GDPR Information Notice

The controller of your personal data is Łukasz Jagodziński, with its registered address at: ul. Sumakowa 10, 62-069 Palędzie, gm. Dopiewo, VAT ID (NIP): 7842195025.

Controller contact: [email protected]

The Controller has not appointed a Data Protection Officer (no legal obligation). For matters relating to personal data processing please contact the Controller directly at: [email protected].

We process your personal data for the following purposes:

1. Entering into and performing the Application use agreement — Art. 6(1)(b) GDPR.

2. Compliance with legal obligations of the Controller — Art. 6(1)(c) GDPR.

3. Pursuing legitimate interests of the Controller: ensuring the security of the Application and accounts, content moderation and handling reports, automatic licence-plate blurring and photo authenticity checks, error diagnostics, service analytics, notifications about nearby events, asserting or defending claims — Art. 6(1)(f) GDPR.

4. Marketing push notifications, personalised advertising, product analytics and marketing communication — solely on the basis of your consent — Art. 6(1)(a) GDPR.

We process the following categories of personal data:

— identity data: email address, username, optional phone number;

— profile data: handle, profile and cover pictures, bio, garage (vehicles and their photos), following relationships;

— location data provided deliberately: coordinates of spots, places, routes and checkpoints;

— real-time location data: the position shared with participants of a drive or meetup for its duration, and the approximate (rounded) last device position used server-side only for nearby-event notifications;

— user content: photos and videos, descriptions, reviews, comments, posts, meetup chat messages, group messages and direct messages;

— file metadata: photo EXIF (including GPS coordinates written by the camera) and technical signals used to assess authenticity;

— advertising data: ad mode, consent history, impression events;

— calendar sharing settings: generated links together with their visibility scope, timezone, expiry date and revocation date;

— technical data: IP address, device identifier, push token, activity logs, error reports;

— SSO data (if you use Google or Apple sign-in): external identifiers.

We do not knowingly process special categories of data (Art. 9 GDPR). Please do not upload content that reveals such data.

Data may be shared with:

— processors acting on behalf of the Controller — only under data processing agreements. These include: the server infrastructure and file storage provider, Cloudflare, Google (sign-in, maps, AdMob, Firebase), Apple (sign-in, APNs), Expo, Resend, Twilio, MapTiler AG (Switzerland/EEA), Sentry — Functional Software, Inc. (USA);

— public authorities — only when required by mandatory applicable law;

— other Application users — in respect of published content, and during an active drive or meetup also the live position visible to its participants.

The Controller may transfer data to entities outside the European Economic Area (EEA) only where appropriate safeguards required by the GDPR are in place (e.g. standard contractual clauses adopted by the European Commission).

Personal data is retained for:

— the period arising from the agreement and legal obligations (generally up to 5 years after the agreement ends, or longer if required by law);

— until consent is withdrawn — where processing is based solely on consent;

— the duration of the drive or meetup — for live map positions, after which no history remains;

— up to 24 months — for advertising consent records and ad impression events;

— up to 12 months — for technical and security logs;

— 3 years from the expiry of the limitation period for claims — for asserting and defending claims.

You have the following rights under the GDPR:

1. Right of access (Art. 15 GDPR) — you may request information about the data we process.

2. Right to rectification (Art. 16 GDPR) — if data is inaccurate or incomplete.

3. Right to erasure (Art. 17 GDPR) — the "right to be forgotten", when data is no longer needed or you withdraw consent.

4. Right to restriction of processing (Art. 18 GDPR).

5. Right to data portability (Art. 20 GDPR) — in respect of data processed on the basis of consent or a contract.

6. Right to object (Art. 21 GDPR) — against processing based on legitimate interests.

7. Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.

8. Right to lodge a complaint with a supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

Please submit requests to: [email protected]

Data may be processed in an automated manner for: the spot scoring algorithm and feed ordering, selecting nearby-event notifications, automatic licence-plate blurring and preliminary photo authenticity assessment, and — if you consent to it — ad personalisation on the Google AdMob side.

None of these mechanisms produces legal or similarly significant effects for you. Moderation decisions restricting or removing an account are always taken by a human and may be appealed.

We do not apply automated decision-making within the meaning of Art. 22 GDPR that would produce significant legal effects without human involvement.

Providing data is voluntary, but necessary to use the Application. Failure to provide data required for registration makes it impossible to create an account.

For all matters concerning personal data processing and exercising your GDPR rights, please contact us:

Łukasz Jagodziński

ul. Sumakowa 10, 62-069 Palędzie, gm. Dopiewo

Email: [email protected]