged through the platform (to demonstrate fulfilment of the obligation under Section 21e(1) of the Road Transport Act)
Data on applicants whose registration was not completed or was rejected	6 months from rejection or the applicant’s last activity
Records of transport services arranged through the platform	3 years from the end of the Ride (Section 21e(2) of the Road Transport Act)
Precise location data	12 months from the end of the Ride or from collection, unless needed to resolve an incident or dispute
Ratings and feedback from passengers	For the duration of the account; deletion after its cancellation unless needed to protect legal claims
Confirmations of transport retained for the Carrier	3 years (Section 21(7) of the Road Transport Act)
Access records of Weyo Fleet portal users	12 months
Records of breaches of terms, restrictions, account suspension and termination, and their review	For the duration of the account and subsequently for the applicable limitation periods (usually 4 years)
Messages between driver and passenger	30 days from the end of the Ride; messages concerning lost property, 90 days
Communications with customer support, incident reports	3 years from closure of the request, or until the dispute ends
Accounting and tax documents, settlements and payouts	5 years from the end of the accounting period (Section 31 of Act No. 563/1991 Coll., on Accounting), or 10 years from the end of the tax period (Section 35 of Act No. 235/2004 Coll., on VAT)
Data for the platform operator’s reporting obligation (DAC7)	For the period prescribed by Act No. 164/2013 Coll. (10 years from the end of the reportable period)
Operational and access logs, IP addresses	30 to 90 days, followed by deletion; security records relating to an incident until it is resolved
Backups	Automatic backups, 30 days; manual and final snapshots, usually no more than 60 days; longer only exceptionally where deletion is suspended (e.g. an ongoing dispute)
Protected record of completed erasure (without name or contact details)	For the backup retention period and a reasonable period thereafter; used to repeat erasure following any restoration of a backup
Personal data export on request	48 hours after it is made available for download
Data for sending commercial communications	Until an objection is made or consent is withdrawn
Records of consents given and acceptance of terms	For the duration of the processing and subsequently for the period necessary to demonstrate compliance (usually 4 years)

Once the relevant period expires, personal data are erased or irreversibly anonymised.

Cancellation of an account does not necessarily mean the immediate erasure of all data. We must retain certain data even after account cancellation, in particular to complete an ongoing Ride, settle earnings and fees, fulfil legal obligations (e.g. transport records, accounting, reporting obligations) or protect legal claims. Access to such data is restricted. Data erased from operational systems disappear from backups no later than the end of the backup retention period. If the database needs to be restored from a backup, we will erase again the data whose erasure was requested.

9 Recipients and processors of personal data

We disclose personal data only to the extent necessary and to trusted recipients.

9.1 Independent controllers and other recipients

Passengers – to the extent described in Section 4;
The Fleet for which the driver drives – to the extent described in Section 4;
Recipients of a link for sharing a Ride to whom the passenger sends it – the driver’s name, vehicle details and vehicle location during the Ride (see Section 4);
Organisations paying for their employees’ Rides (the Weyo Work service, where available) – the driver’s name, vehicle registration number and data on the Ride taken on their account;
Stripe – provider of payment and payout services; for the purposes of fraud prevention, prevention of money laundering and verification of payout recipients, it processes data as an independent controller (and otherwise as a processor, see below);
The Ministry of the Interior of the Czech Republic and the Ministry of Transport of the Czech Republic – when querying the register of invalid documents (document number) and the road vehicle register (VIN);
Apple and Google – distribution of the Application;
Seznam.cz, a.s. (Mapy.com) – address searches and calculation of routes and arrival times; it receives the searched addresses and coordinates (without the user’s name) and processes them under its own terms;
OpenFreeMap (Hyperknot Software Kft., Hungary) – provision of map data; when loading a map, the user’s device directly transmits to it the IP address and technical request data, including the displayed area; the provider may use the Cloudflare network;
Navigation providers selected by the driver (e.g. Mapy.com, Google Maps, Waze, Apple Maps, HERE WeGo) – the Ride’s destination coordinates when navigation is opened outside the Application;
Insurance companies – in the event of an insured event, to the extent necessary to investigate it;
Public authorities – in particular authorities exercising state specialist supervision in road transport and transport authorities, the Police of the Czech Republic, courts and tax authorities (including the Specialised Tax Office under the DAC7 reporting obligation, which may disclose the data to tax authorities of other EU Member States), and components of the integrated rescue system, where required by legislation or necessary to protect life, health or rights;
Advisers (lawyers, tax advisers, auditors) bound by a statutory duty of confidentiality;
Any acquirer of the Controller’s business undertaking or part thereof, subject to the conditions laid down by legislation.

