Privacy Notice for Passengers and Riders
This privacy notice lets you know how Bolt Operations OÜ and Bolt Support Services Thailand Co., Ltd. promise to look after and process (collects, uses, maintains, and discloses) your personal data. This notice tells you things like what information we use to provide you with our bundle of transportation services, how we use your information to keep you safe, and the choices and controls available to you. This notice also tells you about your privacy rights and how data protection rules work to protect everyone.
Subject to the applicable local laws, Bolt Operations OÜ and Bolt Support Services Thailand Co., Ltd. are the joint controllers of your personal data unless otherwise stated below.
Bolt Operations OÜ postal address is :
Vana-Lõuna 15 Tallinn 10134 Estonia.
Bolt Support Services Thailand Co., Ltd. postal address is:
Level 30, Bhiraj Tower at EmQuartier, 689 Sukhumvit Road (Soi 35), Klongton Nuea Sub-district, Vadhana District, Bangkok, Thailand.
We have nominated a Data Protection Officer, and you can contact him at email@example.com or via any one of our postal addresses found in this privacy notice. Please mark the envelope ‘Data Protection Officer’.
The term “us” or “we” or “Bolt” refers to Bolt Operations OÜ a private limited company incorporated and registered under the laws of Republic of Estonia with registration code 14532901, and Bolt Support Services Thailand Co., Ltd.
The term “you” or “your” refers to the passenger or rider who requests, hires and/or receives a transportation service through their Bolt app account.
1. Personal data we process
We only process information that we need, so we can provide you with the best service on our transportation marketplace.
- Contact details: things like name, phone number and e-mail address. For some of our services we might require a little more, like your home address.
- Profile information: things like your profile picture, saved addresses, language and communication preferences. For some of our services we might require a little more, like your driver license details.
- Geolocation: such as where you need a ride from, or the location of nearby scooters to you, the time, the journey progression and the final destination of your trip.
- Payment information like the amount charged and the payment card used. Communication and correspondence records such as when you engage with our in-app chat, or speak with our customer service agents.
- Limited identification data of the device, like the IP address, on which the Bolt app has been installed
- Data about the usage of the transportation services: things like data about journey status, times and data about your conduct as assessed by drivers.
- Data related to communication through instant messages directly in the Bolt app ("Chat with Driver" option): date and time of the communication and its content.
- Other user-generated content such as photos of parked e-vehicles.
2. Purpose of the processing
We process your personal data so we can provide you with one or more of our transportation services:
- We connect you with a driver, help find you a scooter or hire a vehicle: We collect and process personal data for the purpose of connecting passengers with drivers so you can be picked up and dropped off; or to show you where our nearest available hire-vehicles are located, such as our cars or scooters. Instant messages directly in the Bolt app are processed in order to provide service and customer support (including resolving disputes between driver and rider), for security purposes as well as to improve our products and services, and for analysis associated directly to provide our products and services to you.
- We get you to where you want to go: We display geolocation data and the phone number of passengers to drivers when ride-hailing to enable efficient pick-up and drop-off, and make the journey and route transparent. This data is collected only when the Bolt app is activated. The collection of geolocation data stops after closing the Bolt app. In some countries drivers cannot see passengers' phone numbers; the driver sees an altogether different number which temporarily diverts to the passenger's phone number meaning the driver and passenger can still communicate.
- We make sure your journey goes smoothly: We use geolocation data to make sure you get to your destination and resolve quality issues related to our services. We also need to know where you choose to drop off a hire-vehicle so we can bill correctly, recharge batteries and maintain our fleet.
- We make sure the app is optimal: We use contact details to notify passengers and riders of updates to the Bolt app so you can keep using our services. We also gather limited data from the device that you use to connect you with our internet, mobile and telephone services, and to help keep your account safe through authentication and verification checks. We make sure your ride is the quickest, cheapest and most convenient to you: We collect data on the routes taken by our passengers and riders to analyse geographic coverage. This lets us do things like improve recommendations to the drivers about the most efficient routes, and helps us make sure that our hire-vehicles, like our scooters, are in the most convenient locations for customers.
- We collect your payment: We obtain payment details to process passenger payment on behalf of drivers for ride-hailing. And we process payments for our own hire-vehicles, such as for our cars and scooters, too.
- We maintain and promote standards: We collect data about journey statuses, time and passenger ratings from driver feedback to encourage user safety, promote compliance with our terms and conditions, and make sure we’re providing a quality and enjoyable service to everyone. Customer support data and correspondence is collected for the purposes of feedback, and resolving disputes and service quality issues.
- We keep you informed: Your name, phone number and email address will be used to communicate with you for things like letting you know that your journey has been completed, sending you trip confirmation slips and receipts, and letting you know about important service updates such as when bad weather suspends the hiring of ours scooters.
3. Legal Basis
We are allowed to use personal information in the ways described above if we have a legal basis to do so. We always make sure we have a legal basis for doing anything with your data. We may obtain your explicit consent before processing your personal data, and will process your personal data in accordance with such explicit consent, and in accordance with the provisions of this privacy notice or process your personal data on the following legal basis:
- Personal data is generally processed in order to provide the services contracted through the Bolt app with you. This means that to give you the service we promised you, and to meet our terms and conditions, we’ll process your personal data to meet those obligations.
- We generally in other circumstances process your personal data relying on legitimate interest grounds, or we may process your personal data personal data, upon obtaining an explicit consent from you, or where necessary as permissible under the law. Legitimate interests include our commercial interests in providing an innovative, personalised, safe and profitable service to our passengers and partners, unless those interests are overridden by other interests. Our legitimate interests also include things like investigating and detecting fraudulent payments and other malicious activities, maintaining the security of our network and systems, and responding to suspected or actual criminal acts.
We may from time to time rely on alternative legal bases when:
- it is necessary to comply with a legal obligation such as for processing data when the law requires it, including, for example, if there is a valid legal request to disclose personal information to a third party such as a Court or regulatory authority;
- to protect your vital interests, or those of others, for example in the event of an emergency or an imminent threat to life
In countries where legitimate interest is not an available lawful basis for Bolt’s processing activities, such as in Nigeria, Bolt instead relies on an alternative valid legal basis available above.
If you choose not to give us personal information it may prevent us from fulfilling the contract with you, or stop us doing something expected of us in law. It may also mean that we cannot operate your account. For example, we collect and process the personal data submitted by you in the course of installing and using the Bolt app; refusing to share geolocation data via the App means we cannot direct a driver to your location for pick-up, nor can we show you one of our own vehicles close to you for hire. We will not be able to fulfil our obligations to you in other circumstances, for example, should you refuse to undertake an identity verification check to ensure the integrity of your account, then the account may be suspended or blocked to prevent fraud.
We only work with trusted partners and authorities. In order to provide you with our products and services and to comply with any legal and regulatory requirements, we only share or disclose your personal data when there is a proper reason and legal basis to do so. We limit sharing to only that which is required. We do not sell your personal information.
- The personal data of the passenger is only disclosed to the ride-hailing drivers when they engage with a ride on in the Bolt app; in such a case, the driver will see the name, phone number (in some countries the number is masked), rating and geolocation data of the passenger.
- After providing the transportation service, the name and the telephone number (in some countries the number is masked) of the ride-hailing passenger will remain visible to the driver for 24-48 hours. This is necessary for drivers to resolve any issues with the passenger like getting something special back to you which might have been left in the car. Oops!
- Feedback given by passengers regarding the quality of the ride-hailing service is anonymous. Your rating is private between you and Bolt.
- Depending on the location of the passenger, the personal data may be disclosed to the Bolt group companies and partners (local subsidiaries, representatives, affiliates, agents etc). Processing of personal data by Bolt group companies and partners will occur under the same strict conditions as established in this privacy notice. You can read more on your country page.
- In some circumstances we are legally obliged to share information with external recipients. For example, under a Court Order or where we cooperate with a data protection supervisory authority in handling complaints or investigations. We can also respond to requests, such as those from law enforcement agencies, when we have a good-faith belief that the response is required by law in that jurisdiction or furthers a public interest task, affects users in that jurisdiction, and is consistent with internationally recognised standards. In any scenario, we’ll always satisfy ourselves that we have a lawful basis on which to share the information, and we’ll make sure that we document our decision.
5. Security and access
- Any personal data collected in the course of providing our services is transferred to and stored in the data centres of Zone Media Ltd. and/or Amazon Web Services, Inc., which are located in the territories of Member States of the European Union. Only authorised employees of Bolt group companies and partners have access to the personal data and they may access the data only for the purpose of resolving issues associated with the use of the services (including disputes regarding transportation services).
- We ensure that we will protect your personal data by implementing adequate personal data protection standards for the transfer of your personal data outside your jurisdiction. We shall also ensure that any third parties to whom your personal data will be disclosed, shall implement adequate personal data protection standards, and where your personal data will be transferred within our affiliates or group companies, we shall use data transfer mechanisms, i.e. binding corporate rules.
- Bolt group companies and partners can access personal data to the extent necessary to provide customer support in the respective country.
- For our research and scientific purposes, all data, like bulk geolocation data, is anonymised so you can never be identified from it.
6. Your rights and controls
We want you to stay in control of your personal data. Bolt provides you with controls through the app where you can view your personal information including your profile data and trip history. We also offer in-app settings like marketing opt-ins, and transparent cookie consent controls on our website.
Your right of access
- You can access your personal data via the Bolt app. You have the right to ask us for copies of your personal information. There are some exemptions, such as when we have to balance the rights of others, which means you may not always receive all the information we process.
Your right to rectification
- You can access and update your personal data via the Bolt app. You have the right to ask us to rectify information you think is otherwise inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure
- You have the right to ask us to erase or anonymize your personal information in certain circumstances.
Your right to restriction of processing
- You have the right to ask us to restrict or suspend the processing of your information in certain circumstances. This means that your data can only be used for certain things, such as legal claims or to exercise legal rights.
Your right to object to processing
- You may have the right to object to processing of your personal data. You may also submit an objection to any automated decision we have made, and ask that a person reviews it.
Your right to data portability
- You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you, in certain circumstances. This only applies to information you have given us.
- The retention period for the data about instant messages directly in the Bolt app messages is 90 days, except cases where messages are related to a reported incident - in which case we will store them for 6 months.
Your right to withdrawn your consent and lodge complaints
- You have the right to withdraw your consent at any time, provided that there is no other legal basis for us to continue with the processing of your personal data.
- You have the right to lodge complaints to the competent authority. The exercise of your rights is subject to the limitations prescribed by law.
Bolt retains user data for only as long as necessary for the purposes described above. This means that we retain different categories of data for different periods of time depending on the type of data, the transportation service it relates to, and the purposes for which we collected the data.
- Your personal data will be stored as long as you have an active passenger account. If your account is closed, personal data will be deleted (according to our retention schedule and rules), unless such data is still required to meet any legal obligation, or for accounting, dispute resolution or fraud prevention purposes.
- Financial data regarding transportation services provided to passengers will be stored for three years after the last journey. Data required for other accounting purposes will be stored for seven years after the last journey.
- In the event that there are suspicions of a criminal offence, fraud or false information having been provided, the data will be stored as long as necessary according to the internal, legal, and regulatory requirements.
- In case of payment disputes, data will be retained until the claim is satisfied or the expiry date of such claims.
- Journey history data and the data about usage of transportation services will be stored for three years, after which the data will be anonymized.
Please note that the deinstallation of Bolt app in your device does not cause the deletion of your personal data. If the Bolt app has not been used for three years, we’ll get in touch and ask you to confirm whether you wish to keep your account active for future use. If no reply is received in a reasonable time, the account will be closed and personal data will be deleted unless such data is required for any purpose mentioned earlier in this privacy notice.
8. Direct marketing
- We may send direct marketing messages to your e-mail address and/or phone number when you have given us an explicit consent to do so, or under a soft opt-in basis. We may personalise direct marketing messages using information on how you use Bolt’s services, such as how frequently you use the Bolt app, and your transportation preferences.
- If you no longer wish to receive direct marketing messages, please click the "Unsubscribe" link in the footer of one of our emails, or opt-out in the profile section of the Bolt app. Easy.
9. Automated decision making
We use help of automated decision-making in case of issuing warnings and implementing ride hailing service suspension. Using automated decision-making is less error-prone, more efficient and safer than using our employees. Data about your usage of the transportation services (data about journey status incl. cancellations and no-shows and data about your conduct as assessed by drivers) is considered when assessing the need for a warning or suspension. You can read more about the automated decision-making here. Ride hailing suspension will stay in force for 6 months, after which access to ride hailing service will be restored.
We may also use automated decision-making in order to undertake fraud checks which are necessary for us to perform our services, ensure that the services are paid for and ensure the protection of riders from fraudulent transactions on their payment cards.
We may use automated decision-making in order to verify you which is necessary to ensure the safety of our platform and the enforcement of our terms and conditions.
You will always have the right for human review of the decision and to contest the decision, express your point of view and obtain an explanation by contacting our customer support in our app.
10. Dispute resolution
- Disputes relating to the processing of personal data are resolved through customer support (firstname.lastname@example.org) in the first instance. You have the right to contact Bolt's Data Protection Officer at (email@example.com), and the local address provided in this Privacy Notice.
- Subject to the power of the local competent authority under the personal data protection laws in your jurisdiction, our supervisory authority is the Estonian Data Protection Inspectorate (www.aki.ee).
11. Making this notice great
We hope you have found this privacy notice easy to understand. Data protection laws are important. They strengthen rules and enhance your information rights. Many of these rules may appear complicated, but most are grounded in common sense. We take our responsibilities with your data seriously. Bolt will continue to make changes to this privacy notice as part of our commitment to protecting your privacy and affording you even more transparency.
Further information is available in the local Terms and Conditions for Passengers which can be located here.