1. Data controller identification

This Privacy Policy explains how WAIIS SOLUTIONS IBERIA, S.L. (hereinafter, “WAIIS”) may collect, use and disclose your personal data through its mobile application (the “WAIIS Platform”), as well as your rights and how to exercise them.

WAIIS is committed to protecting and respecting your privacy. We operate in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and the guarantee of digital rights (“LOPDGDD”), together referred to below as the “Data Protection Legislation”.

The controller of users’ personal data in connection with services provided through the WAIIS mobile application is:

Data controller: WAIIS SOLUTIONS IBERIA, S.L.
Registered office: Rambla Catalunya, 49 — P. 3 Pta. 1, 08007, Barcelona
CIF: B09835778
Email: rgpd@waiis.com

2. Our approach to privacy

2.1 This Privacy Policy explains how we collect, store, process, transfer, share and use personal data that identifies or is associated with you (“personal information”) when using the WAIIS mobile app (the “Platform”).

2.2 This Privacy Policy applies exclusively to use of the mobile Platform operated by WAIIS. Please ensure you have read and understood it before accessing or using the app.

3. Information about our account type

WAIIS offers one type of user account. Through this account, users may use the Platform either to offer a journey as a driver or to book a journey as a passenger, depending on their needs.

This account is personal, unique and non-transferable. WAIIS is not responsible for improper or negligent use of the account by its holder, or for use by unauthorised third parties.

4. Who is responsible for using your personal information?

WAIIS as data controller

WAIIS acts as controller of users’ personal data when it:

Manages the creation and registration of user accounts in the WAIIS app.
Processes the information required to create and manage journeys, whether you are a driver or a passenger.
Administers payments, incentives, discounts and other services associated with the Platform.
Monitors use of the app to improve the service, ensure security, prevent fraud or meet regulatory requirements.
Processes data to obtain Energy Saving Certificates (CAEs) in accordance with the legal requirements set out in the CAE legal framework when the user uses the app in Spain.
If the app is used within an organisation that contracts us to make it available to its staff, we may process data relating to journey characteristics (excluding geolocation data), provided your organisation requests this and meets the requirements established by the GDPR.

5. Personal information we collect and how we use it

We collect different types of personal information when you use our mobile application. Below we explain what data we process, when we process it and for what purposes.

5.1 Registration and account creation

When you register in the mobile application, we ask for basic information to create your account and give you access to the Platform.

This includes information essential to providing the service: your first and last name and telephone number.

Optional information: your email address, whether you belong to a company and a profile photo. You may also complete optional fields such as your country and date of birth, nationality and identity document (DNI, NIE or passport).

This information is used to identify you correctly, provide the service, personalise your experience and, where applicable, allocate benefits linked to your organisation. The legal basis is performance of a contract (providing the service) and, for optional/voluntary data, your consent.

5.2 Using the Platform as a driver or passenger

As a registered user, you can use the app to offer and book journeys as either a passenger or a driver. We process the data you provide when creating or requesting a journey, such as its origin and destination, date and time, available seats, price, your preferences and messages exchanged with other users. You may also save favourite addresses or add details about your vehicle, such as its registration number.

This information is essential to managing and coordinating shared journeys. Data strictly necessary to provide the service is processed to perform the contract between you and WAIIS; data you provide voluntarily is processed on the basis of your consent.

5.3 Participation in the CAE programme

In connection with Energy Saving Certificates (CAEs), we process certain profile data (first and last name, email address, telephone number, identity documents and the registration number of the vehicle registered in the app and linked to the CAE) and journey details (duration, distance, arrival/destination cities, proof of payment and information about the users with whom you shared the journey) that are necessary to obtain CAEs in accordance with the legal requirements set out in the CAE legal framework. Our partner Delcae processes this data as a data processor to verify your eligibility and submit an application to Spain’s Ministry for the Ecological Transition and the Demographic Challenge.

For journeys eligible for the Energy Saving Certificate (CAE) incentive (the “Bonus”) and taken between 26 January 2023 and 19 July 2024, this processing is based on our legitimate interest in obtaining CAEs and enabling you to benefit from them. You may object when we contact you to transfer your energy-saving rights.

You may rectify or erase your data (before a CAE application is submitted), access information concerning you and/or object to this processing on legitimate grounds by contacting us.

All documents submitted with a CAE application are retained for at least three years after the CAEs are validated, to enable verification by public authorities.

Energy Saving Certificates are governed by Royal Decree 36/2023 of 24 January 2023, as partially implemented by Orders TED/815/2023 and TED/845/2023 of 18 July 2023, and by the simplified versions of TRA030 and TRA040 approved by Spain’s Ministry for the Ecological Transition and the Demographic Challenge (each or collectively, the “CAE legal framework”).

5.3.1 Location data

To prevent and detect fraud against the CAE system, WAIIS and/or its users, we need to collect real-time location data. This is a legal requirement of Spain’s Ministry of Transport, Mobility and Urban Agenda (MITMA) for obtaining CAEs.

Once a journey has been booked and confirmed, we track the driver’s and passengers’ locations during the journey and link this data to their respective accounts. This allows us to verify that the journey takes place as planned.

Precise location data collection starts when the user manually activates tracking by taking one of the following actions:

Conductores: al pulsar el botón “Have you started your journey?”.
Pasajeros: al pulsar el botón “Has the driver picked you up?”.

Tracking ends when the user manually stops the journey:

Conductores: al pulsar el botón “Have you finished your journey?”.
Pasajeros: al pulsar el botón “Has your driver dropped you off?”.

If the journey is not ended manually, location data collection will stop automatically once twice the estimated journey duration has elapsed.

To activate the Bonus and benefit from CAEs, you must grant permission to collect precise location data. Without this permission, the Bonus cannot be activated and you will not be eligible for CAEs.

If you have any questions about this process, please contact us at rgpd@waiis.com.

5.4 Payments and withdrawals

When you take part in paid journeys, we collect the information needed to process payments or transfers. This includes your bank details (such as card number or IBAN), first and last name, full address, city, country and postcode. If you request a balance withdrawal, you will need to complete identity verification (KYC) through our payment provider.

This data is processed to meet our legal obligations concerning anti-money laundering and to carry out agreed transactions. The legal bases are compliance with a legal obligation and performance of a contract.

6. How long we keep your personal information

WAIIS retains your personal information only for as long as necessary to fulfil the purposes for which it was collected and to meet any legal or contractual obligations arising from use of our app. While your account remains active and you continue to use the Platform, we retain your data to provide the service properly. If you stop using the app without closing your account, your data may be retained for up to five years from your last activity.

If you choose to close your account, your personal data will be deleted within 60 days. However, if your profile has received reports or negative ratings from other users, we may retain your information for an additional period to address any potential liability arising from the service, depending on the incident, and to protect the safety and proper use of the community.

Certain data may be retained for different periods where required by law. For example, information about payments or financial transactions must be retained for the period specified by current accounting and tax legislation (Article 66 of the General Tax Law). Certain content generated on the Platform, such as published journeys or exchanged messages, may also be retained in anonymised form for statistical or service-improvement purposes, without identifying the user.

Finally, where an account has been suspended or blocked due to fraudulent use or serious breaches of the Platform rules, WAIIS may retain relevant information for as long as necessary to determine any administrative or judicial liability arising from the user’s breach or fraudulent use.

7. Recipients of personal information

WAIIS will share user data with third parties only where necessary. We will never sell your data. External service providers (for example, hosting providers) working with WAIIS may use data to provide their services, but may not use it for their own purposes or disclose it to other third parties.

WAIIS seeks to protect personal data shared outside the company and ensures that third-party service providers maintain confidentiality and implement appropriate safeguards through the relevant data processing agreement. These providers must process information in accordance with data protection law.

In some cases, the law may require disclosure of personal data to public authorities or other parties. We will disclose only what is strictly necessary to comply with those legal obligations.

