Privacy Policy
Draft. Requires review by a lawyer before publication.
Effective from: "[effective date]" · Revision 1
1. Who processes your data
- Data controller: "[Name of sole proprietor/LLC]", code "[EDRPOU/RNOKPP]", address "[address]", email "[email]", phone "[phone]" ("Daxio").
- Processing follows the Law of Ukraine "On Personal Data Protection" (Закон України «Про захист персональних даних») and GDPR principles.
- This policy covers the "Daxio" rider and driver apps and the website.
2. Data we process
- Riders: phone number, name, ride history (addresses, time, fare, payment method), location while using the app and during rides, ratings and reviews, support tickets, device push token, language and settings.
- Drivers: additionally full name, date of birth, identity document details and photo (passport or ID card), driving licence details and photo, vehicle data, location during shifts, application status, payment and rental transactions, rating.
- Payments: card data is processed solely by monobank; Daxio never stores or receives it and gets only the payment status and a masked card number.
- Technical data: server logs without personal data (no phones, names or documents).
3. Purposes and legal bases
- Performing the contract with you (ordering and performing rides, payment, car rental, driver admission): contract (offer).
- Checking drivers' eligibility (age 23+, 2+ years of experience, documents): your consent and the need to conclude a contract. Consent is recorded with the text version and date.
- Safety of riders and drivers, fraud prevention, handling complaints: Daxio's legitimate interest.
- User support and service notifications about rides: contract performance.
- Legal compliance (accounting, tax, requests from authorities): legal obligation.
- Marketing messages are sent only with your separate consent, which you can withdraw.
4. Location
- Location is used to match a driver, build the route, calculate the fare and for safety during a ride. Drivers share location only during a shift. You can turn location off in device settings, but ordering or working may then be impossible.
5. Retention
- Account data and ride history: while the account is active, then up to 3 years to defend claims and meet legal duties, after which they are deleted or anonymised. Financial records: as long as accounting law requires.
- Driver documents (passport/ID, licence): rejected applications are deleted after 30 days; approved ones are kept for the cooperation period and up to 3 years after (lawyer to confirm).
- Push notifications: 30 days.
- Support tickets: up to 3 years after closing.
- Server logs without personal data: limited technical period (up to 90 days).
- On your request we delete data earlier unless there is a legal basis to keep it.
6. Who receives data (processors)
- monobank (JSC "Universal Bank") - card payments.
- TurboSMS - delivery of SMS login codes.
- Google Firebase Cloud Messaging - delivery of push notifications (device token and notification text).
- Hosting providers (Hetzner, DigitalOcean) - storage on servers in the EU.
- OpenStreetMap-based map and geo services - map display, routing, address search (query coordinates/addresses are sent).
- A driver sees the rider's name and pickup point; a rider sees the driver's name, car details and rating.
- Data may also be disclosed to public authorities on a lawful request. We do not sell personal data.
- Processors act under contracts and only on our instructions. Transfers outside the EU (including the US) rely on appropriate safeguards.
7. Security
- Document photos are kept in private storage with restricted, audit-logged access; connections are encrypted; staff access is role-based.
8. Your rights
- You may: learn about and access your data; request correction; request deletion or stop of processing; withdraw consent (without affecting earlier lawful processing); object to processing; complain to the Ukrainian Parliament Commissioner for Human Rights or a court.
- To exercise your rights contact "[email]" or in-app support. We reply within 30 days.
9. Children
- The service is not intended for persons under 14 without an adult; we do not knowingly collect their data without parental consent.
10. Changes
- A new revision is published on this page with its date. We notify you of material changes in the app.
11. Contact
- "[Name of sole proprietor/LLC]", "[address]", email "[email]", phone "[phone]".