Translations are provided for convenience. The Czech version of legal documents remains authoritative. Čeština

PERSONAL DATA PROCESSING POLICY

for passengers – the “Weyo Passenger” mobile application and the “WEYO” web interface

Who this policy is intended for: This policy is intended for passengers and other users of the “Weyo Passenger” mobile application and the related WEYO web interface (see Article 3 for details). If you are a driver, a Carrier or a user of the fleet management portal and you use the “Weyo Driver” application or the “Weyo Fleet” portal, the processing of your personal data is governed by the separate Personal Data Processing Policy for Drivers and Fleets, available at https://withweyo.com/pravni/driver_fleet_privacy_policy.

1 Personal data controller

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (hereinafter the “GDPR”) is:

Trans Flow s.r.o.

Company ID No. (IČO): 24026760
registered office: Holečkova 789/49, Smíchov, 150 00 Praha 5
registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, File 437203
e-mail: gdpr@withweyo.com
website: https://withweyo.com

(hereinafter the “Controller” or “we”).

The Controller has not appointed a data protection officer (DPO). For all matters concerning the processing of personal data and the exercise of data subjects’ rights, the Controller can be contacted using the contact details above.

2 Introduction

The “WEYO” platform is a digital platform through which passengers in the Czech Republic order passenger transport from independent carriers holding the relevant business authorisation, who are drivers operating on their own account or companies managing a fleet of vehicles and drivers (hereinafter “Carriers”). Passengers use the “Weyo Passenger” mobile application for iOS and Android and the related web interface, including the website for sharing location during a Ride (hereinafter collectively the “Application”).

Within the Application, the Controller acts as a taxi service intermediary within the meaning of Section 2(10) and Section 21e of Act No. 111/1994 Sb., on Road Transport (hereinafter the “Road Transport Act”). It facilitates the conclusion of a transport contract between the passenger and the Carrier (and, where this service is available, also the transport of parcels) and related services, in particular finding and assigning a vehicle, calculating the price, payment, communication, ratings and safety features (hereinafter the “Service”). The transport itself (hereinafter a “Ride”) is provided by the Carrier through a driver.

This policy describes what personal data we process in connection with use of the Application and provision of the Service, for what purposes, on what legal basis, for how long, to whom we disclose it, and what rights data subjects have. It forms an integral part of the Controller’s obligation to provide information under Articles 13 and 14 GDPR.

3 Who this policy is intended for

This policy is intended in particular for the following categories of data subjects:

Passengers – natural persons who create an account in the Application and order Rides or other Services for themselves or for other persons;
Business account users – employees and other persons whose Rides are paid for by an organisation through Weyo Work, and persons who manage the organisation’s business account, where this service is available in the Application;
Family account members – persons invited to a shared Weyo Family account, where this service is available in the Application;
Parcel senders and recipients – when using parcel transport, where this service is available in the Application;
Other persons concerned, who may not have their own account – in particular persons for whom a passenger orders a Ride, persons with whom a passenger shares the progress of a Ride and who follow it on the location-sharing website, and persons designated by a passenger as a safety contact;
Visitors to the WEYO web interface.

For simplicity, all the persons listed above are also referred to in this policy as “users”.

4 The Controller’s role and mutual disclosure of data

In relation to personal data processed through the Application, Trans Flow s.r.o. acts as a controller that independently determines the purposes and means of processing.

The Carrier is an independent controller in relation to the passenger’s personal data that it receives to perform the Ride. The Carrier is contractually obliged to use it only to perform the Ride, fulfil its legal obligations and protect its legal claims.

Mutual disclosure of data is necessary to carry out a Ride:

to the driver and the Carrier, we disclose the passenger’s name or, where applicable, the name of the person for whom the Ride is ordered, the passenger’s profile photograph (if they have uploaded one), the pickup location and destination of the Ride, any intermediate stops and Ride notes, the passenger’s location when the vehicle arrives (if shared), the passenger’s rating (if the feature is available), and details of the price and payment method;
communication with the driver takes place through the chat in the Application or, where this feature is available, by telephone using a masked telephone number; the passenger’s telephone number is not disclosed to the driver;
to the passenger, before the Ride begins, we disclose details of the Carrier, driver and vehicle (the driver’s name and photograph, the vehicle’s make, model, colour and registration number, and the Carrier’s identification), the vehicle’s location in real time and the estimated arrival time. After the Ride ends, we send the passenger a transport confirmation. These details and the confirmation are a condition for the Carrier to perform an electronically ordered Ride under Section 21(6) of the Road Transport Act. The Carrier is obliged to retain the transport confirmation for at least 3 years (Section 21(7) of the Road Transport Act).

