Bolt Technology OÜ (hereinafter: “Bolt Head Office”)
Registered seat: Vana-Lõuna tn 39/1, Tallinn Harjumaa 10134, Estonia
Bolt ITX Ltd. (hereinafter: “Bolt Ireland”)
Registered seat: 15 Main Street, Raheny, Dublin (Ireland)
The contact details of the data protection officer of Bolt Head Office: firstname.lastname@example.org.
Bolt Head Office developed the Bolt application for Passengers ("Bolt app") and Bolt application for Drivers (“Bolt Driver App”) and Bolt Ireland provides in Ireland Bolt Services (i.e., providing booking services as a licensed dispatch operator for the procurement of transportation services performed by third party licensed small public service vehicles which include taxis, hackneys or limousines (“SPSV”) through the Bolt app. Bolt Head Office established the data processing conditions and is in charge of operating the IT infrastructure supporting the Bolt app and Bolt Driver app.
For the data processing activities related to the Bolt Services, the data controllers under the General Data Protection Regulation (EU) 2016/679 ("GDPR") are Bolt Head Office and Bolt Ireland, save where indicated otherwise in this privacy notice (the “Privacy Notice”).
1. Personal data which is processed
- Name, e-mail, phone number, place of residence.
- Geolocation of Drivers and driving routes.
- Information about vehicles (including plate and registration number).
- Driver's efficiency and ratings.
- Driver's SPSV license, driving license, photo, profession and identity documents (including Dashboard ID, Garda Paper Licence, Vehicle SPSV).
- Information about disputes/complaints.
- The financial data of providing transportation services is not considered as personal data, because Drivers provide services in the course of economic and professional activities.
2. Purposes of the processing
- The primary objective of the data processing is to enable a connection between the passenger and the driver through the app and for Bolt Irelandto timely and duly dispatch the SPSVas efficiently as possible.
- Geolocation and driving routes while using the app are processed by us to analyse the geographical area and give suggestions to the Drivers. If you do not want to disclose your geolocation for passengers, you must close the Bolt app or indicate in the Bolt app that you are offline and currently are not providing transportation services.
- Driver's SPSV license, driving license, identity card, profession, identity documents are processed to determine the compliance with the legal requirements and the suitability of pursuing a profession as a Driver.
- Bolt app displays driver's photo, name, phone number and vehicle details for the passengers to identify Driver and vehicle, which implies the passengers may have access to your phone number for the adequate execution of the transportation service you provide to the latter and/or to return lost items.
- You will see summaries in the Bolt Driver App / Bolt Driver Portal, which will include your efficiency and ratings as a driver. Summary and ratings about drivers are necessary to provide a reliable service for passengers.
- In case you lodge a complaint through the Bolt app or otherwise, we process the latter and run an investigation.
3. Legal basis for the data processing
- Personal data is processed for the performance of the contract concluded with the employer of the Driver (transportation provider entity) or Driver (in case of a sole trader). The prerequisite for the use of the Bolt Services is (i) installing the Bolt app, (ii) allowing for the use of geolocation data within your device and (iii) drivers agreeing to the processing of identification and geolocation data.
- Personal data may be processed on the ground of Bolt Head Office and Bolt Ireland’s legitimate interest, for example, in investigating and detecting fraudulent payments.
- Your personal data is disclosed to passengers, whose order has been accepted by you. Passengers will see driver's name, vehicle, phone number, photo and geolocation data. Passengers also see driver's personal data in the summary received after the trip.
- Depending on the location of the Driver, the personal data may be disclosed to the Bolt local subsidiaries, representatives, affiliates, agents etc). Processing of personal data will occur as established in the relevant country’s privacy notice.
- The competent Authorities, in case of an investigation or audit, are entitled to request personal data in written form and we shall comply with such requests.
5. Data Processing by Bolt Ireland
- Bolt Ireland shall maintain a complete and up-to-date list of all vehicle and driver licences in respect of which they are providing a booking service and shall make such list available to NTA upon request.
- Bolt Ireland shall put in place a record management procedure in relation to any bookings and complaints received and shall make such records available to NTA upon request.
5. Data Processors, Security and Access
- Any personal data collected in the course of providing services is transferred to and stored in the data centres of Zone Media LTD (Lõõtsa 5, 11415 Tallinn, Észtország) and/or Amazon Web Services, Inc., which are located in the territories of a Member States of the European Union.
- Only authorised employees of Bolt Head Office and Bolt Ireland (or any of the companies belonging to the respective groups over which they exercise controlling rights) and partners have access to the personal data and they may access the data only for the purpose of resolving issues associated with the use of the services (including disputes regarding transportation services and customer support).
- Bolt group companies and partners can access personal data to the extent necessary to provide customer support in the respective country, see more https://bolt.eu/cities/.
- The contractual partners of Bolt Head Office undertake backups regularly and as may be required and, if it is necessary, participate in the restoration of the database.
- The payment service providers, which process the payments of the passengers by electronic means are our partners and we may use the platforms of our contractual partners to investigate and to respond to relevant complaints.
6. Processing passengers' personal data
- You shall not process the personal data of passengers without our permission or that of the passenger. You shall not contact any passenger or collect, record, store, grant access, use or cross-use the personal data provided by the passenger or accessible to you via the Bolt app for any reason other than for the purposes of fulfilling the respective transportation service.
- You must in any case comply with the rules and conditions for processing of personal data of passengers as set forth in the Privacy Notice for Passengers (http://www.bolt.eu/legal/). If you violate the requirements for the processing of personal data of passengers, we may terminate your account and claim damages from you.
7. Access, correction and restriction
- Personal data can be viewed and corrected in the “Bolt Driver Portal” or by sending us email. Please inform us by email in case your data changes.
- You can request information related to your personal data, in which case we will provide information in connection with the categories of personal data concerned, the purposes of the processing, the period for which the personal data is stored, your rights related to data processing and your rights to lodge a complaint with the supervisory Authority in charge (hereinafter: “Authority”). In case you believe that your rights have been violated by Bolt Ireland you may lodge a complaint with the Irish Data Protection Commission; if you believe that your rights have been violated by Bolt Head Office the Authority is the Estonian Data Protection Inspectorate.
- You are entitled to request the restriction of the processing of your personal data according to Article 18 of GDPR, also where we no longer need your personal data for the purpose of processing, but they are required by you for the establishment, exercise or defence of legal claims.
8. Retention of your personal data
- Your personal data will be stored by Bolt Head Office as long as you have an active account. If your account will be closed the personal data will be stored for an additional 3 year period, unless such data is required to be retained for longer for accounting, dispute resolution or fraud prevention purposes.
- Financial data regarding transportation services provided to passengers will be stored for 3 years after the last journey.
Data necessary for accounting purposes shall be stored for 7 years by Bolt Head Office.
- In the event of suspicions of a administrational or criminal offence, fraud or false information, the data shall be stored for 10 years by Bolt Head Office in order to hinder the renewed registration of the person who acted unlawfully.
- In the event of disputes, the data shall be retained until the claim is satisfied or statue of limitation of such claim is reached (usually 5 years).
- Journey history data will be stored for 3 years, after which the data will be anonymized.
- Please note that the deinstallation of Bolt app in your device does not cause the deletion of your personal data.
- If the Bolt app has not been used for 3 years, you will be notified and asked whether the account is still active. If no reply is received, the account will be closed and personal data will be deleted unless such data is required to be stored for accounting, dispute resolution or fraud prevention purposes.
- You should also bear in mind that any request to delete your personal data is handled by Bolt Head Office and is possible only if your account is deleted. As a result of that you will not be able to use the Bolt Driver app.
- We respond to any request to delete personal data submitted by e-mail and proceed with the data deletion within a month. Such a deadline may be extended for good cause.
- We may retain certain personal data as may be required by law and for legitimate business purposes permitted by law.
We will respond to any request for transfer of personal data submitted by e-mail and proceed with the data transfer within a month. Such a deadline may be reasonably extended for good cause. After we have verified the driver in question, we will provide you with your personal data, which includes: contact information, last 3 years' journey history and payment information.
11. Direct marketing and sweepstakes
- We will only use your e-mail address, Bolt app and/or phone number to send direct marketing messages pursuant to their legitimate business interest under Article 6, para. 1, let. f.) of the GDPR.
- We may share (1) your Full Name, (2) Email and (3) Circle K Tag Number to CIRCLE K IRELAND ENERGY LIMITED (registration number: 8209; registered office: Circle K House, Beech Hill, Clonskeagh, Dublin 4) ("Circle K") as long as and to the extent that you have filed and submitted the Bolt - Circle K form requesting the relevant information and available at: https://forms.gle/geT1kfg5fHvoMZqY8 with the purpose of obtaining exclusive benefits from Circle K with their Park & Play app (subject to the relevant terms and conditions), in accordance with the Data Sharing Agreement in force between Circle K and us and in compliance with applicable laws.
- We may personalize direct marketing messages using the information on how you use Bolt services (frequency of use, journeys, payments) by sending you direct marketing messages, push notifications, emails to promote third party providers who may offer you promotions, discounts or similar initiatives by reason of you using the Bolt Services.
- If you no longer wish to receive direct marketing messages, please notify us an e-mail at email@example.com.
12. Dispute resolution and remedies
- Disputes relating to the processing of personal data are resolved through customer support (for matters relating to Bolt Head Office: firstname.lastname@example.org; for matters relating to Bolt Ireland: email@example.com) or by contacting Bolt’s Data Protection Officer (firstname.lastname@example.org).
- In case you believe that the data processing is unlawful, you are entitled to start the procedure before the Irish Data Protection Commission (Postal address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; web contact: https://forms.dataprotection.ie/contact) and initiate judicial proceedings or before the Estonian Data Protection Inspectorate (www.aki.ee) which can be contacted by email: email@example.com.