9.2 Processors

To operate the Application, we use the following processors, which process personal data under a processing agreement pursuant to Article 28 GDPR:

Amazon Web Services – hosting, databases, file and document storage, encryption keys, operational and security logs; production infrastructure is located in the Frankfurt region (Germany);
Amazon Web Services – Textract service – automated reading of data from photographs of documents and vehicle documentation; in the same region;
Cloudflare – operation of the Weyo Fleet portal, the web page for location sharing during a Ride and other web interfaces, content delivery network, and protection of forms against abuse (Turnstile);
Resend (Plus Five Five, Inc.) – sending transactional e-mails (e.g. Fleet invitations, notifications of verification status);
Twilio – sending SMS messages (e.g. verification codes) and, where applicable, facilitating communication with passengers through a masked number;
Google (Firebase Cloud Messaging) – delivery of push notifications; for iOS devices, through the Apple Push Notification service (APNs);
Stripe – processing payments, payouts and any subscriptions;
The Application’s development and technical support supplier – maintenance, support and development of the Application;
Providers of accounting, e-mail, office and helpdesk services and outsourced IT administration.

If additional services are activated in the Application (e.g. sending verification codes through WhatsApp, integration with a partner emergency service, rewards providers or alternative route calculation services), the relevant recipients will be added to this policy.

Personal data are not sold or transferred to third parties for their own marketing purposes.

10 Transfers of personal data to third countries

The main databases, document storage and document-reading service are located in the European Union (Frankfurt, Germany). However, some recipients are based outside the European Economic Area, in particular in the United States of America (Resend, Twilio, Google, Apple, Cloudflare and Stripe), and may also process personal data there.

Such transfers always take place with appropriate safeguards under the GDPR, either on the basis of a European Commission adequacy decision under Article 45 GDPR (the EU–US Data Privacy Framework) or on the basis of standard contractual clauses adopted by the European Commission under Article 46 GDPR.

Further information about the safeguards may be obtained from the Controller on request.

11 Automated decision-making, monitoring and profiling

The Service is based on automated processing of personal data. The Controller uses automated systems in particular for:

Allocating Ride offers – the system assesses drivers’ availability and eligibility, their location, distance and estimated time of arrival at the passenger, and, where applicable, waiting time and the number of recently received offers;
Calculating routes, prices, fees and earnings – according to pre-established rules known to Partners;
Verifying documents and vehicles – machine reading of photographs of documents and automated checks of age, validity, data in the register of invalid documents and consistency of vehicle data with the road vehicle register; ambiguous results are assessed by an authorised member of staff;
Security checks and prevention of misuse – automated checks of logins, unusual activity and eligibility for individual features;
Ratings – calculation of the driver’s average rating from passenger ratings (neither ratings nor Ride cancellations affect offer allocation or result in automatic account restrictions).

If an automated check finds that a driver or vehicle does not meet the legal requirements (e.g. an invalid document, insufficient age, or vehicle data inconsistent with the register), the account or vehicle will not be activated. The driver will be informed of the reason and may request a review by an authorised member of the Controller’s staff. An authorised member of the Controller’s staff decides on permanent rejection of registration, suspension or termination of an account or any other substantial restriction of cooperation. In justified cases, in particular where safety is at risk or fraud is suspected, automated systems may temporarily restrict a driver’s access to the Application or a particular feature until a review by an authorised member of staff, which will take place without undue delay. The driver will be informed in writing (through the Application or by e-mail) of a decision to restrict, suspend or terminate an account, including the reasons for the decision.

A driver affected by a decision has the right to an explanation, the right to express their point of view, the right to have the decision reviewed by an authorised member of the Controller’s staff and the right to challenge the decision. These rights may be exercised through support in the Application or using the Controller’s contact details.

Through automated monitoring and decision-making systems, the Controller does not process data on drivers’ emotional or psychological state; the content of drivers’ private communications with other drivers or their representatives; data obtained when the driver is neither logged in to receive Rides nor carrying out a Ride; data used to predict the exercise of fundamental rights (e.g. freedom of association); data used to infer racial or ethnic origin, migration status, political opinions, religious beliefs, health status, disability, sexual orientation or trade union membership; or data for biometric identification. The Controller will act in accordance with legislation implementing Directive (EU) 2024/2831 of the European Parliament and of the Council on improving working conditions in platform work, to the extent that it applies to the relationship with Partners.

