Privacy policy

Who the controller is

The controller of your personal data is Daniel Grey, company number (IČO) 87262304, VAT number (DIČ) CZ8606141819, a self-employed natural person operating the mytripfleet.com platform under the MyTripFleet brand. For anything concerning personal data, write to [email protected] or use the form in the Contact section of this website.

The operator may in future be transformed into a limited company. Until then the operator and data controller is the natural person named above. You will be told if the controller changes.

We have not appointed a data protection officer, we are not a controller required to have one. We handle your requests directly.

MyTripFleet works with MYTRIPLINE s.r.o., company ID 07388489, registered at Roháčova 145/14, 130 00 Prague 3, operator of the mytripline.com platform. Transfer bookings reach us from them and some data goes back. The details are under Who we share data with. For data MYTRIPLINE processes on its own systems, MYTRIPLINE is the controller and its own policy applies.

Whose data we process

What we process depends on how you relate to us, so it is described separately below:

• Applicants: you have filled in the driver registration form.
• Drivers: you hold an account with us and drive for us as an independent contractor.
• Passengers: you are being carried under a booking passed to us by our partner.
• Website visitors: you write to us through the contact form, or simply read the site.

Applicants

From the registration form we process your name, e-mail address, telephone number, the year of your vehicle, any message you write and a record of your agreement to this policy.

The legal basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). If we do not approve the application, we delete the data once the selection is over.

Drivers: account, documents and pay

Account: name, e-mail address, telephone number, chosen language and password (stored only as an irreversible hash, we do not know your password and cannot recover it). The legal basis is performance of the cooperation contract.

Documents: in the client zone you upload the vehicle registration certificate, a photograph of the roadworthiness sticker, the green card, photographs of the vehicle, two identity documents (one of them a driving licence), a profile photograph and a criminal record extract. They serve to verify that you meet the conditions of cooperation and to comply with our legal obligations. Only authorised dispatch staff can see them.

The criminal record extract is data on convictions and offences within the meaning of Article 10 GDPR. We require it because we place passengers, often including children: in a driver's care, and we process it solely to verify good standing when cooperation begins. We keep it no longer than the cooperation lasts and share it with nobody outside the dispatch office.

Rides and pay: records of the rides you have driven, their statuses and times, your fee, our commission, bonuses, any contractual penalties and amounts paid out. The legal basis is performance of the contract and our accounting and tax obligations.

Vehicles: make, model, year, registration plate, colour and approval status of the vehicle you use for the work.

Driver location

If you switch location sharing on in the client zone, we process your device's geographic position, the accuracy of the reading and the time it was taken. The dispatch office sees it on a map and we pass it to our partner so that a booking in progress can be followed.

In a browser, location is only sent while the client zone is open on screen and you have sharing switched on. A web application cannot read your location in the background, once you close it or the screen goes dark, reporting stops.

If you use the MyTripFleet mobile application, it can report your location in the background as well, with the screen off or while you are in another app. It does so only while you have an accepted job, and only if you have granted that permission in your phone's system settings. On Android a permanent notification stays in the status bar for as long as it runs, so the phone always shows you that tracking is on.

You can switch sharing off in the application at any time and withdraw the permission in your phone's settings at any time. Without a location, though, the dispatch office may not be able to assign a job to you or to accept one as completed.

The legal basis is our and our partner's legitimate interest in coordinating transfers under way and in passenger safety. We keep only the latest known position, not a history of your journeys.

No-show evidence and contact with the customer

If a passenger does not arrive at the pickup point, the driver evidences the wasted wait with photographs of the place carrying coordinates on arrival and on leaving, and with screenshots of the call history and messages by which they tried to reach the passenger. That evidence contains the passenger's phone number and the content of the exchange with them.

We process it so that a wasted journey can be evidenced to the partner and paid to the driver, and to defend a disputed settlement. The legal basis is our legitimate interest and the partner's in evidencing how a booking went.

On airport jobs a driver may contact the passenger 24 hours before landing (WhatsApp, SMS or a call) as far as arranging the pickup requires. A driver may use passenger data solely to perform the ride and must not pass it to anyone else.

Passengers

For a booked transfer we process the passenger's name, telephone number, pick-up and destination address, time, the number of passengers and items of luggage, the flight or train number and any notes on the booking.

We do not obtain this data from passengers directly, the partner who took the booking passes it to us so that we can carry it out. We make it available only to the driver holding the ride and to the dispatch office. The legal basis is our legitimate interest in performing the booked transfer and in the contract between the passenger and the partner.

If you are a passenger and wish to exercise your rights, please contact both us and the partner you booked the transfer with, your data originated there.

Website visitors

Contact form: name, e-mail address and the content of your message, in order to answer your enquiry, on the basis of our legitimate interest in replying to those who write to us.

