Bolt Operations OÜ (hereinafter: “Bolt Head Office”)
Registered seat: Vana-Lõuna tn 15, Tallinn Harjumaa 10134, Estonia
Bolt ITX Ltd.. (hereinafter: “Bolt Ireland”)
Registered seat: 15 Main Street, Raheny, Dublin (Ireland)
The contact details of the data protection officer of Bolt Head Office: firstname.lastname@example.org.
Bolt Head Office developed the Bolt application ("Bolt app") and Bolt Ireland provides in Ireland Bolt Services (i.e., providing booking services as a licensed dispatch operator for the procurement of transportation services performed by third party licensed small public service vehicles which include taxis, hackneys or limousines (“SPSV”) through the Bolt app, jointly with Bolt Ireland who is in charge of the taxi dispatching activities. Bolt Head Office established the data processing conditions and is in charge of operating the IT infrastructure supporting the Bolt app.
For the data processing activities related to the Bolt Services, the data controllers under the General Data Protection Regulation (EU) 2016/679 ("GDPR") are Bolt Head Office and Bolt Ireland, save where indicated otherwise in this privacy notice (the “Privacy Notice”).
1. Personal data which is processed
- Name, phone number, e-mail addresses of the passenger.
- Identification data of the device on which the Bolt app has been installed.
- Geolocation of the device which is used by the passenger, time of the journey, departure and the arrival address of the passenger’s journey.
- Payment information (including passenger’s bank card number).
- Information about disputes/complaints.
- The feedback of the passenger in connection with the driver/journey.
2. Purpose of the data processing
- The primary objective of the data processing is to enable a connection between the passenger and the driver through the Bolt app and for Bolt Ireland to timely and duly dispatch the SPSV as efficiently as possible.
- After the passenger’s ride request has been accepted by the driver, geolocation data, name and the phone number of the passenger is displayed to drivers to enable efficient pick-up. Geolocation data is collected only when the Bolt app is activated. The collection of geolocation data stops after closing the Bolt app.
- We may use geolocation data to resolve quality issues related to transportation services.
- We may use contact details to notify passengers of updates to the Bolt app.
- We collect data of the routes taken by drivers and passengers to analyse the geographic coverage in order to provide recommendations to the drivers about most efficient routes.
- Bolt Ireland will ensure that the transportation service is always provided for by an available taxi that is situated in the best location to offer such service. For this purpose, Bolt Ireland uses data related to the booking of the passenger's journey to recommend drivers who are in proximity to the passengers’ location.
- Your name, phone number and e-mail will be used to communicate with you.
- Bolt Head Office obtains payment details also to process passengers' payments on behalf of drivers for their transportation service.
- Customer support data is collected on a case-by-case basis and stored for the purpose of resolving disputes and service quality issues.
- In case you lodge a complaint through the Bolt app or otherwise, we process the latter and run an investigation.
3. Legal Basis for the data processing
- Personal data is processed in order to provide the service contracted with passengers. We collect and process the personal data submitted by the passengers in the course of installation and use of the Bolt app. The prerequisite for the use of Bolt services is (i) installing the Bolt app, (ii) allowing for the use of geolocation data within your device and (iii) passengers agreeing to the processing of identification and geolocation data.
- Personal data may be also processed on the ground of Bolt Head Office's and Bolt Ireland’s legitimate interest, for example in investigating and detecting fraudulent payments.
- The legal basis for the data processing related to marketing communications is the legitimate business interest as permitted by law.
4. Recipients of the personal data
- The personal data of a passenger is only disclosed to the driver who provides transportation services via the Bolt app; in such case, the driver will see the name, phone number and geolocation data of the passenger.
- After providing the transportation service, the name and the telephone number of the passenger will remain visible to the driver for 24 hours, which is necessary for drivers to resolve any issues associated with service provision, e.g.: to contact the passenger in case of something was left behind in the vehicle.
- Feedback given by passengers regarding the driver or the quality of the service is anonymous and drivers (or partner passenger transport providers) do not receive names and telephone numbers of the passenger who provided rating and feedback.
- Only those personal data necessary for the purpose of providing a transportation service via the Bolt app will be provided to the passenger transport providers / drivers, partner of Bolt Ireland.
- Any processing of personal data by the passenger transport providers / drivers, partner of Bolt Ireland will occur under the same conditions as established in this Privacy Notice.
- You can obtain information from the journey summary about the transport provider who provided you with the transportation service.
5. Data processing by Bolt Ireland
- Bolt Ireland shall put in place a record management procedure in relation to any bookings and complaints received and shall make such records available to NTA upon request.
- The competentAuthorities, in case of an investigation or audit, are entitled to request personal data from Bolt Ireland in written form and Bolt Ireland shall comply with such requests.
6. Data processors, Security and Access
- The payment service providers, which process the payments of the passengers by electronic means are our partners and we may use the platforms of our contractual partners to investigate and to respond to relevant complaints.
- We may use the software of our contractual partners to send marketing messages.
