Russian Federation, Ufa
Revision of 23.07.2024
Car Blanche Chauffeur Privacy Policy (CPP)
1. General Provisions
This Car Blanche Chauffeur Privacy Policy (CPP) will inform you as an applicant to become a Car Blanche Chauffeur chauffeur, as partner of Car Blanche Chauffeur providing transportation services to Car Blanche Chauffeur end customers or as a chauffeur for Car Blanche Chauffeur end customers as to which personal data about you is processed by Car Blanche Chauffeur and for what purpose.
For the use of Car Blanche Chauffeur website and other Car Blanche Chauffeur services Car Blanche Chauffeur general Privacy Policy:
https://car-blanche.net/privacy-policy 2. Name and Contact Information of the Controller
The controller for the processing of data within the meaning of the General Data Protection Regulation (GDPR) is:
Car Blanche OOO
106 ul. Dostoevskogo
Ufa
Republic of Bashkortostan
Russian Federation,
45007
E-Mail:
b2b.car.blanche@gmail.comYou can find further information on Car Blanche in the Legal Notice:
https://car-blanche.net/imprint3. Contact Information for the Data Protection Officer
Our data protection officer is: “CAR BLANCHE”, OGRN 1200200052095, INN 0274959783, location address: 450077, Ufa, st. Dostoevsky, 106
You can contact our data protection officer confidentially by mail to the above-mentioned address. Alternatively, you can contact our data protection officer and our data protection crew by e-mail to: b2b.car.blanche@gmail.com
4. Data Security
Car Blanche uses appropriate technical and organizational security measures to ensure a level of protection for personal data appropriate to the risk, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and the degree of risk. The transfer of personal data between your user device and Car Blanche is generally carried out in an encrypted form (TLS encryption). You can identify an encrypted connection for example by the lock symbol in the address line of your browser.
If you communicate with us by e-mail, access by third parties cannot be ruled out. In the case of confidential information, Car Blanche therefore recommends using ordinary mail or encrypted e-mail communication (PGP). Please let us know if you would like to correspond with us by e-mail in an encrypted form so that we can give you information on the relevant addresses and public keys.
5. Application of partners or chauffeurs
Personal data provided will be processed as part of your application in order to determine your suitability for chauffeur services for Car Blanche end customers. This includes information about whether a partner or chauffeur is appropriately qualified, licensed, experienced, sufficiently cleared by criminal background checks (if required or permitted by local law), capable of performing the chauffeur services and whether he fully complies with any and all guidelines or other requirements of Car Blanche.
Your data are necessary for the conclusion of a partner or transportation contract, otherwise we cannot process your application or offer you requests for transportation services. Car Blanche decision on your application is not solely based on automated processing.
Application data is usually not forwarded to external recipients, unless it is a Car Blacnhe contractor (see Art. 28 GDPR) or otherwise legally permitted. If your application is successful, your application data will be used for the contractual relationship with Car Blanche and the provision of professional chauffeur services for Car Blanche end customers (see Section 6 below). Otherwise, your application data will generally be deleted after 6 months, unless there is an additional need or reason to store the data longer.
The legal basis for our processing of application data is Article 6 Paragraph 1 lit b GDPR (contract initiation). If you give us your consent to transmit personal data beyond the required extent, the legal basis is Art. 6 Paragraph 1 lit. a GDPR (consent).
6. Chauffeur data, rides, contractual relationship
Car Blanche processes partner or chauffeur application data and partner or chauffeur data arising from the contractional relationship or the provision of Car Blanche chauffeur services (hereinafter “chauffeur data”). Chauffeur data will be used for Car Blanche services, i.e. for the fulfilment of the Framework Cooperation and Transportation Services Agreement with a partner, for transportation requests, transportation contracts or for accounting and payment purposes. This can include data like: Full name, gender, birth date, age, licenses, place of birth, physical address, email, telephone number, social security number, tax ID, pay-out preference or bank account, user ID, trainings and webinars, location data, ride status, tour milestones, vehicle number plate, vehicle details, customer orders, customer ratings, photographs, audio files, incident information, criminal background checks, compliance with Car Blanche guidelines company data.
Car Blanche provides chauffeur data to third parties, if necessary, in particular to end customers of Car Blanche so that the end customer can be transported in accordance with their booking and the transport can be processed, accounted and paid for. Chauffeur data can in such cases be transmitted in a third-party country outside of the European Union or the European Economic Area in which the end customer is located or planning to use Car Blanche services. Car Blanche cannot generally provide further information on the data protection level in the third-party country. An adequacy decision (see Art. 45 Paragraph 3 GDPR) or suitable guarantees (see Art. 46 GDPR) are not required for the transmission since the transmission is required for the performance of a contract between the data subject and the controller or to carry out pre-contractual measures upon request from the data subject (Art. 49 Paragraph 1 lit b GDPR) or because the transmission is required to enter into or to perform a contract concluded in the interest of the data subject by the controller with another natural or legal person (Art. 49 Paragraph 1 lit c GDPR).
The legal basis for the processing of chauffeur data is Art. 6 Paragraph 1 lit b GDPR (contract performance). If the chauffeur provides additional, voluntary information, the legal basis is chauffeurs’ consent according to Art. 6 Paragraph 1 lit a GDPR and our legitimate interest according to Art. 6 Paragraph 1 lit f GDPR.
In addition, Car Blanche processes chauffeur data in order to analyze, personalize and improve the use of Car Blanche services (e.g. ride reviews, to advertise Car Blanche services, to detect, limit and eliminate technical or process-related disruptions and problems, and to prevent illegal use of Car Blanche services (e.g. fraudulent booking, cyberattacks). For such purposes chauffeur data usually is not forwarded to recipients, unless it is to the chauffeurs’ employer or principal, a Car Blanche contractor (see Art. 28 GDPR) or if otherwise legally permitted (e.g. in order to assert or reject claims). The legal basis for the processing of chauffeur data is, in this respect, is Art. 6 Paragraph 1 lit f GDPR (Car Blanche legitimate interest).
7. Car Blanche Chauffeur App and Car Blanche Partner Portal
Car Blanche operates an App for mobile devices (“Car Blanche Chauffeur App”) and an online portal for Partners (“Car Blanche Partner Portal”, together “Car Blanche Chauffeur Tools”) for the communication with chauffeurs and the processing of end customer’s service requests. Data generated or used while utilising the Car Blanche Chauffeur Tools, i.e. all chauffeur tools data (e.g. login, password) or ride related data (e.g. date, time, pickup, drop-off, stopover, pax number, vehicle category/class, pick-up sign information and logo, end customer name, end customer mobile number, flight or train, reference number, booking comments, special needs, cancellations, changes to bookings, no shows and delays), are otherwise processed like chauffeur data for the purposes and as described in Section 6 above.
Car Blanche decision on an offer by a partner or chauffeur can be solely based on automated processing. Such an automatic decision is required to conclude the contract (Art. 22 Paragraph 2 lit a GDPR). The data subject has the option of contacting us using the mentioned contact data (see section 2) in order to have an explanation or an intervention by a person or to express their point of view.
8. GPS tracking, location data
With chauffeurs’ consent, Car Blanche processes and uses GPS tracking or location data,in the background / when the application is closed / always in use / when the application is not in use. (i.e. longitude, latitude, speed, accuracy). Chauffeurs must first agree to this on their mobile device using the confirmation field or the system settings in Android or iOS ("Allow"). Chauffeurs’ position is then determined using the GPS data from the Car Blanche Chauffeur App (hereinafter “location data”) as soon as the chauffeur starts a journey (i.e. as soon as he presses the button "On the way to Pick up Location" in the Car Blanche Chauffeur App) and ends once the chauffeur presses the button "Finish Ride" in the Car Blanche Chauffeur App. In case the "Finish Ride" button is not pressed, tracking of location data stops automatically after the estimated time of arrival at the drop off point.