12 Rights of data subjects

In connection with the processing of personal data, data subjects have the following rights, which may be exercised with the Controller:

The right of access to personal data (Article 15 GDPR); the Application allows a personal data export to be requested;
The right to rectification of inaccurate or incomplete data (Article 16 GDPR); data can be corrected directly in the Application, although changes to document or vehicle data may require new verification;
The right to erasure (“right to be forgotten”) subject to the conditions of Article 17 GDPR; account erasure may be requested in the Application or through a form on the web interface;
The right to restriction of processing (Article 18 GDPR);
The right to data portability for data provided on the basis of a contract or consent, in a structured, commonly used and machine-readable format (Article 20 GDPR), including data on completed Rides and ratings;
The right to object to processing based on a legitimate interest (Article 21(1) GDPR) and, at any time, to processing for direct marketing purposes (Article 21(2) and (3) GDPR);
Rights in connection with automated decision-making under Article 22 GDPR and the related rights described in Section 11;
The right to withdraw consent where processing is based on consent, with effect for the future;
The right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

A request may be submitted through the Application or using the contact details given at the beginning of this policy. The Controller will respond without undue delay, no later than one month after receiving the request; this period may be extended by a further two months where necessary, taking into account the complexity and number of requests, and the data subject will be informed of this. The Controller may reasonably verify the applicant’s identity before handling the request.

Data that the Controller must retain under legislation (e.g. records of transport services arranged through the platform, accounting documents or data for reporting obligations), or data necessary for the establishment, exercise or defence of legal claims, are not subject to erasure. Drivers’ rights in relation to data processed about them by a Fleet as an independent controller must be exercised with the Fleet.

13 Commercial communications and direct marketing

Where permitted by legislation, we may send Partners commercial communications concerning our own similar services (e.g. Application news, promotions and driver bonus programmes). Receiving commercial communications may be refused free of charge at any time through the unsubscribe link in each communication, in the Application settings or by sending a message to the Controller’s contact e-mail. After an objection is made or consent is withdrawn, we will stop processing personal data for this purpose. Operational notifications concerning the account, verification, Rides and payouts are not commercial communications and cannot be unsubscribed from.

14 Security of personal data

Taking into account the nature, scope and purposes of processing and the risks to the rights and freedoms of data subjects, the Controller has implemented appropriate technical and organisational measures under Article 32 GDPR, in particular:

Encryption of communications using HTTPS (TLS), including encrypted connections between internal systems;
Encryption of databases and document storage, and management of encryption keys in a dedicated service;
Placement of databases in a private network without direct access from the internet;
Storage of passwords only as cryptographic hashes, login using verification codes or passkeys, and additional verification for sensitive operations;
Management of access permissions by role and Fleet affiliation, restricted access to identity and other documents, and recording of the reason for access and an audit trail when the Controller’s staff access protected data;
Rate limiting, protection of forms against automated misuse and verification of incoming messages from service providers;
Data backups and measures to restore availability following an incident;
Regular updates and checks of the technologies and components used.

Only authorised persons bound by confidentiality have access to personal data. Ordinary e-mails and SMS messages are not end-to-end encrypted. Partners must protect their login credentials and devices against misuse, and Fleets must grant access to the Weyo Fleet portal only to authorised persons and to the extent necessary.

15 Cookies, web interfaces and device storage

The Weyo Fleet portal and other web interfaces use cookies and similar technologies (browser storage). Necessary cookies and browser storage records that ensure basic functionality, login, language settings, confirmation of an erasure request and security (including Cloudflare Turnstile form protection) are processed on the basis of Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, and Article 6(1)(b) and (f) GDPR, and do not require consent.

Optional functional, analytical and marketing cookies are used only on the basis of the user’s consent (Article 6(1)(a) GDPR), which may be given or withdrawn at any time in the cookie settings. Details are provided in the separate cookie settings.

The mobile Application stores login credentials in the device’s secure storage and other settings and working data in the device’s local storage. These data are used exclusively for the operation of the Application and are removed upon logout; after the Application is uninstalled, data in the device’s secure storage (e.g. iOS Keychain) may persist until overwritten.

16 Changes to this policy

This policy may be updated from time to time, in particular in response to development of the Application, introduction of new features, changes to the Services or legislation. The current wording is always available in the Application and on the web interface. Users will be informed of substantial changes in an appropriate manner (through the Application or by e-mail), usually at least 14 days before they take effect.

This policy takes effect on 16.10.2026.

17 Contact

For all matters concerning the processing of personal data and the exercise of data subjects’ rights, please contact the Controller: