Privacy Notice for Fleet Partner and Corporate Client Contacts

This notice is information provided under Art. 13 and 14 GDPR. It is not a consent and does not require your acceptance.

The contractual counterpart to this notice is Part D (fleet partners) and Part E (corporate clients) of the Platform Terms of Use (nutzungsbedingungen), together with the signed Fleet Partner Agreement or Corporate Client Agreement. Where this notice refers to a clause such as "D2" or "E2", it means a clause of those Parts.

1. Controller and Data Protection Requests

Controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this notice:

Emaride EU S.à r.l. société à responsabilité limitée under Luxembourg law represented by its sole manager Ramez Mohamad Alkhalaf Luxembourg [Placeholder: address to follow] Trade register (RCS): registration pending VAT (TVA): registration pending Email: info@emaride.lu

Data protection requests: privacy@emaride.lu

A data protection officer has not been appointed at present. Assessing whether an appointment is required under Art. 37 GDPR, and the appointment itself, are open items before go-live. Until then, privacy@emaride.lu is the responsible point of contact.

2. Who This Notice Applies To — and Who It Does Not

Emaride has three privacy notices. Which one applies to you does not depend on your role in the account, but on where your data comes from.

This notice applies to you as a contact person on the organisation side, that is, if you are

• an owner, member of management, or designated contact person of a fleet partner (role subcontractor_owner),
• a member working in the Platform for a fleet partner (role subcontractor_member), or
• an administrator of a corporate client account who maintains the designated authorised persons (clause E2).

Your data then arises from the contractual relationship between Emaride and your organisation — from the application, onboarding, billing, and ongoing administration of the account.

This notice no longer applies the moment you book or take a ride. Anyone who books a ride or is transported is a passenger, and the data arising from that — pickup and drop-off address, route, coordinates, fare, payment method, rating — is governed exclusively by the Privacy Policy for Passengers (datenschutz). This applies expressly to corporate clients and their authorised employees too: a ride booked for business purposes is, in data protection terms, the same processing as a ride booked privately.

Both notices can apply to you at the same time. If you administer a corporate client account and also book rides yourself, this notice governs your contact, contract, and billing data, while datenschutz governs your rides. That is not a contradiction but the consequence of two distinct processing operations.

This notice does not apply to drivers. Drivers receive the Privacy Notice for Drivers (datenschutz-fahrer), because Directive (EU) 2024/2831 and Art. 22 GDPR additionally apply to them — location processing, automated allocation of rides, and automated measures. None of that concerns contact persons. If, as the owner of a fleet partner, you are also approved as a driver yourself, both notices apply to you: this one for the contractual relationship, the driver notice for your activity behind the wheel.

3. Categories of Data Processed

What is personal data here is primarily your own contact data. We also list purely company-related details — company name, invoice prefix, payment term — because they sit in the same records and can be attributable to you.

Bank details are additionally ring-fenced: in the Platform, account holder, bank name, and IBAN are accessible only to the owner role and to authorised Emaride staff; the manager role has no access to them. This is enforced in the database access rules, not merely in the user interface.

Company records. Under clause D2.5 (b) of the Terms of Use, the fleet partner stores its company records on the Platform: transport authorisation, proof of the operating or fleet liability insurance, trade or commercial register record, optionally a tax clearance certificate and a social security clearance certificate, and any other documents the fleet partner adds itself. We store the file, the document type, the issue and expiry dates, the review status and, where applicable, a rejection reason; superseded versions are kept as history. These records concern the organisation. They contain personal data — such as the names of managing directors, owners, signatories, or beneficial owners — only in so far as it appears on the document itself; the Platform has no input fields of its own for such information. Access is limited to the users of your fleet partner account and to Emaride staff authorised for fleet partners in the relevant market, who review the records. The files are held in non-public storage with our hosting provider (clause 6). The evidence under clause D2 at driver and vehicle level — driving licence, vehicle registration, contrôle technique, insurance per vehicle — is not data about your contact persons; datenschutz-fahrer applies to it.

We do not process special categories of personal data (Art. 9 GDPR) about you.

4. Purposes and Legal Bases

No processing based on consent. None of the processing listed relies on your consent, and there is no consent mechanism. We do not send marketing or advertising messages to contact persons; all notifications are transactional (application status, invitations, invoices, payouts, document reminders, support, security notices).

5. Know-Your-Business, Anti-Money-Laundering, and Sanctions Screening

Under clause 4.3 of the Fleet Partner Agreement, a fleet partner must provide the beneficial-ownership and identity information required for know-your-business (KYB), anti-money-laundering (AML), and sanctions-screening obligations. That screening is a legal obligation and relies on Art. 6(1)(c) GDPR; no consent is obtained for it, and consent would not be the correct basis.

Who actually performs the screening is decisive for your rights, so we state it precisely:

• The screening is performed by the payment service provider (Stripe) as part of its own onboarding. You enter your identity, ownership, and bank details directly with it, in its form and under its responsibility as a licensed payment institution.
• Emaride neither sees nor stores those details. When the account is opened, all we transmit to the payment service provider is an internal identifier for your organisation, the business contact email address, and the country. All we receive and store in return is the identifier of the account created there and the information whether payouts are enabled.
• Emaride performs no sanctions screening or AML check of its own — no own database, no own matching, no own score. We take no automated decision about you on that basis.
• If the screening with the payment service provider remains incomplete or is adverse, payouts are not possible and onboarding may be refused or suspended under clause 4.3 of the Fleet Partner Agreement. At Emaride that decision is taken by a person, not by a system, and it is given to you with reasons under clause D5.2.

For access to, rectification, or erasure of the screening details held by the payment service provider, please therefore address that provider; we will assist you and name the right point of contact (privacy@emaride.lu).

Emaride takes no automated individual decisions within the meaning of Art. 22 GDPR about contact persons. The restriction, suspension, and termination procedures under clause D5 come with a statement of reasons on a durable medium and a review by a person (clause D5.4).

Exception: the blocklist. The blocklist can prevent re-registration after a serious exclusion (clause 4). Placing someone on the blocklist is decided by a person at Emaride, who records the reasons in writing. What happens at a later registration attempt is the enforcement of that earlier decision, not its formation. If only a name matches, nothing is decided at all — the case is referred to a person for review. If you believe a refusal was made in error, contact privacy@emaride.lu; we will review the case personally.

6. Recipients and Processors

Further recipients

• Emaride staff and mandated auditors — restricted by role and country, for approval, billing, support, and compliance. Only expressly authorised persons have access to the bank details.
• Authorities — where legally required, in particular tax and supervisory authorities and law-enforcement authorities within their powers.
• Tax advisers, auditors, and legal advisers — where necessary to comply with legal obligations or to pursue legal claims.
• Drivers of your fleet partner — on request we name to a driver the contact point we hold on file for their fleet partner, so that they can exercise their rights against their employer or principal.

Your contact data is not disclosed to passengers.

Processors (Art. 28 GDPR)

Emaride does not hold or manage ride funds itself; cashless card processing is handled exclusively by Stripe as the licensed payment service provider and Merchant of Record (clause D4.1).

Not all listed services are currently in use. Twilio, Apple and Google are marked "not currently in use" above: phone login by SMS is switched off and has been removed from the app, and signing in with an Apple or Google account is not enabled. No personal data is currently processed through these three services. They remain in the table because they are technically provided for; if we put one of them into operation, that applies from that point and not retroactively.

The "Basis" column describes the contractual requirement for each processor engaged, not the state currently achieved: for processing within the EU a data processing agreement (DPA) under Art. 28 GDPR is envisaged, and for transfers to third countries the EU Standard Contractual Clauses (SCC) under Chapter V GDPR in addition. Concluding these agreements with the respective providers is a precondition for the Platform going live.

In so far as Stripe performs the KYB, AML, and sanctions screening described in clause 5, it does not act on Emaride's instructions but in order to meet its own regulatory and anti-money-laundering obligations. For that processing, Stripe is a separate controller and not a processor of Emaride.

7. Transfers to Third Countries

In so far as data is transferred to countries outside the EEA (see the "Location" column in clause 6), this takes place only on the basis of appropriate safeguards under Chapter V GDPR, in particular the EU Standard Contractual Clauses or an adequacy decision of the European Commission. The data itself is hosted in the EU (Frankfurt).

8. Retention Periods

Principle: your data as a contact person is retained for the duration of your organisation's contractual relationship with Emaride, and beyond that in so far as a statutory retention obligation exists or claims are not yet time-barred. In detail:

The 10-year period is an obligation, not a discretion. We may not delete accounting and tax records before it expires, not even at your request. An erasure request therefore leads to restriction of processing under Art. 18 GDPR in that respect: the data is then kept solely to fulfil the retention obligation.

For application data, bank details, organisation and status data, and the metadata of technical access, we expressly promise no automatic deletion period, because none is implemented in the product. This data is retained for the duration of the contractual relationship and is deleted or anonymised on request (privacy@emaride.lu). A rejected or withdrawn application can be deleted in full and irreversibly; that is a case-by-case decision which only an authorised person at Emaride can trigger. We do not carry out automatic deletion for inactivity.

For company records, too, we promise no automatic deletion period, because none is implemented in the product. They are retained, including superseded versions, for the duration of the contractual relationship and are deleted on request (privacy@emaride.lu).

Retention hold in the event of litigation or a request from an authority. Where litigation, a request from an authority or other legal proceedings concern you personally, an authorised person at Emaride can suspend the automatic deletion of the following data: log data on operations you carried out, notifications to you, the support tickets you opened and the chat content you wrote, and the device and location data of your sign-in sessions (legal basis: Art. 6(1)(c) or (f) GDPR). This data is then retained beyond the period stated above until the hold is lifted, and is removed by the next deletion run thereafter. There is no such hold for the other data in this clause.

9. Role Mapping: Who Is Responsible for What

This clause is the heart of the relationship and is frequently confused.

Your fleet partner is a separate controller for the data of its employees and drivers within the meaning of Art. 4(7) GDPR — not a processor of Emaride. It processes that data for its own purposes and on its own responsibility: personnel file, employment or service contract, duty and shift planning, payroll, social security, working-time records, tax obligations. Emaride gives no instructions in that regard and cannot provide information about it (clauses D7.3 and D8.1).

The transfer between Emaride and the fleet partner is therefore a controller-to-controller transfer under Art. 6(1)(b) and (f) GDPR and not processing on behalf of a controller under Art. 28 GDPR. In practice that means:

• Each side is responsible for its own processing and its own legal basis.
• Access, rectification, and erasure requests go to the side that processes the data for its own purpose; we forward requests and name the right point of contact.
• A complaint about your fleet partner goes to the supervisory authority competent for it, not to the one competent for Emaride.
• Each side is liable for its own processing under Art. 82 GDPR; there is no chain of instructions that shifts that responsibility.

Where Emaride processes on instructions, a data processing agreement applies. In so far as Emaride processes personal data on the instructions of the fleet partner, the data processing agreement dpa-fleet-partner applies (clause D7.1). Conversely, it applies in so far as the fleet partner processes on Emaride's instructions.

The complete allocation per data category is set out in schedule-7 (Data Processing Particulars, clause 15.2 of the Fleet Partner Agreement). It determines, for each category — passenger, driver, vehicle, contact, and billing data — who is controller and who is processor. Where there is doubt about an individual category, schedule-7 prevails; this notice only summarises.

The same pattern applies to corporate clients: the corporate client is a separate controller for its own processing — selecting and administering the authorised persons, internal travel-expense and billing processes (clause E5).

10. Your Rights

Under the GDPR you have the right to:

• access (Art. 15),
• rectification (Art. 16),
• erasure / anonymisation (Art. 17), within the limits of the retention obligations in clause 8,
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21).

For your organisation's data we provide the owner role with a data export in the Platform: it contains the fleet partner's drivers, vehicles, invoices, and change log as files in an archive. The export file is deleted after 8 days; the download link is valid for 7 days.

For everything else, please contact privacy@emaride.lu. We respond within one month (extendable under Art. 12(3) GDPR). If your request concerns details held by the payment service provider (clause 5), we will name the responsible point of contact there.

11. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority in Luxembourg is the

Commission nationale pour la protection des données (CNPD) 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg <https://cnpd.public.lu>

As the controller is established in Luxembourg, the CNPD is the lead supervisory authority (one-stop shop, Art. 56 GDPR). Data subjects resident in Germany may in addition contact their locally competent state data protection authority at any time (Art. 77 GDPR). Complaints about your fleet partner or your corporate client as separate controllers go to the authority competent for them (clause 9).

12. Data Security

We apply appropriate technical and organisational measures (including encryption in transit, access controls by role and country, hashed passwords, separately restricted access to bank details, hashed-only storage of interface keys, and logging of changes) to protect your data (Art. 32 GDPR).

13. Changes to This Notice

We may adapt this notice to reflect changes in the law or in functionality. The current version is available on the website; it carries a version number and an effective date. Changes to the contractual terms are additionally communicated to fleet partners and corporate clients at least 15 days in advance on a durable medium (clauses D6 and E4).

14. Deviations from the V2.1 Legal Package

This notice follows Part A of the GDPR Compliance Package and clause 15 of the Fleet Partner Agreement. Where it deviates, it does so because it may only describe what the product actually does: