1. Information regarding the Administrator and collection of personal data
1. The administrator within the meaning of art. 4 point 7 of Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (hereinafter referred to as the Regulation) in relation to Your personal data is iTaxi.pl S.A. with its registered office in Warsaw, ul. Przasnyska 6B, 01-756 Warsaw, entered into the Register of Entrepreneurs of the National Court Register under the number KRS: 0000922228, NIP: 1182053355, REGON: 142717162 (hereinafter referred to as the Administrator).
2. By means of the Application, the Administrator collects Your personal data such as: name, surname, telephone number, e-mail address, and in the event of contact via the Call Centre also a voice. The Administrator processes the personal data provided by You for the purpose necessary to use the Application, in particular creating an account, enabling the search for a taxi transport service in the Application and providing access to other functions of the Application and the use of other Administrator services, including the Call Centre, complaints handling, as well as pursuing claims. Providing this personal data is necessary for the conclusion and implementation of the contract for the use of the Application and its functions, including the ability to search for a service to transport people and goods by taxi using the Application, and their processing is based on art. 6 clause 1 letter b) of the Regulations. If You are a driver interested in the offer of the Administrator or entities cooperating with the Administrator, Your data, such as name, e-mail address, telephone number, other data provided by You in the course of contact will be processed in order to service the offer of the Administrator or cooperating entity, including transferred to the entity cooperating as a separate administrator.
3. When placing an order through the Application, the Administrator also processes data regarding Your location (GPS data) at the time of placing the order, coordinates of the place of the pickup and coordinates of the destination, as well as data regarding travel time (e.g. pickup time and time of reaching the destination). The consent to provide location data in the GPS system is expressed through the operating system of Your terminal device. The Administrator also processes travel data: cost, payments, invoices, driver’s ID, passenger’s ID, device’s ID. The processing of this data is necessary for the implementation of the contract for the use of the Application and its functions, including the ability to search for a service to transport people and goods by taxi using the Application, and their processing is carried out on the basis of art. 6 clause 1 letter b) of the Regulations. You can optionally enter the address of the place of residence and work address in the Application. These data are processed if You provided them.
4. The administrator allows You to make a non-cash payment via the Application using a credit card, PayPal account, Google Pay account, Apple Pay, BLIK or PLAY.
For this purpose, it may be necessary to provide a card number, card expiration date, CVV2 / CVC2. The Administrator, however, does not have access to or process this data. Providing the personal data indicated is necessary to make a non-cash payment for a taxi using the Application in accordance with the chosen method of payment, and their processing takes place on the basis of art. 6 clause 1 letter b) of the Regulations. You can always pay by credit card or cash with the driver. In case of adding a payment card to Your account in the Application, the indicated data may be required and processed for the purposes of adding the payment card to the Customer’s account and verifying such a card. For the purposes referred to in this section, the data referred to in this section may be transferred to payment operators-payment service providers.
5. By placing an order through the Website, the Administrator collects Your personal data such as: name, telephone number. The Administrator processes the personal data provided by You for the purpose necessary to place an order, perform the service of providing the tool (Website) to place an order regarding taxi transport, as well as to pursue claims. Providing this personal data is necessary for the conclusion and implementation of the contract for the provision of the tool (Website) to place an order regarding the transport of persons and goods by taxi through the Website, and their processing is carried out on the basis of art. 6 clause 1 letter b) of the Regulations.
6. By placing an order through the Call Centre, the Administrator collects Your personal data such as: name, phone number, voice. The Administrator processes the personal data provided by You for the purpose necessary to place an order, perform the service of providing access to the tool (Headquarters) for placing an order regarding taxi transport, as well as pursuing claims. Providing this personal data is necessary for the conclusion and implementation of the contract for the provision of the tool (Call Centre) to place an order regarding the transport of persons and goods by taxi, and their processing is carried out on the basis of art. 6 clause 1 letter b) of the Regulations.
7. In order to perform the order of the transport service using the „voucher”, the Administrator processes the personal data of persons using the „voucher” option in the form of a telephone number, and the processing of this personal data is carried out on the basis of art. 6 clause 1 letter f) of the Regulations. The processing of personal data provided is necessary for the purposes of the legitimate interests pursued by the Administrator, i.e. providing an appropriate tool for placing an order regarding taxi transport to a person using the „voucher” option.
8. In addition, the Administrator collects and processes Your personal data in the form of name, phone number, email address pursuant to art. 6 clause 1 letter f) of the Regulation, i.e. the legitimate interest of the Administrator, which is direct marketing of own services, with the proviso that in the scope of services constituting the provision of electronic services within the meaning of the Act of 18 July 2002 on the provision of electronic services, the Administrator may process, only with Your consent and for the purposes of advertising, market research and behaviour, and preferences of the recipients of the results of these studies for the purpose of improving the quality of services provided by the Administrator (which also applies to profiling), other data about You that are not necessary to provide the service electronically. You can object to such processing at any time, which will immediately stop the processing of Your personal data by the Administrator for this purpose, and in the event of processing based on consent, You may at any time revoke (withdraw) the consent given.