Purposes of processing are the execution of the contractual relationship (planning, disposition, arrangement, execution, accounting for and payment of transportation), to monitor the performance of the ride, to increase the quality of rides, to support Car Blanche, the chauffeur and the customer in case of questions or problems, the design and improvement of Car Blanche services, the detection, limitation and elimination of faults, errors or problems of a technical or process-related nature and the prevention or detection of illegal use (otherwise see Section 6 above).
Location data may be passed on to the current end customer of the chauffeur in order to facilitate and enhance the meeting with the chauffeur or for accounting and payment purposes. Otherwise, location data will not be transmitted to third parties, unless it is a Car Blanche contractor (see Art. 28 GDPR) or otherwise legally permitted.
Location data is processed safely and stored on encrypted media. Location data is not permanently linked to the chauffeurs’ profile but stored separately. It can only be accessed according to a separate authorization concept, which allows only a limited group of people access for a limited time. Evaluations are otherwise carried out pseudo- or anonymised. Profiling (Art. 4 Paragraph 4 GDPR) using location data does not take place. Location data is not stored for more than 2 years and then deleted or anonymised.
The legal bases of the processing of location data by Car Blanche are Art. 6 Paragraph 1 lit a GDPR (consent) and Art. 6 Paragraph 1 lit b GDPR (contract performance and contract initiation). The described tracking of location data is necessary, so the chauffeur can use a navigation app at the same time whilst using the GPS tracking on the Car Blanche Chauffeur App. Rides can only be performed when GPS tracking is active and switched on for the Car Blanche Chauffeur App.
The chauffeur can withdraw his consent to GPS tracking at any time by changing the device settings for the Car Blanche Chauffeur App. Such withdrawal of consent will not affect the processing of chauffeur’s location data tracked before driver’s withdrawal. The chauffeur can also withdraw his consent to further use of his location data at any time by sending us a message to that effect (communication channels see Sections 2 and 3 above). Such withdrawal of consent will not affect the processing of chauffeur’s location data before driver’s withdrawal.
9. End customer rating
Car Blanche offers end customers the possibility to comment and rate a ride e.g. in the Car Blanche App. End customers can rate each trip between one (1) and five (5) stars, as the case may be separately for individual aspects of the trip (e.g. chauffeur, vehicle), and leave a comment.
Comments and ratings are stored in the chauffeurs’ profile and can be communicated to the chauffeur and the relevant driving service partner in anonymized form. End customers can only see their own comments and ratings. The purposes of data processing within the rating system is the calculation of fees and the settlement of driving service partners’ accounts, the display and the selection of chauffeurs, the analysis and improvement of Car Blanche services, i.e. to monitor the performance of the rides and to increase the quality of rides, and the prevention or detection of illegal use (otherwise see Section 6 above).
Profiling (Art. 4 Paragraph 4 GDPR) or an automated decision-making based on rating data does not take place. Comments are not stored for more than two (2) years and then deleted or anonymised. A chauffeur can request erasure of a rating concerning him if such rating violates his rights or if a rating is no longer meaningful (usually after 5 years, see Sections 12.3 and 12.5 below).
The legal basis for the processing of end customer ratings is Art. 6 Paragraph 1 lit b GDPR (contract performance), especially for the calculation of bonuses. The legal basis for the processing of rating data is also Art. 6 Paragraph 1 lit. f (Car Blanche legitimate interest). It is Car Blanche legitimate interest to provide the end customer with a possibility to leave feedback and to use such feedback to improve the Car Blanche services. Such evaluation systems are common for chauffeurs and therefore to be expected. Chauffeurs have the right to lodge an objection to a rating at any time (see Sections 12.3 and 12.5 below).
