Data Protection Officer (DPO): It is not mandatory; the Operator handles this matter directly at gdpr@wooz.sk.
Scope: This applies to B2C customers and B2B drivers. Fleet partners and investors have a separate B2B Partner Information Memorandum.
Article II. – Data Categories and Data Minimization
Operator processes the following data:
Identification and Contact Information: First name, last name, permanent address, date of birth, country where the driver's license was issued, phone number, email address.
Technical and Authentication: Hashed passwords, session security tokens, IP address, device ID, push tokens, app version, logs.
Documents and driver's license: ID card/passport number, expiration date, driver's license number, license categories, and double-sided photos of the original documents.
Biometrics (voluntary consent): A selfie and a liveness check that compares the geometry of the face with that on the ID document.
Payments and Billing: Payment token from the PCI-DSS gateway (we do not store full card numbers or CVC codes), masked 4-digit numbers, billing information, and trip history.
Performance of a Contract – Article 6(1)(b) of the GDPR
Settlement of Deposits, Fines, and Damages
Performance of a Contract – Article 6(1)(b) of the GDPR
Invoicing and Bookkeeping
Legal obligation – Article 6(1)(c) of the GDPR
24/7 Fleet Protection, Theft Prevention, and Vehicle Immobilization
Legitimate Interest – Article 6(1)(f) of the GDPR
Detection of Traffic Accidents and Safety Incidents
Legitimate Interest – Article 6(1)(f) of the GDPR
Police Handling of Traffic Violations
Legal Obligation – Article 6(1)(c) and Legitimate Interest
Direct Marketing of Our Own Services (soft opt-in for clients)
Legitimate interest (Article 6(1)(f)) and Section 116(3) of Act No. 452/2021 Coll.
Marketing and Newsletters for Non-Clients
Consent – Article 6(1)(a) of the GDPR and Section 116(2) of Act No. 452/2021 Coll.
Article IV. – Biometrics, Article 22 of the GDPR, and Data Protection Impact Assessment (DPIA)
Biometrics
Voluntary Participation and Alternatives: The user may opt out of biometric authentication; the operator provides manual verification by staff until 24 hours free of charge.
Automated Decision-Making in the Registration Process (Article 22): The algorithm verifies the document's security features, the MRZ zone, the validity of the visa, and the mathematical match of the face. In the event of a rejection, the user has the right to human intervention (human-in-the-loop), to express their opinion, and to have the case manually reviewed by a staff member within 24 hours.
DPIA: The controller has conducted an internal Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the GDPR.
Article V. – IoT Telematics and Driving Dynamics
All vehicles operator are tracked via GPS. The purpose is:
In addition to the lease, 24/7 location monitoring is in place to protect the property (not linked to a specific person).
During the lease term, the telematics system is used to track mileage, monitor fuel levels, detect unauthorized entry into restricted countries, and immobilize the vehicle in the event of unauthorized retention.
Overloads and impacts are used solely for assistance in the event of an accident and to verify gross violations of the General Terms and Conditions. The data is not used for covert driver profiling, dynamic pricing, or insurance scoring.
Article VI. – Beneficiaries and Cross-Border Transfers
Processors (Article 28 of the GDPR):
SIA ATOM Tech (Aldaru iela 10-4, LV-1050 Riga, Latvia) – the platform's cloud core (AWS EU data centers).
Sumsub Tech Limited (Cyprus / Lithuania / UK based on the UK Adequacy Decision) – identity verification.
Adyen N.V. (Amsterdam, Netherlands) – payment gateway and card tokenization.
OneSignal, Inc. (San Mateo, USA) – push notifications (transmission secured via EU-U.S. Data Privacy Framework and SCC).
Independent operators: Insurance companies contracted to cover a specific vehicle (PZP/KASKO) in the settlement of claims, legal representatives, the Slovak Police Force, and administrative authorities.
Article VII. – Retention Periods
We store your data:
Profile in the App: For the duration of the active account.
Scans of documents (ID card, driver's license): For the duration of the account plus 3 years (B2C) / 4 years (B2B) after its termination, to defend against legal claims (Section 101 of the Civil Code / Section 397 of the Commercial Code).
Accounting and tax documents:10 years in the years following the year of issuance.
Telematics Routes (GPS):90 calendar days from the termination of the lease; in the event of an accident or dispute, until the matter is legally resolved.
Photo Documentation: Check-out:12 months.
Direct marketing (soft opt-in): During the term of the contract + max. 1 year upon its completion (Section 116(3) of Act No. 452/2021 Coll.), or until an objection is filed.
Raw facial biometric data: Disposed of immediately after the completion of the comparative test.
Article VIII. – Rights of Data Subjects and the Supervisory Authority
As a data subject, you have the right to to the operator the following rights:
The user has the right of access, rectification, erasure, restriction, portability (automated data derived from a contract or consent), withdrawal of consent, and the right to object. If an objection is raised against direct marketing, the processing will terminate immediately.
Deleting an Account in the App: Profile → Account Settings → Delete Account.
Supervisory Authority:Office for Personal Data Protection of the Slovak Republic Galvani Business Center II, 7/B Galvaniho Street, 821 04 Bratislava Website: https://dataprotection.gov.sk | Email: statny.dozor@pdp.gov.sk.
Try WOOZ
Always have a car at hand, whenever you want it. No worries and no commitments.
Download, unlock and drive. Flexible, worry-free mobility now on your mobile.
With WOOZ, you always have a car when you need it. Easy, flexible and hassle-free.