9. The processing of personal data in the form of name, phone number, email address for marketing purposes carried out by the Administrator’s Partners may only take place with Your consent, pursuant to art. 6 clause 1 letter a) of the Regulations. Each time when giving consent, the Administrator defines the Partner whose marketing objectives will be implemented on the basis of this consent. Providing personal data for these purposes is voluntary and is at the discretion of the data subject, and their processing by the Administrator depends on obtaining consent. You can withdraw Your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal. More on the conditions for granting and withdrawing consent in section 3 of this policy.
10. The Administrator processes the personal data provided by You in the contact form in order to perform the service provided electronically – the contact form. For this purpose, the Administrator collects Your personal data such as: name, email address, telephone number. Providing an e-mail address is necessary to answer the question submitted via the contact form via e-mail. If You request a telephone contact, You must also provide your telephone number. Processing takes place on the basis of art. 6 clause 1 letter b) of the Regulations.
11. The Administrator also uses the information contained in cookies for analytical purposes. They provide data on Your activity as part of using the Application. The use of cookies is based on Your consent. You can disable cookies at any time by changing the settings in Your browser. Details on how to use cookies can be found in the Cookies Policy.
12. In relation to Your personal data, the Administrator does not make automated decisions within the meaning of the Regulations, with the proviso that:
– Your data may be profiled for the purpose of providing personalized content in the Application, i.e. the implementation of the function of the Application consisting in presenting the offer of taxi transport services best suited to Your preferences
– applies to the situation of introducing such functionality of the Application
– data on the manner of using the Application and services offered through the Application, as well as contact details may be used for the purposes of sending personalized messages regarding the use of the Administrator’s services.
Such processing is necessary to perform the contract for the use of the Application or other contract for the service provided electronically, pursuant to the content of art. 22 paragraph 1 letter a) of the Regulation.
13. The Administrator stores Your personal data only for the period necessary to perform the services provided, including redress and compliance with the requirements arising from applicable provisions, including tax regulations or for the period necessary to achieve other purposes in which, in accordance with this Privacy Policy, the Administrator may process Your data. In the case of personal data processed on the basis of the Administrator’s legitimate interest, including for the purpose of providing the service using a „voucher”, the Administrator stores the personal data provided for the period necessary for the purpose of processing or until an effective objection is raised. In the case of personal data processed on the basis of consent given, the Administrator stores the personal data provided for the period necessary for the purpose of processing or to withdraw consent. After these periods, Your personal data will be deleted.
14. In the event of contact by the Call Centre, a special message informs the caller that the telephone conversation is being recorded. The condition for continuing the telephone conversation is submitting a declaration of consent to its recording. Expressing consent may occur through a voluntary continuation of the conversation by the caller or in another way resulting from the message. Failure to submit a declaration of consent to record the conversation results in the fact that the conversation will not be registered and will be terminated.
2. The rights of the data subject
1. You have the right to obtain confirmation from the Administrator whether he processes Your personal data, the right to request access to this data and the right to obtain from the Administrator information regarding the purposes of processing and the categories of personal data processed, information on recipients or categories of recipients to whom personal data is disclosed, the planned period of storage of personal data, the data source in the event that it was collected not from the person to whom it relates, and information whether the Administrator makes automated decisions towards the data subject, including based on profiling. You also have the right to obtain a copy of the data.
2. In addition, You have the right to request the rectification of personal data, the right to request the deletion of personal data, the right to request restriction of processing, the right to transfer data and the right to object to the processing. You can exercise these rights:
- regarding the request to rectify data: when Your data is incorrect or incomplete;
- regarding the request to delete data: when Your data is no longer necessary for the purposes for which they were collected by the Administrator; You withdraw Your consent to data processing; You object to the processing of Your data; Your data will be processed unlawfully; the data should be deleted in order to comply with the obligation arising from legal provisions or the data was collected in connection with the offering of information society services;
- in relation to the request to limit data processing: when Your data is incorrect – You can request a restriction of its processing for a period allowing the Administrator to check the correctness of this data; Your data is processed unlawfully, but You do not want them to be deleted; Your data will no longer be needed by the Administrator, but You will need it to determine, pursue or defend claims; or You objected to the processing of data – until it is determined whether legally justified grounds on the part of the Administrator prevail over the grounds for the objection;
- in relation to the right to data portability: when the processing of Your data takes place on the basis of consent or contract granted, and when the processing takes place in an automated manner
- regarding the right to object: when the processing of Your personal data is based on a legitimate interest and the objection is justified due to Your particular situation, as well as when Your personal data is processed for the purposes of direct marketing, including profiling.
