Privacy Notice — TaxiBuddy app

This notice explains which personal data we process when you use the TaxiBuddy mobile app as a driver or as an administrator of a taxi company — why we process it, who we share it with, how long we keep it and which rights you have.

This notice does not apply to:

• The use of the public website taxibuddy.be — see the Website Privacy Notice.
• Cookies and analytics on the website — see the Cookie Notice.
• Passengers of the taxi company — they receive their information through their taxi company.

Important difference from the website notice: for the vast majority of the data we process through the app, your taxi company is the controller and we are the processor. We process your data on behalf of your taxi company, under a data processing agreement (DPA).

We have not appointed a formal Data Protection Officer (DPO): our core activities involve neither large-scale, systematic monitoring of data subjects nor large-scale processing of special categories of personal data (Art. 37 GDPR). We will review this if the platform grows substantially.

When is TaxiBuddy itself the controller? For a few things that fall outside your taxi company's instructions: app performance monitoring, platform security, account management at Auth0 for sign-in, invoicing the subscription to your taxi company, handling your support requests, and — together with your taxi company — push notifications. For this limited set we are (joint) controller; see the table in section 4.

a. Account and profile data. At first sign-in and in your profile:

• First and last name
• E-mail address (= your sign-in)
• Phone number
• Language preference (NL/FR/EN/AR)
• Role in the taxi company (Administrator or Driver)
• Technical identity-provider identifier after signing in
• For drivers: the pass number that your taxi company's licence area requires. The app stores it in a single field and names it per area: driver pass number (Flanders), certificate of capacity number (Brussels and Wallonia) or driver number (other areas)

b. Location data (in the driver flows). When you start or end a shift or start or end a ride, the app requests your location once through the standard operating-system API. When you prepare a new ride, the app also takes one point reading to suggest the starting point — that point is only stored when you actually create the ride — and in the wizards for rides and shifts you can tap "Use current location" yourself. We take point readings only at the moment of such an action — there is no continuous background tracking. Between actions (ride in progress, shift ongoing) the app collects no location data. When you close the app or lock the phone, all location processing stops. If an administrator uses these driver functions themselves (for example a managing director who drives), these readings also apply to that administrator.

Location is not mandatory. If you do not give the app access to your location, if location is turned off on your device or if a reading fails, the app asks you to search for and choose the address yourself; at the end of a ride with a planned destination address it takes over that address. We then store the coordinates of that address as Google Maps Platform returns them, without a separate note that it is not a GPS reading. For a taxi company with a Flemish licence, those coordinates thus also go into the report to Chiron (see section 5).

For each point reading we store: latitude and longitude (lat/long, accurate to about 10 metres; for an address you chose yourself, the coordinates of that address), the time of the action (the moment you confirm, not that of the position fix, or an end time you choose yourself: "Earlier" at the end of a shift, your own end time after a ride of more than 70 hours) and the related type of action (start or end of a shift, start or end of a ride). For the start and end location of both rides and shifts the app also requests a geocoded address from Google Maps Platform, directly from your device. Except at the start of a ride, the reading and that address request already happen when the screen opens, even if you cancel afterwards (see section 5).

c. Ride and booking data (entered by Admins or, through the taxi company's booking page, by the passenger; viewable by Drivers): the passenger's name and phone number; for customers in the customer list (clients) also an email address (a mandatory field in the app) and optionally an address, company name and VAT number; number of travellers, planned start time, departure and destination address, agreed price, payment method, any tip the driver records after the ride, cancellation reason + who cancelled, free-text notes. This data is entered by an Admin (dispatcher / fleet manager), or by the passenger when they request a ride through the taxi company's booking page; such a request also contains their email address and language. The duty to inform the passenger lies with the taxi company — we provide a template for this. For a taxi company with a Walloon licence, the driver also records at the start of each ride the platform through which the ride came in (e.g. Uber, Bolt or Heetch), chosen from the taxi company's list or entered freely (free text, at most 50 characters). That field is mandatory there; for other areas it stays empty. If the driver rides under a contract of your taxi company (only with a Flemish licence), the app records that contract when the ride starts: its number and the contracting party. For such a contract ride and for every ride of a taxi company with a Walloon licence, the driver also records the dashboard odometer reading at pickup and at drop-off; in Wallonia, for a booking, also when setting off to the client. These readings give the distance travelled on those rides and, in Wallonia, appear on the feuille de route. When each ride starts, the Platform also records on that ride a copy of your first and last name and your pass number, the number plate and the vehicle number, your taxi company's details, the tariff and the agreed price; the ride ticket and, for a taxi company with a Flemish licence, the report to Chiron use that copy, even if those details change later.

d. Working-time / shift data. Per shift: driver ID, vehicle ID, start and end location (lat/long + address, see b), start and end time, odometer reading (start + end), status (ongoing / paused / ended), breaks with timestamps. If the app stopped during an open shift, for example because of a flat battery, it reports at the next start since when it was not running; we keep that with the shift. If a shift stays open, the Platform sends you a push reminder every six hours from twelve hours after the start to close it. If you do not close it, the Platform may end it automatically at the time of your last activity (by default after 48 hours, configurable per environment); the end location and end odometer reading then stay empty and the shift report states that the end was inferred. When a shift starts, the Platform also records on that shift your taxi company's licence area (which the applicant chooses at signup and TaxiBuddy can correct afterwards, e.g. Flanders, Brussels or Wallonia; among other things it determines whether rides are reported to Chiron), and the details as they appear on the documents of that shift: your first and last name, the number plate and the vehicle number, and the name, address, email address and phone number of your taxi company. This keeps those documents correct, even if those details change later. An administrator of your taxi company can retrieve your shifts per period, with start and end address, the number of rides, the distance and the total ride price (in the app under Manage → Shifts, with a filter per driver), and download their shift report.

e. Vehicle / licence data (viewable by Admins): number plate, VIN, the vehicle identification number that the licensing municipality assigns to the vehicle (not a licence number: the app does not store that), make + model, assignment to a driver account.

f. Audit / activity logs. For evidence and dispute handling we record who made which status change (e.g. onboarding, deactivation, company status). Per log line: actor account ID + role, status change (from → to), any comment, timestamp. When a TaxiBuddy staff member makes a change through our back office, for example to your account, we record that too: which staff member, what kind of change, the technical number of the changed record, the outcome and the time. The data entered itself is not in that log.

g. Technical data. The app automatically collects diagnostic telemetry: device and OS version (for compatibility debugging), app version, crash logs, performance traces and app navigation (which screens are opened). This telemetry is linked to your user ID and role, so that in case of a support question or an error we can investigate a specific user's problem (see section 5 — Microsoft Application Insights). We also use it to improve the app: for example, we see whether a guided tour or "What's new" was viewed or skipped, how a help article was rated ("Did this help?") and what the address and route requests to Google cost per taxi company. For this, Application Insights keeps a random session number on your device (ai_session, in the app's local storage; it remains after you sign out) and temporarily holds telemetry not yet sent in the app's session storage (see section 7). For push notifications the app also registers a push registration token for your device (see section 5 — Google Firebase). On our server that token is stored with your account ID, the platform of your device and the time it was last used. When you sign out, the app erases the token on your device and deregisters it with our server; there it is marked as deregistered, but not erased (there is no automatic clean-up yet). No advertising identifiers. We do not use IDFA (iOS) or the Android Advertising ID.

We also keep the push notifications the Platform sends you in the app's notification centre (Notifications): title, text, type of notification, time and whether you have read it, even if the notification did not reach your device. If you swipe a notification away, it disappears from your list; after 40 days the Platform erases it automatically. For every email the Platform sends you, we keep a message log: the type of message, the subject, the language, the time, the delivery status, your account ID and your email address in masked form (at most the first letter and the domain), without the content of the email. That log is not yet cleaned up automatically.

h. Support requests. If you report a problem or ask a question via Profile → Help, we keep: the topic chosen, the title, your description, up to three screenshots per message, the messages exchanged afterwards, the status and the timestamps, and who the request comes from (your account and your taxi company). The app automatically adds technical data: the app version, the platform (iOS or Android), the operating-system version, the device model (on iPhone or iPad only that, on Android the model code), the app language and, if you have a shift open at that moment, the technical number of that shift. No location and no IP address. If you add a screenshot, the app scales it down before sending and converts it to JPEG; the image metadata, such as where it was taken, is dropped in the process. Our staff can write an internal note on a request; you do not see it. An administrator of your taxi company does not see your requests.

We do not use your data for:

• Marketing by TaxiBuddy or third parties
• Profiling with legal effects
• Sale to third parties
• Automated decisions affecting your employment relationship

We pass your data on to carefully selected service providers that help us run the platform. We have a data processing agreement with each of them.

For a taxi company with a Flemish licence, we also transmit ride data to Chiron — the Flemish government system for ride registration of taxi services. Chiron is not a sub-processor: it is a separate controller (public authority) with its own legal regime. For a taxi company with a licence in another area, the Platform sends no ride data to a government system.

