Platform Privacy Policy

Introdution

Thank you for your interest in MyTaxiCRM Service! We are committed to protecting your privacy. In order to ensure you are properly informed of what information we collect about you and how we handle it further, we at MYTAXICRM - FZCO (“we”, “us”, “our”, “MyTaxiCRM”, “Company”) created this Privacy Policy (“Policy”). This Policy covers privacy-related concerns regarding your access and use of our services through the MyTaxiCRM web application (“Service”).

Please note that when you access and use our Website at mytaxicrm.com and its subdomains (“Website”) to get more information on the Service, book a demo or access other Website content, you can learn what data we collect and process in a separate Privacy Policy. Be aware that this Policy does NOT cover processing operations related to our Website.

In this Policy, we would like to inform you how we handle your personal data. Please keep reading to learn more about:

1. types of personal data we collect;
2. purposes for collecting your personal data;
3. how we use and store your personal data;
4. your rights regarding your personal data;
5. how we share and disclose your personal data;
6. measures we take to safeguard your personal data, etc.

Please note that this Policy does not extend to any information you might directly provide to third parties, including via integrated services.

Please read this Policy thoroughly before using our Service. If you disagree with any of the terms outlined below, please do not register an account. Should you require clarification on any part of this Policy, please reach out to us using the contact options provided

Defenitions

The terms used hereunder have the following definitions:

• “GDPR” means the European Union's General Data Protection Regulation;
• “PDPL” means the UAE's Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data;
• “personal data” means any information relating to you and helping identify you (directly or indirectly), such as a name, email, address, etc.;
• “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• “controller” means a natural or legal person who (either alone or jointly with others) determines the purposes and means of the processing of personal data
• “processor” means a natural or legal person who processes personal data on behalf of the controller;
• “data subject” means an identified or identifiable natural person whose personal data we collect.

Our identity and contact details

When processing your personal data as outlined in this Privacy Policy, we act as a controller and data processor under the GDPR and PDPL.

Data collection

Your Roles

Depending on your interaction with MyTaxiCRM, you can be a Customer, Potential Customer or Driver:

• You are a Customer when you create an account in our Service, subscribe to use the Service, request сustomer support, contact us via available options, or otherwise provide your personal data when you use our Service. The Customer's representative (e.g., a team member managing an account) is considered “Customer” for the purposes of this Policy
• You are a Potential Customer when you express interest in our Service, in particular, such as when you request a demo, fill out a contact form to get the Service details, etc., or if we reasonably believe that our Service may be of interest to you.
• You are a Driver if, on the Customer's behalf and following the Customer's request, we provided you as a Customer's employee or contractor with access to your personal data on the Service received from the Customer. A Driver's account may be created in the database of the respective fleet, where Drivers can view information about themselves. In such cases, Customers remain the data controllers of Drivers’ accounts.

When We Collect Your Data

As a data controller, we collect your personal data when you:

• use our Service;
• contact us via contact forms available, via email or messaging applications;
• contact us via other available means of communication, e.g., by phone;
• create an account;
• subscribe to the Service;
• choose to integrate a third-party service with MyTaxiCRM account;
• voluntarily provide your data, including any other instances on the Service where you knowingly choose to share your personal data.

We act as a data controller when processing your personal data as outlined below. We also receive different kinds of third-party data that you as the Customer upload when using our Services, and we act as data processors in relation to this information. Please note that the Company processes this data only under the instructions and on behalf of the Customer, who acts as a data controller, and in accordance with the Data Processing Agreement signed with the Customer. You can learn more about our data processing as a data processor in the “Information We Process on Behalf of the Сustomer” section of this Privacy Policy.

Information We Collect and Process

MyTaxiCRM collects and processes data when

• you directly provide us with it,
• data is automatically collected from you, and
• we receive data from other sources as described below.

We also store the information provided by Сustomers when they use our Service and process it on their behalf.

When processing your personal data, MyTaxiCRM relies on the following legal bases:

• necessity for the performance of a contract;
• legitimate interest;
• your consent to specific processing operation;
• a need to fulfil our legal obligation.

For more information, please refer to the “LEGAL BASES FOR PROCESSING” section below.

Information Provided Directly by You

Contact Information. When you, as a Customer or Potential Customer contact MyTaxiCRM via available contact options, in particular via contact forms, email, phone, or other available means of communication we collect personal data you submit.

This may include your first and last name, company title, email address, phone number, country, information on your business model (e.g. number of vehicles in your fleet) and other details you may provide (e.g., in the message field).

Registration Information. When the Customer creates an account on our Service, we collect the following information: first and last name, phone number, company name, auto vehicle fleet main details (e.g. its size, the business model, country of services provision, etc.).

This information is also collected through the “Book Demo” form on our Website.

Team Members Information. The Client may add team member(s) to their MyTaxiCRM account. In this scenario, we collect the personal data of your team members (name and email) to include them in the workspace so you can allocate access levels for your team and send them Service-related notifications and reminders.

Integrations API Information. The Customer may integrate their MyTaxiCRM account with third-party services and platforms (“Integrated Services”), such as different taxi service providers, social media platforms, messaging platforms, telephony tools, payment service providers, сustomer support platforms, and other third parties. In this case, the Customer provides relevant API tokens and API keys that are necessary to enable such integration(s) to function by giving MyTaxiCRM access to a third-party service API

Please note that when the Customer collects information, including personal data of third parties, from Integrated Services and uploads it to MyTaxiCRM system, the Customer acts as a data controller. MyTaxiCRM will process such data according to the instructions and on behalf of the Customer.

Contract Information. When we conclude a service contract, we need your information to verify the counterparty. This includes the representative's first and last name, position, email address, phone number, company details, bank details, details for invoicing, and the document authorising the representative to represent the company.

Transactions and Payment Information. When you subscribe to our services by paying the invoice or using other payment options available, you'll be asked to provide payment details that may include personal information. We collect your first name, last name, email address, company name and transaction status to confirm receipt of payment.

Information for Other Services Provision. MyTaxiCRM may offer additional (on-request) services to our Customers. For example, we may provide consultation services, and in order to do so, we collect and process information that the Customer provides on the specific topic of consultation.

Also, we may create new or additional functionality or amend the Service to meet specific needs (if possible) at the Customer's request, for which the Customer may provide us with additional data.

Information We Automatically Collect

Cookies Information. We use cookies and other tracking technologies, e.g., pixels and web beacons when providing you with our Service to ensure its correct and smooth functioning, prevent fraud, identify your device, conduct analytics and marketing activities, remember your preferences, and for other related purposes.

Cookies Information includes, in particular, information on how you interact with our Service, e.g., pages you have visited, dates and times of the visit, and other information on your interaction with the Service for analytics purposes. We also use necessary, performance, and marketing cookies.

To learn more about our use of cookies and other tracking technologies, please read our Cookies Policy.

Automatically Collected Information. When you sign up with MytaxiCRM and use the Service we automatically collect and process certain information about you and your device, e.g., through server logs or other similar technologies. This information may include IP address, browser and device information, internet service provider (ISP), geographical location, system model, operating system, clickstream data, other technical information and information about your activity on the Service (length of visit, page response time, as well as information about the timing, frequency, and pattern of your service use, etc.).

We use this data to enable the smooth operation of the Service and enhancements of the system.

Information We Collect From Other Sources

In some cases, we may collect information, including personal data, from sources other than you, such as public sources.

Publicly Available Information. We may collect publicly available information about Potential Customers if we believe that MyTaxiCRM's services may be of potential interest to them (e.g. when they contact us for more information about the Service). Publicly Available Information may include contact data such as first and last name, email address, phone number, company name and other company information, website, links to social media, messaging platforms, and other relevant public information.