- Any personal data collected in the course of providing the services is transferred to and stored in the data center of Zone Media Ltd. (Lõõtsa 5, 11415 Tallinn, Estonia) and/or Amazon Web Services, Inc., which are located in the territories of a Member States of the European Union. The contractual partners of Bolt Head Office undertake backups regularly and as may be required and, if it is necessary, participate in the restoration of the database.
- Only the authorized employees of Bolt group companies and Bolt services’ partners, and the authorized employees of contractual partners, can access personal data, to the extent necessary to comply with requests of the passengers in connection with Bolt Services (e.g.: customer support in the respective countries) or contribute in providing services to the passengers. The list of Bolt group companies and Bolt services’ partners is available on: https://bolt.eu/cities/.
- Geolocation data is processed in anonymised form and personalized only if the geographical location data is needed to be linked to a passenger for resolving disputes or fraud.
- For research and scientific purposes, the data is used in unidentified form (anonymized).
7. Access, correction and restriction
- You can access and update your personal data via the Bolt app.
- You can request information related to your personal data, in which case we will provide information in connection with the categories of personal data concerned, the purposes of the processing, the period for which the personal data is stored, your rights related to data processing and your rights to lodge a complaint with the supervisory Authority in charge (hereinafter: “Authority”). In case you believe that your rights have been violated by Bolt Ireland you may lodge a complaint with the Irish Data Protection Commission; if you believe that your rights have been violated by Bolt Head Office the Authority is the Estonian Data Protection Inspectorate.
- You are entitled to request the restriction of the processing of your personal data according to Article 18 of GDPR, also where we no longer need your personal data for the purpose of processing, but they are required by you for the establishment, exercise or defence of legal claims.
8. Retention of personal data
- Your personal data will be stored by Bolt Head Office as long as you have an active passenger account. If your account is closed, personal data will be deleted (according to the policies set out in this section), unless such data is required to be retained for accounting, dispute resolution or fraud prevention purposes.
- Financial data regarding transportation services provided to passengers will be stored for 3 years after the last journey.
- Data required for accounting purposes will be stored for 7 years after the last journey.
- In the event that there are suspicions of criminal offence, fraud or false information having been provided, the data will be stored by Bolt Head Office for 10 years in order to hinder the renewed registration of the person who acted unlawfully.
- In case of payment disputes, personal data will be retained until the dispute has been resolved or until the statute of limitation of the claim has elapsed (in principle for 5 years).
- Journey history data will be stored for 3 years, after which the data will be anonymized.
- Please note that the deinstallation of Bolt app in your device does not cause the deletion of your personal data.
- If the Bolt app has not been used for 3 years, you will be notified and asked whether the account is still active. If no reply is received, the account will be closed and personal data will be deleted unless such data is required to be stored for accounting, dispute resolution or fraud prevention purposes.
- You should also bear in mind that any request to delete your personal data is handed by Bolt Head Office and is possible only if your account is deleted. As a result of that you will not be able to use Bolt app via an account which has been deleted.
- We respond to any request to delete personal data submitted by e-mail and proceed with the data deletion within a month. Such a deadline may be extended for good cause.
- We may retain certain personal data as may be required by law and for legitimate business purposes permitted by law.
- We will respond to any request for transfer of personal data submitted by e-mail and proceed with the data transfer within a month. Such a deadline may be extended for good cause. After we have verified the customer in question, we will provide you with your personal data, which includes: contact information, last 3 years' journey history and payment information.
11. Direct marketing and sweepstakes
- Bolt Head Office will only use your e-mail address and/or phone number to send direct marketing messages pursuant to their legitimate business interest under Article 6, para. 1, let. f.) of the GDPR.
- Bolt Head Office may personalize direct marketing messages using the information on how you use Bolt services (frequency of use, journeys, payments). Direct marketing messages could be e-mails, SMS-s, push notifications or in-app messages, and may contain promotional codes or information which could facilitate the use of the service. The aim is that you receive advertisements which could raise your interest/ are as relevant to you as much as possible.
- If you no longer wish to receive direct marketing messages, please click the “Unsubscribe” link in the footer of our e-mail or change the settings related to direct marketing in Bolt app or send us an e-mail at email@example.com.
- We may process personal data (your Facebook name) for the participation in sweepstakes organized on Facebook and publish your name provided you have consented to.
- We may also generate new categories within the Bolt app and launch promotional initiatives for customer fidelization.
- Bolt Head Office may direct to you marketing campaigns that contain gifts, sweepstakes and other marketing or promotional materials.
12. Dispute resolution and remedies
- Disputes relating to the processing of personal data are resolved through customer support (for matters relating to Bolt Head Office: firstname.lastname@example.org; for matters relating to Bolt Ireland: email@example.com) or by contacting Bolt’s Data Protection Officer (firstname.lastname@example.org).
- In case you believe that the data processing is unlawful, you are entitled to start the procedure before the Irish Data Protection Commission (Postal address: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland; web contact: https://forms.dataprotection.ie/contact) and initiate judicial proceedings or before the Estonian Data Protection Inspectorate (www.aki.ee) which can be contacted by email: email@example.com.