Passenger Privacy Notice

Notice on the Processing of Personal Data

(Articles 13 and 14 of Regulation (EU) 2016/679)

Perloo Tech Μονοπρόσωπη ΙΚΕ (Perloo Tech Single Member Private Company), trading as “Perloo Tech”, with its registered office at 39 Grigoriou Lampraki Street, Rhodes, 85100, Greece (the “Company”), treats the protection of personal data and privacy as a priority. The Company complies with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (the General Data Protection Regulation, or “GDPR”), and applicable Greek legislation.

This Notice provides information under Articles 13 and 14 of the GDPR about how the Company processes your personal data when you use the application for booking passenger transport services (the “App”). It also covers information about you received from the other party to a trip. This Notice applies to the App; separate privacy notices apply to third-party websites to which you may be redirected.

1 Data controller

The Company identified above is the controller responsible for collecting and processing your personal data. This means that the Company determines the purposes and means of processing in accordance with the GDPR and other applicable legislation.

2 Sources of personal data

We collect information you provide when registering and using the Platform, together with booking, communication, location and technical data. A Passenger account requires first name, surname, telephone number and email. Booking requires trip details and a payment method using a card, Apple Pay or Google Pay. Without the necessary information, the corresponding service cannot be provided. Booking notes are optional. Booking is possible without GPS access by entering an address. Information about you may also come from reports submitted by the other party to the trip.

3 Processing of personal data and legal bases

Passengers and Drivers communicate through in-app chat and calls using Twilio, without revealing their actual telephone numbers to each other. Perloo does not record calls. Twilio may retain call metadata, such as numbers and duration, under its own retention practices. Call identifiers may appear in Perloo technical logs.

Live trip tracking operates from thirty (30) minutes before the scheduled pickup until the trip is completed or cancelled, with the required device permissions, and may operate in the background during that same period. Passenger booking does not require GPS permission. Location access can be changed through device settings. Pickup and destination points entered in a booking are separate data from live location.

The table below sets out the purposes for which the Company processes personal data, the categories of data concerned and the corresponding legal bases.

Purpose of processing	Categories of personal data	Legal basis under the GDPR
Account registration and login	First name, surname, telephone number, email and account authentication information.	Article 6(1)(b): processing necessary to perform a contract or to take steps at the data subject’s request before entering into a contract.
Booking a trip	Trip details, pickup and destination addresses/coordinates, optional notes, payment method (card, Apple Pay or Google Pay), transaction identifiers, amounts and payment status; no full card number is stored in the Perloo database.	Article 6(1)(b): processing necessary to perform a contract.
Communication between Passenger and Driver and location updates	Full name; contact details (email address); subject and content of communications; location data (GPS coordinates).	Article 6(1)(f): processing necessary for the Company’s legitimate interests, in particular providing prompt support to users and Passengers.
Contact form	Full name; correspondence and contact details; the content of any message submitted.	Article 6(1)(f): the Company’s legitimate interest in responding to enquiries and providing support.
Handling support and cancellation requests through a ticketing system	Requester and booking details; a text description of the incident; the administrator’s decision and an optional explanation. Attachments are not supported. The decision and any explanation are displayed to the requester once the review is complete.	Article 6(1)(b) for managing the contractual relationship, and Article 6(1)(f) for examining disputes and supporting related claims.
Technical operation and notifications	FCM tokens, notification content, Crashlytics crash reports, installation identifiers, request and error logs.	Article 6(1)(b) for service updates and Article 6(1)(f) for the legitimate interest in secure and reliable operation.
Driver ratings	Passenger-submitted rating linked to the Driver and trip.	Article 6(1)(f) for the legitimate interest in assessing service quality and informing users.
Reviewing no-shows and disputes	Trip and incident details, available Passenger and Driver location snapshots, and administrator decision.	Article 6(1)(f) for the legitimate interest in investigating disputes and supporting claims.

4 Disclosure to third parties and categories of recipients

Authorised administrators and technical support partners access data within their duties. The development partner is ZEALOUS SYSTEMS AND SOLUTIONS LLP, Ahmedabad, India. Hosting uses Amazon infrastructure in Europe; eu-central-1 is the region reported for S3 files. Services include Stripe for payments and Stripe Connect for Driver payouts, Twilio for verification SMS and calls, Google Maps and Places for maps, addresses and routing, and Firebase for notifications and Crashlytics crash diagnostics. These providers receive the data needed to provide their respective services.

Notifications use FCM device tokens and content relating to trips, messages or payments. Crash diagnostics use technical reports and installation identifiers. Server request and error logs are also kept. Stripe processes payment details; the Perloo database does not store full card numbers. For its own identity verification and regulatory obligations, Stripe processes data under its privacy policy: https://stripe.com/privacy. Firebase information is available at https://firebase.google.com/support/privacy. Provider processing is not necessarily confined to the region hosting Perloo.

To identify the parties and the vehicle at pickup, the Passenger is shown the Driver’s full name and the vehicle’s make, registration number and colour. The Driver is shown the Passenger’s full name.

These details become visible within a specified period before the scheduled pickup time. In-app chat and telephone calls that conceal the parties’ actual telephone numbers are enabled at the same time. This period is currently thirty (30) minutes. Any change is communicated through the Platform before it is applied to the relevant booking.

A trip confirmation code (OTP) is displayed on the booking screen. The Passenger may tell the Driver this code to confirm that they are referring to the correct booking. Its use is optional and is not a prerequisite for starting the trip.