The form is protected against automated abuse by Cloudflare Turnstile, which evaluates technical signals from the browser. It uses no tracking cookies and does not profile you across websites.

Operational and security records: IP address and technical details of the request, needed to run the service and protect it from abuse, on the basis of our legitimate interest.

Cookies

We use strictly necessary cookies only: one keeps you signed in to the client zone or the dispatch office, another protects the forms from abuse. The service would not work without them, so we do not need consent for them.

We measure visits to the website with Cloudflare Web Analytics. It uses no cookies, stores nothing in your browser and builds no profile of you: it counts the pages viewed, where a visit came from, the kind of device and how fast the page loaded.

We use no analytics and no advertising cookies, we do not track you across other websites, and we pass nobody your data for their own marketing. That is why we neither ask you to consent to any of it nor show you a cookie banner.

Your language and appearance preferences are stored by your browser on your own device and are never sent to our server.

Records of activity in the system

We keep an operational record of significant actions in the system, who confirmed a ride status and when, who changed data, approved a document or signed in. It exists to show what happened to a booking, to settle disputes and complaints and to keep accounts secure. The legal basis is our legitimate interest.

How long these records are kept is configured in the administration, and older entries are deleted automatically.

Credentials for the partner's platform

If you link your own Mytripline account in your profile, we store the e-mail address and password for that account in encrypted form. We need them so that rides you have driven, which are visible only under your own account, can be closed with the partner.

Neither the dispatch office nor we can read them, only a masked address is ever shown on screen. They are used solely for queries and writes towards the partner's platform, and you can unlink at any time, which deletes them.

The legal basis is performance of the cooperation contract. Linking is voluntary, but without it some of the rides you have driven cannot be closed and settled.

Who we share data with

We do not sell data and pass it to nobody for their own marketing. We share it only with those without whom the service cannot run:

• MYTRIPLINE s.r.o.: booking status, the identity of the driver and vehicle and, where applicable, position, so the booking can be tracked on their side.
• Resend (Resend, Inc.), delivery of the e-mails we send you.
• Google Ireland Limited: Google Maps services turning addresses into coordinates and calculating routes. The ride's address is sent, not the passenger's name.
• OpenStreetMap Foundation and the OSRM project, the same purpose, when no Google Maps key is configured.
• RapidAPI: checking arrival times by flight number. Only the flight number and date are sent.
• Cloudflare, Inc., running the website, abuse protection, Turnstile and cookieless visit measurement.
• OVH SAS: the server the platform runs on, in a data centre in Frankfurt, Germany.
• Public authorities: where the law requires it of us.

Where data is stored

The database and uploaded documents are held on our own server in the European Union (Frankfurt, Germany). We do not place driver documents with any third-party cloud storage service.

Some of the recipients above are established outside the European Economic Area or may process data there. Where that happens, the transfer is covered by the European Commission's standard contractual clauses or by an adequacy decision.

How long we keep data

Once those periods are up we delete the data, or anonymise it so that it can no longer identify anyone.

• Applications we do not approve, deleted once the selection is over.
• A driver's account and documents, for the duration of the cooperation and three years after it ends.
• The criminal-record extract, for the duration of the cooperation only. Deleted when it ends.
• Ride data, the record of how a job went and no-show evidence, three years from the end of the job, and longer only where a live legal dispute requires it.
• Documents of accounting or tax significance, ten years, as the law requires.
• A driver's last known position, the current value only, overwritten by the next one.
• Operational records of activity in the system, for the period configured in the administration.

How we protect data

All communication with the platform is encrypted. Passwords are stored only as an irreversible hash. Credentials for the partner's platform and other sensitive keys are stored encrypted.

Only authorised dispatch staff can reach documents and passenger data, and access is recorded. A driver sees a passenger's details only for a ride assigned to them.

Your rights

In relation to your personal data you have the right of access, to rectification, to erasure, to restriction of processing, to portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You can delete your account yourself at any time, in your profile under Delete account. We delete your documents, your criminal record extract, your photos, your phone number, your location, your signed-in devices and your Mytripline link. If you drove for us, your name stays on the ride and payment records for as long as accounting and tax law requires us to keep them. Nobody but you can delete an account this way.

You can correct much of the data yourself in your profile. For anything else, write to us through the form in the Contact section. We will answer without undue delay and within one month at the latest.

If you believe our processing breaks the law, you may lodge a complaint with the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz. We would appreciate the chance to put it right first.

No automated decision-making or profiling with legal effects for you takes place.

Changes to this policy

We may revise this policy if the way we process data changes, or if the law does. The current version is always available at this address. Drivers will be told of a substantial change by e-mail or a notice in the client zone.