Who We Are (Processor).
With this privacy policy (hereinafter the “Privacy Policy”) the private company under the name “BITAS DIMITRIS” and the distinctive title “MY WAY TAXI”, which has been incorporated and operates under Greek law with its registered office in Athens, 49 Messogeion Avenue, Athens, with VAT number 134261278, D.O.Y. IB Athens, (hereinafter the “Company” or “we” or “us” or “our”), sets out and discloses the terms by which, acting as the General Data Protection Regulation (hereinafter the “GDPR” or “GDPR”) defines as a data controller (the “Data Controller”), it collects, stores, uses and generally processes your personal data collected when you visit or in any way use this website at myway.taxi (hereinafter the “Website”) and/or when you register or in any way use the transport coordination application “MyWay Taxi” created and owned by the Company (hereinafter the “Application”).
The Company has been active in the transport project coordination services sector in Greece since 2018 and is one of the dynamically growing companies in Greece. The Website is the Company’s website and the user can register and use the Application. In addition, a call center is operated at our Company’s headquarters so that there is also the possibility of telephone booking, where call recording technology is used to ensure the quality of service and for your safety. The calls are recorded, after informing you with a recorded message and after you have given your consent, and are kept for security reasons for as long as absolutely necessary for the purpose of the commercial transaction.
This Privacy Policy also describes how we use, share and protect your personal data, the choices you have regarding your personal data and how you can contact us.
The Company respects your privacy and values the relationship we have with you. Accordingly, we handle your personal data responsibly and we want you to be familiar with how we collect, use and disclose your personal data. We strive to fully comply with all personal data processing and protection rules, as applicable, in accordance with Greek and European law.
We collect certain information about visitors and users of the Website and/or the Application, (hereinafter referred to as “Data Subjects”) that may lead to their identification and which we process as “Data Controller” of your data.
For issues relating to the protection of your data, you can contact us directly at the following details: 49 Mesogeion Avenue, Athens, tel.: 211 21 55 899, email: mywaygrammateia@gmail.com
Definitions
We provide some definitions from the GDPR to help you better understand the terms we use here:
“Personal Data”: any information of natural persons, such as their full name, postal address, e-mail address, contact telephone number, etc., which identifies or can identify them (hereinafter “Personal Data” or “Data”).
“Processing of Personal Data”: any operation or set of operations which is performed, with or without the use of automated means, on Personal Data or on sets of Personal Data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction.
“Processor”: the natural or legal person, public authority, agency or other body that processes Personal Data on behalf of the Controller.
“Consent of the Data Subject”: any free, freely given, specific, explicit and fully informed indication of intent by which the Data Subject declares that he or she agrees, by a statement or by a clear affirmative action, to the processing of Personal Data concerning him or her.
“Recipient”: the natural or legal person, public authority, agency or other body to whom the Personal Data are disclosed, whether or not a third party. However, public authorities which may receive Personal Data in the context of a specific investigation in accordance with Union or Member State law shall not be considered as recipients. The processing of such Personal Data by such public authorities shall be carried out in accordance with the applicable data protection rules depending on the purposes of the processing.
“Third party”: any natural or legal person, public authority, agency or body, with the exception of the Data Subject, the Controller, the Processor and persons who, under the direct supervision of the Controller or the Processor, are authorised to process Personal Data.
“Pseudonymisation”: the processing of Personal Data in such a way that the Data can no longer be attributed to a specific Data Subject without the use of supplementary information, provided that such supplementary information is kept separately and subject to technical and organisational measures to ensure that it cannot be attributed to an identified or identifiable natural person.
“Filing System”: any structured set of Personal Data which is accessible according to specific criteria, whether that set is centralised, decentralised or distributed on a functional or geographical basis.
“Restriction of Processing”: the marking of stored Personal Data with the aim of restricting their processing in the future.
“Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access of Personal Data transmitted, stored or otherwise processed.
“Supervisory Authority” means an independent public authority established by a Member State in accordance with Article 51 of the GDPR.
“Interested Supervisory Authority”: supervisory authority concerned by the Processing of Personal Data, because:
(a) the Controller or Processor is established in the territory of the Member State of that Supervisory Authority;
(b) Data Subjects residing in the Member State of that Supervisory Authority are or are likely to be substantially affected by the processing; or
(c) a complaint has been lodged with that Supervisory Authority.
Obligation to grant Personal Data
The provision of the Data to the Company may be necessary to achieve the purposes specified in this Privacy Policy or may be optional.
If you refuse to provide the data marked as mandatory on the Website and/or the Application, it will be impossible to achieve the main purpose for which the specific Data are collected and it may become impossible for the Company to conclude the commercial contract or provide the other services available through the Website and/or the Application. The provision of additional Data to the Company, beyond those marked as mandatory, is optional and does not affect the main purposes of the Data collection, since their provision serves exclusively to optimize the quality of the services provided by us.
What you need to know about us:
Α. What Data we process and for what purpose
The Personal Data you provide us with are, but not limited to, your full name, your address, your email address, your mobile phone and your landline phone. In addition, you provide us with internet connection information – such as time and duration of use of our service, but also location information – such as the GPS signal of your device or information about WiFi access points, which may be transmitted to us when you use our services (e.g. WiFi, Mobile Apps). You also provide us with information related to your route and destination (address: street, number, city) as well as the payment method. We may process your Personal Data only when we have a legitimate reason to do so. With regard to the Data required to complete the transaction, the processing is necessary both in the context of the relationship between us and in accordance with the applicable tax legislation and for the purpose of securing any financial claims and rights in legal actions.
We would like to assure you that your Personal Data is not publicly displayed and is only used by the Data Controller. The Data marked as mandatory is required in order to provide you with the services, in accordance with the relevant terms of use of the Website and/or the Application.
The Personal Data collected may be processed for the following purposes:
a) to create a user account, in order for the Company to provide you with the account functions and to facilitate the provision of the services;
b) to enable the Company to conduct a customer satisfaction survey regarding the quality of the Company’s products and services in accordance with the Company’s legitimate interest;
c) subject to your explicit consent, in order to communicate with you for commercial purposes, as well as to send promotional material regarding the Company’s services, or to conduct market research and to analyse your behaviours, habits and consumption trends in order to improve the services provided by the Company, as well as to meet your expectations;
e) to improve the user experience of the Website;
f) for information in relation to commercial transactions carried out (credit card payment etc.) and for the processing of payments and the prevention of fraudulent transactions based on our legitimate business interests and to protect our customers from fraud
g) to track your geographical location
h) to store your travel routes and your personal preferences in relation to the service provided;
i) to protect your account from fraud and other illegal activities: this includes the use of your Data to maintain, update and protect your account. We also monitor your browsing activity on our Website and/or App to quickly identify and resolve any problems and to protect the integrity of our Website in order to protect our legitimate interests
j) for communication: the Company uses your Data to respond to the requests/questions you submit, refund requests and/or any complaints. The information you share with us enables us to manage your requests and respond to you in the best possible way. We may also keep a record of your queries/requests to us so that we can better respond to any future communications, based on our contractual obligations to you, our legal obligations and our legitimate interests to provide you with the best possible service and to be able to improve our services based on your personal experience.
k) to send you communications required by law or necessary to inform you of changes to the services we provide to you, such as, for example, updates on changes to the services provided. These service messages will not include promotional content and will not require prior consent when sent by email or text message (SMS). If we do not use your Personal Data for these purposes, we cannot comply with our legal obligations.
We use call recording technology in the call centre 24 hours a day, 7 days a week to ensure quality of service and your safety. Calls are recorded, after you have informed us with a recorded message and after you have given your prior consent, and are preserved for transaction security purposes. We may also collect and store the content of the emails we exchange with you when necessary to perform our services.
Data may be processed in paper, automated or electronic form, including by post or email, telephone (e.g. automated telephone calls, SMS, MMS), fax and any other means (e.g. online websites, mobile applications).
The legal basis for processing on our behalf is mainly the performance of a contract, or our legitimate interest (e.g. to safeguard the security of our systems) or the existence of a legal obligation (e.g. notification of data to competent authorities).
Your Personal Data may be collected and processed only for specified, explicit and legitimate purposes, where this is strictly necessary for the intended purpose and shall be kept for the minimum period of time strictly necessary for the intended purpose.
In the context of protecting the Data we process, we apply a series of appropriate technical and organisational measures and technologies (encryption, etc.) to safeguard your Data from any unlawful processing or malicious action.
