This Privacy Policy regulates the procedure for collecting and processing personal and other confidential data of individuals by the TuTu Taxi service (hereinafter referred to as the "Service") using automated tools via the Internet.
General Provisions
1. The following terms are used within this document:
1.1. Personal Data – any information that relates directly or indirectly to a specific or identifiable natural person (data subject).
1.2. Service – the entity that independently organizes and/or performs the processing of personal data, and determines the purposes of such processing, the scope of personal data to be processed, and the actions (operations) performed with personal data.
1.3. Website – a set of computer programs and other information contained in an information system, accessible via the Internet through domain names and/or network addresses, enabling identification of websites on the Internet, which is used by the Service to provide services to Customers. Website address: https://tutu.taxi
1.4. Mobile Application – the software "TuTu Taxi: Taxi Booking" installed on the Customer's device running iOS, Android, or Windows Phone, integrated into the Service's software and hardware system, which allows automating the process of placing service requests.
1.5. Services – information services provided by the Service to the Customer, aimed at receiving, processing, and forwarding the Customer's request to a Partner and informing the Customer about the order status. The scope and conditions of service provision are defined in the public offer available on the Website.
1.6. Customer – a natural person placing a service request via the Website, Mobile Application, or by calling the Service's support number and providing their personal data for this purpose.
1.7. Partner – a person who independently provides services to the Customer such as passenger transportation, delivery of goods (cargo), or loading/unloading operations. The Service is not a transportation company and does not independently provide any transportation services to the Customer.
1.8. Order – a request generated by the Customer for transport services to be provided by the Partners.
1.9. Personal Data Processing – any operation or set of operations performed on personal data, with or without automation tools, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, and destruction of personal data.
1.10. Automated Personal Data Processing – processing of personal data using computing technology.
1.11. Provision of Personal Data – actions aimed at disclosing personal data to a specific person or a certain group of persons.
1.12. Personal Data Blocking – temporary suspension of personal data processing (except where processing is necessary for data clarification).
1.13. Personal Data Destruction – actions that render it impossible to restore the content of personal data in the personal data information system and/or result in the destruction of physical media containing personal data.
1.14. Personal Data Information System – a set of personal data contained in databases, along with information technologies and technical tools used for their processing.
1.15. Cookies – fragments of data sent by the Website and stored on the Customer's computer, mobile phone, or other device used to visit the Website, applied to store information about the Customer's activity on the Website.
1.16. Device Identifier – unique data that allows the identification of the Customer's device on which the Mobile Application is installed, provided by the device itself or generated by the Mobile Application.
2. 2. By placing an order for services via the Website, Mobile Application, or by calling the Service's support number, the Customer agrees to the terms of this policy, including giving consent to the Service for processing their personal data in cases where such consent is required by applicable law.
Personal Data
3. 3. During the processing of personal data, the Customer has the right to:
3.1. Receive information related to the processing of their personal data, including:
3.1.1. Confirmation of the fact of personal data processing;
3.1.2. Legal grounds and purpose of personal data processing;
3.1.3. Purpose and methods of personal data processing used;
3.1.4. Information on the name and location of the person carrying out personal data processing, as well as on persons (except for Service employees) who have access to personal data or to whom personal data may be disclosed based on a contract with the Service or applicable law;
3.1.5. The personal data being processed that concerns the relevant data subject, and the source of its acquisition, unless a different procedure for providing such data is specified by applicable law;
3.1.6. Periods of personal data processing, including data retention periods;
3.1.7. The procedure for the Customer to exercise the rights stipulated by applicable law;
3.1.8. Information about cross-border data transfer that has occurred or is anticipated;
3.1.9. The name or full name and address of the person processing personal data on behalf of the Service, if such processing is or will be assigned to such a person;
3.1.10. Other information provided by applicable law.
3.2. 3.2. Request the Service to update, block, or delete their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the declared processing purpose, and also take legally prescribed measures to protect their rights.
