Privacy notices for passengers in accordance with the EU’s General Data Protection
Regulation (‘GDPR’)
Information as of 27-03-2024
This Privacy Notice for Moby Taxi describes how and why we might access, collect,
store, use, and/or share your personal information when you use our services.
Reading this Privacy Notice will help you understand your privacy rights and choices.
We are responsible for making decisions about how your personal information is
processed. If you do not agree with our policies and practices, please do not use our
services.
1.Information on the data controller
Data controller under Article 4(7) GDPR for drivers in the territory of EU:
Mobility Partners OOD (Moby Taxi)
ul. Akad. Stefan Mladenov, bl. 80, et. 7, ap.48
Sofia, 1000
Email address: privacy@mobytaxi.bg
2.Processing purposes and data categories
We aim to inform you about the various types of personal data we process and the
purposes for which we do this below.
2.1 Ride-hailing
The Moby Taxi App enables you to hail a ride in a taxi with a taxi driver (‘driver’)
through us. You must provide personal data to use our Moby Taxi App for ride-
hailing, which we process to provide the given service. Additional voluntary
information that may also be provided is marked accordingly (optional).
In the context of the hailing service, the following personal data will be processed in
accordance with Article 6(1.)(b) GDPR for the performance of the contract:
• Your GPS location data at the time of booking, the start and destination
coordinates of your ride, unique identifier of your device (Advertising
Identifier on iOS, Android ID on Android)
• Name, email address and mobile phone number, password you have
chosen (in encrypted form) (optional).
You either enter the personal data (e.g. your name) at the time of registration or we
receive it directly from your device (e.g. GPS location data). You approve the
transmission of your GPS location data via your device’s (smartphone, tablet,
coordinates of your location so that the taxi you have ordered can find and collect
you.
We will forward your GPS location data and your first name to the driver who has
accepted the ride you have booked so that he is able to pick you up.
It will not be possible for you to hail taxis through us if we do not process the
personal data shown above. This does not apply to optional information.
2.2 Payment
You can pay for taxi rides hailed through us in cash or by credit/debit card via the
app. The card payment functionality enables you to pay without cash using the Moby
Taxi App. We will then debit the amount via your specified means of payment. If you
register, your payment card in the app, it will be transmitted directly to the payment
service provider engaged by us via an encrypted connection. Our payment service
provider then authenticates your means of payment by charging BGN 0.20 on your
account and then refunds the amount. This ensures your means of payment is
active. Our payment service provider is Stripe. Only the first digit of your credit card
number is transmitted to us for security reasons and we store it for the purposes of
inferring your card type (VISA, MasterCard, etc.).
In the context of payment, the following personal data will be processed in
accordance with Article 6(1.)(b) GDPR for the performance of the contract:
• Payment card number, name of card holder, card expiry date, CVV number.
We cannot offer you card payments for your trips if we do not process these
personal data. You can still pay in cash, however.
2.3 Fraud prevention and non-payment
Since Moby Taxi bears the risk of non-payment in the event that payments made by
credit or debit card are not honoured, an assessment of the risk of non-payment is
made on the basis of a statistical procedure (scoring) after your registration in the
app, each time a new means of payment chosen by you is entered, and each time a
ride is booked, so as to protect Moby Taxi’s legitimate interests in accordance with
Article 6 (1.) (f) and 22(2.)(b) GDPR.
The following personal data are processed to determine the value:
• First and last name (if provided), start and destination coordinates of your
ride, mobile phone number, email address, payment card’s expiry date,
information about your device (device ID), and the Moby Taxi App version.
To protect you against overpaying for taxi rides, the driver’s mobile phone transmits
GPS location data to us at short intervals during a taxi ride, enabling us to map the
entire journey. We do this because we want to ensure the driver does not extend the
route intentionally to earn higher remuneration.
If you believe you have paid too much, you may ask us about the route covered after
a ride. The processing of your GPS location data takes place for your and our
protection against fraudulent drivers and/or passengers on the basis of Article 6(1.)(f)
GDPR to protect your and our interests (e.g. protection against overpayments).
2.4 Bug fixing, customer services and improvement of functionality
To make it possible to eliminate malfunctions in our App, to answer specific
customer inquiries about functionality or the hailing services and to adapt the Moby
Taxi App to the needs of passengers, the following personal data is processed for
the performance of the contract in accordance with Article 6(1.)(b) GDPR:
• First and last name (if provided), email address (if provided), mobile phone
number (if provided), your GPS location data at the time of booking, start
and destination coordinates of your ride, and information about your device
(device ID).
If sufficient for the purpose, we work with data rendered anonymous or aggregated
data rather than personal data.
2.5 a) News and personalised offers
You will receive offers and advertising from us if you have agreed to receive news
and personalised offers (advertising, vouchers and promotions) and to the display of
usage-based advertising (‘retargeting’) during the registration process or
subsequently in the menu of the Moby Taxi App and have operated the toggle
accordingly. This concerns non-personalised (sent to all customers) and
personalised (sent only to you and based on an analysis of the Moby Taxi App
usage frequency) newsletters sent electronically (email, in-app messages, push
messages) to your device. To send you personalised advertising, we will process
your usage data. Usage data are information about the number of app installations,
registrations and taxi rides. Based on this data, you will then receive special offers
and advertising from us.
In this context, we will process the following personal data in accordance with Article
6(1.)(a) GDPR:
• First and last name, passenger ID, email address, registration date, Moby
Taxi App version, your GPS location data at the time of booking and at the
end of the taxi ride, device ID, IDFA (Ad-ID, Apple, identifier for advertisers),
GAID (Google advertising identifier), and usage data (usage frequency,
information about the number of app installations, registrations and taxi
rides), language, and city.
You confirm that you are 16 years old or older when you give your consent.
If you do not wish to receive the news and personalised offers already discussed,
you can – just as easily as when you agreed to it – withdraw your consent by
operating the toggle discussed above accordingly. Of course, you can also contact
us by sending an email to privacy@mobytaxi.bg.
Please note that the withdrawal and ensuing changes are valid only for the future
and will be effective or implemented by no later than 30 days from withdrawal.
2.5 b) Facebook Custom Audiences
In order to be able to display individually targeted advertisements about our services
within the Facebook social network, a service of Facebook Ireland Limited, 4 Grand
Canal Square, Dublin 2, Ireland, and on Facebook partner sites, we work with
Facebook Custom Audiences. We do this so that advertisements (e.g. banners) can
be tailored exactly to the possible needs of the customer. The basis of this is a
marking process, wherein the Ad-ID (IDFA or GAID) from the customer’s end device
(e.g. smartphone) is sent automatically or manually to Facebook via a certain
interface with the involvement of a service provider selected by Moby Taxi. Moby
Taxi then creates a list of customers who have carried out certain actions with the
Moby Taxi App. Only certain pre-defined actions can be selected (e.g. installation of
the Moby Taxi App in the last 30 days). Finally, Facebook compares the customers’
Ad-ID with the Ad-ID of people with a Facebook profile, defines certain groups (e.g.
group 1: installation in the last 30 days) and displays corresponding advertisements
to these groups. Customers who are not also users of Facebook cannot be
compared by Facebook and advertising is not displayed to them.
You confirm that you are 16 years old or older when you give your consent.
If you do not wish to receive advertising in the context of Facebook Custom
Audiences, you can – just as easily as when you agreed to it – withdraw your
consent by operating the toggle discussed above accordingly. Of course, you can
also contact us by sending an email to privacy@mobytaxi.bg.
Please note that the withdrawal and ensuing changes are valid only for the future
and will be effective or implemented by no later than 30 days from withdrawal.
2.5 c) Newsletter
If you provide us with your email by either a) creating an account via the Moby Taxi
App and choosing to be notified about useful promotions and discounts or by b)
subscribing for our newsletter on our website (https://taxime.to), we will email you
our newsletter containing useful information like discounts and promotions. In this
context we process pursuant to Art. 6 (1) f) GDPR the following personal data: e-
mail. You may revoke to direct marketing by clicking on a link at the end of an email
(e.g. Opt out from newsletter) with effect for the future. Please note that the
withdrawal and ensuing changes are valid only for the future and will be effective or
implemented by no later than 30 days from withdrawal. This is for reasons of a
technical nature, which do not permit faster implementation.
2.6 Google Maps
The Moby Taxi App makes use of the Google Maps API. This enables us to display
maps in your Moby Taxi App and you to use those maps. Our Moby Taxi App cannot
function without the Google Maps API. You can view Google’s terms of use at
https://policies.google.com/terms?hl=en. Additional terms of use for Google Maps
are available at https://www.google.com/help/terms_maps.html. Google’s privacy
policy is available at https://policies.google.com/privacy?hl=en. After you have given
your approval via your operating system, we use Google Maps to calculate the
estimated fare for your ride and show you the distance of the taxi you have booked
interactively. This involves us processing your GPS location data in accordance with
Article 6(1.) (b) GDPR. We render your GPS location data anonymous before
forwarding it to Google. Identification of you personally is ruled out.
2.7 Rating drivers
You can rate drivers via the Moby Taxi App. When you submit a rating, it is assigned
to a specific ride and considered in the average rating of the driver and vehicle in
question. It does not involve transmitting personal data to the driver.
3.Provider of processing services and processing in
countries outside the European Economic Area
In some cases, we arrange for external service providers to process your data (e.g.
troubleshooting, creation of mailings). This makes it necessary for us to transmit your
personal data to our external service providers for a specified purpose (confined to
the purpose in question). We have selected our service providers carefully. We have
obtained information about their technical and organisational measures for the
secure processing of personal data. We also require that our service providers
comply with the applicable data protection regulations. We work with service
providers from the EU and other EEA countries.
We store all our data with a cloud service provider within the EU or in IT
infrastructures and systems (employee computers) at our sites within the EU.
We work with IT service providers that facilitate the ride-hailing services in
accordance with point 2.1, as well as the fault elimination, customer services and
improvement of functionality in accordance with point 2.3. We also work with
payment service providers that facilitate payment processing in accordance with
point 2.2. If you have agreed to receive news and personalised offers (point 2.5),
then we work with marketing agencies and service providers. Please do not hesitate
to contact us at privacy@mobytaxi.bg if you would like to know more about the
service providers we engage.
We do not sell personal data to third parties.
However, we do reserve the right to disclose information about you if we are legally
obliged to or if we are required to surrender it by administrative or law enforcement
bodies (e.g. police or public prosecutors).
4.Your rights
You have the right to request information from us at any time about your personal
data we have stored and the origin, recipients or categories of recipients to whom
these data are forwarded or otherwise disclosed, the purpose of the storage and
processing, the planned storage period, our automated decision-making procedure,
the right to data portability, the existence of a right to rectification, erasure, restriction
of or objection to processing, and any existing right to lodge a complaint with a
supervisory authority.
You also have the right to rectification of incorrect data and, in cases where the legal
requirements are met, to blocking and erasure, as well as to restrict the processing
of data.
You may also send requests for information, withdrawals of consent, objections and
other concerns regarding data processing by email to privacy@mobytaxi.bg or to the
address stated in the introduction.
5.Data security
We have taken appropriate technical and organisational measures to guarantee data
security, in particular to protect your personal data against access by third parties, as
well as accidental or intentional modification, loss or destruction.
Such measures are reviewed periodically and adapted in line with the state of the
art. The transfer of your personal data from your terminal equipment (e.g.
smartphone) to us is always encrypted.
6.Storage period
In principle, we process and store your data for the duration of our contractual
relationship. In addition, we are subject to various retention and documentation
requirements. The required periods, e.g. from tax law, can be up to 10 years.
Moreover, special statutory provisions can make a longer retention period
necessary, e.g. evidence in the context of statutory periods of limitation.
If data is no longer required for compliance with contractual or statutory
requirements, it is regularly deleted, unless limited further processing is necessary
for the purposes listed above.
7. Obtaining access to, removing, or changing information you
provide
Users may review, update, or correct their Personal Information (PI) via a written
request to the dedicated email address privacy@mobytaxi.bg.
Users may, to the extent permitted by law, request the deletion of their PI, unless we
are required to retain such information by law. This can be done if User would like to
access the PI we have collected online from him/her, correct errors in such PI,
request to have the PI deleted or no longer collected or maintained. We reserve the
right to verify the identity of any person making an opt-out or correct/update request,
but shall have no liability whatsoever resulting from false or erroneous requests.
We may in Our discretion delete any information provided by a User or related to a
User, pursuant to Our policies as then in effect, to the extent permitted by applicable
law.
For identity verification:
Where identity verification is enabled, the app may process biometric data (facial imagery) to verify your identity and prevent misuse. The app may use depth data for liveness detection. This depth data is processed locally on your device and is not stored or transmitted. The app may ask you to take a selfie, which may be securely transmitted to our trusted Service Providers solely for verification purposes and is deleted after verification is completed. Biometric data is used only for identity verification and liveness detection, and not for advertising, marketing, or profiling.
