Modified and Effective from 18 October 2026
This Privacy Notice explains how personal data is collected, used, shared, retained and protected in connection with the WeeDRIVE App and Service. It also explains your rights regarding your personal data and how you may exercise them.
This Privacy Notice applies to:
This Privacy Notice applies to the processing of personal data in connection with:
If you provide personal data about another person, including a minor, you must be authorised to provide that information. Where appropriate, you should ensure that the person receives the relevant privacy information in a clear and age-appropriate form.
This Privacy Notice should be read together with the WeeDRIVE Terms and Conditions and any additional privacy information provided when personal data is collected. Capitalised terms used in this Privacy Notice have the meanings given to them in the Terms and Conditions unless stated otherwise.
Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Republic of Cyprus Law Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data, Law 125(I)/2018, and any other applicable data-protection legislation.
Different organisations may be responsible for processing personal data in connection with different parts of the WeeDRIVE Service.
MaaSLab [HE 437778, Address: John Kennedy, Iris House, Floor 2, 3106, Limassol] is a non-profit research and technology organisation established under the laws of the Republic of Cyprus. MaaSLab is the controller of the personal data processed through the WeeDRIVE App and platform. This includes personal data processed for:
As controller, MaaSLab determines why and how personal data is processed for these purposes.
MaaSLab can be contacted at:
Email: weedrive@maaslab.org
Website: www.maaslab.org
EMEL [ETAIRIA METAFORAS EPIVATON LEMESOU LIMITED, HE 258276, Address: Inomenon Ethnon, 4, ANASTASIA BUILDING, Floor 2, 6042, Larnaca, Cyprus] and any other Licensed Transport Operator providing a Ride act as separate controllers for the personal data they process to operate that Ride, assign and manage Drivers and Vehicles, contact the Passenger or Account Holder where necessary, manage operational and safety incidents, and comply with their transport-related and legal obligations.
For these purposes, the relevant Licensed Transport Operator may receive:
MaaSLab provides EMEL and the Licensed Transport Operator only with the personal data reasonably necessary for the Rides it operates.
EMEL’s website: https://limassolbuses.com/el/
WeeMOBILITY [WEEMOBILITY LTD; HE 464002; John Kennedy, 8, IRIS HOUSE, Floor 3, 3106, Limassol] acts as a separate controller for the personal data it processes to receive payments for Credits, administer monetary refunds, issue invoices and comply with applicable tax, accounting and financial obligations.
Payments are processed through Stripe. Full payment-card details are entered directly into Stripe. Of the payment-card details, WeeMOBILITY can see only the cardholder’s name used for the invoice. WeeMOBILITY does not receive or store the card number, the last four digits, the expiry date or the security code.
MaaSLab uses an external customer-support provider to provide customer support on MaaSLab’s behalf. The provider acts as MaaSLab’s processor and processes personal data only in accordance with MaaSLab’s documented instructions and the applicable data-processing agreement.
The provider may access relevant Account, Booking, Ride, location and contact information where necessary to respond to an enquiry, assist with a Ride, handle a complaint or investigate a reported incident.
Each controller is responsible for the personal-data processing purposes and means that it determines. A processor acts only on the documented instructions of the relevant controller, except where otherwise required by applicable law.
Depending on the matter concerned, a request relating to personal data may need to be addressed to MaaSLab, EMEL or the relevant Licensed Transport Operator, WeeMOBILITY or Stripe.
Processed personal data is related to the following individuals:
| Category | Individuals covered |
|---|---|
| Account Holders | Parents or legal guardians who create a Family Account, purchase Credits, make Bookings and manage Passenger profiles. |
| Account Members | Individuals given authorised access to a Family Account through their own Account Member access. |
| Passengers | Individuals for whom a Passenger profile is created or a Ride is booked. This primarily includes teenagers aged 12 to 18. It may also include younger children eligible to use a separate service available only to specifically authorised users. |
| Parents, guardians and contact persons | Parents, legal guardians, emergency contacts or other authorised persons whose details are provided in connection with a Passenger, Booking, Ride, safety matter or emergency. |
| App Users | Individuals who download, access or interact with the WeeDRIVE App. |
| People who contact customer support | Individuals who submit an enquiry or complaint, report an incident, request a refund or otherwise communicate with customer support. |
| Other individuals connected with a Ride or incident | Individuals whose personal data may be included in a safety or incident report, complaint, insurance claim, lost-property report or investigation connected with the Service. |
Where personal data relates to a minor, it may be provided by the minor’s parent or legal guardian, by an authorised Account Member, by the minor through their authorised App access, or generated while the minor uses the Service.
We process only the personal data reasonably necessary to operate, secure and improve the Service. Not every data category applies to every individual.
| Data category | Data | Source | Responsible controller(s) |
|---|---|---|---|
| Account Holder and Account Member data | Full name, telephone number, email address, Family Account role, linked family members, account status and communication preferences. | Provided by the Account Holder and, where applicable, completed or updated by the Account Member. | MaaSLab |
| Passenger identity and eligibility data | Passenger’s full name, date of birth, age, telephone number, connection to the Family Account and information required to determine eligibility for a particular service. | Provided by the Account Holder. | MaaSLab |
| Accessibility and special-needs data | Information about mobility or accessibility requirements, wheelchair use and other health-related or assistance information necessary to arrange an appropriate Ride and boarding time. | Voluntarily provided by the Account Holder. | MaaSLab and EMEL or the relevant Licensed Transport Operator, where required for a particular Ride. |
| Saved places and weekly schedule data | Names and addresses of saved places, including the Passenger’s home and activity locations, together with the days and times when the Passenger normally travels to or from each location. This information may reveal the Passenger’s regular movements and routines. | Entered and managed by the Account Holder, Account Member or Passenger through the App. | MaaSLab |
| Booking and Ride-location data | Passenger’s name, telephone number, Ride date, requested time, exact pickup and drop-off locations, estimated pickup and drop-off times, Booking status, booking PIN, assigned route, vehicle and Driver, cancellation or no-show information and Ride history. | Entered through the App or generated when planning and providing the Ride. | MaaSLab and EMEL or the relevant Licensed Transport Operator. The operator receives only the information required for the Rides it provides. |
| Passenger precise-location data | The precise GPS location of the Passenger’s phone during the tracking window beginning 10 minutes before the Ride, continuing throughout the Ride and ending 10 minutes after the Ride. The location is made available to the Account Holder and all Account Members so that they can monitor the Passenger’s location. | Collected from the Passenger’s phone through the User App when location permission is enabled. | MaaSLab |
| Vehicle location and Ride-tracking data | The vehicle’s real-time location, Ride progress and estimated arrival information. | Generated through the vehicle systems and Driver App. | MaaSLab, including processing by its external customer-support provider acting on MaaSLab’s instructions, and EMEL or the relevant Licensed Transport Operator. |
| Mapping, location-search and navigation data | Location searches, selected addresses and coordinates, map and navigation requests, route information, timestamps, device and application information and IP addresses. Mapbox may also receive the Driver’s device and Vehicle location where necessary to provide navigation. MaaSLab does not collect IP addresses for its own purposes, but Google Maps and Mapbox may automatically receive them when their services are used. | Collected from the User’s or Driver’s device when Google Maps or Mapbox functions are used through the App. | MaaSLab and, for processing they determine independently, Google and Mapbox. |
| Credits and Wallet data | Credits purchased, Gift Credits, available Wallet balance, Credits deducted for Bookings, Credits returned following cancellations and Wallet transaction history. | Generated through the App, Booking system and payment process. | MaaSLab |
| Payment-card and transaction data | Cardholder’s name, payment amount, date, payment status, transaction reference, refund information and invoice information. Full card details—including the card number, expiry date and security code—are entered directly into Stripe. | Provided by the Account Holder directly through Stripe and generated during payment, invoicing or refund processing. | WeeMOBILITY is responsible for receiving payments, administering monetary refunds and issuing invoices. Stripe processes card payments and acts as a separate controller for certain fraud-prevention, security and regulatory purposes. |
| Customer-support and call-recording data | Enquiries, complaints, refund requests, incident reports, correspondence, support notes, telephone numbers and recordings of customer-support calls. Call recordings are normally retained for one month. | Provided during telephone calls, emails or other communications and generated when the request is handled. | MaaSLab, including through its external customer-support provider. WeeMOBILITY, EMEL or the relevant Licensed Transport Operator may process the information where the matter concerns a payment or Ride for which it is responsible. |
| Ratings and feedback data | Ratings submitted following a Ride, comments and other feedback concerning a Passenger, Driver, Ride or the Service. | Provided by Account Holders, Passengers or Drivers. | MaaSLab, EMEL or the Licensed Transport Operator that performs the Ride. |
| Safety, complaint and incident data | No-shows, delays, conduct reports, accidents, emergencies, lost property, vehicle damage, additional cleaning, complaints, investigation records and information required for an insurance or legal claim. | Provided by Account Holders, Account Members, Passengers, Drivers, customer support or the Licensed Transport Operator, or generated when investigating an incident. | MaaSLab, EMEL or the relevant Licensed Transport Operator, depending on the matter. |
At the user’s request, Booking information may be exported to the calendar on the user’s device. The App does not read or import other information from the calendar. Once exported, the information may be processed by the relevant calendar provider under its own privacy terms.
The legal basis depends on the purpose of the processing, the organisation responsible for it and the individual whose personal data is being processed.
MaaSLab relies on performance of a contract only where the processing is necessary to perform its agreement with the relevant Account Holder or Account Member, or to take steps requested by that person before entering into the agreement. Where MaaSLab processes a Passenger’s personal data to provide a Ride booked by another person, it generally relies on legitimate interests, consent, compliance with a legal obligation or another legal basis identified below.
| Purpose | Personal data used | Legal basis | Controller(s) |
|---|---|---|---|
| Creating and managing accounts | Account Holder and Account Member details, Family Account roles, linked Passenger profiles, account status and communication preferences. | For the Account Holder or Account Member: performance of the agreement governing use of the App. For linked Passenger information: legitimate interests in administering the Family Account, enabling authorised access and providing the requested Service. | MaaSLab |
| Confirming Passenger identity and eligibility | Passenger’s name, date of birth, age, telephone number and connection to the Family Account. | Legitimate interests in confirming eligibility, preventing misuse, applying age requirements and ensuring that the Passenger is offered an appropriate service. | MaaSLab |
| Managing saved places and weekly schedules | Home and activity addresses, preferred days and times, and regular travel schedules. | For information entered and managed by the Account Holder or Account Member: performance of the agreement governing use of the App. For information relating to a Passenger: legitimate interests in organising and providing the transport requested by the Account Holder or Account Member. | MaaSLab |
| Creating Bookings and planning routes | Passenger details, Booking information, requested time, pickup and drop-off locations, schedule and eligibility information. | For the Account Holder or Account Member making the Booking: performance of the agreement governing use of the Service. For Passenger information: legitimate interests in processing the Booking, planning an appropriate route, allocating available capacity and providing the requested Ride. | MaaSLab |
| Providing and coordinating Rides | Passenger’s name and telephone number, Booking details, pickup and drop-off locations, Account Holder’s telephone number, Booking PIN, route, Driver and Vehicle information. | For the Account Holder or Account Member: performance of the agreement governing the Booking. For Passenger and contact-person information: legitimate interests in providing, coordinating and completing the Ride safely. Processing may also be necessary to comply with applicable transport, accessibility and safety obligations. | MaaSLab and EMEL or the relevant Licensed Transport Operator, according to their respective responsibilities. |
| Tracking the Passenger’s phone | Precise GPS location of the Passenger’s phone from 10 minutes before the Ride, throughout the Ride and until 10 minutes after the Ride. | Consent under Article 6(1)(a) GDPR. Location tracking is optional and permission may be withdrawn through the Passenger’s phone settings. Withdrawal stops the collection and sharing of the phone’s location but does not prevent the Passenger from taking the Ride. | MaaSLab |
| Tracking the Vehicle and displaying Ride progress | Vehicle location, route progress and estimated arrival information. | Legitimate interests in operating the Service efficiently, coordinating Drivers and Vehicles, providing Ride updates and supporting Passenger safety. Where Ride-tracking information is displayed to the Account Holder or Account Member as part of a confirmed Booking, processing is also necessary to perform the agreement governing the Booking. | MaaSLab, including processing by its external customer-support provider acting on MaaSLab’s instructions, and EMEL or the relevant Licensed Transport Operator. |
| Providing maps, location search and navigation | Location searches, selected addresses and coordinates, map and navigation requests, route information, timestamps, device and application information and IP addresses processed by the relevant mapping provider. | MaaSLab’s legitimate interests in providing address-search, mapping, routing and navigation functions. Google Maps and Mapbox process certain information under their own legal bases where they act as separate controllers, as further explained in Sections 9 and 10. | MaaSLab and, for processing they determine independently, Google and Mapbox. |
| Accommodating accessibility and assistance requirements | Mobility, wheelchair, accessibility, health-related and assistance information. | Consent under Article 6(1)(a) GDPR and, where the information constitutes health data, explicit consent under Article 9(2)(a) GDPR. In a genuine emergency, processing may also be necessary to protect the vital interests of the Passenger or another person under Articles 6(1)(d) and 9(2)(c) GDPR. | MaaSLab and EMEL or the relevant Licensed Transport Operator, where the information is required for a particular Ride. |
| Managing Credits and Wallet balances | Credit purchases, deductions, returns, Reward Credits, Wallet balance and Wallet transaction history. | For the Account Holder: performance of the agreement governing Credits and Bookings. Legitimate interests in maintaining accurate Wallet and transaction records, preventing misuse and resolving account discrepancies. | MaaSLab |
| Processing payments, monetary refunds and invoices | Cardholder’s name, payment amount, payment status, transaction reference, refund information and invoice information. | For WeeMOBILITY: performance of the payment transaction requested by the Account Holder and compliance with applicable tax, accounting and financial obligations. Stripe determines the legal bases for processing carried out for its own fraud-prevention, security and regulatory purposes, as described in Stripe’s privacy notice. | WeeMOBILITY and, for processing it determines independently, Stripe. |
| Providing customer support | Account, Booking, Ride, payment, correspondence, complaint and incident information. | For support necessary to administer an account, payment or Booking: performance of the relevant agreement. For Passenger information and other support activities: legitimate interests in responding to enquiries, resolving complaints, assisting with Rides and improving customer support. | MaaSLab, WeeMOBILITY, EMEL or the relevant Licensed Transport Operator, depending on the subject of the request. MaaSLab’s external customer-support provider acts as MaaSLab’s processor. |
| Recording customer-support calls | Caller’s voice, telephone number and information discussed during the call. | Legitimate interests in maintaining an accurate record of communications, monitoring service quality, training support personnel and resolving complaints, subject to prior notice and appropriate safeguards. Consent will be obtained where required by applicable law. | MaaSLab, including processing by its external customer-support provider acting on MaaSLab’s instructions. |
| Collecting ratings and feedback | Ratings, comments and feedback concerning Passengers, Drivers, Rides or the Service. | Legitimate interests in monitoring service quality, identifying operational problems and improving the Service. Ratings do not automatically result in account suspension or termination. | MaaSLab and, where it uses the information for its own service-quality purposes, EMEL or the relevant Licensed Transport Operator. |
| Protecting safety and investigating incidents | No-show, conduct, accident, emergency, damage, cleaning, lost-property, complaint and investigation information. | Legitimate interests in protecting Passengers, Drivers and the Service, preventing and investigating misconduct and maintaining appropriate safety records; compliance with applicable legal obligations; establishment, exercise or defence of legal claims; and protection of vital interests in an emergency. | MaaSLab, EMEL or the relevant Licensed Transport Operator, depending on the incident and their respective responsibilities. |
| Sending operational communications | Contact details, Booking information, Ride updates, pickup and drop-off notifications, service disruptions, safety messages and changes to applicable terms. | For communications necessary for an account or confirmed Booking: performance of the relevant agreement. For safety, operational and service-related communications concerning a Passenger: legitimate interests in keeping the Account Holder, Account Members and Passenger appropriately informed. | MaaSLab and, where relevant to a Ride it provides, EMEL or the relevant Licensed Transport Operator. |
| Sending promotional communications | Contact details and communication preferences. | Consent under Article 6(1)(a) GDPR, where consent is required. Consent may be withdrawn at any time. | MaaSLab |
| Exporting a Booking to a calendar | Booking date and time and the selected pickup and drop-off locations. | Performance of the calendar-export function specifically requested by the User and consent to any device permission required to complete the export. | MaaSLab |
| Conducting research and innovation activities | Pseudonymised Booking, Ride, route, location and mobility information required for approved research and innovation activities, including the metaCCAZE project. Accessibility or health-related information is not included unless a separate legal basis and an applicable Article 9 GDPR condition have been established. | MaaSLab’s legitimate interests under Article 6(1)(f) GDPR in conducting, validating, evaluating, reporting and auditing approved research and innovation activities, following a documented legitimate-interests assessment and subject to the safeguards described in Section 11. Where another legal basis is required for a particular research activity, MaaSLab will provide additional information before that processing begins. | MaaSLab |
| Complying with law and handling legal claims | Account, Booking, Ride, payment, support and incident records relevant to the legal requirement or claim. | Compliance with applicable legal obligations under Article 6(1)(c) GDPR and legitimate interests in establishing, exercising or defending legal claims. Where special-category information is involved in a legal claim, Article 9(2)(f) GDPR may also apply. | The organisation responsible for the relevant processing. |
Where a controller relies on legitimate interests, it considers the necessity of the processing and balances its interests against the rights and freedoms of the affected individual. Particular attention is given to the interests and rights of minor Passengers. Further information about a legitimate-interests assessment may be requested using the contact details in Section 15.3.
Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing that took place before withdrawal.
Where an information-society service is offered directly to a child and the processing is based on consent within the meaning of Article 8 GDPR, a child aged 14 or over may generally provide their own consent under Cyprus law. For a child under 14, consent or authorisation must be provided by the holder of parental responsibility. Where the processing concerns accessibility or health-related information, consent must be obtained from the data subject or, where permitted or required by applicable law, from the holder of parental responsibility.
MaaSLab may use personal data to produce aggregated statistics and anonymised datasets for research, service evaluation and transport-planning purposes. Once data has been rendered genuinely anonymous so that no individual can reasonably be identified, it is no longer personal data under the GDPR.
MaaSLab will not provide identifiable Passenger information or precise individual travel histories to external students or researchers. If a research project involves personal-data categories, purposes or recipients beyond those described in this Privacy Notice, MaaSLab will establish the applicable lawful basis, implement appropriate safeguards and provide additional privacy information or obtain consent where required.
Pseudonymised data remains personal data and continues to be protected under the GDPR. MaaSLab may use pseudonymised Booking, Ride, route, location and mobility data for approved research and innovation projects, on the legal basis stated in Section 5.1 and subject to the Article 89 safeguards described in Section 11.
An Account Holder may provide and manage personal data relating to a minor for whom they have parental or legal responsibility. This includes creating the Passenger profile and managing the information described in Section 4.
The Account Holder, and any authorised Account Member with the relevant permissions, may view information relating to the Passenger, including their profile, Bookings, saved places, weekly schedule and Ride information.
Where location permission is enabled on the Passenger’s phone, the Account Holder and all Account Members connected to the Family Account may view the Passenger’s precise location from 10 minutes before the Ride, throughout the Ride and until 10 minutes after the Ride.
Minor Passengers also view this Privacy Notice giving clear and age-appropriate information about how their personal data is used, including when their phone location is being collected, who can view it and how location permission can be withdrawn.
The Account Holder may voluntarily provide information about a Passenger’s accessibility, mobility, wheelchair or assistance requirements where this is necessary to arrange and provide a suitable Ride.
Some accessibility or assistance information may constitute health data under the GDPR. MaaSLab processes such information only with explicit consent or where another legal basis permitted by applicable law applies.
MaaSLab limits access to this information to authorised personnel. It is shared with EMEL or the relevant Licensed Transport Operator and Driver only where necessary to:
Where customer support is contacted, this information may also be disclosed to MaaSLab’s external customer-support provider.
Consent may be withdrawn at any time by contacting MaaSLab. Withdrawal does not affect processing that occurred before consent was withdrawn, but it may limit MaaSLab’s ability to accommodate the Passenger’s requirements. The information will be deleted when it is no longer necessary, unless retention is required by law or in connection with an incident or legal claim.
MaaSLab processes the locations entered or saved through the App, including home and activity addresses, weekly schedules and the pickup and drop-off locations selected for a Booking.
Where location permission is enabled, the User App collects the precise GPS location of the Passenger’s phone during a limited tracking window:
The App does not collect the Passenger’s precise phone location outside this tracking window.
During the tracking window, the Passenger’s precise phone location is made available through the Family Account to the Account Holder and all Account Members connected to that Family Account. Every Account Member added to the Family Account can view the Passenger’s location during this period.
MaaSLab, EMEL or the relevant Licensed Transport Operator, and MaaSLab’s external customer-support provider, process the vehicle’s real-time location to operate the Ride, monitor its progress, calculate estimated arrival times and provide live Ride information through the App or customer support.
Access is limited according to operational need:
The Passenger may withdraw phone-location permission through the device settings. If permission is withdrawn, the Ride may still operate, but the Account Holder and Account Members will not be able to monitor the Passenger’s phone location through the App. Vehicle-location and Ride-progress information remain available.
Where necessary for the purposes described in this Privacy Notice, personal data may be shared with:
Only personal data reasonably necessary for the relevant purpose is shared. Service providers acting on MaaSLab’s behalf must comply with appropriate confidentiality, security and data-protection obligations.
MaaSLab does not sell or rent personal data.
MaaSLab’s and EMEL’s main operational databases are hosted within the EEA. Other controllers and service providers may process personal data in other countries as described below.
Certain limited personal data may nevertheless be processed outside the EEA when third-party mapping and navigation services are used.
Google Maps may process location searches, coordinates, IP addresses and related technical information in countries where Google or its service providers operate.
WeeDRIVE uses Mapbox to provide navigation through the Driver App. Mapbox’s standard cloud services are hosted in the United States and may process IP addresses, device information, coordinates and navigation-related information there.
MaaSLab selected Google Maps and Mapbox after considering their technical expertise, reliability, security measures, data-protection arrangements and mechanisms for protecting personal data transferred outside the EEA.
These providers maintain technical and organisational safeguards that include encryption, access controls, data-minimisation measures, security monitoring and recognised international data-protection mechanisms. MaaSLab limits its integrations with these providers to the information required to provide the relevant mapping and navigation functions.
MaaSLab reviews the applicable contractual terms, privacy documentation and transfer safeguards and may reconsider the use of a provider if it no longer provides sufficient guarantees for the protection of personal data.
WeeMOBILITY uses Stripe to process payments, administer monetary refunds and issue invoices. Stripe and its affiliates or service providers may process transaction, identity, fraud-prevention and related technical information outside the EEA, including in the United States.
Where personal data is transferred outside the EEA, the relevant controller will ensure that the transfer is covered by an applicable European Commission adequacy decision or by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses together with supplementary measures where required.
Further information about Stripe’s processing activities and international-transfer safeguards is available in the Stripe Privacy Policy.
MaaSLab is responsible for selecting and integrating Google Maps and Mapbox and for the personal-data processing activities over which MaaSLab determines the purposes and means.
Google and Mapbox are separately responsible for the lawfulness and security of any processing that they perform for purposes determined independently by them, including the operation, security, fraud prevention and improvement of their respective services.
Where a personal-data incident originates within a provider’s systems or results from processing independently controlled by that provider, the provider is responsible for complying with the legal obligations applicable to that processing. MaaSLab will nevertheless take any steps required of it under applicable law, including cooperating with the provider, assessing the effect on WeeDRIVE Users and notifying affected individuals or the competent supervisory authority where required.
Responsibility for any particular incident will depend on the circumstances and the respective roles of MaaSLab and the provider. Nothing in this Privacy Notice limits the rights available to individuals under the GDPR.
Where Google Maps, Mapbox, Stripe or another service provider processes personal data outside the EEA, the relevant transfer will be protected through an applicable legal mechanism. Depending on the provider and destination, this may include:
Further information is available in the Google Privacy Policy and the Mapbox Privacy Policy. You may also contact MaaSLab to request further information about the safeguards applying to your personal data.
Personal data is retained for the periods set out below:
| Data category | Retention period |
|---|---|
| Account and Passenger-profile data | While the relevant account remains active and for up to 90 days following an account deletion request, unless continued retention is required for another purpose specified below. |
| Accessibility and health-related information | Retained while the information remains relevant to the Passenger’s current accessibility or assistance requirements. Where the information is removed from the Passenger profile or the relevant account is deleted, it will be deleted within 90 days. Where particular information is relevant to a safety incident, complaint or legal claim, the necessary information may be retained with the relevant case records for the applicable six-year period. |
| Ratings and feedback data | Retained for up to two years after the relevant Ride or submission of the feedback for service-quality monitoring and operational improvement. Where feedback forms part of a complaint, safety incident or legal claim, it may be retained with the relevant case records for the applicable retention period. Aggregated and genuinely anonymised service-quality results may be retained without a fixed period. |
| Marketing preferences and opt-out records | Marketing preferences are retained while the account remains active or until they are changed or consent is withdrawn. Where a person unsubscribes, MaaSLab may retain the minimum information necessary to record and respect that choice and to demonstrate the withdrawal of consent, in accordance with the retention period applicable to consent records. |
| Recorded customer-support calls | One month from the date of the call. Where a recording is relevant to an unresolved customer-support request or complaint, it may be retained with the relevant support records until the matter is closed and for one year afterwards. Where a recording is relevant to a safety incident, it may be retained with the relevant safety and incident records while the incident is being investigated and for six years after it is finally resolved, or for longer where related legal proceedings remain ongoing. |
| Operational Passenger GPS data | Precise location data directly connected to the Passenger’s account is retained for up to 90 days after the relevant Ride. Where particular location data is relevant to a complaint or safety incident, the necessary data may be preserved with the relevant case records for the applicable six-year period. |
| Pseudonymised location and mobility research data | Location, Ride and mobility data required for an approved research or innovation project may be retained in pseudonymised form for up to six years after the relevant Ride where this is necessary to complete the research, validate results, fulfil project-reporting or audit requirements and ensure research reproducibility. The need for continued retention will be reviewed periodically, and the data will be anonymised or deleted earlier where the research purposes can reasonably be achieved without retaining personal or pseudonymised data. |
| Booking and Ride history | Six years after the relevant Ride. |
| Customer-support communications | One year after the relevant request is closed, unless the communication relates to an unresolved complaint or safety incident. |
| Safety and incident records | While the incident is being investigated and for six years after it is finally resolved, or longer where proceedings remain ongoing. |
| Invoices and payment records | For the period required by applicable tax, accounting and financial laws, which may be up to ten years. |
| Consent records | While the relevant processing continues and for up to six years following account deletion or withdrawal of consent. Only the information necessary to demonstrate when, how and for what purpose consent was provided or withdrawn will be retained. |
Where personal or pseudonymised data is retained for scientific research or innovation purposes, MaaSLab will apply appropriate safeguards in accordance with Article 89 GDPR. These safeguards include, where applicable:
External students will receive only aggregated or genuinely anonymised information unless a separate lawful basis, approved research protocol and appropriate data-protection safeguards have been established.
MaaSLab does not retain App security logs, push-notification tokens, device identifiers, operating-system or App-version information, crash diagnostics or similar technical data.
Where Google Maps, Mapbox, Stripe or another provider processes technical information as a separate controller for its own purposes, that provider determines the applicable retention period in accordance with its own privacy notice.
Selecting “Delete Account” does not necessarily result in the immediate deletion of every record. Certain information may continue to be retained for the periods and purposes specified above.
The automated Booking, routing and service-planning systems used by WeeDRIVE are developed and operated by MaaSLab as part of research and innovation projects. These systems:
MaaSLab has assessed these operational processes and concluded that they do not produce legal effects or otherwise similarly significantly affect Users within the meaning of Article 22 GDPR. Nevertheless, a User who believes that an automated outcome is incorrect may contact WeeDRIVE customer support and request that the outcome be reviewed by an authorised member of the WeeDRIVE team.
The system applies predefined eligibility and operational criteria, including the Passenger’s eligibility, Service Area, operating hours, requested locations and times, available seats, Vehicle capacity and route feasibility. It does not infer the Passenger’s personality, behaviour or personal preferences. The result may prevent a Booking from being completed or may cause a confirmed Booking to be cancelled where the Ride cannot be provided.
These operational processes are not intended to produce legal effects or similarly significant effects within the meaning of Article 22 GDPR. Nevertheless, a User who believes that an automated outcome is incorrect may contact WeeDRIVE customer support and request that the outcome be reviewed by an authorised member of the WeeDRIVE team.
Google Maps is integrated into the User App to display maps and allow Users to search for and select saved places, pickup locations and drop-off locations.
Mapbox is integrated into the Driver App to provide Drivers with routing and navigation to the relevant pickup and drop-off locations.
Google Maps and Mapbox do not determine Passenger eligibility, Booking availability or whether a Booking is accepted or cancelled. These functions are performed by the systems developed and operated by MaaSLab.
WeeDRIVE does not use Passenger ratings to make automated decisions about account suspension and does not profile minors for advertising purposes.
WeeDRIVE may contact Account Holders, Account Members or Passengers where necessary to provide and administer the Service. These communications may include:
Service communications may be sent through the App, push notification, email, SMS or telephone depending on the content. Because these communications are necessary to provide the Service safely and effectively, they are not treated as promotional marketing.
The App may request permission to send push notifications. Users may manage notification permissions through their device settings. Disabling essential notifications may prevent the User from receiving important Booking, Ride or safety information.
WeeDRIVE may send Account Holders or adult Account Members information about new services, promotions, surveys or events where permitted by law and, where required, after obtaining consent.
You may withdraw your consent or unsubscribe from promotional communications at any time by using the unsubscribe method provided in the communication, changing the relevant App settings or contacting WeeDRIVE customer support. Withdrawing from promotional communications will not prevent you from receiving essential service or safety communications.
WeeDRIVE does not use personal data to target minor Passengers with advertising.
Subject to the conditions and exceptions provided by the GDPR, you may exercise the following rights:
| Right | What it means |
|---|---|
| Access | You may ask whether the relevant controller processes personal data about you and request a copy of that data together with information about how it is used. |
| Rectification | You may ask the relevant controller to correct personal data that is inaccurate or complete data that is incomplete. |
| Erasure | You may ask the relevant controller to erase your personal data in circumstances provided by the GDPR, including where the data is no longer necessary, consent has been withdrawn and no other legal basis applies, or the data has been processed unlawfully. This right is subject to applicable exceptions, including legal obligations, legal claims and qualifying scientific research conducted with the safeguards required by Article 89 GDPR. |
| Restriction | You may ask MaaSLab to restrict the use of your personal data in certain circumstances, including while its accuracy or the lawfulness of its processing is being examined. |
| Objection | You may object to processing based on legitimate interests for reasons relating to your particular circumstances. You may object to direct marketing at any time. |
| Data portability | Where processing is based on consent or a contract and is carried out electronically, you may request certain personal data in a structured, commonly used and machine-readable format or ask for it to be transferred to another controller where technically feasible. |
| Withdrawal of consent | Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn. |
| Automated decisions | Where applicable, you may request information about an automated outcome and ask for human review, express your point of view and challenge the outcome. |
Requests may be submitted to MaaSLab at weedrive@maaslab.org.
Please describe the right you wish to exercise and the personal data or account concerned. MaaSLab may request information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.
MaaSLab will respond without undue delay and normally within one month. Where a request is particularly complex or several requests have been submitted, this period may be extended by up to two additional months. You will be informed within the initial one-month period if an extension is required.
Requests are handled free of charge. Where a request is manifestly unfounded or excessive, particularly because it is repetitive, MaaSLab may charge a reasonable administrative fee or refuse to act, as permitted by the GDPR.
Where your request concerns processing for which EMEL or another Licensed Transport Operator, WeeMOBILITY, Stripe, Google or Mapbox acts as a separate controller, the request should normally be submitted directly to that organisation. If you submit such a request to MaaSLab, MaaSLab will inform you where another controller is responsible and will provide reasonable assistance in identifying the relevant controller and directing your request.
A minor Passenger has data-protection rights in their own name. Depending on the Passenger’s age and circumstances, the Passenger may exercise those rights directly or through a parent or legal guardian.
A parent or guardian may submit a request on behalf of a minor where legally authorised to do so. MaaSLab may request evidence of identity, parental responsibility or other authority before responding.
MaaSLab applies technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, destruction or cyber attacks.
These measures include, where appropriate:
Access to information concerning minor Passengers, precise locations and accessibility needs is limited to authorised persons who require it for their work.
No electronic system can guarantee absolute security. MaaSLab regularly reviews its security measures and updates them where reasonably necessary, taking into account the nature of the data, available technology and the risks associated with the processing.
If MaaSLab becomes aware of a personal-data breach, it will investigate the incident, take appropriate steps to limit its effects and notify the competent supervisory authority and affected individuals as required by law.
Where an incident involves a service provider, MaaSLab will cooperate with that provider to investigate the incident and fulfil the obligations applicable to MaaSLab. The provider remains responsible for complying with the legal and contractual obligations applicable to the systems and processing activities under its control.
For questions about this Privacy Notice, the use of your personal data or the exercise of your data-protection rights, please contact:
MaaSLab
Email: weedrive@maaslab.org
Data Protection Officer: Prof. Maria Kamargianni
Please do not include unnecessary sensitive information in your initial communication.
If you have concerns about how your personal data has been processed, you may contact MaaSLab so that the matter can be investigated.
You also have the right to lodge a complaint directly with:
Office of the Commissioner for Personal Data Protection
Kypranoros 15
1061 Nicosia, Cyprus
Telephone: +357 22 818456
Email: commissioner@dataprotection.gov.cy
Website: www.gov.cy/dataprotection
Contacting MaaSLab first does not limit your right to complain directly to the Commissioner or to seek another remedy available under applicable law.
MaaSLab may update this Privacy Notice to reflect changes to the WeeDRIVE Service, its data-processing activities, service providers, legal requirements or data-protection practices.
The effective date of the current version will be displayed at the beginning of the Privacy Notice.
Where a change materially affects how personal data is collected, used or shared, MaaSLab will provide reasonable advance notice through the App, by email or through another appropriate communication method.
Where a new processing activity requires consent, MaaSLab will request that consent before the processing begins. Continued use of the Service will not be treated as consent where applicable law requires a specific, informed and affirmative choice.
You should review this Privacy Notice periodically to remain informed about how personal data is processed.