To convert coordinates into addresses and to autocomplete addresses, the app requests addresses from Google Maps Platform (Geocoding and Places; Google LLC, United States) directly from your device; Google also receives your device's IP address in the process. This already happens when a screen that records or suggests a location opens (starting or ending a shift, ending a ride, preparing a new ride), even if you cancel afterwards. For the route calculation, our server sends the departure and arrival points together to Google (Routes) for every ride of at least 50 metres (as the crow flies), sometimes with the departure time; if your taxi company has set a ride tariff, this also happens for the price estimate, before a ride even exists. Google processes those requests as a separate controller under its own controller terms, not as our sub-processor; we send no names, accounts or ride IDs with them, only the points, addresses or search text themselves. Because the app makes those requests directly from your device, Google can link them to each other through the IP address, and for the route calculation Google receives the departure and arrival points of a ride together. The transfer to the US takes place under the EU-US Data Privacy Framework and standard contractual clauses.

When you navigate to a destination from the app, the app opens your own navigation app (Google Maps, Waze or Apple Maps) with the destination address. That hand-over happens on your device, outside our systems, and falls under the privacy policy of the navigation app you choose. If the chosen navigation app is not installed on your device, the app opens the App Store on an iPhone, without the address. On Android the link with the destination address (maps.google.com or waze.com) then opens in the browser, or the Play Store if that does not work.

When it opens, the app also loads fonts (Manrope and IBM Plex Sans Arabic) directly from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), already on the sign-in screen, and it shows a default profile picture from ionicframework.com in the app header and on your profile. As with any web server, those services receive your IP address and the data the app's web view sends along (user agent: among other things the device type and operating-system version). We do not send them any data ourselves.

For the complete list of external parties TaxiBuddy uses: see our Sub-processor list.

We do not share your data with:

• Taxi companies other than your own
• Marketing or advertising networks
• Third parties for commercial purposes

We request no access to:

• File storage — PDFs (ride tickets, invoices, documents) are prepared in the app's protected cache and offered through your device's share sheet; you choose where to save them
• Camera and photo library — the app does not ask for this access. If you add a screenshot to a support request, you pick it yourself through your device's standard file picker, and the app only receives the images you select
• Microphone
• Contacts
• Calendar
• SMS
• Advertising identifiers (IDFA/AAID)

You can withdraw the location permission at any time through your operating system (iOS: Settings → TaxiBuddy → Location; Android: Settings → Apps → TaxiBuddy → Permissions). You can still start and end shifts and rides afterwards: the app then asks you to choose the address yourself each time (see §3b).

The app stores a limited set of data locally to enable offline use and fast sign-in. Apart from the PDFs and the queue, everything below is kept in the storage of the web view (WebView) the app runs in, not in a separate secure storage of the device:

• Session tokens of the identity provider (Auth0) in the app's local storage — to keep you signed in between sessions; they are removed when you sign out
• Language preference and your "Calculate fare automatically" setting
• Recent destinations — at most four pick-up or drop-off points you chose (with address), only on your device, to enter a next ride faster
• Your acknowledgement of this privacy notice (the version number you agreed to)
• Guided-tour status — which in-app guided tours you have already seen (per account), so they do not start again each time
• "What's new" status: which explanation of a new version you have already seen (per account), so it does not appear again
• Last chosen platform: for a taxi company with a Walloon licence, the app remembers per taxi company the platform of your previous ride, to suggest it for the next ride
• Telemetry: a random Application Insights session number (ai_session) and, until it has been sent, the telemetry not yet sent in the app's session storage
• Queue of registrations: registrations such as the start and stop of a shift, break or ride, with their time, location and odometer reading, until the server has received them; while a shift is open, also which shift it is and when the app last ran (section 3d). They are kept in a separate database of the app, outside the device's backups
• Copies of PDFs you open or share in the app (ride tickets, shift reports, invoices and other documents), in the app's protected cache. The app does not erase those copies itself; the operating system clears the cache when it sees fit, for example when space runs low

The app uses no tracking cookies and no analytics cookies. The diagnostic telemetry (section 3g) sets no cookies, but it does keep the session number and the telemetry not yet sent that are listed above.

When you sign out, the app erases the data of your account that it kept in memory, the session tokens and the recent destinations. The language preference, the fare setting, your acknowledgement of this notice, the guided-tour and "What's new" status, the last chosen platform and the telemetry session number stay on the device. They contain no account data, apart from the account ID to which the acknowledgement and the guided-tour and "What's new" status are linked, and the ID of the taxi company with the last chosen platform. The PDF copies in the cache also stay until the operating system clears them.

