PL TAXI PLATFORM PRIVACY POLICY

1. General Provisions

This Privacy Policy defines the rules for processing the personal data of users of the PL Taxi web platform and mobile application.

This document has been prepared in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR);
• the Act of 10 May 2018 on the Protection of Personal Data;
• the Act of 18 July 2002 on Providing Services by Electronic Means;
• other applicable laws of the Republic of Poland and the European Union.

Using the Platform means that you have read this Privacy Policy. The protection of users' personal data is one of the fundamental elements of the Platform Operator's activity.

2. Data Controller

The controller of personal data is:

The Controller is responsible for the lawful processing of personal data and for applying appropriate organizational and technical measures to ensure data security.

3. Definitions

For the purposes of this Policy:

• Controller – PL Group Sp. z o.o.;
• Platform – the PL Taxi website and mobile application;
• User – any person using the Platform;
• Passenger – a person ordering a ride;
• Carrier – an entrepreneur providing passenger transport services, cooperating with the Operator under a separate agreement;
• Personal Data – any information that allows a natural person to be identified;
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council.

4. Scope of Application

This Policy applies to all persons using the Platform, in particular:

• passengers;
• carriers;
• drivers cooperating with carriers;
• persons contacting the Controller;
• users visiting the website.

5. Categories of Processed Data

The Controller may process the following data:

Identification Data

For a Passenger, the Controller processes the first name, phone number, and e-mail address. With respect to Carriers, drivers, and contractors, the Controller may additionally process:

• company name;
• NIP (tax ID);
• REGON;
• KRS;
• licence number;
• driver identification number.

Contact Data

• phone number;
• e-mail address;
• correspondence address (applies to carriers and contractors).

Ride Data

• ride start address;
• ride end address;
• intermediate stops;
• date and time of the ride;
• route length;
• ride duration;
• ride cost;
• payment method;
• order number.

Location Data

The Controller may process the GPS data of the mobile device while the application is in use for the purpose of:

• finding the nearest driver;
• carrying out the ride;
• monitoring the course of the ride;
• improving passenger safety;
• handling complaints;
• preventing abuse.

Location is processed only to the extent necessary to provide the services.

Technical Data

The Controller may collect:

• IP address;
• device identifier;
• device model;
• operating system;
• application version;
• cookie identifiers;
• advertising identifiers;
• diagnostic data;
• information about application errors.

Payment Data

The Controller may process information including:

• transaction amount;
• payment identifier;
• payment status;
• payment method.

The Controller does not store full payment card data. Payment processing is carried out by external payment operators in accordance with applicable security standards.

For cashless payments, the funds for the ride are received into the account of the Controller (PL Group Sp. z o.o.), which acts as an intermediary in the settlements between the Passenger and the Carrier, and then transfers them to the Carrier after deducting the service commission.

6. Purposes and Legal Bases for Processing Personal Data

The Controller processes personal data only to the extent necessary to carry out the activity of the PL Taxi Platform and in accordance with the GDPR. Personal data may be processed for the following purposes:

6.1. Providing Platform Services

Data processing is necessary to create and manage a user account, fulfil ride orders, provide ride-related information, contact the user, and ensure the proper functioning of the Platform.

Legal basis: Article 6(1)(b) GDPR.

6.2. Performance of Agreements

The Controller processes data in order to perform agreements concluded with passengers, carriers, drivers, and contractors.

Legal basis: Article 6(1)(b) GDPR.

6.3. Payment Processing

Data is processed for the purpose of accepting payments, confirming transactions, settling with carriers, maintaining accounting records, and processing refunds.

Legal basis: Article 6(1)(b) and (c) GDPR.

6.4. Fulfilment of Legal Obligations

The Controller processes data in order to fulfil obligations arising from the law, in particular concerning accounting, tax law, prevention of abuse, and cooperation with state authorities.

Legal basis: Article 6(1)(c) GDPR.

6.5. Handling Complaints

The Controller processes data in order to handle complaints, resolve disputes, contact the user, and document the course of the complaint procedure.

Legal basis: Article 6(1)(b) and (f) GDPR.

6.6. Ensuring Security

The Controller processes data in order to prevent fraud, detect abuse, protect users and carriers, protect IT systems, and ensure payment security.

Legal basis: Article 6(1)(f) GDPR.

6.7. Pursuing Claims

The Controller may process data in order to pursue receivables, defend against claims, and conduct court and administrative proceedings.

Legal basis: Article 6(1)(f) GDPR.

6.8. Contacting the User

The Controller may contact the user regarding the fulfilment of rides, safety, changes to the Terms and the Privacy Policy, technical issues, and responses to user requests.

Legal basis: Article 6(1)(b) GDPR.

6.9. Marketing

If the user gives separate consent, the Controller may send information about new services, promotions, discounts, loyalty programmes, and commercial information.

Legal basis: Article 6(1)(a) GDPR. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

7. Recipients of Personal Data

The Controller may transfer personal data only to entities to which it is necessary for the provision of services or which results from applicable law. Recipients of the data may include, in particular:

• carriers performing rides;
• drivers performing rides;
• payment operators and banks;
• providers of IT, hosting, and cloud services;
• providers of SMS and e-mail services;
• law firms, accounting offices, and audit firms;
• entities providing IT security services;
• public administration bodies, law enforcement authorities, courts, and other entities authorized under applicable law.

The Controller transfers data only to the extent necessary to achieve the specific processing purpose.

8. Transfer of Data Outside the European Economic Area

As a rule, personal data is processed within the territory of the European Economic Area (EEA). If the Controller uses the services of technology providers established outside the EEA, personal data may be transferred to third countries only in accordance with the applicable provisions of the GDPR.

In particular, the transfer of data may take place only where:

• the European Commission has issued a decision confirming an adequate level of data protection;
• Standard Contractual Clauses (SCC) have been applied;
• other safeguards provided for in the GDPR have been applied.

The Controller exercises due diligence to ensure that each data recipient provides an adequate level of personal data protection.

9. Data Retention Period

The Controller stores personal data only for the period necessary to achieve the purposes for which it was collected, unless applicable law requires a longer retention period. Data may be stored for the following periods:

• user account data – for the period the account is held and until it is deleted;
• ride data – for the period necessary to provide the services and pursue any claims;
• accounting data – for the period required by tax and accounting law;
• complaint-related data – for the period necessary to complete the complaint procedure and until claims become time-barred;
• data processed on the basis of consent – until the consent is withdrawn, unless the earlier processing was lawful.

After the retention period expires, the data is deleted or anonymized, unless further storage is required by applicable law.

10. Rights of Data Subjects

Every person whose data is processed by the Controller is entitled to the rights arising from the GDPR. The data subject has the right to:

• access their personal data;
• receive a copy of the data;
• rectify the data;
• complete incomplete data;
• erase the data (the "right to be forgotten"), where the conditions set out in the GDPR are met;
• restrict data processing;
• data portability;
• object to data processing based on the Controller's legitimate interest;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with the President of the Personal Data Protection Office.

The Controller responds to data subjects' requests without undue delay, no later than within one month of receiving the request, unless the law provides for the possibility of extending this period.

11. Automated Decision-Making

The Controller may use partially automated processes for the purpose of:

• assigning rides to the nearest carriers;
• detecting attempted fraud;
• analyzing transaction security;
• preventing abuse;
• improving the quality of the services provided.

The Controller does not make decisions producing legal effects concerning the user based solely on automated data processing, unless permitted by applicable law.

12. Cookies

The Platform uses cookies and similar technologies to ensure the proper functioning of the website and mobile application. Cookies are small text files stored on the user's device while using the Platform.

The Controller uses the following types of cookies:

• necessary;
• functional;
• analytical;
• statistical;
• preference;
• marketing (only after obtaining the required user consent).

Detailed rules for the use of cookies are set out in the separate Cookie Policy. The user may change cookie settings at any time using the settings of their web browser or mobile device. Restricting the use of cookies may affect the proper functioning of certain Platform services.

13. Data Security

The Controller applies appropriate organizational and technical measures to ensure the security of personal data. In particular, the Controller applies:

• encryption of data transmission;
• server safeguards;
• data access control;
• user authorization systems;
• system security monitoring;
• regular backups;
• measures protecting against unauthorized access;
• security incident response procedures.

Access to personal data is held only by persons authorized by the Controller or by entities processing data under appropriate agreements. The Controller takes action to reduce the risk of loss, destruction, disclosure, or unauthorized use of personal data.

14. Children's Data

The Platform services are not intended for persons under 18 years of age, unless applicable law provides otherwise. The Controller does not knowingly collect the personal data of children.

If the Controller becomes aware of the processing of a child's data without the required legal basis, it will promptly take action to delete such data.

15. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy in the event of:

• changes to applicable law;
• changes to the way services are provided;
• introduction of new Platform features;
• changes to the way personal data is processed;
• the need to adapt the document to decisions of supervisory authorities or court rulings.

The current version of the Privacy Policy is published on the Platform's website. In the event of significant changes, users may be informed via e-mail, the mobile application, or the Platform's website.

16. Contact Details

For matters concerning the protection of personal data, please contact the Controller:

The Controller handles requests concerning the protection of personal data without undue delay, in accordance with applicable law.

17. Final Provisions

This Privacy Policy is an integral part of the legal documentation of the PL Taxi Platform.

In matters not regulated by this Policy, the provisions of the GDPR and applicable laws of the Republic of Poland apply.

If any provision of this Policy is found to be invalid, the remaining provisions retain full force and effect. This Privacy Policy applies to all users of the PL Taxi Platform.