Privacy Policy FLINTAXI

The protection of personal data is a priority for FLINTAXI. FLINTAXI is aimed in particular at FLINTA* people and everyone who needs safe and reliable mobility. We therefore handle personal data, location data, ride data, payment information and support cases with particular care.

This privacy policy explains what data is processed when you use the FLINTAXI website, the FLINTAXI Rider App, the FLINTAXI Driver App and the FLINTAXI control centre.

---

1. Controller

The controller responsible for data processing is:

FLINTAXI e.U.
Mag. Sarbjit Dhillon, MEd
Saikogasse 6/20/17, 1220 Vienna
E-mail: office@flintaxi.at
Phone: +43 677 62 93 82 53

Should FLINTAXI be transferred to a successor company (e.g. GmbH or FlexCo) in the future, this privacy policy will be updated accordingly.

2. Scope of this Privacy Policy

This privacy policy applies to:

• the website flintaxi.at
• booking forms and contact forms
• the FLINTAXI Rider App
• the FLINTAXI Driver App
• the FLINTAXI control centre / admin interface
• support communication via email, phone, WhatsApp or other agreed channels

3. Data We Process

3.1 Passenger / Rider data

We may process the following data:

• First and last name
• Username / display name
• Email address
• Phone number
• Password and technical login data
• Pronouns
• Information about gender identity / FLINTA* affiliation / booking category
• Payment status and chosen payment method
• Booking data
• Pick-up address, destination, intermediate stops
• Date and time of the ride
• Estimated price and actual ride fare
• Ride history
• Ratings and feedback
• Support and complaint data
• Voluntarily provided additional information, e.g. pet, luggage, child seat, wheelchair note
• Technical device data, e.g. app version, operating system, device ID, log data
• Location data to the extent necessary for booking, driver assignment, ride processing or safety features
• Voluntarily entered home/work address for quick search

Special categories of personal data — such as information about gender identity, pronouns, FLINTA* affiliation or safety needs — are only processed where this is necessary for the use of certain FLINTAXI features or is provided voluntarily.

3.2 Driver data

For drivers, the following data may be processed:

• First/last name, display name
• Gender identity, pronouns
• Phone number, email address, login data
• Photo / profile picture
• Driver status, online/offline times, shift times
• Accepted and declined rides, ride history
• GPS/location data during active use of the Driver App
• Revenue overview, tips, ratings and feedback
• Document status, assignment to taxi company and vehicle
• Support and complaint data
• Technical device data and log data

3.3 Taxi company data

• Company name, address, contact persons
• Email address, phone number
• Company register number, VAT/tax number
• Bank details / payout information
• Driver assignments and vehicle data
• Invoice and billing data
• Revenue and commission overviews, document status

3.4 Vehicle data

The following vehicle data may be processed:

• Licence plate, make and model
• Vehicle category, number of seats
• Drive type, e.g. electric, hybrid, petrol/diesel
• Available equipment, e.g. child seat, foldable wheelchair, pet transport
• Assigned taxi company and drivers

4. Purposes of Processing

We process data for the following purposes:

• Registration and management of user accounts
• Phone number and email verification
• Processing and handling of taxi bookings
• Driver assignment and ride coordination
• Display of driver and vehicle information and ETA
• Payment processing and invoicing
• Management of tips and payouts
• Management of taxi companies, drivers and vehicles
• Support, assistance and complaint handling
• Rating of rides
• Security and fraud prevention
• Technical error analysis, operation, maintenance and improvement of the app
• Compliance with statutory retention and tax obligations
• Traceability of rides and support cases

5. Legal Bases for Processing

Depending on the purpose, processing is carried out on the following legal bases:

• Performance of a contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR
• Legal obligations pursuant to Art. 6(1)(c) GDPR
• Legitimate interests pursuant to Art. 6(1)(f) GDPR
• Consent pursuant to Art. 6(1)(a) GDPR, where required
• Explicit consent pursuant to Art. 9(2)(a) GDPR, where special categories of personal data are processed

Our legitimate interests lie in particular in the safe execution of rides, fraud prevention, technical stability, documentation of support cases and the protection of passengers, drivers and FLINTAXI.

6. Location Data

The FLINTAXI app may process location data to the extent necessary for use of the app.

For passengers, location data may be used to:

• determine the pick-up location
• enable the driver to navigate to the pick-up point
• display ride status
• provide safety or support features

For drivers, location data may be used to:

• assign available drivers
• accept and carry out rides
• calculate ETA and arrival status
• make ride status and ride history traceable
• process support cases

Location data is not processed on a permanent basis without a specific purpose. Continuous tracking outside active app use or outside active shifts is not intended.

7. Phone Number Verification by SMS

To ensure user security and prevent misuse, FLINTAXI may verify phone numbers via SMS code. SMS verification is used to confirm that the phone number provided is reachable and associated with the device being used.

WhatsApp, Signal or similar services may be used for communication or support but are not intended as a primary phone number verification method.

8. Payments, Invoices and Payouts

For digital payments, FLINTAXI may use payment service providers, in particular Stripe. Data that may be processed includes: payment status, transaction numbers, invoice data, payment method, ride fare, commissions, tips, payout information, refunds and cancellation fees.

FLINTAXI does not store complete credit card data. This is processed by the payment service provider. Privacy policy: stripe.com/privacy

Invoices to passengers may be issued in the name of the respective taxi company. FLINTAXI may additionally issue invoices and billing statements to taxi companies.

9. Ratings, Complaints and Support Cases

Passengers and drivers may submit ratings, feedback and complaints. Data that may be processed includes: star ratings, comments, complaint categories, messages, ride reference, persons involved, processing status, internal notes and outcome of processing.

Complaints may contain sensitive information. FLINTAXI processes this data solely for handling the case, for safety, for quality assurance and to fulfil legal obligations.

10. Emergency and Help Features

The app may include help or emergency features. In phase 1, no direct technical connection to police, emergency services or silent police alerts is planned. However, hints, contact options, support features or referrals to official emergency services or emergency apps may be provided.

When using such features, ride data, location data, contact data and messages may be processed to the extent necessary for assistance, safety or support.

11. Website Cookies and YouTube

When visiting the website, technically necessary data may be processed (IP address, time of access, browser information, device data, cookie information).

FLINTAXI uses the following categories of cookies and comparable storage technologies:

• Necessary cookies (always active): Login, session, security, CSRF protection, booking process and portal functionality. Legal basis: Art. 6(1)(f) GDPR / § 165(3) TKG (technically required).
• Google Maps: Address search with autocomplete, location query, route planning, map display and automatic price calculation. Legal basis: consent. Without consent, addresses can be entered manually; price calculation and map will not be available.
• Stripe: Loaded only at the payment step, not on page load. Legal basis: consent or performance of contract during the payment process. Without Stripe, cash payment or card payment in the vehicle remains possible.
• WebSMS (always active): For SMS verification and ride notifications, the phone number is transmitted to WebSMS (websms.at). This service is required for using FLINTAXI and therefore cannot be deactivated.
• YouTube: Intro video by YouTube (Google LLC). Legal basis: consent. Without consent, only a preview image with a note is displayed. Privacy policy: policies.google.com/privacy
• Analytics & Marketing: Not used. FLINTAXI does not use Google Analytics, Meta Pixel or retargeting.

The cookie consent is stored locally in your browser (localStorage) for 365 days. After this period, or when cookies are cleared, consent will be requested again.

Individual cookie settings can be adjusted at any time via the cookie banner.

12. WhatsApp Business and Other Communication Channels

When users make contact via WhatsApp, email, phone or other channels, FLINTAXI processes the data transmitted in order to handle the enquiry. This may include in particular: phone number, name, gender identity, pronouns, message content, pick-up and destination addresses, ride requests, date and time of the ride, location data (if actively sent) and support information.

When using WhatsApp, the privacy policy of WhatsApp/Meta also applies. FLINTAXI does not have full control over data processing by WhatsApp.

13. Recipients and Service Providers

Personal data may be transmitted to the following persons and services depending on the purpose:

• Staff and authorised persons at FLINTAXI
• Assigned drivers
• Taxi companies for whom a ride is carried out
• Technical staff (services / development / data processing)
• Hosting providers
• Payment service (e.g. Stripe)
• Map and routing service (e.g. Google Maps)
• SMS service (WebSMS)
• Email or push notification services
• Apple App Store and Google Play Store
• Tax advisors / accountants
• Legal advisors
• Authorities or courts, where required by law

Data processing agreements pursuant to Art. 28 GDPR are concluded with processors as required.

14. Retention Periods

Personal data is only stored for as long as necessary for the respective purposes or as required by statutory retention obligations.

• Account data: for as long as the account exists
• Ride data: for as long as required for billing, support, verification and legal obligations
• Invoice data: in accordance with statutory retention obligations (§ 132 BAO, 7 years)
• Support and complaint data: for as long as required for processing, documentation, security and legal interests
• Technical log data: only for a reasonable period for error analysis and security

15. Transfers to Third Countries

Where personal data is transferred to providers outside the EU or EEA, this is done only on the basis of appropriate safeguards, e.g. adequacy decision, Standard Contractual Clauses or other permissible mechanisms under the GDPR. This may be relevant in particular for global service providers such as app stores, payment services, map/routing services or communication services.

16. Data Security

FLINTAXI implements technical and organisational measures to protect personal data:

• Encrypted data transmission
• Access restrictions and role-based permission concepts
• Private, access-restricted repositories
• Backups and logging of security-relevant events
• Regular security updates
• Separation of test and production systems
• Careful selection of service providers

17a. Rights of Data Subjects

Data subjects have the following rights under the GDPR:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right to lodge a complaint with a data protection supervisory authority

The competent supervisory authority in Austria is the Austrian Data Protection Authority (dsb.gv.at).

17b. Erasure of Personal Data

Erasure requests can be submitted to office@flintaxi.at. In addition, certain personal data can be independently changed or deleted in the profile/dashboard. Erasure requests are generally processed within 30 days.

Statutory retention obligations (e.g. under tax and company law), the assertion, exercise or defence of legal claims and other legal obligations may preclude immediate erasure.

18. Children and Young People

Under certain conditions, FLINTAXI may also facilitate rides for children or young people. For users under 16 years of age, data of a person with parental responsibility may be processed to the extent necessary for registration, booking, communication or safety.

19. Changes to this Privacy Policy

FLINTAXI may update this privacy policy when services, features, legal requirements or technical processes change. The current version is always available on the website and in the app.

20. Contact

For privacy-related enquiries:

FLINTAXI e.U.
Mag. Sarbjit Dhillon, MEd
E-mail: office@flintaxi.at