Information We Process on Behalf of the Customer

The Customer may upload or otherwise transfer and store personal data of third parties in the Service (“Сustomer Data”). MyTaxiCRM will act under instructions of the Customer to host and process third-party personal data on the Customer's behalf. For the avoidance of doubt, the Customer acts as a data controller, and MyTaxiCRM acts as a data processor in accordance with the Data Processing Agreement in this case. Each Customer as a data controller is solely responsible for providing notice to its data subjects and other third parties concerning the purpose for which their personal data is collected and processed through the Service and other information required by applicable law.

Сustomer Data that MyTaxiCRM processes on behalf of the Customer includes personal data about Drivers, other Customer's employees, contractors, team members, partners, and other third parties. Сustomer Data may include:

Personal data collected by Customers and inserted in the Service manually. This may include the following types of Customer Data:

• first, last names and age of third party data subjects;
• email addresses;
• phone numbers;
• CV;
• copies of identity documents;
• financial and bank information;
• other relevant data.

Personal data collected by Customers from Integrated Services or other third parties and uploaded by using API, manually or in other ways available to the Customer. This may include the following types of Customer Data:

• first, last names and age of data subjects;
• email addresses;
• phone numbers;
• CV;
• copies of identity documents;
• financial and bank information;
• GPS tracking data;
• schedule information;
• communication data (social media, messaging platforms, telephony data);
• other relevant data.

In any case, MyTaxiCRM is not responsible for any data Customers may upload into and store in the Service, and for how Customers collect, use and share such data.

MyTaxiCRM does not directly access Customer Data except as authorised or specifically requested by the Customer, e.g. for troubleshooting or to provide customer support. The Customer is solely responsible for collecting, handling, and sharing personal data they provide to MyTaxiCRM.

When we act as a data controller we:

• DO NOT collect or process your sensitive data. Please, refrain from sharing your or third-party sensitive personal data. The Customer may choose to collect sensitive data about its job applicants, employees, contractors, or other third parties, in which case we process such data solely as a data processor and under the instructions of the Customer who is responsible for collecting such data in compliance with the applicable law.
• DO NOT use automated decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects a data subject.

Legal bases for processing

We process your personal data in accordance with the GDPR and other applicable data protection laws. When choosing grounds for processing, we rely on the GDPR as a compliance standard to the extent it does not violate the applicable data protection law. The GDPR provides an exhaustive list of legal bases for processing. In our processing operations, we rely only on four of them, namely:

Your consent (Article 6.1 (a))

We process the personal data you choose to provide us with on the basis of your consent. You have the right to withdraw your consent for the processing of your personal data at any time.

Please note that withdrawing your consent does NOT automatically mean that the processing before the withdrawal is considered unlawful. You can withdraw your consent by emailing us at [email protected] or by contacting us through any other convenient means.

MyTaxiCRM's legitimate interest (Article 6.1 (f))

We process your personal data to protect our legitimate interests, such as preventing fraudulent activities on our Service, ensuring the security and functionality of our Service, and conducting certain marketing activities, such as contacting you if we believe you have a potential interest in our services or new offerings related to the Service.

We only collect and use the data necessary to achieve these purposes and do not override your fundamental rights and freedoms.

Performance of a contract (Article 6.1 (b))

When you provide us with personal data during account registration, when you subscribe to our Service, when you contact us to get more information on MyTaxiCRM, paid plans etc., this can be considered as an indication of your intent to enter into a contract or perform a contract between you and us.

Legal obligation (Article 6.1 (c))

We process your personal data to meet our legal obligations, including complying with tax or regulatory requirements.

In case you submit a request to exercise your rights, we may request you to provide certain personal data we already possess to verify your identity and ensure compliance with the applicable law.

Use your personal data

When acting as a data controller, we process your personal data for the purposes outlined in the table below, where you can also find information on the type of personal data processed and the legal bases we rely on in the “DATA SHARING AND DISCLOSURE” section.

DATA SHARING AND DISCLOSURE

As a data controller, MyTaxiCRM engages various service providers and specialists to ensure the functionality of our Service, provide you with a pleasant user experience, and ensure smooth and transparent business operations.

Sharing data with data processors

We may engage a variety of specialists, including experts in technical, sales, legal, accounting, and marketing fields, who may have access to your personal data. This is done to improve customer service and maintain the accuracy and transparency of our business. These specialists, collectively referred to as Contractors, receive your personal data only to the extent necessary and solely for the purpose of providing services, as well as technical and customer support.

We also rely on the support of third-party service providers to ensure essential features of the Services and deliver our services effectively. These service providers are considered data processors that operate on our behalf. In particular, we may share and disclose your personal data to the service providers listed further:

• AWS (Amazon Web Services, Inc., USA): for data storage. You may read its privacy policy here;
• Google Workspace (Google LLC, USA): for collecting, storing, structuring, and using personal data, and contacting you. You may read its privacy policy here;
• Sentry (Functional Software, Inc. d/b/a Sentry): for efficiently maintaining the technical side of our Service. You may read its privacy policy here.
• Hotjar (Hotjar Ltd.): for efficiently maintaining the technical side of our Service. You may read its privacy policy here.

Third-Party Integrations

We provide the option to integrate your MyTaxiCRM account with third-party services and platforms (Integrated Services), including social media accounts, messaging platforms, telephony tools, ride-hailing services, GPS vehicle trackers, and more.

While we do not directly share your personal data with these third parties, enabling such integrations may allow these services or platforms to access your information and transfer data between us and the third parties. We strongly recommend reviewing these services and platforms' privacy policies before integration.

DATA TRANSFER TO THIRD COUNTRIES

GDPR perspective

We may transfer your personal data to countries outside the European Union (EU) and the European Economic Area (EEA) that are not deemed to provide an adequate level of data protection under Article 45 of the GDPR (adequacy decision). For such transfers, we will ensure that appropriate safeguards are implemented in accordance with the GDPR to protect your personal data, in particular, the standard contractual clauses adopted by the European Commission.

When transferring data outside the EU and EEA, we implement additional technical and organisational measures. These measures include evaluating service providers' reliability and data protection practices, promptly addressing threats to confidentiality, integrity, and availability of personal data, and conducting Transfer Impact Assessments (TIA) when necessary.

Where possible and necessary, we always enter into Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) with these third parties to ensure the adequate protection of your personal data.

PDPL perspective

We may transfer your personal data to countries outside the United Arab Emirates that are not deemed to satisfy the recipient country's privacy legislation requirements described in Article 22 of the PDPL. In such cases, we will ensure that the transfer is based on Article 23 of the PDPL, which means we enter into a contract or agreement obligating PDPL data protection requirements or transfer of data is based on the other exclusions described in the article (if any apply to us).

Where possible and necessary, we always enter into Data Processing Agreements (DPAs) and Non-Disclosure Agreements (NDAs) with these third parties to ensure the adequate protection of your personal data.

DATA RETENTION, SECURITY AND INTEGRITY

As a data controller, we store and process your personal data until it is no longer necessary for any of the purposes outlined in this Privacy Policy.

As a general rule, we retain Potential Customers' personal data for the period we communicate and for 6 months afterwards. We retain Customers' personal data for the duration of our cooperation (while your MyTaxiCRM account is actively used) and/or communication, and for a period of 2 years following our last interaction or your last activity on the Service, unless a longer retention period is required or expressly permitted by law.

Upon the expiration of the retention period, we will completely delete (erase) your personal data from our systems and backups. We may not delete or anonymise your data if we are required to retain it to comply with the law or legal process.

Certain categories of data may have shorter storage periods; for instance, cookies expire within a few days, weeks, or months as per their programmed settings (or sooner if you clear your browser's cache). Cookies Information retention periods are specified in our Cookies Policy.

To exercise your right to erasure, you may contact us at [email protected] or in any other convenient way.

As a data processor, we store information the Customer provides us with through its account when using the services for the period established by the Customer in the data controller's instructions, taking into account the terms of EULA regarding the storage period of the Customers' data in accordance with physical capacities.

How we protect your data

We have implemented appropriate organisational, technical, administrative, and physical security measures aimed at safeguarding your personal data against unauthorised access, disclosure, use, and modification. Our security procedures are subject to regular reviews to incorporate appropriate new technology and methods.

