1. General provisions
1.1. This Privacy Policy (hereinafter – the Policy) explains how UAB CRT Partner, company code 302760841, VAT payer code LT100006825214, registered address Žalgirio g. 92-106, LT-09303 Vilnius (hereinafter – the Company), as the operator and administrator of the Drivitty mobile application, the website and related technical solutions (hereinafter – Drivitty or the System), collects, uses, stores and transfers the personal data of Drivitty users (hereinafter – the User or You).
1.2. Drivitty is intended for the needs of legal persons (hereinafter – Business Clients) which use vehicles for their commercial activities. The User may be a representative or an employee of the Business Client (e.g. a driver, a manager) to whom the Business Client grants access to the Drivitty account.
1.3. The Company processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter – GDPR), the Lietuvos Respublikos asmens duomenų teisinės apsaugos įstatymas (Law on Legal Protection of Personal Data of the Republic of Lithuania), the Elektroninių ryšių įstatymas (Law on Electronic Communications) and other applicable legal acts.
1.4. By using Drivitty, You confirm that You have read this Policy and understand how the Company processes Your personal data.
2. Data Controller and contacts for data protection matters
2.1. Data Controller: UAB CRT Partner.
2.2. Data protection matters: regarding the processing of personal data, the exercise of these rights or any privacy-related questions, please contact us by e-mail at [email protected].
3. What data we process
The Company processes the following categories of personal data:
3.1. Identity and contact data: first name, surname, telephone number, electronic mail address.
3.2. Business Client data: name of the legal person, company code, VAT payer code, address, position of the representative.
3.3. Vehicle data: registration number, type of fuel of the vehicle.
3.4. Account and login data: Drivitty account identifier, password fragment (hash), login logs (dates, IP address, device identifier).
3.5. Payment data: the unique tag (token) of the payment card, which is assigned by the Payment Service Provider „Klix“ (AS „Citadele banka“ Lietuvos filialas, company code 304940934) when the User links a payment instrument. The Company does not process the bank card number, expiry date or CVV data — these data are processed only by “Klix”.
3.6. Balance and transaction data: top-ups of the Drivitty balance, transactions carried out (date, amount, Point of Sale (as this term is defined in the Terms of Use), goods), VAT invoice data.
3.7. Geolocation data: location data of the mobile device (GPS, Wi-Fi, mobile network), collected only with the User’s active consent and only while Drivitty is being used, in order to show the nearest Points of Sale and to ensure payment functionality.
3.8. Device and usage data: IP address, operating system, device model, Drivitty version, usage statistics, error logs, cookie data.
3.9. Communication data: correspondence with the Company’s customer service, claims, feedback.
4. Purposes and legal bases
| Purpose | Data processed | Legal basis (GDPR) |
|---|---|---|
| Creation and administration of the Drivitty account | 3.1, 3.2, 3.4 | Performance of a contract (Art. 6(1)(b)) |
| Execution of payments, management of the Balance | 3.5, 3.6 | Performance of a contract |
| Issuance of VAT invoices | 3.1, 3.2, 3.6 | Legal requirement (Art. 6(1)(c)) — LR PVM įstatymas (Law on Value Added Tax of the Republic of Lithuania), Finansinės apskaitos įstatymas (Law on Financial Accounting) |
| Search for the nearest Points of Sale, confirmation of the location of payments | 3.7 | Consent (Art. 6(1)(a)) |
| Security of the System, fraud prevention | 3.4, 3.8 | Legitimate interest (Art. 6(1)(f)) |
| Improvement of the Drivitty platform, analysis of statistics | 3.8 (anonymised) | Legitimate interest |
| Customer service, handling of claims | 3.1, 3.9 | Performance of a contract / legitimate interest |
| Corporate Loyalty Programme | 3.1, 3.6 | Performance of a contract (if the programme is activated) |
| Direct marketing (news, offers) | 3.1 | Consent — may be withdrawn at any time |
| Communication with state authorities (tax, law enforcement) | as applicable | Legal requirement |
5. Data recipients
The Company transfers personal data to the following categories of recipients under data processing agreements:
5.1. Payment Service Provider – „Klix“ (AS „Citadele banka“ Lietuvos filialas) — carries out payment initiation, SCA authentication, card tokenisation, top-ups of the Balance.
5.2. IT and hosting service providers – providers of servers, cloud services and software maintenance, operating in the European Union or under data transfer schemes safeguarded pursuant to Art. 46 GDPR.
5.3. Accounting and audit service providers – for the administration of VAT invoices and for financial and data security audits.
5.4. Legal service providers – for consultations and dispute resolution.
5.5. Communication service providers – for sending e-mail, SMS and push notifications to the User.
5.6. Business Client – the Business Client’s representative is granted access to the transactions carried out by the Users assigned to the Business Client, to the drivers’ location (if activated) and to other information related to the Business Client’s activities, for administration purposes.
5.7. State authorities (the tax inspectorate, law enforcement, courts) – on the basis of legal acts applicable to the Company and only in the case of a reasoned request.
Personal data are not transferred to third parties for direct marketing purposes without the User’s consent.
6. International data transfers
6.1. Personal data are processed and stored within the territory of the European Union / European Economic Area.
6.2. In the event that any data processor were to process data outside the EU/EEA, the Company ensures that the transfer complies with the requirements of Chapter V GDPR — for example, on the basis of a European Commission adequacy decision, using standard contractual clauses (SCC) or other appropriate safeguards.
7. Retention periods
7.1. Account and User data – until closure of the account and for a further 1 year after its closure, in order to safeguard the time limits for claims.
7.2. Payment, transaction and VAT invoice data – 10 years from the date the transaction was carried out: for VAT invoices pursuant to Article 78(7) of the PVMĮ (Law on Value Added Tax), and for other accounting documents pursuant to the Dokumentų ir archyvų įstatymas (Law on Documents and Archives) and the index of retention periods approved by the Chief Archivist of Lithuania.
7.3. Balance data – for the period during which the account is active + 10 years in accordance with accounting requirements.
7.4. Geolocation data – only during an active session; historical data, if accumulated, for no longer than 12 months, unless they are needed for a fraud investigation or for the handling of claims.
7.5. Login logs, device data – up to 24 months from the last login.
7.6. Communication data, claims – up to 3 years from the end of the correspondence.
7.7. Direct marketing data – until the withdrawal of consent or 2 years from the last activity.
7.8. Upon expiry of the retention period, personal data are securely destroyed or de-personalised.
8. Geolocation data
8.1. Drivitty collects the geolocation data of a mobile device only with the explicit consent of the User, which the User gives through the Drivitty application or in the settings of the mobile device.
8.2. Geolocation data are used only for the following purposes:
(a) showing the nearest Points of Sale to the User;
(b) confirming payments at a specific Point of Sale;
(c) fraud prevention (matching of the location of transactions).
8.3. Consent may be withdrawn at any time by switching off the geolocation permission in the Drivitty application or in the settings of the mobile device. The withdrawal of consent does not affect the lawfulness of the processing of data carried out up to that time.
8.4. Geolocation data are not transferred to third parties for direct marketing purposes.
9. Cookies and other technologies
9.1. Cookies and similar technologies (local storage, device identifiers) may be used on the Drivitty website (drivitty.com) and in the application in order to:
(a) recognise the device and ensure the functionality of the System (necessary cookies);
(b) remember the User’s settings;
(c) analyse usage statistics (analytical cookies — only with consent);
(d) improve the functionality of Drivitty.
9.2. The Company uses cookies which are not necessary for the operation of the System only after obtaining the User’s consent through the cookie banner or the application settings.
9.3. More detailed information about the specific cookies used is provided in a separate Cookie Policy available on the Drivitty platform and on the Company’s website drivitty.com.
9.4. The device identifiers and analytics technologies used in the Drivitty mobile application are described in clause 3.8 of this Policy. The Cookie Policy applies to the Company’s website drivitty.com.
10. Automated decision-making and profiling
10.1. The Company does not generally apply automated decision-making which produces legal effects for the User, as defined in Art. 22 GDPR.
10.2. Profiling of a limited nature may be applied in the context of the Loyalty Programme (e.g. personalised offers based on purchase history) — only where the Loyalty Programme has been activated and the User has agreed to its rules. Profiling never results in changes to material contractual terms.
11. Rights of the data subject
11.1. The User has the following rights provided for in the GDPR:
(a) the right to access the personal data processed and to obtain a copy thereof;
(b) the right to request the rectification of inaccurate or incomplete data;
(c) the right to request the erasure of data ("the right to be forgotten"), except for the exceptions provided for in legal acts (e.g. accounting data);
(d) the right to restrict the processing of data in certain circumstances;
(e) the right to data portability — to receive the data in a structured, commonly used format;
(f) the right to object to the processing of data where it is based on legitimate interest;
(g) the right to object to direct marketing at any time;
(h) the right to withdraw consent at any time (the withdrawal of consent does not affect the lawfulness of earlier processing);
(i) the right to lodge a complaint with the Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate) (L. Sapiegos g. 17, LT-10312 Vilnius, [email protected], www.vdai.lrv.lt).
11.2. In order to exercise the rights, the User shall apply by e-mail to [email protected]. The Company responds to a request no later than within 1 month from its receipt and, in complex cases, the time limit may be extended up to 3 months, informing the User thereof.
11.3. In order to ensure that the request is submitted by the actual data subject, the Company may require documents confirming identity.
12. Data security
12.1. The Company applies organisational and technical measures to protect personal data against unlawful loss, use, disclosure, alteration or destruction, including:
(a) encryption of data in transit (TLS) and at rest, where technically possible;
(b) access control based on the „need to know“ principle;
(c) regular security audits and vulnerability tests;
(d) confidentiality undertakings of employees;
(e) monitoring of security events and response procedures.
12.2. Payment card data are processed by the certified Payment Service Provider „Klix“ (AS „Citadele banka“ Lietuvos filialas), which complies with the PCI-DSS standard. The Company itself does not process these data.
12.3. In the event of a personal data security breach, the Company notifies the Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate) within 72 hours if the breach may pose a risk to the rights and freedoms of data subjects, and where a high risk is likely — the User is notified as well.
13. Amendments to the Policy
13.1. The Company has the right to amend this Policy. The User is informed of material amendments no later than 14 (fourteen) calendar days before they enter into force, through the Drivitty platform and/or by e-mail to the address registered in the account.
13.2. Non-material amendments (editorial amendments, updates of contact information, clarifications of wording) may be implemented by the Company immediately after their publication on the Drivitty platform.
13.3. The current version of the Policy is always available on the Drivitty platform and on the Company’s website drivitty.com. This Policy is published in Lithuanian, English, Russian and Polish. In the event of any discrepancy between the language versions, the Lithuanian version prevails.
14. Contact information
UAB „CRT Partner"
Company code: 302760841
VAT payer code: LT100006825214
Address: Žalgirio g. 92-106, LT-09303 Vilnius
General queries: [email protected]
Data protection queries: [email protected]
Website: drivitty.com