3. You also have the right to lodge a complaint to the supervisory body if You find that the processing of personal data concerning You violates the provisions of the Regulation.
4. The implemented security procedures mean that we can ask for confirmation of Your identity before exercising Your rights.
3. Consent to the processing of personal data
1. If the Administrator processes personal data that is not necessary for the service, Your data is always provided voluntarily, after giving Your consent to the processing of the data provided.
2. Expressing consent takes place after getting acquainted with this policy by checking the appropriate selection box. In this case, You agree to the collection and processing by the Administrator of personal data provided by You for the purpose clearly indicated when giving consent.
3. You can withdraw Your consent at any time, in the same way that consent was given, i.e. by unchecking the appropriate selection box. In addition, You can withdraw Your consent by sending to the Administrator a statement of withdrawal of consent in the manner indicated in section 6 of this policy.
4. Withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal.
4. Information about the recipients / categories of recipients of personal data
1.In order to perform and settle the taxi transport service, the Administrator will transfer Your data, including personal data, to the following recipients:
- location data (GPS coordinates of the pickup address), destination coordinates, as well as travel time data (e.g. pickup time and time to reach destination), will be forwarded to drivers who apply for the course;
- location data (GPS coordinates of the pickup address), coordinates of the destination, as well as data on travel time (e.g. pickup time and time of arrival) and Your personal data in the form of name and phone number will be forwarded to drivers who have adopted ordering a taxi service.
As the taxi transport service may also be provided through entities operating taxi companies or other subcontractors, the above data may be transferred to such entities for further transmission to drivers.
2. The Administrator also partly uses external service providers who process personal data on behalf of the Administrator, e.g. hosting service providers, email service providers, email marketing and sending system providers, website traffic analysis, marketing campaign effectiveness analysis, supporting account functionality, debt collection companies, payment service providers. The transfer of data may, however, only be used to provide their service. The administrator uses only the services of such entities that provide sufficient guarantees to protect the rights of data subjects. The processing of personal data by these entities is based on written agreements concluded with the Administrator. These entities follow the Administrator’s guidelines and are subject to audits conducted by him.
3. Your personal data may also be made available to entities authorized to obtain them under applicable law, e.g. law enforcement authorities, if the authority makes a request on an appropriate legal basis (e.g. for the purposes of pending criminal proceedings).
4. The administrator uses the Google Analytics service to analyse Internet traffic, collect and analyse data on the behaviour of people using the Application or the Administrator’s websites. Web traffic analysis is mainly used to optimize the website and marketing purposes. Pursuant to certain functionalities of Google Analytics, the „cookies” files and the data contained therein can be used for marketing purposes, and the data contained therein can also be used for profiling.
The operator of the Google Analytics service is Google Inc., 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351 based in the USA.
The User may not consent to the collection of data related to the use of information collected by Google Analytics, and the processing of this data by Google, and may prevent such activities. To do this, download the browser add-on available here: tools.google.com/dlpage/gaoptout and then install it.
5. The Administrator also has a fanpage on the Facebook website that is linked to on the Website. Therefore, data in the form of name and email address can be collected and then made available to the Facebook operator, in which case the data is processed in order to use the administrator’s Facebook page and marketing with the help of Facebook. Similarly, the indicated data may be transferred to other similar social networking sites and entities operating them.
6. In addition, due to the Administrator’s use of Google services, e.g. the G Suite service, data may be transferred outside the EEA. Guarantees to ensure an adequate level of protection result from the obligations to apply standard contractual clauses adopted by the Commission (EU) or the entity’s participation in the Privacy Shield program established by Commission Implementing Decision (EU) 2016/1250 of 12 July 2016. on the adequacy of the protection afforded by the EU-US Privacy Shield.
7. For the purposes of the legitimate interests pursued by the Administrator, which is the pursuit of claims, Your personal data in the field of identification, contact and address data may be transferred to debt collection companies and other entities providing services related to debt collection.
8. Your data may also be transferred to authorities that may request them in accordance with legal regulations.
5. Security of personal data
1. The Administrator processes Your personal data in accordance with the provisions of the Regulation, including the appropriate technical and organizational measures to ensure the security and adequate confidentiality and integrity of personal data, including protection against unauthorized access to them, against unauthorized or unlawful processing and accidental loss, unauthorized change, destruction or damage.
2. When downloading Your personal data as part of registering an account in the Application, they are transmitted via an encrypted SSL connection.
6. Contact details
1. All demands, requests, notifications, queries related to the processing of personal data, you can send via the contact form on the website www.iTaxi.pl, by e-mail to the following address: iod@itaxi.pl or in writing to the address iTaxi S.A. ul. Przasnyska 6B, 01-756 Warsaw.
2. You can also contact our Data Protection Officer directly: Adam Klimczak, e-mail address: adam.klimczak@kancelariakww.pl
As of February 15, 2020.