If an organisation pays for a Ride through Weyo Work, we disclose to that organisation details of Rides taken on its account (in particular the user’s name, date and time, pickup location and destination, price and purpose of the Ride, if stated). The organisation is an independent controller in relation to this data. Similarly, the administrator of a Weyo Family account can see details of members’ Rides that the administrator pays for. Real-time location is not disclosed to the organisation or family account administrator unless the user shares it using the Ride-sharing feature.

5 What personal data we process

5.1 Account, identification and contact data

first name and surname, e-mail address and telephone number;
profile photograph, if uploaded by the user;
login credentials and identifiers (a password stored only as a cryptographic hash, verification codes, passkeys); when signing in through a Google, Facebook or Apple account, the identifier and profile data provided by that service;
account settings, language, saved places (e.g. home, work), favourite addresses;
information about membership of a business or family account and the user’s role in it.

5.2 Ride and order data

the Ride’s pickup location, destination and intermediate stops, entered addresses and their coordinates;
the times of ordering, vehicle arrival, commencement and completion of the Ride, the selected vehicle category, route and distance travelled;
the price and its components, discounts or credits used, Ride cancellation details and related fees;
Ride ratings and feedback provided by the user, and ratings given to the user by the driver (if the feature is available);
for parcel transport, the recipient’s name and telephone number, pickup and delivery addresses and a description of the parcel;
information about selection of the Rides with a Female Driver category (Women for Women), where this category is available, related information about the passenger’s sex, and any report by the female driver that the passenger does not meet the conditions of this category, including the outcome of its review.

5.3 Location data

the precise location of the passenger’s device, if the user permits access to it in the device settings, particularly when entering the pickup location, when the vehicle arrives and during the Ride;
the vehicle’s location and the progress of the Ride.

The Application’s access to location can be restricted or switched off at any time in the device settings. The pickup location can then be entered manually. However, some features (e.g. the vehicle arriving at the precise pickup point) may not be available without location data.

5.4 Payment and transaction data

the selected payment method and identifiers of payment instruments and of the customer’s account with the payment service provider (e.g. card type, last four digits, expiry);
amounts, receipts and Ride confirmations, payment status, refunds, the balance in the Application wallet, credits and rewards, and transaction history;
subscription details, where subscriptions are available in the Application;
billing details (for business accounts, the organisation’s business name, Company ID No. (IČO), Tax ID No. (DIČ) and billing address).

The user enters full payment card details directly with the payment service provider, and the Controller does not have access to them.

5.5 Communication, support and safety

the content of messages exchanged between the passenger and driver in the Application;
the content of communications with customer support, complaints and lost property reports;
safety incident reports and related documentation;
safety contact details (name and telephone number) and information about Ride sharing (creation, validity and cancellation of the link);
for persons who open the location-sharing website, technical access data (IP address, browser and device type, access time); we do not obtain other data about these persons.

5.6 Technical and operational data

IP address, device identifier and type, operating system, browser type and version, Application version, language settings;
the device identifier (token) for sending notifications (push notifications);
login session data, logs of access and account changes, date and time of activity;
error and diagnostic reports to a limited extent (technical codes, versions, platform);
records of consent given and acceptance of contractual terms, including their history.

5.7 Sources of personal data

We obtain personal data primarily directly from the user and from the user’s use of the Application. We may also obtain it:

from the driver or Carrier (e.g. a passenger rating, incident report, found property);
from another user (e.g. an organisation using Weyo Work or a family account administrator who invites the user; a passenger who orders a Ride or parcel transport for another person);
from the login service provider (Google, Facebook, Apple) to the extent agreed to by the user;
from the payment service provider (payment outcome and status).

Anyone who enters another person’s personal data into the Application (e.g. a parcel recipient, a safety contact or a person for whom they order a Ride) is obliged to inform that person and refer them to this policy.

The Controller does not intentionally process special categories of personal data under Article 9 GDPR (e.g. health data, biometric data). Users are obliged not to enter such data into the Application (in particular in Ride notes, chat or ratings). If such data nevertheless appears (e.g. in an incident report), we process it only to the extent necessary to resolve the incident and protect rights.

6 Purposes of processing and legal bases

We process personal data only for specified, explicit and legitimate purposes, on the following legal bases within the meaning of Article 6 GDPR:

Purpose of processing	Categories of data	Legal basis
Creation and management of a user account, login and user verification	Account, identification and contact data, technical data	Article 6(1)(b) GDPR – performance of a contract (use of the Application)
Arranging a Ride – ordering, finding and assigning a vehicle, calculating the route, estimated price and price, displaying the vehicle’s location, communication with the driver, Ride confirmation	Ride data, location data, contact data, communications	Article 6(1)(b) GDPR – performance of a contract
Providing the passenger with details of the Carrier, driver and vehicle and sending the transport confirmation	Ride data, contact data	Article 6(1)(b) GDPR – performance of a contract, in conjunction with Section 21(6) of the Road Transport Act
Keeping records of transport arranged	Ride data (time and place of commencement and completion, price, Carrier, driver, vehicle)	Article 6(1)(c) GDPR – legal obligation (Section 21e(2) of the Road Transport Act)
Processing payments and refunds, issuing receipts and tax documents, bookkeeping	Payment, transaction and billing data	Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (accounting and tax regulations)
Weyo Work, Weyo Family and parcel transport services, where available	Account and membership data, Ride and parcel data, payment data	Article 6(1)(b) GDPR – performance of a contract; for persons without their own account (e.g. a parcel recipient), Article 6(1)(f) GDPR – legitimate interest in providing the ordered Service
Safety features selected by the user – Ride sharing, safety contacts, incident reporting, the Rides with a Female Driver category	Ride data, location data, communications, safety contact details	Article 6(1)(b) GDPR – performance of a contract (features selected by the user); for safety contacts and recipients of a shared link, Article 6(1)(f) GDPR
Assessment of a female driver’s report in the Women for Women category and temporary suspension of the passenger’s access pending review	Information about the passenger’s sex, content of the report, Ride data, review outcome	Article 6(1)(f) GDPR – legitimate interest in female drivers’ safety and compliance with the category’s conditions
Protection of life and health in an emergency (e.g. sharing location with the integrated rescue system’s emergency services)	Identification and contact data, location, Ride data	Article 6(1)(d) GDPR – vital interests
Ride ratings, ensuring the quality of the Service and compliance with contractual terms	Ratings and feedback, Ride data, cancellation data	Article 6(1)(f) GDPR – legitimate interest in a high-quality and safe Service
Securing the Application, preventing and detecting fraud, misuse and technical incidents, keeping operational logs	Technical and operational data, Ride and payment data	Article 6(1)(f) GDPR – legitimate interest in security and proper operation
Operational notifications related to the Service (e-mail, SMS, push notifications)	Contact data, device token	Article 6(1)(b) GDPR – performance of a contract
Handling enquiries, complaints, lost property and claims made, conducting disputes	Identification and contact data, Ride data, communications	Article 6(1)(b), (c) and (f) GDPR (performance of a contract, legal obligations, legitimate interest in protecting rights)
Fulfilling obligations towards public authorities (e.g. Policie ČR, courts, road transport inspection authorities)	Data to the extent required by law	Article 6(1)(c) GDPR – legal obligation
Sending commercial communications to our own customers about similar services	Name, e-mail, telephone number, deliverability data	Article 6(1)(f) GDPR – legitimate interest; Section 7(3) of Act No. 480/2004 Sb. (known as soft opt-in); commercial communications in the form of push notifications only if the user enables them in the settings
Sending marketing communications beyond the above, if introduced	Name, e-mail, telephone number	Article 6(1)(a) GDPR – consent
Statistics, analysis of use and development of the Application	Technical and operational data and Ride data, in aggregated or pseudonymised form	Article 6(1)(f) GDPR – legitimate interest in improving the Service

Providing personal data for account creation and ordering a Ride is a contractual requirement; without it, the Application cannot be used and a Ride cannot be arranged. Where consent is the legal basis, giving it is voluntary and it can be withdrawn at any time with future effect.

Where we base processing on a legitimate interest, we have assessed that users’ interests or fundamental rights and freedoms do not override that interest. Further information about this assessment can be obtained from the Controller on request.

Right to object: You may object at any time to processing based on a legitimate interest on grounds relating to your particular situation. You may object at any time to processing for direct marketing purposes, without giving a reason.

7 Safety features

The Application contains or may contain features to support Ride safety. Where they are available in the Application, the following applies:

Ride sharing – the passenger can create a link and send it to selected persons. On the location-sharing website, the recipient of the link can follow the vehicle’s location during a Ride ordered through the Application and view limited information about the Ride (route, destination, estimated arrival time, driver’s name and vehicle details). The website serves exclusively as a supplement to the Ride-sharing feature, does not require registration, and does not display the passenger’s contact or payment details to the recipient. The link has a limited period of validity, stops displaying location after the Ride ends, and can be cancelled by the passenger at any time. The link may remain stored by the recipient or in the service through which the passenger sent it;
Safety contacts – the passenger can designate persons to whom information about the Ride can be sent if needed;
Incident reporting and emergency assistance – when an incident is reported or an emergency feature is used, we process Ride data, location and the content of the report. In an emergency, we may pass this data to the integrated rescue system’s emergency services;
Rides with a Female Driver category (Women for Women) – where the feature is available, a category intended for female passengers in which only a female driver is assigned to the passenger. For this purpose, we process information about the selected category and the passenger’s sex. If the female driver reports that the passenger does not meet the conditions of this category, the passenger’s access to the Application may be temporarily suspended pending review by an authorised member of the Controller’s staff. The passenger will be informed of the outcome of the review, including the reasons, and may challenge it (see Article 11).

8 Personal data processing periods

We retain personal data only for the period necessary to fulfil the stated purposes:

Category / purpose	Retention period
User account data and data about its use	for the lifetime of the account; after its closure, only data necessary to protect legal claims, for the limitation period (3 years) extended by 1 year to assert a claim
Records of transport arranged	3 years from the date the Ride ends (Section 21e(2) of the Road Transport Act)
Ride history and order data (excluding the precise course of the route)	for the lifetime of the account and subsequently for the duration of limitation and complaint periods (usually 4 years)
Precise location data on the progress of a Ride	12 months after the Ride ends, unless needed to resolve an incident or dispute
Messages between passenger and driver	30 days after the Ride ends; messages concerning lost property, 90 days
Safety contact details	until removed by the user, no longer than the lifetime of the account
Ride-sharing links	until the Ride ends or the link is cancelled; link creation data, 30 days
Data about parcels and their recipients	for the complaint period, usually 1 year from delivery; data in records and accounts according to the relevant periods
Weyo Work and Weyo Family membership	for the duration of membership; Ride data according to the periods for Ride history
Communications with customer support, complaints, incident reports	3 years after the request is closed, or until the dispute ends
Accounting and tax documents concerning payments	5 years from the end of the accounting period (Section 31 of Act No. 563/1991 Sb., on Accounting), or 10 years from the end of the tax period (Section 35 of Act No. 235/2004 Sb., on VAT), respectively
Operational logs and IP addresses	30 to 90 days, then deletion; security records related to an incident until it is resolved
Backups	automatic backups, 30 days; manual and final snapshots, usually no longer than 60 days; longer only exceptionally where deletion is suspended (e.g. an ongoing dispute)
Protected record of completed deletion (without name or contact details)	for the backup retention period and a reasonable period thereafter; used to repeat deletion following any restoration of a backup
Export of personal data at the user’s request	48 hours after it is made available for download
Data for sending commercial communications	until an objection is made or consent is withdrawn, respectively
Records of consent given and acceptance of terms	for the duration of processing and subsequently for the period necessary to demonstrate compliance (usually 4 years)

Once the relevant period expires, personal data is deleted or irreversibly anonymised.

Closing an account does not necessarily mean immediate deletion of all data. We must retain some data after account closure, particularly to complete an ongoing Ride, settle payments, fulfil legal obligations (e.g. transport records, accounting) or protect legal claims. Access to such data is restricted. Data deleted from operational systems ceases to exist in backups no later than the expiry of the backup retention period. If it becomes necessary to restore the database from a backup, we will again delete data whose deletion has been requested.

9 Recipients and processors of personal data

We disclose personal data only to the extent necessary and to trusted recipients.

9.1 Independent controllers and other recipients

Carriers and drivers – to the extent necessary to perform a particular Ride (see Article 4);
organisations using Weyo Work, the Weyo Family account administrator, recipients of a shared link and safety contacts – within the scope of the relevant feature;
Stripe – payment service provider; for the purposes of preventing fraud and money laundering and fulfilling its legal obligations, it processes payment data as an independent controller (in other respects, as a processor; see below);
Google, Meta (Facebook) and Apple – when the user chooses to sign in through an account with these services (for Apple, the Sign in with Apple service); closing a WEYO account does not close an account with these services;
Apple and Google – distribution of the Application, and also providers of payment wallets (Apple Pay, Google Pay), if selected by the user;
Seznam.cz, a.s. (Mapy.com) – address searches and calculation of routes and arrival times; it receives the addresses and coordinates searched for (without the user’s name) and processes them under its own terms;
OpenFreeMap (Hyperknot Software Kft., Hungary) – provision of map data; when loading a map, the user’s device directly transmits to it the IP address and technical request data, including the area displayed; the provider may use the Cloudflare network;
navigation and map providers selected by the user to open a route outside the Application;
insurance companies – in the event of an insured event, to the extent necessary to investigate it;
public authorities (in particular Policie ČR, courts, authorities responsible for state professional supervision of road transport, tax authorities) and the integrated rescue system’s emergency services, where required by law or necessary to protect life, health or rights;
advisers (lawyers, tax advisers, auditors) bound by a statutory duty of confidentiality;
any acquirer of the Controller’s business undertaking or a part of it, under the conditions laid down by law.

9.2 Processors

To operate the Application, we use the following processors, who process personal data under a processing agreement pursuant to Article 28 GDPR:

Amazon Web Services – hosting, databases, file storage, encryption keys, operational and security logs; production infrastructure is located in the Frankfurt region (Germany);
Cloudflare – operation of the web interface and the website for sharing location during a Ride, content delivery network and protection of forms against abuse (Turnstile);
Resend (Plus Five Five, Inc.) – sending transactional e-mails;
Twilio – sending SMS messages (e.g. verification codes) and, where applicable, facilitating communication with the driver through a masked number;
Google (Firebase Authentication) – optional sign-in through a Google or Facebook account;
Google (Firebase Cloud Messaging) – delivery of push notifications; on iOS devices, through Apple Push Notification service (APNs);
Stripe – processing payments, saved payment methods and any subscriptions;
the Application development and technical support supplier – maintenance, support and development of the Application;
providers of accounting, e-mail, office and helpdesk services and external IT administration.

If additional services are activated in the Application (e.g. sending verification codes through WhatsApp, integration with a partner emergency service, reward providers or alternative route calculation services), the relevant recipients will be added to this policy.

Personal data is not sold, nor is it transferred to third parties for their own marketing purposes.

10 Transfers of personal data to third countries

The Application’s main databases and storage are located in the European Union (Frankfurt, Germany). However, some recipients are based outside the European Economic Area, particularly in the United States of America (Resend, Twilio, Google, Meta, Apple, Cloudflare and Stripe), and may also process personal data there.

Such transfers always take place with appropriate safeguards under the GDPR, either on the basis of a European Commission adequacy decision pursuant to Article 45 GDPR (the EU–US Data Privacy Framework), or on the basis of standard contractual clauses adopted by the European Commission pursuant to Article 46 GDPR.

Further information about the safeguards can be obtained from the Controller on request.

11 Automated decision-making and profiling

The Service is based on automated processing of personal data. This includes in particular:

Ride assignment – the system assesses vehicle availability, location, distance and estimated arrival time;
route and price calculation – the price is determined under preset rules (in particular distance, expected Ride duration, vehicle category and time of ordering) and is communicated to the passenger before the order is confirmed;
security checks and prevention of misuse – automatic checks of logins, payments and unusual activity.

Security checks may result in a temporary restriction of a feature, for example a requirement for additional verification or an inability to order a Ride until an outstanding amount is paid. Following a report by a female driver in the Women for Women category, a passenger’s access to the Application may be automatically suspended, but only pending review by an authorised member of the Controller’s staff (see Article 7). Such a measure is necessary for entering into and performing the contract and for protecting users and the Controller (Article 22(2)(a) GDPR). Permanent blocking or closure of an account is decided by an authorised member of the Controller’s staff.

A user affected by an automated decision has the right to obtain human intervention by the Controller, to express their point of view and to contest the decision. These rights can be exercised through customer support or using the Controller’s contact details.

