Privacy Policy for Drivers in Montenegro providing Taxi Service

Pokupi D.O.O (hereinafter: “Pokupi”)

Registered under the laws of Montenegro with registration code 5-0944989 PIB 03331423, registered office Radoja Dakića bb. 81400 Nikšić, Montenegro

E-mail: [email protected]

Website: https://pokupi.me

The contact details of the data protection officer of Pokupi: [email protected].

Pokupi developed the Pokupi applications and accounts (“Pokupi app”), while Taxi companies provide Pokupi Services in Montenegro territory. Pokupi established the data processing conditions and is in charge of operating the IT infrastructure supporting the Pokupi app, while taxi companies offer taxi services locally.

For the data processing activities related to the Pokupi Services, the data controllers under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) are Pokupi.Me and Taxi Companies in Montenegro.

1. Personal data we process

Name, e-mail, phone number, place of residence.
Geolocation of drivers and driving routes (including geolocation of the device which is used by the Driver).
Information about vehicles (including registration number).
Driver’s efficiency and ratings.
Driver’s required licenses, photo, profession and identity documents.
Information about disputes/complaints.
The financial data of providing transportation services is not considered as personal data, because drivers provide services in the course of economic and professional activities under an agreement entered into by their respective Fleet Partner.

2. Purposes of the data processing

We collect and process personal data for the purpose of connecting passengers with Taxi Companies Partners / Drivers to help them to provide taxi services more effectively.
Geolocation and driving routes are processed to analyse the geographical area and give suggestions to the drivers. If you do not want to disclose your geolocation for passengers, you must close the Pokupi app or indicate in the Pokupi app that you are offline and currently are not providing taxi services.
Driver’s required licenses, profession and identity documents are processed to determine the compliance with the legal requirements.
Pokupi app displays the driver’s photo, name and vehicle details for the passengers to identify the driver and vehicle.
You will receive summaries which will include your efficiency and ratings as a driver. Summary and ratings about a driver are necessary to provide reliable services for passengers.
We may use geolocation data to resolve quality issues related to transportation services.
We may use your contact details to notify you of updates on the Pokupi app, your trips or complaints.
In case you lodge a complaint through the Pokupi app or otherwise, we process the latter and run an investigation.
Pokupi processes and stores data in connection with the bookings and the provision of the transportation service.
Pokupi may use this data in case it is necessary in connection with the inspection by the local competent authorities. The legal basis of the data processing is the compliance with a legal obligation of taxi companies in Montenegro.
We shall carry out investigations in connection with your complaints and upon completion, store all relevant results. The legal basis for this data processing is the compliance with a legal obligation. Although the storage of personal data is executed on the IT systems operated by Pokupi, Taxi Companies in Montenegro can also access the complaints and the relevant investigations’ results for the duration of ten (10) years.
The Montenegrin authorities, in case of an investigation or audit, are entitled to request personal data from Pokupi in written form and Pokupi shall comply with such requests.

3. Legal basis

Personal data is processed for the performance of the contract concluded with the employer of the Driver (taxi transportation provider entity) or Driver (in case of a sole trader). The prerequisite for the use of the Pokupi services is (i) installing the Pokupi app, (ii) allowing for the use of geolocation data within your device and (iii) agreeing to the processing of identification and geolocation data.
Personal data may be processed on the ground of Pokupi’s legitimate interest in investigating and detecting fraudulent payments.

4. Recipients of the personal data

Your personal data is disclosed to passengers, whose order has been accepted by you; passengers whose rides have been fulfilled and that may have forgotten any of their belongings in the vehicle or to resolve a dispute between said passengers and the respective driver.
Passengers will see the driver’s name, vehicle, phone number, photo and geolocation data. Passengers also see this driver’s personal data in the receipt.
Depending on the location of the driver, the driver’s personal data may be disclosed to Pokupi and its local subsidiaries, representatives, affiliates, agents etc. Processing of personal data by will occur under the same conditions as established in this privacy policy.

5. Security and access

Any personal data collected in the course of providing services is transferred to and stored in the data centres of Contabo Data Center, which are located in the territories of a Member States of the European Union. The contractual partners of Pokupi undertake backups regularly and as may be required and, if it is necessary, participate in the restoration of the database.
Only authorised employees of Pokupi have access to the personal data and they may access the data only for the purpose of resolving issues associated with the use of the services (including disputes regarding transportation services and customer support).
The payment service providers, which process the payments of the passengers by electronic means are partners of Pokupi. Pokupi may use the platforms of its contractual partners to investigate and to respond to relevant complaints.
For research and scientific purposes, the data is used in unidentified form (anonymized).

6. Processing passengers personal data

You shall not process the personal data of passengers without our permission or that of the passenger. You shall not contact any passenger or collect, record, store, grant access, use or cross-use the personal data provided by the passenger or accessible to you via the Pokupi app for any reason other than for the purposes of fulfilling the respective transportation services.
You must comply with the rules and conditions for processing of personal data of passengers as set forth in the Privacy Policy for Passengers (http://pokupi.me). If you violate the requirements for the processing of personal data of passengers, we may terminate your accounts and claim damages from you.

7. Access, correction, retention, deletion and data portability

Personal data can be accessed and corrected in Pokupi Driver App or by sending us email.
You can request information related to your personal data, in which case we will provide information in connection with the categories of personal data concerned, the purposes of the processing, the period for which the personal data is stored, your rights related to data processing and your rights to lodge a complaint with the supervisory authority in charge. In case you believe that your rights have been violated by Pokupi you may lodge a complaint with the Montenegrin competent authorities (see below – 8.).
You are entitled to request the restriction of the processing of your personal data according to Article 18 of GDPR, also where we no longer need your personal data for the purpose of processing, but this personal data is required by you for the establishment, exercise or defence of legal claims.
Financial data regarding taxi services provided to passengers will be stored for 3 years after the last journey.
Your personal data will be stored by Pokupi as long as you have an active driver’s account. If your account is closed the personal data will be stored for an additional 3 year period, unless such data is required to be retained for accounting, dispute resolution or fraud prevention purposes.
Data necessary for accounting purposes shall be stored for 7 years after the last journey.
In the event of suspicions of a administrational or criminal offence, fraud or false information, the data shall be stored by Pokupi for 10 years in order to hinder the renewed registration of the person who acted unlawfully.
In the event of disputes, the data shall be retained until the dispute has been resolved or until the statute of limitation of the claim has elapsed (in principle for 10 years).
We will respond to any request for transfer of personal data submitted by e-mail and proceed with the data transfer within a month. Such a deadline may be extended for a good cause.
We may retain certain personal data as may be required by law and for legitimate business purposes permitted by law.
Please note that the deinstallation of the Pokupi app in your device does not cause the deletion of your personal data.
If the Pokupi app has not been used for 3 years, you will be notified and asked whether the account is still active. If no reply is received, the account will be closed and personal data will be deleted unless such data is required to be stored for accounting, dispute resolution or fraud prevention purposes.

8. Dispute resolution and remedies

Disputes relating to the processing of personal data are resolved through customer support ([email protected]) or by contacting Pokupi Head Office’s Data Protection Officer ([email protected]).
In case you believe that the data processing is unlawful, you are entitled to start the procedure before the Montenegrin competent authority.