VOZI PRIVACY POLICY

1. DATA CONTROLLER

The controller within the meaning of the law is the legal entity operating the Vozi platform.

Data protection contact: privacy@vozi-auto.com

2. DATA WE COLLECT

• 2.1. Identification: first/last name, date of birth, profile photo.
• 2.2. Contact: email, phone number.
• 2.3. Location: device GPS position during use (precise location), pickup/drop-off history.
• 2.4. Transactional: ride history, ratings, amount and payment method, last 4 digits of card (full PAN is NEVER stored — held only by Stripe).
• 2.5. Technical: device model, OS, IP address, session ID, push token (FCM/APNs), language, timezone, error logs.
• 2.6. Communications: in-app chat messages exchanged during a ride, complaint content.
• 2.7. Drivers — additional: driving license, vehicle registration, insurance policy, document photos, biometric selfie check (face match every 30 days), IBAN for payouts.

3. LEGAL BASIS

• Performance of contract (providing transport and billing)
• Legal obligation (accounting, fraud prevention, AML/KYC for Drivers)
• Legitimate interest (safety, abuse prevention, service improvement)
• Consent (marketing, optional push notifications, non-essential cookies)

4. PURPOSES

• providing, maintaining and improving the service
• matching passengers and drivers, navigation, fare calculation
• payment processing and fraud prevention
• ride-related communication (push, email, SMS)
• analytics and statistics (anonymised)
• legal compliance
• safety (SOS, incident recording)

5. RETENTION PERIODS

• Account data: until account deletion + 30 days
• Ride data: 5 years (statutory accounting obligation)
• Support communications: 2 years
• Access and security logs: 12 months
• Deleted accounts: anonymised within 30 days
• Driver documents: while active + 10 years (tax and transport obligations)

6. RECIPIENTS

Data may be shared with:

• another User/Driver within the same ride (name, rating, location, masked-call or in-app chat)
• Stripe Payments Europe Ltd. — payment processing
• Supabase / hosting infrastructure — secure EU storage
• OSRM and OpenStreetMap (Nominatim) — routing and geocoding (anonymous)
• Apple / Google — push notification delivery
• government authorities based on a final order

Vozi does NOT sell personal data to third parties.

7. INTERNATIONAL TRANSFERS

Main processing takes place in EU data centers. Any transfers outside the EU (e.g. iCloud, Stripe US) are carried out under EU Commission Standard Contractual Clauses with appropriate additional safeguards.

8. COOKIES & SIMILAR TECHNOLOGIES

The App uses local storage and security tokens that are strictly necessary for operation. We do not use third-party advertising cookies.

9. YOUR RIGHTS

You have the right to:

• access and obtain a copy
• rectify inaccurate data
• erasure ("right to be forgotten")
• restrict processing
• data portability in a structured format
• object to processing based on legitimate interest
• withdraw consent at any time
• lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs)

Send requests to privacy@vozi-auto.com. We respond within 30 days.

10. AUTOMATED DECISION-MAKING

The matching system uses automated algorithms (geo-proximity, rating, vehicle category, dynamic pricing). These do not produce legal effects on the User nor significantly affect their rights. Users may request human review via support.

11. MINORS

The App is not intended for persons under 18. If we learn that we have collected a minor's data without parental consent, we delete it immediately.

12. SECURITY

We apply technical and organisational measures: TLS 1.3 encryption in transit, encrypted database at rest, Row-Level Security policies, two-factor authentication for admins, regular security audits, staff training. In case of a high-risk data breach, we will notify You and the Commissioner within 72 hours.

13. CHANGES TO THIS POLICY

This Policy may be updated. Material changes will be published in the App at least 15 days before they take effect.

14. CONTACT

Vozi — Data Protection

Email: privacy@vozi-auto.com

Support: podrska@vozi-auto.com