When you delete the app, the operating system erases the app's data on your device, including the cache; what you saved or shared yourself through the share sheet remains. On Android the app allows Android's standard backup, with the queue as the only exception: if you use that backup feature, app data, such as the storage above with the session tokens, can end up in a backup of your device and thus be kept even after the app has been deleted.

Below is a simplified table. The full internal retention policy can be consulted on reasonable request via privacy@taxibuddy.be.

For your account we use a soft delete: a deleted account can no longer be used, but it stays in our database as long as it has not been permanently deleted. There is no restore function; an erroneous deletion can only be corrected directly in the database. Permanent deletion or anonymisation takes place according to our internal retention policy; data that may not be deleted by law (e.g. ride records for the accounts) is then anonymised, not kept with your name. If you request the deletion of your account yourself (see section 11), we erase the identifying data of your account. Your name on your rides and shifts and your pass number on your rides remain until those rides and shifts are anonymised after seven years.

We take appropriate technical and organisational measures:

• Encryption in transit: all communication between the app and our servers over HTTPS (TLS 1.2 or higher)
• Encryption at rest: databases at Microsoft Azure use transparent data encryption (TDE)
• Token-based authentication: every signed-in request is verified
• Multi-tenant data isolation: a user of company A technically cannot see data of company B
• Restricted back-office access: only our authorised staff have access for support; every change they make there is logged
• PII filter on the server: in production the server removes email addresses and Belgian IBAN, VAT and phone numbers from its log lines and monitoring data before they are stored; error messages and their stack traces are not filtered. The app itself has no filter: when a request to the server fails, it sends, among other things, the full URL of that request to Application Insights, including any search terms (e.g. a name or address you searched for)
• Soft delete: a deleted account stays in the database until it is permanently deleted or stripped of its identifying data, so that an erroneous deletion can still be corrected (only directly in the database; there is no restore function)
• Backups: Azure SQL Point-in-Time Restore (35 days for production)

No system is completely watertight. Should a data breach ever occur involving your data, we inform your taxi company within 72 hours of our internal confirmation, so it can meet its own obligation to notify the Data Protection Authority (Art. 33 GDPR) and — in case of high risk — you. For the limited processing for which we are the controller ourselves (see §2), we notify the Data Protection Authority ourselves within 72 hours and inform you directly in case of high risk.

Under the GDPR you have the following rights over your personal data:

First route — through your taxi company (controller): for the vast majority of the data in the app, your taxi company is the responsible party. Contact your Admin or the manager of your taxi company. They can adjust, or arrange to adjust, much of the data directly in the app.

Second route — directly via TaxiBuddy: if your request concerns the TaxiBuddy platform processing (sign-in, security, monitoring, your support requests), or if your taxi company does not respond, you can contact us directly:

• E-mail: privacy@taxibuddy.be
• State: which right you want to exercise, which data it concerns, and how we can verify your identity (e.g. replying from the e-mail address you use in the app)

Having your account deleted from the app: under Profile → Personal Information → Delete account you request the deletion of your account yourself. Your account is then blocked straight away and you are signed out; you receive an acknowledgement by email and we receive a notification at privacy@taxibuddy.be. We then carry out the deletion itself manually, as described on the Delete account page.

We handle your request within one month of receipt. For complex requests we may extend this period by a maximum of two months — we will inform you of this within the first month. There is no charge, except for manifestly unfounded or excessive requests.

You have the right to lodge a complaint with the Belgian Data Protection Authority:

• Data Protection Authority (GBA/APD)
• Drukpersstraat 35, 1000 Brussels
• Tel: +32 2 274 48 00
• contact@apd-gba.be
• dataprotectionauthority.be

We recommend contacting your taxi company or us first (privacy@taxibuddy.be) so we can address any concerns directly, but you are of course not obliged to do so.

This privacy notice and all processing we describe in it are governed by Belgian law, supplemented by the directly applicable European General Data Protection Regulation (GDPR).

For disputes that cannot be resolved by mutual agreement or through the Data Protection Authority, the courts of the judicial district of Antwerp, Mechelen division have jurisdiction. This does not affect your right as a data subject to bring proceedings before the courts of the Member State where you habitually reside (Art. 79(2) GDPR).

When we change this privacy notice, we update the version number and the date at the top of this page. For significant changes (such as new processing purposes, new sub-processors or new permissions) we show the updated notice again in the app, asking you to take note of it.