Legal/For Partners/

Privacy Policy

Introduction

This Privacy Policy describes how Wheely Technologies Ltd and its affiliates (“Wheely”, “we”, “us” or “our”) collect and process your personal data when you visit our website and use our mobile app. It also explains how we use and protect your data, along with your rights.

“Personal data” is information, or a combination of pieces of information that could reasonably allow you to be identified.

1. PERSONAL DATA WE PROCESS

You may provide us with personal data through our website, mobile app or by corresponding with us via phone, email or otherwise. The categories of data we may process are as follows:

• General Data — including name, email, phone number, address (this is collected directly from you).
• Geolocation Data — including geolocation of drivers and driving routes (this is collected through the Wheely driver app when you are using it).
• Technical Data relating to your vehicle — including the make and model, technical specifications, age, registration number and compliance status.
• App Usage Data — including your engagement and interactions on the Wheely platform, as well as your rating and feedback from passengers.
• Identification/Verification Data — including your licence, photo and identity documents.
• Criminal Record Data — including cautions, criminal convictions and offences.
• Communication Data — including conversations you have using Wheely’s in-app chat function or when you speak with our customer service agents, the date and time of the communication and its content.
• Financial and Taxation Data — such as your taxpayer identification number, business structure, VAT ID, place of birth and your financial account identifier.
• User-generated Data — including audio recordings generated during the trip or any other content submitted like pictures, videos or files in connection with a customer support request.
• Driving Data — whilst you are using the app, we may collect data related to your driving, such as the speed, acceleration and braking.

We may also need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

INFORMATION WE COLLECT FROM THIRD PARTIES

In addition to above mentioned sources, we may collect and receive your data from third parties such as:

• The DVLA;
• Fleet partners;
• Service providers who conduct vehicle and driver compliance checks and criminal background checks; and
• Passengers and third parties who provide information and content in connection with the service or in regard to possible claims and disputes.

INFORMATION WE COLLECT USING AUTOMATED TECHNOLOGIES

As you interact with our website or app, we may automatically collect the personal data described above, as well as information about your device, browsing activity and patterns. We may collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites deploying our cookies as further described in our cookie statement.

From time to time, we utilise Application Programming Interfaces (“APIs”) to automate and expedite verification, compliance checks, onboarding and related operational processes. APIs are tools which allow one application to request and receive information from another. This process involves transmitting a limited amount of personal data (such as your name and your vehicle’s license plate) to an external API (for example, operated by the DVLA) and receiving a response containing such personal data as may be accessible via the relevant API. The data processed in this way may include General Data, Technical Data and Criminal Record Data. Where required by law, we will notify you and obtain consent before commencing the relevant processing.

If you do not wish for your data to be processed in this way, you may opt out. Please see section 8 for more details.

2. HOW WE USE YOUR INFORMATION AND THE BASIS ON WHICH WE USE IT

We will only process your data where we have a need to do so.

For example, we process your personal data:

• To enable you to provide your services by connecting you to passengers, including to help passengers identify the chauffeur and the vehicle.
• To analyse the geographical area, give suggestions to chauffeurs and improve our service.
• To deal with your enquiries and requests and to provide customer support.
• To enable you to communicate with passengers directly by either voice or chat. Note that we do not disclose your phone number to the passenger, or vice versa. In order to enable this feature, we receive the date, time and content of the communication. This information also allows us to resolve disputes and to improve the safety and security of our users and chauffeurs.
• To measure your service performance in order to ensure reliable services for passengers and to improve their experience.
• To contact you via email or using push notifications with marketing and offers (unless you have opted out of marketing, or we are otherwise prevented by law from doing so).
• For analytical and advertising and marketing purposes, including interest-based advertising in line with your preferences. We also use measurement tools to measure the effectiveness of our advertising campaigns. Note that you can opt-out by enabling “limit ad tracking” on your device.
• To personalise the marketing messages we send you to make them more relevant and interesting.
• To analyse how our platform is used in order to help us improve it and fit it to our chauffeurs’ needs.
• For fraud prevention. We use automated technology to analyse interactions between our chauffeurs and Wheely as well as between chauffeurs and passengers in order to ensure that chauffeurs behave legitimately on the platform. We may suspend accounts that we believe to be fraudulent. We may also use biometric data to verify your identity.
• To ensure compliance with applicable laws and passenger safety and to protect our rights or the rights of others, including through the issuance or defence of legal claims.

We must have a legal basis to process your personal data. In most cases, the legal basis will be one of the following:

• Contractual obligations: Personal data is processed to facilitate the fulfilment of the contract between the chauffeur and the user or Wheely.
• Legitimate interest: Personal data may be processed on the ground of legitimate interest in doing so, for example:
  • to enable the provision of services through our platform and to monitor and ensure their quality;
  • to investigate and detect fraud and other malicious or unlawful activities and/or safety or security incidents;
  • for technical and cyber security reasons: such as combating piracy and ensuring the security of the service, website, Wheely platform and app as well as for making and storing back-up copies and preventing/repairing technical issues (depending on the issue, all data may be processed); and
  • to issue or defend legal claims.
• We may also in certain circumstances rely on alternative legal basis when it is more appropriate to do so, such as:
  • when it is necessary to comply with a legal obligation such as for processing data when the law requires it, including, for example, record-keeping obligations placed onto Wheely by various licensing authorities or the HMRC, or if there is a valid legal request to disclose personal information to a third party such as a court or regulatory authority;
  • when it is necessary to protect your vital interests, or those of others, for example in the event of an emergency or a threat to life; and/or
  • when you have given us clear consent to do so for another specific purpose of which you have been fully informed.

