Vozi Privacy Policy
Version 3.0 — applicable from [being completed]
Article 1Controller
1.1The controller of personal data is [being completed], [being completed], registration number [being completed], tax ID [being completed] (Vozi).
1.2Contact for any question about personal data: podrska@vozi-auto.com. Data protection officer: [being completed].
1.3This Policy applies to passengers, taxi carriers and drivers using the Vozi app, and to visitors of vozi-auto.com. Processing complies with the Personal Data Protection Act (“Official Gazette of RS”, no. 87/2018).
Article 2Passenger data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, phone number, email, Apple or Google account identifier | Opening and managing the account, sign-in, contact | Performance of the contract | While the account exists and 30 days after closure |
| Precise location while the app is open | Showing available taxis and the pick-up point | Performance of the contract | Not stored outside a ride |
| Location during the ride | Ride tracking by the passenger and the driver | Performance of the contract | Route points 30 days; pick-up and destination with the ride data |
| Ride data: addresses, times, distance, price, carrier, vehicle category | Performing the ride, billing, complaints | Performance of the contract; legal obligation | Period required for accounting records ([being completed]) |
| Last 4 digits and card type, transaction identifier | Payment and refunds | Performance of the contract; legal obligation | Period required for accounting records ([being completed]) |
| Messages with the driver | Communication during the ride | Performance of the contract | Deleted when the ride ends; if a report is made, the messages concerned are kept for moderation |
| Ratings and comments | Service quality and safety | Legitimate interest | While the account exists |
| Complaints | Handling complaints and keeping the register | Legal obligation | Period set by law ([being completed]) |
| SOS activation and shared location | Safety | Vital interests; consent for sharing with a close contact | 12 months |
| Push notification token | Ride notifications | Performance of the contract | Until sign-out |
| Email and token for promotional messages | Information about offers | Consent | Until consent is withdrawn |
| IP address, device data, technical logs | Security and debugging | Legitimate interest | 12 months |
| Record of acceptance of the Terms | Proof of the contract | Legitimate interest | Duration of the relationship and limitation period ([being completed]) |
| Email and amount of an unpaid debt after account closure | Debt recovery | Legitimate interest | Until paid or time-barred |
| Ride data available to a digital assistant connected by the passenger | Booking rides through the assistant | Performance of the contract, on the passenger's instruction | Until the assistant is disconnected |
Article 3Taxi carrier and driver data
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, date of birth, address, phone, email | Concluding and performing the cooperation agreement, payouts | Performance of the contract | Duration of the cooperation and period set by law ([being completed]) |
| Taxi authorisation, taxi licence, driving licence, registration certificate, ID card (photos and data read) | Checking the legal conditions for taxi transport | Legal obligation to check ([being completed]); performance of the contract | Photos: 1 year after the decision; numbers and expiry dates: during the cooperation |
| Selfie compared with the ID card photo | Checking that the person holds the document | Explicit consent; the driver may choose verification without biometrics | Deleted after the decision |
| Verification outcome | Decision to activate the account | Performance of the contract | Duration of the cooperation and 1 year |
| Location while the driver is online and during rides | Assigning and tracking rides | Performance of the contract | 30 days |
| IBAN and identity verification data held by the payment provider | Payouts | Performance of the contract; payment provider's legal obligation | Period required for accounting records ([being completed]) |
| Commissions and payouts | Accounting | Legal obligation | Period required for accounting records ([being completed]) |
Article 4Automated document checks and biometrics
4.1Driver documents are read automatically by a text recognition tool that checks their legibility, validity and the consistency of their data.
4.2The selfie is compared with the ID card photo only with the driver's explicit consent, under article 17 of the Act. A driver who does not consent may request identity verification without biometrics, [being completed].
4.3Every refusal is reviewed by a member of staff before it becomes final. The driver may state their view and contest the decision at podrska@vozi-auto.com, under article 38 of the Act.
4.4The automated system matching passengers and drivers (proximity, vehicle category) takes no decision producing legal effects for the passenger.
Article 5Recipients
5.1The taxi carrier and the driver of the ride receive the passenger's name, pick-up point, destination and location during the ride. The passenger receives the driver's name, photo if any, rating, and vehicle and carrier details.
5.1aIn the app, the driver sees their ride history, total amount earned and average rating, but not individual passenger ratings that could identify passengers. The taxi carrier has no access to its drivers' accounts through the app. An employed driver's employment contract is processed only to check the conditions for taxi transport, under the rules of article 3 for driver documents.
5.2Vozi uses the following processors:
| Processor | Service | Country |
|---|---|---|
| Lovable / Supabase | Database and server function hosting, email sending | [being completed] |
| Stripe | Payment and payout processing | [being completed] |
| Twilio | SMS codes to confirm phone numbers | USA |
| Google (Firebase Cloud Messaging) | Push notifications | USA |
| Google (Gemini, via Lovable AI Gateway) | Reading documents and comparing drivers' faces | USA |
| OpenStreetMap / OSRM | Maps, address search and route calculation | [being completed] |
5.3Apple and Google process data at sign-in with their accounts as independent controllers. A digital assistant the passenger connects to Vozi processes data as an independent controller under its own privacy policy.
5.4Data is disclosed to public authorities only on a legal basis.
5.5Vozi does not sell personal data.
Article 6Transfers to other countries
When data is transferred outside the Republic of Serbia, the transfer takes place only if the country ensures an adequate level of protection or with appropriate safeguards provided by the Act, such as standard contractual clauses ([being completed]). Information on these safeguards is available at podrska@vozi-auto.com.
Article 7Your rights
7.1Everyone has the right of access and to a copy, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, withdrawal of consent at any time, and the right not to be subject to a decision based solely on automated processing.
7.2Requests are made through the “My data” screen in the app or at podrska@vozi-auto.com. Vozi replies within the time limit set by the Act ([being completed]).
7.3Withdrawing consent does not affect the lawfulness of processing before the withdrawal.
7.4Everyone may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), Bulevar kralja Aleksandra 15, 11120 Beograd, www.poverenik.rs.
Article 8Mandatory data
A phone number and email are required to open an account. Location is required to order a ride. For drivers, the documents in article 3 are required to start the cooperation. Promotional messages and sharing location with a close contact are optional.
Article 9Security
9.1Data travels over an encrypted connection (HTTPS). The full card number is processed only by Stripe. Driver documents are kept in separate storage accessible only to the account holder and authorised server functions. Tokens for connecting digital assistants are stored in hashed form.
9.2[being completed]
9.3In the event of a data breach, Vozi informs the Poverenik and the persons concerned where the Act requires it.
Article 10Minors
The app is intended for adults only. If Vozi finds that a minor has opened an account, the account is closed and the data deleted, except data Vozi must keep by law.
Article 11Cookies and similar technologies
The app uses only the local storage needed for sign-in and operation. The vozi-auto.com website uses Google Ads, Google Analytics and Meta Pixel cookies (Meta Platforms Ireland: measuring visits and waitlist sign-ups from ads) only with the visitor's consent; the rules are set out in the Cookie Policy.
Article 12Changes
Vozi announces material changes to this Policy in the app and by email at least 15 days before they apply. Previous versions are available on request.
Vozi · Version 3.0 — applicable from [being completed]