WoopDrive: πολιτική απορρήτου

This Privacy Policy (the "Policy") is intended to show that we respect your privacy and handle your personal data responsibly.

The information provided in the Policy is primarily intended for individuals who, with respect to any of the WoopDrive companies, act as one of the following entities:

• Customer (or potential customer).
• A legal representative or an employee and/or authorized person of our (potential) client.
• Another user of our services (e.g. a person working for our client).
• A partner, supplier, legal representative of a supplier, or an employee or another cooperating person (e.g. a service provider providing services to us).
• Other persons whose personal data are processed for the purpose of providing services (the persons referred to below are called Data Subjects).

In accordance with applicable laws, we inform you that in order to provide relevant services, WoopDrive companies may process your personal data. The Policy describes what data and when we process, as well as other important data processing conditions and your rights. Please read this Policy carefully. This Policy applies to all WoopDrive processes, including the website, the WoopDrive mobile application (the "mobile application"), and other WoopDrive product management processes that are used to provide WoopDrive services and where Data subjects' personal data are used. If a separate and different privacy policy is provided on the WoopDrive website, mobile application, or another product, then the latter privacy policy applies. You can always find the latest version of the Policy on the WoopDrive website https://woopdrive.com, mobile application, or another WoopDrive product, if applicable.

The data controller of each WoopDrive company is the local business unit. In Lithuania, your personal data controller is RSINVESTMENT GROUP OU, company code 14173840, address: Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, which collects personal data and determines their processing purpose and means ("WoopDrive").

Your data is generally processed by the company whose client you are or with which you cooperate, most often the company with which you have already signed a contract. If several WoopDrive companies are involved in the contractual cooperation, each of them may use your personal data for pre-determined purposes.

If you are not sure who your personal data controller is, contact us.

WoopDrive collects and processes personal data in order to prepare or execute contracts, provide customers with services and products according to the concluded contracts and agreements, offer them discounts, and provide individual offers.

If you are our existing or potential customer, and/or their employee, legal representative, authorized person, or another user of our services, we will process your personal data for the specified purposes:

• To properly fulfill contractual obligations arising from contracts and agreements.
• To continuously improve the services provided by WoopDrive based on your feedback.
• Issuing invoices, processing purchases and/or performed payments, and carrying out other financial tasks.
• To process and respond to your requests when you wish to exercise your rights listed in this Policy.
• To provide support to you as our service user.
• If applicable, for customer profiling purposes, in order to specify and personalize our advertised services.
• Collecting statistical information and performing analysis of this information about the frequency of using WoopDrive's website and/or mobile application. We do this to improve the website and/or mobile application performance and our services.
• To ensure the smooth operation and security of the website and/or mobile application.
• If applicable, for direct marketing purposes.

The legal basis for direct marketing is your consent or a contract if it contains an explicit consent to process personal data for marketing purposes. If you are our supplier and/or partner, and/or a person related to the supplier or partner, also a person providing services to WoopDrive, we will process your personal data to properly fulfill contractual obligations arising from concluded contracts.

The processing of personal data is not possible without a proper legal basis, as specified in Article 6 of the General Data Protection Regulation (the "GDPR"). Therefore, we rely on one of the following legal bases.

1. On the basis of implementing pre-contractual measures

When we process your personal messages sent to our email address, or when you submit business inquiries (inquiries related to our services).

What type of personal data may be processed during pre-contractual relationships: all information provided in your inquiries, as well as other personal data provided during the implementation of pre-contractual relationships.

2. Contract conclusion and execution

When we process your personal data in the execution of contracts concluded with you.

What type of personal data may be processed when concluding specific contracts

• Supplier contract (we receive products / services): name, surname, address, VAT payer code, account number, etc.
• Customer contract (we provide products and/or services): for all services, the following data are generally collected: name, surname, address, personal code, driver's license copy, passport copy, VAT payer code, phone number, email, login details to the client account, bank account number, financial transaction details (including payment transfer and payment dates and amounts), information about other persons related to the client.

Depending on the type of service used: Vehicle refueling: fuel quantity, license plate numbers of your used vehicles, card identification features (number, name, PIN code). Road toll: license plate numbers of your used vehicles, vehicle identification code (VIN). Fleet Management services (telematics): geolocation data about the location of your used vehicles (they may include information about vehicle movement, where and at what speed the vehicle moves, etc.). Our clients may use geolocation data to better plan fleet capacities or shifts, or to prevent vehicle thefts. Access to WoopDrive website and mobile application personal account: unique Data Subject information, e.g. login ID, password, as well as IP address and other unique information. 3. Legitimate interest Collection of receivables and other protection of our rights. This includes situations where the client fails to fulfill obligations and it is necessary to collect the payable amount. What type of personal data do we process: name, surname, address, VAT payer code, email, phone, bank account number, and financial transaction details (amounts, activity results, etc.). Management of business partner relationships. We process personal data to improve our service provision to existing clients, also with the aim to contact regarding changes in business conditions. What type of personal data do we process: name, surname, address, VAT payer code, email, phone, bank account number, and financial transaction details (amounts, activity results, payment dates, etc.). Recruitment. (Potential) employee name, surname, address, email, phone, CV details, other persons' data in case of recommendations, information provided to us during job interviews. We may store this information until the specific position is filled, and until the end of the selected candidate's probationary period. This information is necessary for us to evaluate your interest in a specific position and inform you about the progress and results of the selection process. Telemarketing. WoopDrive contacts clients via telephone (voice) line, offering its products and/or services, but only to the company with which the client has previously been in contact. What type of personal data do we process: name, surname, company name, phone. Video surveillance recordings. You may encounter video surveillance recordings at our gas stations, buildings, and their surroundings; they are intended to protect our rights and our property or the rights and property of third parties (clients, suppliers, employees). What type of personal data do we specifically process: recordings of faces or numbers, vehicle license plate number. Voice recordings. Voice recordings are made in certain cases during telephone communication. You are always warned that the conversation may be recorded. Recordings are primarily used to improve service quality and protect your and our rights. What type of personal data do we specifically process: name, surname, phone, as well as other data, depending on the collected information during the conversation. Communication and correspondence. We may use personal data to respond to your questions, requests, or complaints. What type of personal data do we process: the content of questions, requests or complaints, name, surname, address, VAT payer code, email, phone, social network profiles, etc. Profiling for business purposes. We may use data for profiling, which includes monitoring, analyzing, and storing personal data in databases to create personal profiles. Such processed personal data may help to create business recommendations, so we can offer you specially tailored products and services. Such information, especially when aggregated, can also be used for marketing campaigns. Such data also allows us to create and offer you more favorable services. Automated personal data processing does not mean that an automatic decision with specific consequences for you was made. Even automated data processing is always associated with a human factor, initially selecting data or data groups or controlling results. What type of personal data do we specifically process: name, surname, address, company name, payment history, vehicle license plate number, etc. Improvement and development of products and services. When we aim to create and/or improve future products and/or services, we may collect information that may be used to improve our services and/or create new ones. What type of personal data do we process: feedback, comments, suggestions, and survey results, various anonymized combinations of personal data. Internal analysis and prediction model training based on historical data. What type of personal data do we specifically process: various combinations of personal data, such as name, surname, VAT payer code, vehicle license plate number, financial transaction, card number. 4. Personal data processed in accordance with applicable laws Accounting and taxes. What type of personal data do we process: name, surname, legal entity name, address, VAT payer code, email, phone, bank account number, and financial transaction data (amounts, execution, payment dates, etc.), i.e. information regularly provided in invoices, tax declarations, or transaction reports. Prevention, control, assessment, and detection of money laundering. What type of personal data do we process: name, surname, address, VAT payer code, email, phone, bank account number, and financial transaction data (amounts, results, recipients of results, etc.). Additionally, for this purpose, we collect information about actual business owners, members of company management structures, clients, and their related persons' political status. 5. We have your consent If we need your consent, we always explain what data we will process and why. Your consent is completely voluntary and you decide whether to give us consent. If you do not give consent for such data processing, it will not affect the scope of services you receive. If we ask for your consent to process your personal data, you can decide whether the reason for processing your personal data is acceptable to you, and based on this decision, you can decide to give or not give consent. If you give us consent, you have the right to withdraw it at any time. The easiest way to withdraw consent is described further in this Policy under your rights. Marketing activities. We will strive to obtain your consent to share these personal data with all WoopDrive companies. Your consent is intended to send emails and text messages with individual WoopDrive company product and/or service offers. What specific personal data do we process: name, surname, company name, email, phone number. Cookie storage. For this purpose, we process information about the internet browser used, devices from which you use our services electronically, your settings and data you fill in on our website to ensure convenient use of our website. Certain data is processed on your device in the form of cookies. Cookies allow us to consider your chosen language and other options you saved while visiting our website, as well as determine the frequency of using WoopDrive website and/or mobile application. We do this to improve the website and/or mobile application performance and our services. Consent to make copies and/or scans of your identity cards. For some products and/or services, we may ask for your consent to obtain a copy or scan of your identity card. You are not required to give us consent; your consent will help facilitate service provision, but will not affect the decision on the actual service provision or use. Recruitment. If you do not win the selection for specific positions, but you are still interested in possible cooperation with us in the future, your CV, with your consent, will be stored for 1 year. Otherwise, your personal data will be deleted at the end of the selected candidate's probationary period, as the legitimate interest described above will no longer apply. What type of personal data do we process: name, surname, address, email, phone, CV details, other persons' data in case of recommendations, information provided to us during interviews, etc.

We may share your personal data within WoopDrive, especially to ensure the highest quality customer service, internal management, and reporting.

We may transfer your personal data outside WoopDrive only if required by the offered service, if required by law, or if you allow us to do so.

Some of our services may be provided by WoopDrive in cooperation with certain partners and/or service providers (companies or individuals: data controllers or processors). If your personal data is shared with another entity, we always check what type of personal data is provided and what the basis for such provision is. We also check if the other entity can provide sufficient guarantees and has sufficient expertise to handle personal data.

If we entrust another entity to perform certain activities that are part of our services provided to you, the respective personal data may be processed by those other entities in the course of such activities. In such cases, the mentioned entities are considered your personal data processors. The data processor can process data only for the purposes for which we authorize them. In this case, your consent for the data processing activity is not required.

If we use cloud storage, we always use those located within the EU or EEA. If your data is intended to be transferred to a recipient in a third country, we will inform you.

WoopDrive may engage third-party service providers, i.e. personal data processors, for the following purposes:

• Sending and analyzing invoices and marketing materials.
• Printing and sending payment cards.
• Data storage.
• Scanning and storing data (applies to handling driver's license copies and passport copies; data processed by WoopDrive and UAB ONDATO, Lvivo g. 25-104, Vilnius, server).
• Customer relationship management.
• Debt collection.
• Employee data management, recruitment, and health care services, etc.
• Provision of telephone conversation recording services.

Under certain circumstances, we may be required to disclose your personal data to various governmental and international authorities, but only as required by applicable laws. Your personal data may be processed within the territory of the Republic of Lithuania and other European Union countries. Regarding third countries outside the EU, we ensure appropriate personal data protection measures.

We obtain your personal data directly from you, meaning you provided these data to us voluntarily to receive the relevant services and offers from us or conclude cooperation agreements with us. We may also collect information about you directly from persons related to you, such as your manager, by providing your contact information.

On our website and mobile application, we also use cookies and other tracking technologies to provide general online services. We collect information that the user provides to us through our website or mobile application, e.g. name, email address, and phone number. We also collect data about how our users interact with our website and application. In addition, we collect information from your computer or device, e.g. IP address, used internet browser, and language settings.

In other cases, we may also collect information about you from other sources. These sources may vary, but they are usually WoopDrive marketing partners, public sources, registries, or public information from third-party social networks. We may combine data from one source with data from another source. This is done only to ensure data accuracy and to provide more relevant services and apply a more personalized trading system.

Among our clients or suppliers, there are regularly no persons under 16 years of age. However, such individuals may join WoopDrive for internship training periods or temporary work. The personal data of such Data Subjects are used for limited purposes and in compliance with GDPR restrictions.

We keep your data only for the necessary time; after processing the data, we archive it according to applicable legal requirements, delete or anonymize it. For your information, we provide the following data retention periods:

• Personal data obtained on the basis of a contract or related to contract execution are generally kept for at least 10 years from the contract termination date.
• Certain personal data must be kept according to anti-money laundering legal requirements; such data must be archived for 8 years from the termination of contractual relationships with the client.
• Tax and accounting rules require that selected personal data be archived for at least 10 years.

In other cases, the personal data retention period is determined based on the actual necessary data processing period. For example, camera recordings, stored for the protection of our and your rights, can be stored for no longer than one month. When personal data is processed for internal purposes, such as product development, modeling, and testing purposes, such personal data is generally used only once and then deleted or anonymized. Received CVs can be processed and stored for the aforementioned period, then they are deleted or archived for 1 year, if your consent is obtained.

Right to information means that you have the right to receive information about how your personal data are processed. For this purpose, this Policy is provided to you.

Right of access means that you have the right to know what information we process about you and why, with whom it is shared (if applicable) and what the source of your personal data is.

Right to rectification means that you have the right to request the correction of data as soon as you find out that we do not have updated your personal data or are using inaccurate data (incorrectly written name, old address, etc.).

Right to erasure, also known as the right to be forgotten, means that your personal data will be deleted as soon as other legal acts allow, especially if the purpose for which the personal data were used has been achieved (contract termination, selection procedure termination, etc.). This is not an absolute right and WoopDrive may refuse to delete the respective data.

Right to restrict data processing means that we will not process your personal data during the period when we investigate the accuracy and completeness of your personal data at your initiative, or if you explicitly request that we do not delete your personal data for a significant reason. This right can also be exercised without explicit instructions from you (especially if we find that your personal data is not accurate). As soon as the reasons for restricting data processing disappear, we will inform you.

Right to data portability means that if necessary, you can request that your personal data be transferred to you or another data controller in electronic form. This applies only to your personal data kept in electronic form, which we need to execute the contract with you or for which we have received your explicit consent for processing.

Right to object to data processing. You can exercise this right if you do not want your personal data to be used for direct marketing purposes or if you believe that we do not have the right to process your data.

Right to withdraw consent. You can exercise this right at any time if you decide that you no longer want us to process your data for the purpose for which you gave consent. Withdrawing your consent does not affect the processing of data carried out before the consent withdrawal. You can withdraw your consent by contacting us at hello@woopdrive.com. To withdraw consent for receiving newsletters, the consent withdrawal instructions are provided in the newsletter.

Automated decision-making means that you have the right not to be subject to a decision made without any human intervention, including profiling.

We will do everything reasonably expected to implement your rights. However, we will not be able to fulfill your requests in cases where we cannot assign personal data to your person (i.e. we cannot identify you).

You can exercise your rights by contacting the WoopDrive company that processes your personal data. It is usually the company to which you provided your personal data.

You can exercise your rights by contacting WoopDrive at the general email address: hello@woopdrive.com.

If WoopDrive violates any of your rights related to the processing of personal data, you have the right to file a complaint with the relevant data protection authority. You can find a list of these authorities at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.