AESA Taxi Privacy Policy

English translation for information. The Slovak version is legally binding.

Here we explain what personal data we process when you use the AESA Taxi and AESA Taxi Driver apps, the panel taxi.aesa.sk/admin and the website taxi.aesa.sk. We also explain why, for how long, to whom we give it and what rights you have. This meets our information duty under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)¹.

Summary at a glance

• The controller is AESA Group, SE.
• We use the passenger's location only when ordering and during the ride. We use the driver's location only when they are online – also in the background, never when they are offline.
• Driver and passenger see about each other only what is needed for the ride. The other party's phone number serves only to get in touch about that ride.
• We delete the detailed GPS trace of a ride after 90 days. We keep ride receipts for 10 years following the year of the ride, because the Accounting Act and the VAT Act require it.
• An algorithm alone never decides about a driver. Blocking an account and approving documents are always done by a person.
• We do not sell data and we do not target advertising based on your data. The website uses no analytics or advertising cookies.

1. Who processes your data

1.1 Controller: AESA Group, SE, Haanova 2601/46, 851 04 Bratislava, company/registration number 55361731 ("AESA", "we").

1.2 Data protection contact: taxi@aesa.sk (subject "Personal data protection"), or by post to the registered office address.

1.3 Data protection officer (DPO): We appoint a data protection officer under Article 37 GDPR as a precaution, because monitoring the location of drivers while they are online is part of our core activity. Contact for the data protection officer: taxi@aesa.sk, subject "Personal data protection".

1.4 Independent controllers. AESA and the carrier are not joint controllers. Each processes data for its own purposes:

1.5 Ride receipt on behalf of the carrier. AESA issues the ride receipt in the name and on behalf of the carrier, as its agent². In doing so AESA processes the data on the receipt for the carrier and in line with the carrier's duties; it keeps them separately to meet its own accounting and tax duties.

2. What data we process, why and on what basis

2.1 Passengers

2.2 Driver and carrier

What we never process about drivers⁸: emotional or mental state, private conversations (including conversations with other drivers and representatives), data for predicting the exercise of the right of association, special categories of data (for example health, trade union membership), biometrics for comparison with a database, and no data from the time when you are not online.

2.3 Users of the panel taxi.aesa.sk/admin (dispatchers and administrators of taxi companies)

E-mail, name, role, records of actions in the panel (audit). Basis: performance of a contract with the carrier and legitimate interest in safety. Retention: for the duration of access, records of actions 3 years.

2.4 Visitors to the website taxi.aesa.sk

• Technically necessary data (IP address, browser type, time of the request) are processed by the hosting provider (Google Firebase Hosting) to deliver the page and protect against attacks – legitimate interest, logs 30 days.
• The website uses no analytics, advertising or tracking cookies. It only stores your light or dark theme choice directly in your browser and sends it nowhere. Details are in the Cookie Policy.
• Ordering and carrier registration through the website are not yet available. If we launch them, section 2.1 or 2.2 respectively applies.
• An e-mail you send us from the website is processed as support (2.1).

2.5 Age of users

The service is intended for persons over 18 (Terms for Passengers, Art. 4.2). We do not rely on the consent of minors. Under Slovak law a child's consent to information society services would be valid only from the age of 16⁹, but our services require adulthood. If we find that an account was created by a person under 18, we cancel the account and delete the data, except data we must keep by law.

3. Location – in detail

3.1 Passenger. We use your location when you open the app to enter the pick-up point (if you allow it) and from ordering until the end of the ride. We do not use it in the background. The app also works without location permission – you enter the address manually.

3.2 Driver. We use your location only when you are online – also when the app is in the background, so that we can send you offers and the passenger can see where you are. When you switch to offline, the app does not send location. Frequency: during a ride approximately every 5 s, online without a ride every 30 s when moving.

3.3 Retention: the detailed trace of a ride 90 days (to resolve claims and safety events), afterwards only the route on the receipt remains. The driver's location outside a ride 30 days (to resolve complaints and fraud).

3.4 Who sees the location: the passenger sees their driver's location from assignment to the end of the ride. The driver sees the pick-up point and destination. The taxi company sees the location of its drivers while they are online. People with whom you share the ride see the ride through the link until its end.

4. What the driver and the passenger see about each other

You see the other party's phone number only for the given ride and may use it only to get in touch about that ride (for example when finding the pick-up point or about a forgotten item). Calls and text messages go directly between your devices; the platform does not process their content.

5. To whom we provide data

5.1 Processors (they process data only on our instructions, under a contract pursuant to Article 28 GDPR):

5.2 Independent controllers:

• carrier and driver – data needed for the ride (see 1.4);
• Stripe (Stripe Payments Europe, Limited, Ireland, within the group also Stripe, Inc., USA) – payment processing, identity verification of carriers (KYC), fraud prevention and fulfilment of the duties of a payment institution;
• Apple and Google – if you sign in through their account;
• public authorities – where the law requires: the transport administrative authority (data on brokered carriage within 30 days of a request)¹⁰, the tax administration (DAC7, tax inspection), the police, courts, the labour inspectorate;
• emergency service 112 – when SOS is used;
• lawyers, auditors, insurers – where necessary to establish or defend claims.

6. Transfers outside the EU/EEA

6.1 Some recipients (especially Google and Stripe) may also process data in the USA. We rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, otherwise on standard contractual clauses under Article 46(2)(c) GDPR together with supplementary measures.