10. Credit Card Data
Credit card information is protected by Car Blanche against unauthorized access. For this purpose, a certified payment provider is used whose systems meet the applicable security standards, such as for example PCI-DSS (Payment Card Industry Data Security Standard).
To ensure that the credit card is a means of payment used by the rightful owner and to prevent fraud, IP addresses, location data, rating data, email addresses, payment information and credit card information may be transmitted to one or more external fraud prevention service providers. This transmission may also contain additional personal data. The external fraud prevention service providers process this personal data on behalf of Car Blanche. The legal basis for this processing is Art. 6 para. 1 lit. f DSGVO (legitimate interest of Car Blanche).
11. Communication with Car Blanche
If you contact Car Blanche (e.g. by phone call, video conference, contact form, chat, messenger, text message, e-mail or via the Car Blanche Chauffeur App), the data provided by you will be processed to handle your matter and to answer your question. The legal bases are Art. 6 Paragraph 1 lit a GDPR (consent) and Art. 6 Paragraph 1 lit b GDPR (contract performance and contract initiation). Car Blanche will also use external services and tools to communicate with chauffeurs.
Car Blanche will process personal data from the communication, as far as possible in a pseudonymized or anonymized form, to analyse usage, design and improve Car Blanche services, to detect and remedy interruptions and technical or process-related problems and to prevent illegal usage of Car Blanche services (e.g. fraudulent booking, cyberattacks). The legal basis for the processing is Art. 6 Paragraph 1 lit f GDPR (Car Blanche legitimate interest).
12. Rights of data subjects
If your personal data is processed by Car Blanche, you are the data subject (Art. 4 No. 1 GDPR). As the data subject, you have the following rights in relation to the personal data affecting you:
12.1 Right to information (Art. 15 GDPR)
The data subject has the right to obtain a confirmation from the controller as to whether personal data is processed; if this is the case, they have a right of information about this personal data and further information on the data processing.
12.2 Right to rectification (Art. 16 GDPR)
The data subject has the right to obtain from the controller without undue delay the rectification or completion of inaccurate personal data.
12.3 Right to erasure (Art. 17 GDPR)
The data subject has the right to demand from the controller the erasure of personal data without undue delay and the controller is obliged to erase personal data without undue delay, provided the data is no longer required, the data subject revokes their consent or lodges an objection to the processing, the personal data was processed unlawfully or there is otherwise a ground for erasure within the meaning of Art. 17 GDPR and the controller does not have the right to object to erasure.
12.4 Right to the restriction of data processing (Art. 18 GDPR)
The data subject has the right to demand from the controller the restriction of processing when one of the conditions mentioned in Art. 18 GDPR applies, namely the accuracy of the personal data is contested by the data subject or the processing is unlawful, and the data subject opposes the erasure of the personal data.
12.5 Right to objection (Art. 21 GDPR)
Insofar as the data processing is based on a legitimate interest from our side (Art. 6 Paragraph 1 lit. f GDPR) or is direct advertising, the data subject has at any time the right to lodge an objection to the processing of personal data affecting them for the reasons mentioned in Art. 21 GDPR. The controller will then no longer process the personal data, unless they can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or the processing serves for the establishment, exercise or defense of legal claims.
12.6 Right to data portability (Art. 20 GDPR)
The data subject has the right within the meaning of Art. 20 GDPR to receive the personal data, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided.
12.7 Right to lodge a complaint (Art. 77 GDPR)
Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority according to Art. 77 GDPR.
13. Data Erasure and Storage Period
We will delete your personal data as soon as the legal basis for its processing no longer applies. In some cases, however, other legal bases can also apply, for example if processing is necessary for compliance with a legal obligation of Car Blanche (e.g. in accordance with commercial or tax law).
14. Amendment or Update of this Chauffeur Privacy Policy
Car Blanche may update and amend this Driver Privacy Policy at any time. Chauffeurs will be informed and may be requested to provide consent again.
Issued: July 23, 2024.