3.3. 3.3. Appeal against the actions or inaction of the Service to the authorized body for personal data protection or in court if the Customer believes that the Service is processing their personal data in violation of applicable law or otherwise violates their rights and freedoms.
3.4. 3.4. Protect their rights and legitimate interests, including claiming compensation for losses and/or moral damages through court proceedings.
4. 4. During personal data processing, the Service undertakes to:
4.1. Provide the Customer, upon their request, with the following information:
4.1.1. Confirmation of the fact of personal data processing;
4.1.2. Legal grounds and purpose of personal data processing;
4.1.3. Purpose and methods of personal data processing used;
4.1.4. Information on the name and location of the person carrying out personal data processing, as well as on persons (except for Service employees) who have access to personal data or to whom personal data may be disclosed based on a contract with the Service or applicable law;
4.1.5. The personal data being processed that concerns the relevant data subject, and the source of its acquisition, unless a different procedure for providing such data is specified by applicable law;
4.1.6. Periods of personal data processing, including data retention periods;
4.1.7. The procedure for the Customer to exercise the rights stipulated by applicable law;
4.1.8. Information about cross-border data transfer that has occurred or is anticipated;
4.1.9. The name or full name and address of the person processing personal data on behalf of the Service, if such processing is or will be assigned to such a person;
4.1.10. Other information provided by applicable law.
4.2. Take measures to prevent unauthorized access to the Customer's personal data.
4.3. Publish or otherwise ensure unrestricted access to the document defining the personal data processing policy, as well as to information on personal data protection requirements that are implemented.
5. 5. The purpose of collecting and processing the Customer's personal data is to conclude an agreement between the Customer and the Service for the provision of services.
6. 6. The Customer's personal data is stored on electronic media and processed using automated personal data processing systems.
7. 7. The Service collects and processes the following personal data of the Customer:
7.1. Surname, first name, patronymic;
7.2. Date of birth;
7.3. Subscriber phone number;
7.4. Address of residence;
7.5. Email address.
8. 8. The following personal data may be voluntarily provided to the Service by the Customer and may also be changed and/or deleted at their discretion:
8.1. Surname, first name, patronymic;
8.2. Date of birth;
8.3. Address of residence;
8.4. Email address.
9. 9. The Customer's personal data is deleted by the Service in the following cases:
9.1. Three years after the termination of the provision of Services;
9.2. In case the Customer withdraws consent to the processing of their personal data.
10. 10. The deletion of the Customer's personal data is carried out without the possibility of further restoration.
11. 11. Access to the Customers' personal data is granted only to individuals directly involved in providing the Services. In all other cases, the Service does not disclose or provide access to the Customer's personal data to third parties without the Customer's prior written consent, except when data is provided at the request of authorized state bodies in accordance with applicable law.
12. 12. The Service takes the following measures to prevent unauthorized access to the Customer's personal data:
12.1. Appoints employees responsible for organizing the processing of personal data;
12.2. Applies organizational and technical measures to ensure the security of the Customer's personal data, including:
12.2.1. Identifying threats to personal data security during processing in information systems;
12.2.2. Ensuring secure access to premises housing the information systems, preventing unauthorized access;
12.2.3. Ensuring the safekeeping of personal data storage media;
12.2.4. Approving a list of individuals granted access to personal data necessary for fulfilling their job duties;
12.2.5. Using protection measures to prevent unauthorized access to personal data;
12.2.6. Evaluating the effectiveness of measures taken to ensure personal data security;
12.2.7. Detecting unauthorized access to personal data and taking responsive action;
12.2.8. Restoring personal data that was modified or deleted due to unauthorized access (if technically possible);
12.2.9. Establishing access rules for personal data processed in the information system;
12.2.10. Monitoring and controlling the level of protection and security of the personal data information systems.
13. 13. The Customer has the right to request the Service to clarify (update), block, or delete their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained, or unnecessary for the stated purpose of processing. The Customer also has the right to withdraw their consent to personal data processing by submitting a written request or demand by registered mail with delivery confirmation, or by personally submitting it to the Service's address. The addresses of the Service's departments are listed in the corresponding section of the website. The request/demand must include the number of the main identification document of the Customer or their representative, the issuing authority and date, the Customer's residence address, information confirming the Customer's relationship with the Service (contract number, date, reference designation and/or other data), or any other information confirming the fact of personal data processing by the Service, the request for data clarification, blocking or deletion, or the notice of consent withdrawal, and the signature of the Customer or their representative. The Service is obliged to provide a reasoned response to the Customer's request/demand within 30 calendar days from the date of receipt.
Geolocation Data
14. 14. The Service receives location data (geolocation data) of the Customer via the mobile application. Geolocation data is transmitted to the Service only while the mobile application is in use. The Customer may, at their own discretion, prohibit the transmission of geolocation data by adjusting the relevant settings on their mobile device.
15. 15. In order to fulfill the Order, the Service provides the Customer's geolocation data to its Partners who have accepted the Order for execution.
Payment Data
16. 16. To enable payment for transportation services provided by Partners using cashless payment with bank cards, the Customer may link a bank card to their subscriber phone number. The card is linked by the Customer directly in the mobile application by entering the following information:
16.1. Bank card number;
16.2. Expiration date of the bank card;
16.3. Cardholder's surname and first name;
16.4. Card security code.
17. 17. Payment by bank card is made according to the rules of international payment systems and in compliance with confidentiality and security requirements. The security of the Customer's data is ensured by compliance with the Payment Card Industry Data Security Standard (PCI DSS), and no one, including the Service, can access this data. Card data entry is performed on a secure payment page of the acquiring bank, which ensures the ability to make a cashless payment.
Cookies
18. 18. The Service may use the following types of cookies:
18.1. 18.1. Strictly necessary cookies. These cookies are required to navigate the site and use the requested services. They are used during Customer registration and login. Without them, services requested by the Customer become unavailable. These are essential cookies and may be either persistent or session cookies. Without them, the site does not function properly.
18.2. 18.2. Performance cookies. These cookies collect statistical data on site usage. They do not collect personal information of the Customer. All information collected by these cookies is statistical and anonymous. The purposes of using these cookies are:
18.2.1. Collecting site usage statistics;
18.2.2. Evaluating the effectiveness of advertising campaigns.
18.3. 18.3. Functional cookies. These cookies store information provided by the Customer (such as username, language, or location). These cookies use anonymous data and do not track Customer activity on other websites. The purposes of using these cookies are:
18.3.1. Remembering whether the Customer has previously received any services;
18.3.2. Improving the overall user experience by remembering Customer preferences.
18.4. 18.4. Advertising cookies. These cookies are used to manage advertisements on the site, limit the number of times an ad is viewed by the user, and evaluate the effectiveness of advertising campaigns. Advertising cookies are placed by third parties – such as advertisers and their agents. These cookies are associated with advertising on the site provided by third-party companies. They may be either persistent or session cookies.
19. 19. Cookies may be blocked, deleted, or restricted through the browser settings used by the Customer.
Device Identifier
20. 20. The data collected about the device identifier does not contain any personal data of the Customer.
21. 21. The purpose of collecting information about the device identifier is the internal accounting of mobile application users.
Mobile Network Operator Data
22. 22. The Service receives data via the mobile application about the operator providing mobile communication services to the Customer.
23. 23. The data collected about the mobile network operator does not contain any personal data of the Customer.
24. 24. The purpose of collecting information about the mobile network operator is to automatically set the country and interface language of the mobile application based on the Customer's location.
Order History
25. 25. The Service stores the Customer's trip history, including the time the order was created, the pick-up address, intermediate and final route addresses, the applied fare, the payment method, and other data provided when placing the Order.
26. 26. The purpose of collecting order history information is to improve the quality of services provided by automatically filling in order parameters using previously submitted data, thereby reducing the time required to place an order.