PIDVOZ SERVICE PRIVACY POLICY

1. General provisions

1.1. PidVoz processes Users' personal data in accordance with the Law of Ukraine "On Personal Data Protection" and other Ukrainian legislation in the field of personal data protection.

1.2. PidVoz processes Users' personal data solely to the extent necessary to achieve the purposes set out in this Policy and takes reasonable measures to ensure their confidentiality and security.

1.3. This Policy applies to all Users of the Platform, regardless of whether they act as a Driver or as a Passenger, as well as to persons who visit the PidVoz website without registering an Account.

1.4. Use of the Service by persons under 18 years of age is not permitted. PidVoz does not knowingly collect personal data of persons who have not reached the age of majority. If PidVoz becomes aware that such a person's personal data has been obtained without proper legal grounds, PidVoz will take steps to delete it.

2. Terms and definitions

Personal data - information or a set of information about a natural person who is identified or can be specifically identified.

Processing of personal data - any action or set of actions performed with personal data, including collection, registration, accumulation, storage, adaptation, modification, renewal, use, dissemination, depersonalisation and destruction of personal data.

Owner of personal data - PidVoz, which determines the purpose of processing personal data, the composition of such data and the procedures for its processing.

Personal data subject - a User of the Service whose personal data is processed by PidVoz.

Third parties - any persons other than PidVoz and the User whose personal data is processed, including other Users of the Service and PidVoz counterparties.

Other terms are used with the meaning defined in the PidVoz Service Terms of Use.

3. Personal data we process

3.1. The scope of personal data processed by PidVoz depends on how the User interacts with the Service. In particular, PidVoz may process the following categories of data:

a) Data provided during registration and maintenance of an Account:

• surname, first name;
• phone number;
• email address;
• date of birth (to confirm that the User is 18 years old);
• profile photo;
• gender.

b) Data related to Rides:

• information about created and booked Rides (route, date, time, number of Seats, Seat Price);
• the User's ride history;
• messages exchanged between Users through the Service functionality in connection with arranging a Ride, including photos and other files attached to the messages;
• ratings, reviews and the rating score left by other Users.

c) Geolocation data:

• data on the location of the User's device (subject to the relevant permission being granted in the device settings), used to display the departure point, build the route and make it easier for the Driver and the Passenger to meet.

d) Driver verification data:

• driving licence details;
• vehicle registration details (vehicle registration certificate);
• a photo to confirm identity;
• other documents that the User voluntarily provides to pass verification.

e) Data related to the use of device features:

• access to the device camera and gallery (photo gallery) - solely with the User's permission and solely for the purpose of uploading a profile photo;
• biometric login data (for example, a Face ID / Touch ID token) - in cases where the User activates biometric login themselves; the biometric sample itself is processed on the User's device and is neither transferred to nor stored on PidVoz servers;
• device motion data (accelerometer / activity detector - "Motion & Fitness" on iOS, "Activity Recognition" on Android), used solely to determine that the device is stationary during an active Ride and to improve the accuracy of background geolocation tracking;
• data on links to social network accounts or other services, if the User has chosen the relevant method of signing in to the Service.

f) Additional profile and settings data:

• saved addresses ("home", "work" and other saved places);
• data on saved vehicles (vehicles added to the profile);
• settings of regular (recurring) routes.

g) Financial data:

• information required to pay the PidVoz Commission (processed mainly by the payment provider; as a rule, PidVoz does not store full payment card details);
• the history of transactions within the Service (commission payments, refunds, use of promo codes).

h) Technical data:

• IP address;
• type and version of the operating system and device;
• unique device identifiers and push tokens for sending notifications;
• data on the use of the Service (activity logs, date and time of login, application errors);
• data obtained through cookies and similar technologies while using the website.

i) Data arising in the course of communication with support:

• the content of requests to the PidVoz support service, including attached files, screenshots and other materials provided by the User voluntarily.

3.2. PidVoz does not knowingly collect and does not seek to process special categories of personal data (data on health, religious or political beliefs, racial or ethnic origin, etc.), except where the User voluntarily discloses such information in a request to the support service, and only to the extent necessary to handle such a request.

4. Purposes of personal data processing

4.1. PidVoz processes Users' personal data for the following purposes:

• creating, identifying and administering an Account;
• ensuring the functioning of the Service, in particular searching for Rides, publishing offers and making Bookings;
• organising interaction between the Driver and the Passenger (transferring the contact details required to agree the details of the Ride);
• calculating and charging the PidVoz Commission, processing payments and refunds;
• verifying the User's identity and documents, where this is provided for by the Service functionality;
• ensuring the safety of Users, preventing fraud and abuse, investigating breaches of these Terms;
• providing support to Users, handling requests and complaints;
• sending notifications related to a Booking, changes to a Ride and technical matters concerning the operation of the Service;
• analytics and improvement of the functional capabilities of the Service;
• complying with the requirements of Ukrainian legislation, in particular providing information at the request of authorised state bodies in the cases provided for by law;
• protecting the rights and legitimate interests of PidVoz, in particular in connection with possible disputes or claims.

4.2. With the User's separate consent, PidVoz may use their personal data (in particular, phone number or email address) to send marketing and informational messages about promotions, promo codes or Service updates. The User has the right to withdraw such consent at any time in the Account settings or by following the "unsubscribe" link indicated in the relevant message.

5. Legal grounds for processing personal data

5.1. PidVoz processes Users' personal data on the following legal grounds:

• the necessity of performing a contract (the Terms of Use) to which the User is a party, or of taking steps at the User's request prior to entering into such a contract;
• the User's consent, given by registering an Account, accepting these Terms and this Policy, or separately for specific purposes (in particular, marketing mailings or geolocation);
• the necessity of complying with an obligation laid down by Ukrainian legislation that applies to PidVoz;
• the legitimate interest of PidVoz, in particular in ensuring the security of the Service, preventing fraud and protecting the rights of PidVoz and other Users, - provided that such interest is not overridden by the interests or fundamental rights and freedoms of the User.

6. Sources of personal data

6.1. PidVoz receives personal data in the following ways:

• directly from the User - during registration, completion of the profile, creation of Rides, making Bookings and communication with the support service;
• automatically - in the course of using the Service (technical data, location data, activity logs, cookies);
• from other Users - for example, when another User leaves a review or rating or reports information about a Ride that concerns the User;
• from third parties - in particular payment providers (regarding transaction status), identity or document verification services (where such functionality is available), as well as from state registers in the cases provided for by law.

7. Transfer of personal data to third parties

7.1. PidVoz does not sell Users' personal data to third parties. Personal data is transferred only to the extent necessary to achieve the purposes set out in this Policy.

7.2. Personal data may be transferred:

• to another User of the Service - to the extent necessary to arrange a specific Ride (in particular, the name, profile photo, rating, phone number and/or other contact details of the Driver or Passenger after a Booking is confirmed);
• to payment providers and banking institutions - to process payment of the PidVoz Commission and to make refunds;
• to providers of technical services and contractors of PidVoz - in particular hosting providers, developers, analytics services, push notification and SMS delivery services and mapping services - which process data on behalf of and as instructed by PidVoz under relevant agreements providing for an appropriate level of data protection;
• to advertising and analytics partners, in particular Meta Platforms, Inc. (within Meta Business Tools / Facebook SDK) - the internal User identifier and depersonalised app usage events (for example, the fact of a login, or the creation or booking of a Ride) are transferred for the purpose of measuring application performance. The device advertising identifier (IDFA/GAID) is neither collected nor transferred;
• to state bodies and officials - in the cases provided for by Ukrainian legislation, in particular upon a substantiated request from law enforcement or judicial authorities.

7.3. All third parties to which PidVoz transfers personal data for processing on its behalf are obliged to ensure the confidentiality and proper protection of such data and to use it solely for the purpose determined by PidVoz.

8. Geolocation data

8.1. The Service may use data on the geolocation of the User's device to display the map, the departure point and the route of the Ride, as well as to make it easier for the Driver and the Passenger to meet at the pick-up point.

8.2. The User's location may be collected both while the application is actively being used and in the background during a Ride, which is necessary to show the live position of the car to the Passenger and to ensure the safety of the Ride;

8.3. Access to geolocation, including background access, is granted by the User voluntarily through the settings of their device. The User may restrict or disable access to geolocation in the device settings at any time; however, this may significantly limit the functional capabilities of the Service, in particular the display of the map, route building and live Ride tracking.

8.4. PidVoz does not track the User's location outside the time of active use of the relevant Service functionality or of a Ride made by a Driver or a Passenger, as described in clause 8.2.

9. Cookies and similar technologies

9.1. The PidVoz website and mobile application may use cookies, pixel tags, local storage and similar technologies (hereinafter - "Cookies") in order to ensure the correct operation of the Service, remember the User's settings, analyse the use of the Service and improve its functional capabilities.

9.2. PidVoz uses the following categories of cookies:

• strictly necessary (technical) - required for the functioning of the Service, in particular for User authorisation;
• analytical - to collect statistics on the use of the Service and detect technical errors;
• functional - to remember the User's settings and preferences;
• marketing (where applicable) - to personalise advertising and informational messages.

9.3. The User may manage cookies through their browser settings, in particular block or delete them; however, this may affect the functionality of the website.

10.1. Personal data retention period

10.1.1. PidVoz stores the User's personal data for the period necessary to achieve the purposes for which such data was processed, as well as for the period necessary to comply with the requirements of Ukrainian legislation, in particular regarding tax and accounting records.

10.1.2. Personal data related to an Account is stored throughout the entire period of its existence. After an Account is deleted, personal data is deleted or depersonalised within a reasonable period, except where its further storage is required by Ukrainian legislation (in particular, data on payments made, which may be stored for the periods established by tax and accounting legislation) or is necessary to protect the legitimate interests of PidVoz in connection with possible disputes or claims.

10.1.3. Data on requests to the support service is stored for the period necessary to handle the relevant request, and additionally for a reasonable period in order to make it possible to analyse repeat requests and protect the interests of the parties.

10.2. Procedure for deleting an Account.

10.2.1. The User may delete their Account and the personal data associated with it directly in the application, in the "Profile" - "Personal data" section, by tapping the "Delete profile" button.

10.2.2. Deleting an Account during a Ride with the status "ride started" becomes possible only after such Ride is completed.

10.2.3. After the deletion of an Account is confirmed, PidVoz permanently deletes, in particular: the name and other identification data, phone number and email address, profile photo, gender, saved addresses ("home"/"work"), data on linked social accounts, driving licence details, push tokens, biometric login data, saved places, notification settings and saved vehicles. The content of messages in the Service chats is anonymised.

10.2.4. Scheduled and active uncompleted Rides or Bookings are cancelled. Individual technical records of past Rides or routes may be temporarily stored in depersonalised form - to the extent necessary to fulfil PidVoz's obligations to other Users, and in the cases provided for by clause 10.1.2 of this Policy.

11. Personal data protection

11.1. PidVoz takes reasonable technical and organisational measures to protect Users' personal data against unauthorised access, alteration, disclosure or destruction, in particular: encryption of data in transit, restriction of access to personal data to authorised employees only, and regular updating of security systems.

11.2. Despite the measures taken, PidVoz cannot guarantee the absolute security of data transmission over the Internet or of electronic data storage systems. The User understands that the transmission of information over the Internet involves certain risks.

11.3. The User is obliged to keep their account credentials confidential and not to disclose them to third parties. PidVoz is not liable for consequences arising from the User's disclosure of their account credentials.

11.4. In the event of a personal data breach that may pose a threat to the rights and freedoms of Users, PidVoz will notify the authorised body and, in the cases provided for by law, the Users concerned, within the time limits and in the manner determined by Ukrainian legislation.

12. Rights of the User as a personal data subject

12.1. As a personal data subject, the User has the right:

• to know about the sources of collection and the location of their personal data, the purpose of its processing, and the location or place of residence of the owner or administrator of personal data;
• to receive information about the conditions for granting access to personal data, in particular information about the third parties to which their personal data is transferred;
• to access their personal data, including the right to obtain a copy of it;
• to have inaccurate or incomplete personal data corrected (clarified);
• to have personal data deleted if it was processed unlawfully or the purpose of processing has been achieved, provided that further storage is not required by law;
• to withdraw consent to the processing of personal data given for a specific purpose (in particular, marketing mailings), without retroactive effect on the lawfulness of processing carried out before such withdrawal;
• to object to the processing of personal data carried out on the basis of the legitimate interest of PidVoz;
• to restriction of the processing of personal data in the cases provided for by law;
• to lodge a complaint about the processing of their personal data with the Ukrainian Parliament Commissioner for Human Rights or another competent body, and also to apply to a court for protection of infringed rights.

12.2. To exercise the rights listed above, the User may contact PidVoz through their Account settings (where the relevant functionality is available) or by sending a request to the email address specified in section 17 of this Policy. The procedure for submitting a request to delete an Account and the scope of the data deleted are set out in clause 10.2 of this Policy.

12.3. PidVoz considers the User's request and provides a response within a period not exceeding 30 calendar days from the date of its receipt, unless another period is established by Ukrainian legislation. In exceptional cases, taking into account the complexity of the request, this period may be extended, with the User being notified of the reasons for such extension.

12.4. PidVoz may refuse to fulfil the User's request in the cases provided for by Ukrainian legislation, in particular if satisfying the request would infringe the rights and legitimate interests of other persons or would contravene the requirements of applicable law.

13. Personal data of minors

13.1. The Service is intended solely for persons who have reached 18 years of age. PidVoz does not knowingly collect personal data of persons who have not reached the age of majority.

13.2. If PidVoz receives information that the personal data of a minor has been collected without proper legal grounds, such data will be deleted within a reasonable period. A person who believes that the personal data of a minor has been processed by PidVoz may get in touch using the contact details specified in section 17.

14. Automated decision-making

14.1. PidVoz may use automated technical mechanisms to moderate content, detect suspicious or fraudulent activity, and pre-rank Ride offers in search results.

14.2. Such mechanisms do not make final legally significant decisions concerning the User (in particular, on permanently blocking an Account) without the possibility of such a decision being reviewed by an authorised PidVoz employee at the User's request.

15. Transfer of personal data outside Ukraine

15.1. Where PidVoz's technical service providers (in particular, hosting providers, analytics or communication services) are located outside Ukraine or process data outside Ukraine, personal data is transferred in compliance with the requirements of Ukrainian legislation on cross-border transfer of personal data, in particular provided that an appropriate level of data protection is ensured in the relevant state or on the basis of other legal mechanisms provided for by law.

16. Changes to the Privacy Policy

16.1. PidVoz has the right to make changes to this Policy in connection with changes in Ukrainian legislation, the development of the functional capabilities of the Service or for other justified reasons. The current version of the Policy is always available on the Platform with an indication of its effective date.

16.2. In the event of material changes concerning the scope or purpose of personal data processing, PidVoz will notify Users by posting a relevant notice in the Service and/or by sending a message to their email address or in the application.

16.3. Continued use of the Service after the amended Policy takes effect means that the User accepts it. If the User does not agree with the changes, they have the right to stop using the Service and delete their Account.

17. Contacts and procedure for enquiries

17.1. On all matters related to the processing of personal data, the exercise of the rights of a personal data subject or this Policy, the User may contact PidVoz:

• by email: support@pidvoz.com;

17.2. PidVoz handles Users' enquiries regarding personal data in the manner and within the time limits set out in section 12 of this Policy.

18. Final provisions

18.1. This Privacy Policy is drawn up in the Ukrainian language. If the Policy is translated into other languages for the convenience of Users, in the event of any discrepancies between the texts the Ukrainian-language version prevails.

18.2. This Policy is an integral part of the PidVoz Service Terms of Use. If any provision of this Policy is found invalid by a competent court, this does not entail the invalidity of the other provisions of the Policy.

18.3. This Policy is governed by the legislation of Ukraine.