Privacy Statement for Passengers in Montenegro benefiting from Taxi Services

Pokupi D.O.O (hereinafter: “Pokupi”)

Registered under the laws of Montenegro with registration code 5-0944989 PIB 03331423, registered office Radoja Dakića bb. 81400 Nikšić, Montenegro

E-mail: [email protected]

Website: https://pokupi.me

Pokupi developed the Pokupi application (“Pokupi app”), while Taxi Companies in Montenegro provides Pokupi Services in Montenegro territory. Pokupi established the data processing conditions and is in charge of operating the IT infrastructure supporting the Pokupi app, while local Taxi companies offer Pokupi services locally.

The data controller under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) is Pokupi. 

1. Personal data which is processed

  • Name, phone number, e-mail addresses of the passenger.
  • Identification data of the device on which the Pokupi app has been installed.
  • Geolocation of the device which is used by the passenger, time of the journey, departure and the arrival address of the passenger’s journey.
  • Payment information (including passenger’s bank card number).
  • Information about disputes/complaints.
  • The feedback of the passenger in connection with the driver/journey.

2. Purpose of the data processing

  • The primary objective of the passenger’s data processing is for the Pokupi app to enable a connection between the driver to be able to provide taxi services to the passenger.
  • After the passenger’s ride request has been accepted by the driver, geolocation data, name and phone number of the passenger is displayed to the respective driver to enable efficient pick-up. Geolocation data is collected only when the Pokupi app is activated. The collection of geolocation data stops after closing the Pokupi app.
  • We may use geolocation data to resolve quality issues related to transportation services.
  • We may use contact details to notify passengers of updates to the Pokupi app.
  • Pokupi processes the data collected from the routes taken by drivers and passengers to analyse the geographic coverage in order to provide recommendations to the drivers about the most efficient routes.
  • Your name, phone number and an e-mail will be used to communicate with you.
  • Pokupi may obtain payment details to process passengers’ payments on behalf of fleet partners for their transportation service. Customer support data is collected on a case-by-case basis and stored for the purpose of resolving disputes and service quality issues.
  • In case you lodge a complaint through the Pokupi app or otherwise, we process the latter and run an investigation.

3. Legal Basis for the data processing

  • Personal data is processed in order to provide the service contracted with passengers. We collect and process the personal data submitted by the passengers in the course of installation and use of the Pokupi app. The prerequisite for the use of Pokupi services is (i) installing the Pokupi app, (ii) allowing for the use of geolocation data within your device and (iii) passengers agreeing to the processing of identification and geolocation data.
  • Personal data may be also processed on the ground of Pokupi’s legitimate interest, for example in investigating and detecting fraudulent payments.
  • The legal basis for the data processing related to marketing purposes is the consent explicitly provided for by the passenger via the Pokupi app.

4. Recipients of the personal data

  • The personal data of a passenger is only disclosed to the taxi company partner and respective driver who provides transportation services. The taxi company partner and driver will see the name, phone number and geolocation data of the passenger.
  • After providing the taxi service, the name and the telephone number of the passenger will remain visible to the driver for 24 hours, which is necessary for the drivers to resolve any issues associated with service provision, e.g.: to contact the passenger in case of something was left behind in the vehicle.
  • Feedback given by passengers regarding the driver or the quality of the service is anonymous and taxi company partner/drivers do not receive names and telephone numbers of the passenger who provided rating and feedback.
  • Only those personal data necessary for the purpose of providing a taxi service via the app will be provided to the passenger’s taxi company partner/drivers and partners of Pokupi.
  • Any processing of personal data by any third party will occur under the same conditions as established in this Privacy Notice.
  • You can obtain information about the transport provider who provided you with the taxi service from the journey history section in the Pokupi app.

5. Data processors, Security and Access

  • The payment service providers, which process the payments of the passengers by electronic means are partners of Pokupi. Pokupi may use the platforms of their partners to investigate and respond to relevant complaints.
  • Pokupi may use the software of their contractual partners to send marketing messages.
  • Any personal data collected in the course of providing the services is transferred to and stored in the data centre of Contabo Data Centre, which is located in the territories of the Member States of the European Union. The contractual partners of Pokupi undertake backups regularly and as may be required and, if it is necessary, participate in the restoration of the database.
  • Only the authorized employees of Pokupi and the authorized employees of contractual partners can access personal data, to the extent necessary to comply with requests of the passengers in connection with Pokupi services (e.g.: customer support in the respective countries) or contribute in providing services to the passengers. 
  • Geolocation data is processed in anonymised form and personalized only if the geographical location data is needed to be linked to a passenger for resolving disputes or fraud.
  • For research and scientific purposes, the data is used in unidentified form (anonymized).

6. Access, correction and restriction

  • You can access and update your personal data via the Pokupi app.
  • You can request information related to your personal data, in which case we will provide information in connection with the categories of personal data concerned, the purposes of the processing, the period for which the personal data is stored, your rights related to data processing and your rights to lodge a complaint with the supervisory authority in charge. In case you believe that your rights have been violated by Pokupi you may lodge a complaint with the competent Montenegrin authorities.
  • You are entitled to request the restriction of the processing of your personal data according to Article 18 of GDPR, also where we no longer need your personal data for the purpose of processing, but this personal data is required by you for the establishment, exercise or defence of legal claims.

7. Retention of personal data

  • Your personal data will be stored by Pokupi as long as you have an active passenger account. If your account is closed, personal data will be deleted (according to the policies set out in this section), unless such data is required to be retained for accounting, dispute resolution or fraud prevention purposes.
  • Financial data regarding transportation services provided to passengers will be stored for 3 years after the last journey.
  • Data required for accounting purposes will be stored for 7 years after the last journey.
  • In the event that there are suspicions of a criminal offence, fraud or false information having been provided, the data will be stored by Pokupi for 10 years in order to hinder the renewed registration of the person who acted unlawfully.
  • In case of payment disputes, personal data will be retained until the dispute has been resolved or until the statute of limitation of the claim has elapsed (in principle for 10 years).
  • Journey history data will be stored for 3 years, after which the data will be anonymized.
  • Please note that the uninstallation of the Pokupi app on your device does not cause the deletion of your personal data.
  • If the Pokupi app has not been used for 3 years, you will be notified and asked whether the account is still active. If no reply is received, the account will be closed and personal data will be deleted unless such data is required to be stored for accounting, dispute resolution or fraud prevention purposes.

8. Deletion

  • You should also bear in mind that any request to delete your personal data is handled by Pokupi and possible only if your account is deleted. As a result of that you will not be able to use Pokupi app via an account which has been deleted.
  • We respond to any request to delete personal data submitted by e-mail and proceed with the data deletion within a month. Such a deadline may be extended for good cause.
  • We may retain certain personal data as may be required by law and for legitimate business purposes permitted by law.

9. Portability

  • We will respond to any request for the transfer of personal data submitted by e-mail and proceed with the data transfer within a month. Such a deadline may be extended for good cause. After we have verified the customer in question, we will provide you with your personal data.

10. Direct marketing and sweepstakes

  • We will only use your e-mail address and/or phone number to send direct marketing messages if you have given us permission to do so via the Pokupi.me website or via the Pokupi app.
  • We may personalize direct marketing messages using the information on how you use Pokupi services (frequency of use, journeys, payments). Direct marketing messages could be e-mails, SMS-s, push notifications or in-app messages, and may contain promotional codes or information which could facilitate the use of the service. Our aim is that you receive advertisements which could raise your interest/ are as relevant to you as much as possible.
  • If you no longer wish to receive direct marketing messages, please click the “Unsubscribe” link in the footer of our e-mail or change the settings related to direct marketing in the Pokupi app.
  • We may process personal data for the participation in sweepstakes organized on Facebook and publish your name provided you have consented to it.
  • We may also generate new categories within the Pokupi app and launch promotional initiatives for customer fidelization.
  • We may direct to you marketing campaigns that contain gifts, sweepstakes and other marketing or promotional materials of our partners; however, we never transfer your personal data to the latter.

11. Dispute resolution and remedies

  • Disputes relating to the processing of personal data are resolved through customer support ([email protected]) or by contacting Pokupi’s Data Protection Officer ([email protected]).
  •  
  • In case you believe that the data processing is unlawful, you are entitled to start the procedure before the Montenegrin competent authority.