In particular, we conduct regular backups, adhere to best practices in data security during the development phase and throughout the project lifecycle, and implement security measures to mitigate different risks to the stability and integrity of our systems and data. We also have implemented encryption of authorisation data and other security measures.

YOUR RIGHTS AND CHOICES UNDER GDPR

You may exercise the following rights by submitting a data subject request at [email protected].

Please be aware that in order to proceed with your requests to exercise your rights under the GDPR, we may require confirmation of your identity. Consequently, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

Right to be informed means that you have the right to know about the collection and use of your personal data. All information about our collection and use of your personal data is described in this Privacy Policy and our Cookies Policy.

Right of access means that you have the right to confirm whether your personal data is being processed by us, and ask us to send you a copy of your personal data collected together with specific information.

Right to rectification means that you may ask us to update and correct the false data, or missing or incomplete personal data.

Right to erasure (“right to be forgotten”) means that you may ask us to delete your personal data collected, except insofar it is prohibited by appropriate laws, where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw consent to consent-based processing and there is no other legal ground for the processing;
• you object to the processing under certain rules of applicable data protection law;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in the European Union or an EU Member State law;
• the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Right to restriction of processing means that you may ask us to restrict processing where one of the following applies:

1. you contest the accuracy of the personal data;
2. the processing is unlawful, but you oppose erasure and ask for restriction;
3. we no longer need the personal data for the purposes of our processing, but you require personal data to establish, exercise or defend legal claims;
4. you have objected to processing, and we are verifying your objection request;
5. where processing has been restricted on this basis, we may continue to store your personal data. However, we will only otherwise process it:
   • with your consent;
   • for the establishment, exercise or defence of legal claims;
   • for the protection of the rights of another natural or legal person;
   • for reasons of important public interest of the Union or of a Member State.

Right to data portability means that you have the right to receive your personal data you provided us with in a structured, commonly used and machine-readable format and have the right to request transmission of those data to another controller, where we process your personal data based on your consent or performance of a contract, and the processing is carried out by automated means.

Right to object to the processing means that you may raise objections of your personal data at any time to the extent that the processing is based on our legitimate interest or is necessary for the performance of a task carried out in the public interest, including profiling based on those provisions. Also, you have the right to object to our processing of your personal data for direct marketing purposes (including profiling).

Right to withdraw the consent for data processing means that you have the right to withdraw your consent at any time when your personal data is processed on the basis of your consent. The withdrawal of consent does not automatically mean that processing before its withdrawal is considered unlawful.

Right not to be subject to a decision based solely on automated processing, including profiling, restricts us from making solely automated decisions, including those based on profiling, that produce legal or other significant effects for data subjects. We DO NOT use automated decision-making and profiling.

Right to lodge a complaint with the supervisory data protection authority pertaining to the processing of your personal data. You have the right to lodge a complaint to the supervisory authority of your place of residence within the EU or to the data protection authority stated in this Privacy Policy, if you consider that the processing of your personal data infringes the GDPR.

Right to compensation means that any person who has suffered material or moral damage as a result of a violation of the GDPR requirements has the right to receive compensation from the controller or processor for the caused damage. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the EU Member State referred to in Article 79(2) of the GDPR.

DATA PROTECTION AUTHORITY UNDER THE GDPR

We encourage you to reach out to us initially with any concerns you may have regarding the processing of your personal data. You may use the following email to address your concerns: [email protected]

In some cases, you have the right to lodge a complaint about our use of your personal data with a data protection authority. For more information, please contact your national data protection authority. We will cooperate with the appropriate governmental authorities to resolve any privacy-related complaints that cannot be amicably resolved between you and us. You can find a full list of EU supervisory authorities through this link.

YOUR RIGHTS AND CHOICES UNDER PDPL

You may exercise the following rights by submitting a data subject request at [email protected].