Β. My Way Taxi contact form and the data we process
We provide visitors to our Website the opportunity to contact us via a contact form. The information necessary for contact is the full name and email.
Γ. Automatic Data Collection
It is possible that after visiting our Website, our server (transit server) may record your IP address, which constitutes Personal Data, even if we cannot identify you ourselves on the basis of this data. The reasons (legal basis and purpose) for which we collect your IP address, together with the date and time are as follows:
α) The legitimate interest to process such Data in order to ensure the security of the information against accidental events or illegal or malicious actions that compromise the security of Personal Data and to safeguard the legitimate interest of the Company in relation to legal claims; and
b) The legal obligation to keep this information, based on the applicable legal framework and if requested by the competent authorities and based on the legal requirements.
D. Place and time of storage of Personal Data
Your Data is stored in our Company’s database, which is managed by the Company’s trained staff. The storage period is the minimum required and necessary to achieve the purpose of processing and to ensure compliance with the rules for the protection of Personal Data and in particular for as long as you remain a user of our Application, while if you send a message via the contact form, the message and your data will be deleted within 2 months from the date of sending the last message we receive from you. The period of storage of your personal Data is changed/adjusted accordingly based on the performance of the contract and the relevant legislation. For Personal Data collected and stored based on the promotion of products and services, your Personal Data will be kept until your consent is withdrawn. Please note that even if you submit a request for the deletion of your Data, it is possible to retain some of it, solely due to legal obligations or for the establishment, exercise and support of legal claims and for as long as our legal pursuit lasts. The revocation of consent/consent is only valid for the future and cannot have retroactive effect.
Rights of Data Subjects
Every natural person, based on the General Data Protection Regulation, enjoys the following rights in relation to the processing of your Personal Data by our Company.
In particular, you have the:
Right of access, i.e. to submit a request to be informed whether we process Data and, if so, which Data, and some additional information, such as the purpose of processing, recipients, etc.
Right of rectification, i.e. to request the rectification or updating or amendment of your Personal Data (either by contacting the Data Controller or through your profile)
Right to erasure, i.e. to request the erasure of your Data and in particular where we process them on the basis of your consent or for our legitimate interest, while where there is a processing obligation imposed by law or public interest, this right is subject to specific limitations or even does not exist.
Right to restriction of processing, i.e. to ensure, under certain conditions, the restriction of the processing of your Personal Data by us and in particular and indicatively when you dispute the accuracy of your Personal Data and as long as this dispute lasts and until verification etc.
Right to object to processing, i.e. to object at any time to the processing of your Personal Data, which is carried out when it is necessary and for the purpose of our legitimate interest, which we pursue, as well as for the purpose of direct marketing or consumer profiling.
Right to Data portability, i.e. to request the Data that you have provided to us in a structured, commonly used and machine-readable format, i.e. a format that will allow you to access them and to request that we transfer the Data to another Data Controller, if technically feasible and based on the provisions of the GDPR
The right to lodge a complaint before the Supervisory Authority in case of unlawful Processing of Personal Data (in Greece, the Personal Data Protection Authority).
Data Subjects may exercise the above rights at the email address.
In addition, we inform you that we will make every effort to respond to your request to exercise your rights immediately and within one month at the latest. If necessary, taking into account the complexity of your request and the workload of our Company, this deadline may be extended for a period of two months, but we will inform you as soon as possible and in any case within one month of the submission of your request, of the progress of your request and the reason for any delay in complying with it. If your requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Company may either impose a reasonable fee, taking into account the administrative costs of providing the information or of communicating or carrying out the requested action, or refuse to comply with your request.
We also hereby inform you that in the event of a Personal Data Breach, we have the obligation to inform you without undue delay, given that ensuring the protection of your Personal Data is a top priority for the Company. For this reason, we have the right to request additional information necessary to confirm your identity before exercising your rights.
Right to complain to the CPVO
In case you believe that we are not complying with the Personal Data Protection legislation, please contact our Company for explanations and complaints as described above and in the unfortunate event that we do not meet your requirements, you have the right to lodge a complaint with the Supervisory Authority concerned, in Greece the Personal Data Protection Authority, L. Kifissia 1-2, tel.: 210 64 75 600, fax: 210 64 75 628, e-mail: , website: www.dpa.gr.
Data Security – Processing Methods
The Data Controller shall process the Users’ Data in a proper manner and in accordance with the provisions of applicable law and shall take all due care to take all appropriate security measures to prevent unauthorized access, disclosure, modification or unauthorized destruction of the Data. The Processing of Personal Data is carried out using computers following organizational procedures and operations strictly related to the purposes indicated. In addition to the Data Controller, in certain cases, the Data may be accessed by persons responsible for the operation of the Application (administration, sales, marketing) or external parties (such as third party technical service providers – financial institutions). The Processing of Personal Data takes place at the Data Controller’s headquarters and at any other places where the third parties involved in the processing are located.
Our Company implements all appropriate measures for the safe maintenance of Personal Data, using an encryption system and continuous and extensive checks on the electronic systems for the storage and collection – processing of Data that we maintain in our Company, and has experienced and trained personnel for this purpose.
The Website uses SSL (Secure Sockets Layer) protocol for secure online commercial transactions. This encrypts all the Data you provide so that it cannot be decrypted or altered during transmission over the Internet.
In addition, the data used to identify you as an App account user are two: the Username and the Personal Secret Security Code (Password). Each time you enter your details, you are granted access to your personal account. This process is achieved securely through encryption during their transfer to the Internet and the Company’s servers. The only person who knows your password is you and you are solely responsible for maintaining the secrecy of the password from third parties. These measures are reviewed and modified when necessary.
App use and disclosure of personal data to professional drivers of IFA vehicles
In order to be able to use our Application through your registration on our Website, you will be asked to disclose your Personal Data, which are absolutely necessary (indicatively name, phone number, address, route), in order to complete the commercial transaction, and which may be registered and processed only for the purpose of the proper operation of the commercial transaction. These Data will be forwarded to the driver of the vehicle, who has accepted the specific route and for the purpose of identifying the customer-passenger upon boarding. The driver has the right to contact you to clarify information in relation to your pick-up.
The driver cannot store or process or disclose to third parties your personal data, which will be paid at the end of the route.
With the acceptance of the proposed route by the driver, a contract of carriage is concluded between the driver and the passenger and the Company bears no civil or criminal liability whatsoever for any failure to properly execute the contract. The Company bears no responsibility for any use of your Personal Data by the driver and the driver is solely responsible for the use of your Personal Data by the driver and you should take personal action against him in case he violates or uses your Personal Data in any way, either through use on personal websites or through disclosure to third parties or through any other culpable or illegal behaviour. This privacy statement of the Company does not apply to drivers and the Company shall not be liable for any breach of it by drivers, who are personally liable for any resulting liability arising from Personal Data breaches to passengers.
Other Recipients of the Data
The Data may be processed by natural and/or legal persons acting on behalf of the Company in accordance with specific contractual obligations and located in EU Member States or non-EU countries. They may also be processed by employees of our Company or partners of our Company, only with the permission of our Company and for the purpose of customer service and compliance with the Personal Data protection regulations and for the purpose of our commercial transaction and the proper functioning of our Company.
The Data may be communicated to third parties to comply with legal obligations, such as supporting payment services through credit cards and use in credit institutions, but also for the execution of orders by Public Authorities or the exercise of the Company’s right before the judicial authorities. Our Company’s third-party partners who may process Personal Data on our behalf meet the guarantees of security and protection of such data in accordance with the terms of the GDPR.
Social Media
My Way Taxi, has official accounts on the following social media: Facebook, Twitter, Google, Instagram, Linkedin, Youtube. The purpose of the processing for all the Data we collect about you, using the above social media (social networking platform), whether anonymized or not, is to provide updates on our content or to communicate with you by responding to the messages you send us.The purpose of the processing for all the Data we collect about you, using the above social media (social networking platform), whether anonymized or not, is to provide updates on our content or to communicate with you by responding to the messages you send us. The legal basis for the processing is your consent.
Your consent is given when you like or follow our pages and can be revoked in exactly the same way, i.e. by unliking or unfollowing. We point out that by giving your consent, you accept our Data Protection Policy, which is set out in a prominent and easily accessible place on the page concerned. If you do not agree with our policy, you must withdraw your consent in an appropriate way (unlike, unfollow). Our Company, according to case law, is considered a joint Data Controller with the social networking platform. The management of social media is part of our internal policy for the protection of Personal Data and, in order to safeguard it, we apply a series of appropriate technical and organizational measures, such as the restriction of the persons who have access to the management of the media, in order to ensure the safe Processing of Personal Data.
Important note: We are not responsible for the way or means by which each of the above platforms processes your Data. Please refer to the respective links for the policies of these media.
In addition, we do not control the content of comments submitted by users of these media, however we make efforts to ensure a safe online environment and to this end we have the right to remove any type of content or comment deemed to violate the terms of use of the Website, such as content that is abusive, vulgar, pornographic, threatening, advertising or that violates intellectual property rights or contains a false statement regarding the person of the user, while maintaining the right to remove any content or comment that violates the terms of use of the Website, such as, for example, content that is abusive, vulgar, pornographic, threatening, advertising or that violates intellectual property rights or contains a false statement regarding the person of the user.
Cookies
Our Website and App uses cookies and similar technologies when you access and browse our Website and App. Cookies are small text files that are stored on the hard drive of the computer or other electronic device with which the user accesses the Site and Application. Cookies are unique to each web browser (web browser, e.g. Google Chrome, Mozilla Firefox, etc.) and contain anonymized information that is specific to the web pages you visit and the devices you use.
Age Limit
Our content and services are directed solely to persons over the age of 18 and we do not knowingly collect any information about persons under that age unless we have the verifiable consent of a guardian. Since it is not technically feasible to effectively verify your age in all cases, we are committed, in the event that the submission of personal information relating to minors is reported and verified, to immediately delete all such information, without prejudice to any of our legal rights. In the event that parents and guardians become aware of the use of the Application by minors, please contact us immediately.
Payment Policy
The payment of the executed journey is made in the following ways: a) directly to the driver with cash money without using the App, b) through the payment function of the App. In case the payment is made through the payment function of the Application, Personal Data may be collected – stored for the completion of the commercial transaction to the respective payment service provider, who is responsible for the security of your Personal Data and has taken all the necessary protection measures to safeguard them, meeting all the criteria and conditions set by Greek law. Our Company stores only the strictly necessary data and in the context of the payment for the purpose of verifying the commercial transaction.
Advertising and Newsletter Policy
By subscribing to and using our service, it is possible to receive newsletters or promotional material to the email address you provide. In each newsletter or promotional material you receive you have the option to unsubscribe, with a link at the end of the email, retaining the option to opt-out when you sign up to receive updates for marketing purposes or you have the option to unsubscribe, with a link at the end of the email. By participating in any advertising-promotional activity, you authorize us to process your Personal Data only for the specific purpose. The Company will make every possible effort for the proper operation of the newsletters and other promotional activities, however, it is always possible that problems of a technical or organizational nature may occur. For any issue that may arise and for any relevant information regarding the operation of the newsletters or any other promotional activity, please contact us.
Changes and Modifications to the Privacy Policy and User Notice
The effective protection of your Personal Data requires the systematic monitoring of our policies and procedures. Our Company’s priority is to continuously provide better services, which means a continuous effort to improve our practices with respect to your Personal Data.
Therefore, this Privacy Policy may be amended at any time and without prior notice. Guided by the principle of transparency, we are committed to informing you of any significant changes to our policy. In any case, however, you should check our policy periodically, as your use of our services implies your acceptance of it. The Company reserves the right to amend the Personal Data Policy in part or in whole, or simply to update its content (e.g. as a result of amendments to the applicable law) and any amendment will be posted on this Website.
Applicable law
The applicable law is Greek law, as formulated in accordance with the GDPR and, in general, the applicable national and European legislative and regulatory framework for the protection of Personal Data. The courts of the city of Athens are exclusively responsible for the resolution of any dispute that may arise regarding the protection of your Personal Data.
Questions/Contact
If you have any questions regarding the Privacy Policy or the way we process your Personal Data in general, you can contact us either in writing at 49 Messogeion Avenue, Athens, or by telephone at our Company’s telephone numbers: 211 21 55 899, (contact hours: 09:00 – 17:00 from Monday to Friday) or by email by sending an Email to the following address: mywaygrammateia@gmail.com
Privacy Policy Updates
This Privacy Policy applies to the Website and/or the Application. Any changes will take effect from the moment they are posted on the Website. Where these changes are material, we will send you notice and obtain your consent where required under applicable law.
This privacy policy is effective as of December 2018.