After completion or cancellation, the parties can view trip details in their history, including the other party’s name, vehicle details and amount. Trip communication is disabled. Chat is deleted from Redis when the ride completes, is cancelled or is marked as a no-show; otherwise an expiry period of approximately 30 days applies. This does not delete booking history, support tickets or metadata held separately by providers.

5 Security

The Company takes appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and other unlawful processing.

6 Your rights

You may exercise the rights below subject to the conditions and exceptions laid down in the GDPR. Contact hello@perloo.app to submit a request. The Company will respond without undue delay and, in any event, within one (1) month of receiving your request. Where necessary, taking account of the complexity and number of requests, this period may be extended by two (2) further months. In that case, the Company will inform you of the extension and its reasons within the initial month. Requests are generally handled free of charge, subject to the exceptions in Article 12(5) of the GDPR.

You may request account deletion through the application or the public deletion-request page. Following confirmation of your request, access is disabled immediately and the request is forwarded to the administrator. Perloo completes deletion manually within 14 calendar days of the confirmed request and sends confirmation when completed. This covers the account and associated personal data, including linked documents, that are not subject to a justified retention exception described in Section 7. For assistance, contact hello@perloo.app.

The Company facilitates the exercise of the following rights:

6.1 Right to information

You have the right to clear, transparent and easily understandable information about how your personal data are processed and about your rights under the GDPR.

6.2 Right of access

You have the right to obtain confirmation of whether your personal data are being processed and, if so, access to those data, a copy of them and the information specified in Article 15 of the GDPR. Providing a copy must not adversely affect the rights and freedoms of others.

6.3 Right to rectification

You have the right to request the correction of inaccurate personal data without undue delay and the completion of incomplete data, taking account of the purposes of the processing.

6.4 Right to erasure

You have the right to request the deletion of your personal data in the circumstances set out in Article 17 of the GDPR, for example where the data are no longer necessary for the purposes for which they were collected or have been unlawfully processed. This right is subject to the exceptions in that Article, including where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

6.5 Right to restriction of processing

You have the right to request restriction of processing in the circumstances set out in Article 18 of the GDPR, for example while the accuracy of contested data is checked. Once processing has been restricted, the data may generally be stored but otherwise processed only with your consent, for legal claims, to protect another person’s rights or for reasons of important public interest as provided in that Article. You will be informed before the restriction is lifted.

6.6 Right to data portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you that you have provided in a structured, commonly used and machine-readable format and to transmit them to another controller. Where technically feasible, you may request direct transmission between controllers. This right must not adversely affect the rights and freedoms of others.

6.7 Right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) of the GDPR (legitimate interests). The Company will then cease that processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

6.8 Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time by contacting hello@perloo.app. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. The Company will stop the processing that relies on the withdrawn consent. Any separate processing based on another legal basis remains subject to its own purpose and the applicable information requirements.

6.9 Automated individual decision making and profiling

Fares are calculated automatically using a predefined formula. Trip requests are sent to eligible Drivers under the service criteria. Only Passengers rate Drivers. The rating is visible to the Driver and to the Passenger from 30 minutes before pickup. No account is automatically blocked on the basis of ratings. The administrator decides cancellation charges and reviews disputes. Location snapshots taken when a no-show is declared may be used to assess the incident.

7 Retention of personal data

Accounting records and the necessary records of all rides and their related payments are retained for five calendar years following the end of the calendar year to which the transaction relates. This period is not restarted by an account-deletion request. Retained information is limited to what is necessary to identify and substantiate the transaction, such as the transaction reference, date, amount, payment status and legally required invoicing details. A longer period applies where required by applicable law or necessary for a specific legal claim. Access is restricted to authorised persons for those purposes. Records are deleted or irreversibly anonymised when the applicable retention period ends; deletion is managed manually.

The 14-day period is the deadline for completing a confirmed account-deletion request, not a general retention period starting at registration. The five-year period does not automatically apply to live GPS, chat, identity documents or all profile data. Live tracking operates from 30 minutes before pickup until completion, cancellation or a no-show declaration, with live location cleared even if the Driver remains online. No continuous GPS trail is retained. No-show location snapshots are retained only where necessary for dispute handling or legal claims, with necessity reviewed when the matter is resolved. Chat is cleared at completion, cancellation or no-show, otherwise after approximately 30 days. Logs, backups and linked files are included in the deletion procedure, subject to justified retention exceptions; residual backup data must remain unavailable for ordinary use and deletion must be reapplied if a backup is restored. Google states that Crashlytics reports and associated identifiers are retained for 90 days before removal from live and backup systems begins.

8 Contact about personal data

For any matter concerning the processing of personal data or this Notice, you may contact the Company at hello@perloo.app.

9 Contacting the supervisory authority

You have the right to lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority, in particular in the EU Member State where you habitually reside or work, or where the alleged infringement occurred. Contact details for the Hellenic Data Protection Authority are:

Postal address: 1–3 Kifisias Avenue, 115 23 Athens, Greece

Telephone: +30 210 6475600

General enquiries: contact@dpa.gr. Complaint submission instructions: https://www.dpa.gr/en/individuals/complaint-to-the-hellenic-dpa. Use the Authority’s online portal or, where the applicable procedure permits, complaints@dpa.gr.

10 Updates to this Notice

We aim to review and update this Notice regularly to reflect personal data protection legislation and new developments. Any update to this Notice will be communicated to you promptly.