In countries where legitimate interest is not an available lawful basis for Wheely’s processing activities, we will instead rely on an alternative valid legal basis available as set out above.

Where personal data is processed for a new purpose which is different to the purpose for which the personal data was originally collected and the processing is not based on the data subject’s consent, we carefully consider such new processing to determine whether it is compatible with the purpose for which the personal data are initially collected. We will consider any link between the original purpose and the new purpose, the context in which the data are processed, the nature of the data, the possible consequences of the processing, and any safeguards that can be taken to ensure the data are adequately protected.

To the extent we process any special category data or criminal record data, we shall in addition to relying on one of the lawful bases set out above, rely on the fact that such processing is necessary to comply with our legal obligations and/or it is in the substantial public interest to do so.

We may obtain your consent to collect and use certain types of personal information when we are required to do so by law. If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this privacy policy.

3. OUR USE OF COOKIES

We strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. Where you have given your consent (where lawfully required), we use cookies, log files and other technologies to collect personal information from the device you use to access our website, app and services.

We may use “cookies”, “web beacons” or “pixel tags” (“Tags”) and mobile identifiers. Tags allow us to track receipt of an e-mail to you, to count users that have visited a webpage or opened an e-mail and collect other types of aggregated information. Once you click on an e-mail that contains a Tag, your contact information may subsequently be cross-referenced to the source e-mail and the relevant Tag. In some of our e-mail messages, we use a “click-through URL” linked to a certain website administered by us or on our behalf.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. See our cookie statement for more details.

4. HOW WE SHARE YOUR INFORMATION

We may share your personal data with third parties under the following circumstances:

• Information shared with passengers: Once you accept a booking request, we will share your name, photo, rating, vehicle details and geolocation data with the user.
• Information shared with local subsidiaries and affiliates: Depending on the location of the chauffeur, personal data may be disclosed to one of Wheely’s local subsidiaries or other representatives, affiliates, agents, fleet owners etc. Processing of personal data by such entities will occur under the same conditions as established in this Privacy Policy.
• Information shared with trusted third parties and government agencies: We may share your data with trusted third-party service providers or with government agencies to enable the automated verification of documents required for you to provide your services as a chauffeur. This may include driving licence details, vehicle logbook details, insurance documentation and any other documents that we are legally or contractually required to verify. We will disclose only the minimum personal data necessary.
• Information shared with public authorities, law enforcement agencies and courts: We may disclose information in order to comply with a legal obligation, under a court order or where we cooperate with a data protection supervisory authority in handling complaints or investigations. We may also share your personal data with law enforcement or other public authorities (such as tax authorities), including responding to requests when the information is required by law or furthers a public interest task. In any scenario, we will always satisfy ourselves that we have a lawful basis on which to share the information, and we will make sure that we document our decision.

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on “International Data Transfer” below for more information.

5. INFORMATION SECURITY AND STORAGE

We implement technical and organisational measures to ensure a level of security proportionate to the risk to the personal information we process. These measures are aimed at ensuring the ongoing integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.

Furthermore, we implement appropriate technical and organisational measures for API transfers, including industry-standard encryption in transit and access controls. We monitor and review API integrations, apply data minimisation and set retention controls.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

• Maintain business records for analysis and/or audit purposes.
• Comply with record retention requirements under the applicable law (s).
• Defend or bring any existing or potential legal claims.
• Deal with any complaints regarding the services.

We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

6. INTERNATIONAL DATA TRANSFERS

Wheely services are offered from our United Kingdom headquarters and we have subsidiaries with offices in the United States, France, the United Arab Emirates and Cyprus. In addition, some of our service providers are located in these and other jurisdictions. Please therefore note that your personal information may be transferred to, stored, and processed in countries outside the European Union or United Kingdom that do not have similar data protection laws to the European Union or United Kingdom.

We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

7. YOUR RIGHTS OVER YOUR PERSONAL INFORMATION

You have certain rights regarding your personal information, subject to local law. These include the following rights to:

• Access your personal information.
• Rectify the information we hold about you.
• Erase your personal information.
• Restrict our use of your personal information.
• Object to our use of your personal information.
• Receive your personal information in a usable electronic format and transmit it to a third party (right to data portability).
• Lodge a complaint with your local data protection authority.

You may also object to the processing of your personal information for advertising and data analysis purposes at any time.

We request that you contact us to update or correct your information if it changes or if the personal information we hold about you is inaccurate.

We will contact you if we need additional information from you in order to honour your requests.

If you would like to discuss or exercise such rights, please contact us at the details below.

8. CONTACT US

Wheely is the controller responsible for the personal information we collect and process. For chauffeurs operating in the United States, Wheely USA Inc. is a joint controller, and Wheely Technologies Ltd. maintains the personal data associated with such users and is responsible for handling any requests regarding such data.

If you have questions or concerns regarding the way in which your personal information has been used, please contact us using the details provided below.

Email address: support@wheely.com, copying in londonpartners@wheely.com

Postal address: The Monastery Barn, Syon Park, London Road, Brentford, United Kingdom, TW8 8JF

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the data protection authority of the United Kingdom, the Information Commissioner’s Office using their website https://ico.org.uk/ or the data protection authority applicable to you.

9. CHANGES TO THE POLICY

You may request a copy of this Privacy Policy from us using the contact details set out above. We may modify or update this Privacy Policy from time to time.

If we change this Privacy Policy, we will notify you of the changes. Where changes to this Privacy Policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (for example, to object to the processing).