6.2 We will provide you a copy of the safeguards on request at taxi@aesa.sk.

7. Automated decision-making and profiling

7.1 Assigning rides is automated: the system decides which driver to send an offer to (by arrival time, waiting since the last ride, popularity and vehicle features). This is necessary for the performance of a contract (Article 22(2)(a) GDPR). Declining an offer has no consequences. With each offer you see the reason. You can ask for an explanation, express your view and ask for a human review. Details are in the document "Information on Automated Systems".

7.2 Document checking with AI. An artificial intelligence system reads data from a document (type, name, number, registration plate, expiry date), compares it with the other documents and with the identity verified by Stripe, and suggests "OK" or "attention" with a reason. AI only suggests and never rejects. The decision to approve or reject is always made by a person, who sees the original document. It is therefore not a decision based solely on automated processing under Article 22 GDPR. At registration we will tell you that AI reads the documents¹¹. The AI suggestion and the person's decision are recorded; on request we will tell you what the AI suggested.

7.3 Suspension on document expiry. The system automatically stops sending offers when the expiry date of a document that a person verified passes. This is a statutory condition. You can ask for a human review. A restriction, suspension or cancellation of an account for other reasons is always decided by a person¹².

7.4 Fraud prevention may flag a suspicious payment or account. A person assesses the flag before any measure against you.

7.5 The price for the passenger is calculated from the carrier's price list by route and time. We do not use personal data for an individual price (no price by device, history or profile).

7.6 Impact assessment. For the automated systems concerning drivers we prepare a data protection impact assessment and provide it to the drivers' representatives¹³.

8. Your rights

You have the right:

• of access to the data and a copy of it (Art. 15);
• to rectification (Art. 16);
• to erasure (Art. 17) – unless restricted by a legal retention duty;
• to restriction of processing (Art. 18);
• to portability – the data in a machine-readable format (Art. 20); drivers also including ratings and other data under the Platform Work Act¹⁴;
• to object to processing based on legitimate interest (Art. 21) – including direct marketing at any time;
• to withdraw consent at any time, without affecting processing before the withdrawal;
• not to be subject to a decision based solely on automated processing and, in the case of an automated decision, to ask for human intervention, express your view and contest the decision (Art. 22(3));
• drivers additionally: to ask for an explanation of every decision of the system or of a person and for its review (reply within 2 weeks)⁷ – at taxi@aesa.sk with the subject "Review of a decision" or in the app with the "Request a review" button.

How: in the app (Account → Delete account), by e-mail to taxi@aesa.sk or by post. We will reply within 1 month, in complex cases at most 2 further months – we will inform you of an extension (Art. 12(3)). We may verify your identity (for example by an SMS code).

9. Cancelling an account

A passenger cancels the account in the app. A driver and a carrier do so in the app or through support. We delete photographs and copies of a driver's documents immediately. Within 30 days we delete or anonymise the other data we do not need. Data we must keep by law (ride receipts, accounting, DAC7) remains until the statutory period expires. We replace the passenger's name and phone number in the ride history with "Deleted user".

10. Security

We encrypt data in transit and at rest, only authorised persons have access according to role, every access to drivers' data in the panel is logged, the other party's phone number is available only to the participants of the given ride, and cards are processed only by Stripe (PCI DSS). A security incident that threatens you will be notified to you without undue delay (Art. 34 GDPR).

11. Complaint to a supervisory authority

If you think we are breaching the protection of your data, write to us. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR): Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Budova Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, statny.dozor@pdp.gov.sk, www.dataprotection.gov.sk.

12. Changes

We update this policy when the processing changes. We announce material changes in the app in advance. Previous versions are at taxi.aesa.sk/pravne.

---

Notes

1. Regulation (EU) 2016/679 of the European Parliament and of the Council; in Slovakia also Act No. 18/2018 Coll. on Personal Data Protection. ↩

2. Section 72(6) of Act No. 222/2004 Coll. on Value Added Tax (an invoice may be issued in the name and on behalf of the supplier by a third party). ↩

3. Section 35(3) of Act No. 431/2002 Coll. on Accounting and Section 76(1) of Act No. 222/2004 Coll. on Value Added Tax (10 years following the year to which they relate). ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

4. Limitation period of 3 years (Section 101 of the Civil Code); a right to damages becomes time-barred at the latest after 3 years (Section 106(2) of the Civil Code). ↩ ↩² ↩³ ↩⁴

5. Section 29(2)(a) and (b) of Act No. 56/2012 Coll. on Road Transport. ↩

6. Act No. 442/2012 Coll., Sections 22h et seq.; Section 22m(4) allows keeping the data for 5 to 10 years after the end of the reporting period – we choose 10 years so that the period matches the ride receipts. ↩

7. Section 10 of Act No. 262/2026 Coll. ↩ ↩²

8. Section 6 of Act No. 262/2026 Coll. on Work Through a Digital Labour Platform. ↩

9. Section 15(1) of Act No. 18/2018 Coll. on Personal Data Protection. ↩

10. Section 29(2)(d) of Act No. 56/2012 Coll. on Road Transport. ↩

11. Article 50(1) of Regulation (EU) 2024/1689 (AI Act). The system performs only a preparatory task for a person's decision (Article 6(3) of the AI Act); the assessment is documented. ↩

12. Section 9(5) of Act No. 262/2026 Coll. ↩

13. Section 7 of Act No. 262/2026 Coll. ↩

14. Section 8(9) to (11) of Act No. 262/2026 Coll. ↩