12 Data subjects’ rights

In connection with the processing of personal data, data subjects have the following rights, which can be exercised with the Controller:

the right of access to personal data (Article 15 GDPR); the Application allows users to request an export of personal data;
the right to rectification of inaccurate or incomplete data (Article 16 GDPR); the Application allows data to be corrected directly in the account;
the right to erasure (“right to be forgotten”) under the conditions of Article 17 GDPR; account deletion can be requested in the Application or through the form on the web interface; deleting a WEYO account does not delete a Google, Facebook or Apple account;
the right to restriction of processing (Article 18 GDPR);
the right to data portability for data provided on the basis of a contract or consent, in a structured, commonly used and machine-readable format (Article 20 GDPR);
the right to object to processing based on a legitimate interest (Article 21(1) GDPR), and at any time to processing for direct marketing purposes (Article 21(2) and (3) GDPR);
rights in connection with automated decision-making under Article 22 GDPR (see Article 11);
the right to withdraw consent, where processing is based on consent, with future effect;
the right to lodge a complaint with the supervisory authority, which is Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz.

A request can be submitted through the Application or using the contact details given at the beginning of this policy. The Controller will respond without undue delay, no later than one month after receiving the request; where necessary and taking into account the complexity and number of requests, this period may be extended by a further two months, of which the data subject will be informed. The Controller is entitled to take reasonable steps to verify the requester’s identity before handling the request.

Data that the Controller is required to retain by law (e.g. records of transport arranged, accounting documents), or data necessary for the establishment, exercise or defence of legal claims, is not subject to erasure.

13 Commercial communications and direct marketing

Where permitted by law, we may send users commercial communications concerning our own similar Services. Users may opt out of commercial communications at any time free of charge, using the unsubscribe link in each communication, in the Application settings or by sending a message to the Controller’s contact e-mail address. Once an objection is made or consent is withdrawn, respectively, we will stop processing personal data for this purpose. Operational notifications concerning ordered Rides and the account (e.g. Ride confirmations, receipts, safety alerts) are not commercial communications and cannot be opted out of.

14 Security of personal data

Taking into account the nature, scope and purposes of processing and the risks to data subjects’ rights and freedoms, the Controller has adopted appropriate technical and organisational measures pursuant to Article 32 GDPR, in particular:

encryption of communications using HTTPS (TLS), including encrypted connections between internal systems;
encryption of databases and file storage, and management of encryption keys in a dedicated service;
placement of databases in a non-public network without direct access from the internet;
storage of passwords only as a cryptographic hash and the option of passwordless sign-in (verification codes, passkeys);
role-based access control and recording the reason for access and an audit trail when the Controller’s staff access protected data;
rate limiting, protection of forms against automated abuse, and checks of incoming messages from service providers;
data backups and measures to restore availability after an incident;
regular updating and checking of the technologies and components used.

Only authorised persons bound by confidentiality have access to personal data. Ordinary e-mails and SMS messages are not end-to-end encrypted. Users are obliged to protect their login credentials and devices against misuse.

15 Cookies, web interface and device storage

The web interface uses cookies and similar technologies (browser storage). Necessary cookies and browser storage entries that provide basic functionality, login, language settings, confirmation of a deletion request and security (including protection of forms using Cloudflare Turnstile) are processed on the basis of Section 89(3) of Act No. 127/2005 Sb., on Electronic Communications, and Article 6(1)(b) and (f) GDPR, and do not require consent.

Optional functional, analytics and marketing cookies are used only on the basis of the user’s consent (Article 6(1)(a) GDPR), which can be given or withdrawn at any time in the cookie settings. Details are provided in the separate cookie settings.

The mobile Application stores login credentials in the device’s secure storage and other settings and working data in the device’s local storage. This data serves exclusively to operate the Application and is removed upon logout; after the Application is uninstalled, data in the device’s secure storage (e.g. iOS Keychain) may persist until overwritten.

16 Protection of minors

Only a person over 18 years of age may create a user account. Persons under 18 cannot have their own account; a Ride may be ordered for them by a legal representative (e.g. through Weyo Family, where available), who is responsible for the data about the minor that the representative enters into the Application. If the Controller discovers that it is processing a minor’s personal data without an appropriate legal basis, it will delete that data without undue delay.

17 Changes to this policy

This policy may be updated from time to time, particularly in response to development of the Application, introduction of new features, changes to the Services or changes in legislation. The current version is always available in the Application and on the web interface. Users will be informed of material changes in an appropriate manner (through the Application or by e-mail), usually at least 14 days before they take effect.

This policy takes effect on 21.10.2026.

18 Contact

For all matters concerning the processing of personal data and the exercise of data subjects’ rights, please contact the Controller: