Privacy Policy

Applies to the Blitzride customer app (package de.blitzride.customer) and Blitzride Driver driver app (package de.blitzride.driver). Last updated: [INSERT DATE].

1. Data Controller

The data controller responsible for processing personal data under the EU General Data Protection Regulation (GDPR) is:

[COMPANY / GmbH NAME]
[STREET AND NUMBER]
[POSTAL CODE CITY]
Germany
Email: [EMAIL]
Phone: [PHONE NUMBER]

Authorized representative: [MANAGING DIRECTOR]. Commercial register: [HRB NUMBER, REGISTRY COURT]. VAT ID: [VAT ID].

2. Data Protection Officer

[If appointed:] You can reach our Data Protection Officer at [DPO_EMAIL]. [If no DPO is required by law: remove this section.]

3. Overview — What We Process

3.1 When you create an account (both apps)

• Name
• Email address
• Phone number (for SMS OTP verification)
• Profile picture (optional)
• Language preference

3.2 When using the customer app (Blitzride)

• Location data (precise and coarse, only while the app is in use, to find nearby drivers and set pickup points)
• Booking history (pickup and drop-off, timestamp, fare, rating)
• Push notification token
• Device data for diagnostics (app version, OS version, device model)

3.3 When using the driver app (Blitzride Driver)

• Location data including in the background, only while a ride is active or while the driver is online, for transmission to dispatch and display to the customer
• Ride history and earnings
• Microphone recordings (push-to-talk communication with dispatch; recordings are not persistently stored)
• Camera and photo library access (for ride documentation and profile picture)
• Push notification token

4. Purposes and Legal Bases

5. Sharing with Third Parties

We share personal data only with the following recipients:

• Licensed local fleet operators in your region, to the extent necessary to fulfil a ride (data processing agreement under Art. 28 GDPR in place).
• [BACKEND PROVIDER, e.g. Supabase / AWS / Google Cloud] — hosting and database operation. DPA in place.
• Google Firebase Cloud Messaging — push notification delivery (Google Ireland Limited).
• Google Maps Platform — maps and geocoding (Google Ireland Limited).
• Tax advisors and authorities, where legally required.

No further sharing takes place. We do not sell data.

6. International Transfers

Where data is transferred to processors outside the EU/EEA (e.g. Google), the transfer takes place on the basis of EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) and the European Commission's adequacy decisions where applicable.

7. Retention

• Account data: until the account is deleted by the user; afterwards in accordance with statutory retention periods (e.g. § 147 AO, 10 years for billing-relevant records).
• Trip location data: 90 days after trip completion; afterwards only in aggregated, non-personal form.
• Error logs: 30 days.
• Push tokens: until the app is uninstalled or notifications are revoked.

8. Your Rights

You have the right at any time to:

• Access your processed data (Art. 15 GDPR)
• Correct inaccurate data (Art. 16 GDPR)
• Erasure ("right to be forgotten") (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw a given consent with effect for the future

Please direct requests to [EMAIL].

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is:

The Hessian Commissioner for Data Protection and Freedom of Information
Postfach 31 63, 65021 Wiesbaden, Germany
Phone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Web: datenschutz.hessen.de

9. Account Deletion

You can delete your account at any time within the app under Profile → Delete account, or request deletion in writing at [EMAIL]. We confirm deletion within 30 days, subject to statutory retention obligations.

10. App Permissions in Detail

The apps request the following permissions. You can revoke any permission at any time in Android Settings; individual features will then be unavailable.

11. Changes to This Policy

We may update this policy if processing changes or legal requirements demand it. We will notify you in-app of material changes.

12. Contact

Questions about this policy: [EMAIL].

This policy applies exclusively to the Blitzride and Blitzride Driver apps. The Dispatcher web application is covered by a separate, internally distributed privacy notice.