Please be aware that in order to proceed with your requests to exercise your rights under the PDPL, we may require confirmation of your identity. Consequently, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

Under the PDPL, UAE residents have the following rights concerning their personal data (Articles 13-18):

Right of access to information means that you have the right to obtain information on the categories of personal data being processed, the purpose of the processing, the decisions made upon automated processing, entities with whom the personal data is shared.

Right to request personal data portability means that you have the right to receive your personal data in a structured and machine-readable format.

Right to rectification or erasure of personal data means that you have the right to rectify inaccurate personal data and the right to delete your personal data and be forgotten.

Right to restriction of processing means that you have the right to restrict and stop the processing of your data where it is inaccurate, or you object to the purpose of the processing.

Right to stop processing means that you have the right to object to the processing of your personal data and stop the processing where it is processed for direct marketing or statistical survey purposes or in contraversion of the personal data protection controls.

Right of processing and automated processing means that you have the right to object to automated decisions made by automated processing of your personal data. We do not do automated processing of your personal data.

You can find a detailed description of the personal information that we may collect from you above in the “DATA COLLECTION” section of this Privacy Policy.

The purposes of the collection and/or use of personal information are stated in the “HOW WE USE YOUR PERSONAL DATA” section of this Privacy Policy.

You can review the categories of third parties with whom we may share your personal information in the “DATA SHARING AND DISCLOSURE” section of this Privacy Policy.

HOW YOU CAN FILE A COMPLAINT

GDPR

We invite you to initially communicate any concerns or complaints you may have regarding the processing of your personal data with us. Please feel free to reach out to us to address your concerns at [email protected].

In some cases, depending on the place of your residence, you may have the right to lodge a complaint about our use of your personal data with a data protection authority. For more information, please contact your national data protection authority. You can find a full list of EU supervisory authorities through this link.

We will cooperate with the appropriate governmental authorities to address any privacy-related complaints that cannot be amicably resolved between you and us.

PDPL

We encourage you to contact us initially with any concerns you may have regarding the processing of your personal data. You may use the following email to address your concerns: [email protected].

Please note that we may need to confirm your identity to process your requests to exercise your rights. Thus, we may not be able to satisfy your request if you do not provide us with sufficient detail to allow us to verify your identity and respond to your request.

You also have the right to file a complaint with the UAE Data Office, a federal data regulator, if you believe that the processing of your personal data infringes PDPL.

THIRD-PARTY SERVICES AND SITES

GDPR

This Policy applies only to our Service. We strongly recommend reviewing the privacy documents of any websites you may reach by following the hyperlinks presented on our Services. We have no control over other websites' and services content and data practices and are not responsible for their actions.

CHILDREN'S PRIVACY

MyTaxiCRM Service are not directed to individuals under the age of 16. By providing us with your personal data, you confirm that you are at least 16 years old and, according to the law of your country, you have all rights to consent to the processing of your personal data.

Please consider applicable laws and regulations regarding the protection of children's personal data if you transmit their personal data to us via the Service in your capacity as a data controller (or business under other applicable laws).

If you have any reason to believe that a child under 16 has provided their personal data to us, please contact us at [email protected].

CHANGES AND UPDATES TO THE POLICY

This Privacy Policy may be updated from time to time to reflect updates to our business processes, new technologies, legal requirements, or for other reasons. Any changes will be communicated by posting a revised version of the Policy Policy on the Service. Such changes will be effective immediately upon posting unless otherwise specifically indicated.

We encourage you to occasionally check it for updates and changes. Your continued use of MyTaxiCRM Service after the revised Privacy Policy has become effective constitutes your acceptance of the new terms of the Privacy Policy. We will make reasonable efforts to notify you in advance if these changes are significant and materially alter your rights or obligations hereunder. Where required by applicable laws, we will obtain your consent for the subsequent processing.

SERVICE AGREEMENT AND EULA

When you access and use our Service, you are subject to and bound by the MyTaxiCRM EULA, service agreement between us, and Data Processing Agreement, which is an integral part of the service agreement.

CONTACT US

For questions regarding the processing of your personal data, this Privacy Policy, or your data subject rights, please contact us:

MYTAXICRM - FZCO