The following sub-processors have been appointed by WAIIS in accordance with Article 28 of the Regulation:

Google Cloud: provisión de servicios de infraestructura (servidores, bases de datos y almacenamiento). La información se almacena en sus servidores ubicados en europa-west4-a, Ems Harbor (Países Bajos), Europa.
Mangopay: proveedor de la pasarela de pago para procesar transacciones dentro de la plataforma. Servicios ubicados en Irlanda (Dublín) y Alemania (Frankfurt).
Segment (Twilio): envío de datos personales básicos y eventos de uso de la aplicación a plataformas de terceros para análisis y funcionalidad. Ubicado en Irlanda (Dublín).
Intercom: plataforma de soporte al usuario que gestiona datos personales básicos para ofrecer asistencia personalizada. Ubicada en Dublín, Irlanda (eu-west-1).
Customer.io: plataforma para el envío de notificaciones push y correos electrónicos.
Cometchat: plataforma de chat interno de la aplicación.
Amplitude: plataforma de análisis de datos de interacción de los usuarios con la aplicación. No incluye datos personales sensibles y toda la información está anonimizada.
Clarity: herramienta para monitorear sesiones de usuario, interacción con la interfaz y patrones de navegación, con fines analíticos. Servidores en Estados Unidos.

7.1 Third-party offers and benefits in your community

Some companies or organisations work with WAIIS to offer exclusive benefits to their members. To provide these benefits (for example, reserved parking spaces), we may share identification data (such as your name) or contact details (telephone number or email address) with third parties with whom we have appropriate confidentiality and data-processing agreements, together with records needed to apply the offer (for example, the number of journeys). This processing is necessary to perform the contract for the requested benefit and to participate in a community offering these benefits and promotions.

You can continue using the app without receiving these offers, but you will need to do so outside the community environment.

8. International data transfers

WAIIS aims to process all personal data within the European Economic Area (EEA) and avoids international data transfers wherever possible.

Data collected through the app is stored and processed mainly on Google Cloud Platform servers in the European Union. Although data is not routinely transferred outside the EEA, Google is a global provider and may be subject to legal obligations in third countries such as the United States, which could result in international access.

To ensure an adequate level of protection in these cases, WAIIS and Google have entered into the Standard Contractual Clauses approved by the European Commission and apply additional technical and organisational measures to limit access to and exposure of information.

If, exceptionally, we need to transfer your data to a country outside the EEA that has no adequacy decision from the European Commission, we will apply the safeguards required by Chapter V of the GDPR, including contractual safeguards, impact assessments and appropriate oversight mechanisms.

For more information about safeguards for international transfers, contact us at rgpd@waiis.com.

9. Exercising your data protection rights

Under the GDPR, you have the following rights in relation to the processing of your personal data:

Right to be informed: to receive clear, transparent and easily understandable information about how we use your personal data and your rights.
Right of access: to obtain access to your personal data.
Right to rectification: to have inaccurate or incomplete personal data corrected.
Right to erasure: to request deletion of your personal data when there is no compelling reason for us to continue using it. This right is not absolute and exceptions apply.
Right to restrict processing: to “block” or limit further use of your personal data.
Right to data portability: to obtain and reuse your personal data for your own purposes across different services.
Right to object: to object to certain types of processing.
Right to lodge a complaint: with your national data protection authority.
Right to withdraw consent: if you have given consent, you may withdraw it at any time.
Right not to be subject to automated decision-making: including profiling that produces legal effects concerning you.

You can exercise your rights by writing to: rgpd@waiis.com. In some cases, a request may be refused if it seeks to erase data required to meet legal obligations.

10. Processing children’s personal data

Our services are not directed at children. If any service is directed at children under 14, in accordance with Article 8 of the GDPR and Article 7 of Spanish Organic Law 3/2018 of 5 December (LOPDGDD), WAIIS will require valid, freely given, specific, informed and unambiguous consent from their legal guardians to process the children’s personal data. We will establish the legally required procedures to verify the identity of the person providing consent.

For users over 14, data may be processed with the user’s consent, except where the law requires the involvement of a person holding parental responsibility or guardianship.

WAIIS reserves the right to block an account if we suspect that fraudulent data were used to activate it.

11. Security measures for processing your data

WAIIS implements state-of-the-art security standards to prevent unauthorised access, maintain data accuracy and ensure information is used appropriately.

We also apply security measures to ensure the confidentiality, availability and resilience of systems used to process personal data.

We apply the same security standards when working with business and technology partners. We select and engage only processors and external providers that have appropriate security measures and provide sufficient safeguards, including technical and organisational measures, to protect the data entrusted to them.