Wizy Privacy Policy

This Policy explains what personal data Wizy collects, why it is needed, who it may be shared with, how long it is retained, and how users can exercise their rights. It applies to the Wizy mobile app, the official Wizy website, and related support, notification and user communication services.

Personal data controller: Sole Proprietor Деньга Діана Русланівна

Identification code: 3783801365

Address: Kyiv Region, Obukhiv District, Myronivka, 15 Sobornosti Street, apartment 8

Privacy contact: info@wizy.net.ua

Service: Wizy, the mobile app and the website wizy.net.ua and its subdomains

In this Policy, “Wizy”, “we”, “us” and “our” refer to the personal data controller identified above. If an individual partner independently determines the purposes and means of processing data, it acts as a separate controller and provides information about its own privacy rules.

1 General provisions

1.1. Wizy is a digital platform that helps drivers and passengers find each other for shared intercity and international rides, agree on the route, pickup location, time, number of seats and contribution towards the ride, communicate in a chat and leave reviews.

1.2. This Policy forms part of the rules for using Wizy. For features that cannot be provided without certain data, processing is necessary to perform the contract with the user. For optional features, Wizy requests consent or provides a way to disable the relevant permission.

1.3. This Policy does not govern the independent processing of data by other users after they lawfully receive it, or third-party websites or services opened through external links. Each recipient must use the data only to arrange the specific ride and in accordance with the law.

2 Key terms

• Platform — the Wizy mobile app, Wizy website and related digital services.
• User — an individual who visits the Platform or has a Wizy account.
• Driver — a user who publishes a ride and offers available seats in their vehicle.
• Passenger — a user who searches for a ride, submits a request or books a seat.
• Ride — a route published by a driver, including its date, time, pickup and drop-off points, seats and other conditions.
• Booking — a passenger’s request and, after confirmation by the driver or automatic confirmation, an agreed seat on a ride.
• Personal data — information relating to an identified or identifiable individual.

3 What data we process

3.1 Account and profile data

• first and last name, age or date of birth, gender, phone number and email address;
• authentication data, including a password in a protected or hashed form, verification codes and indicators of phone or email verification;
• profile photo, short personal description, user role, registration date, rating, reviews and activity history;
• ride preferences, including music or conversation, smoking, pets, air conditioning, the number of passengers in the back seat and available safety settings;
• language, notification and privacy settings.

3.2 Driver and vehicle data

• make, model, colour, registration plate number and other vehicle characteristics that the driver adds to their profile or ride;
• information about available seats, transport conditions, automatic confirmation, permitted pets and other ride parameters;
• the driver’s confirmation that they have the legal right to drive the vehicle, a valid driving licence, registration documents and compulsory insurance. Wizy does not collect copies of these documents unless separate notice is provided before they are uploaded.

3.3 Ride and booking data

• the driver’s actual starting point, the passenger’s pickup point, destination, intermediate points, addresses and coordinates, the selected route and its length;
• departure date and time, estimated pickup and arrival times, number of seats, number of passengers, price per passenger and calculated total amount;
• the driver’s comment, ride and booking status, and records of confirmations, refusals, cancellations, ride starts and completions;
• ride participants, user role, and the history of bookings, cancellations and system notifications.

3.4 Messages and user content

• text messages, photographs, voice messages, sending time, and delivery and read status;
• reviews, ratings, complaints, reports of violations and responses to support;
• correspondence with Wizy by email, in the support chat or through other official channels.

3.5 Location data

With the user’s permission, Wizy may process precise or approximate location, points selected on a map and coordinates. This data is needed to find nearby rides, suggest addresses, build routes, and calculate distance, pickup time and the price of a ride segment. Continuous background location access is not used unless a specific feature explicitly explains why it is necessary and the user has granted the system permission.

3.6 Technical data

• IP address, device type and model, operating system, app or browser version, language, time zone and network type;
• session identifiers, authentication and push notification tokens, login events, security logs, and data about errors, crashes and performance;
• actions on the Platform necessary to maintain its features, identify errors, protect accounts and investigate abuse.

3.7 Device permissions

The app may request access to location, the camera, photos or files, the microphone and notifications. Access is used only for an action initiated by the user, such as adding an avatar, sending an image, recording a voice message, selecting their current location or receiving a push notification. Permissions can be changed in the device settings, but the relevant feature may stop working.

3.8 Data Wizy does not ask you to send

Under its current model, Wizy does not accept payments for rides, store bank card details, or ask in a chat for PINs, CVC/CVV codes, one-time banking codes, passwords, photos of payment cards, passports or other documents. Do not send this data to drivers, passengers or people claiming to represent Wizy support.

4 Where we obtain data

• directly from the user during registration, profile editing, publishing or searching for a ride, booking, messaging, rating or contacting support;
• automatically from the device and the Platform when logging in and using features;
• from other users when they book a shared ride, leave a review or complaint, or report a violation;
• from technical providers that supply authentication, maps and routes, push notifications, media storage, crash diagnostics, hosting and Platform protection.

5 Purposes and legal bases for processing

Wizy processes data only for specified and lawful purposes. The main operations and their legal bases are set out below.

Processing purpose	Legal basis
Creating and protecting an account, verifying contact details, logging in, restoring access and maintaining a profile.	Entering into and performing an electronic contract; a legitimate interest in protecting accounts.
Searching for and publishing rides, building routes, and calculating distance, time, price, available seats and intermediate points.	Performing a contract and taking steps at the user’s request before entering into it; consent to location access where needed.
Handling booking requests, automatic or manual confirmation, cancellations, notifications and the ride archive.	Performing the contract between Wizy and the user; a legitimate interest in the proper operation of the service.
Displaying profiles, vehicle data, ratings, reviews and contact details to the extent necessary to arrange a ride.	Performing a contract; the users’ legitimate interest in checking travel companions and ensuring safety.
Operating chats, transmitting text, images and voice messages, providing support and handling complaints.	Performing a contract; a legitimate interest in safety, support and dispute resolution.
Preventing fraud, spam, unlawful content, unauthorised access and violations of the rules.	The legitimate interest of Wizy and its users in safety; compliance with legal obligations.
Diagnosing errors, analysing performance and improving Platform stability.	A legitimate interest in maintaining and developing the service; consent where required by law or where optional analytics are used.
Sending mandatory service messages about accounts, bookings, cancellations, security and changes to documents.	Performing a contract and complying with legal obligations.
Marketing messages, if Wizy introduces them.	Prior voluntary consent, with the option to withdraw at any time.
Complying with requests from public authorities, accounting or other legal obligations, and defending rights in a dispute.	Compliance with the law; establishing, exercising or defending legal claims.

Where processing is based on consent, consent may be withdrawn without affecting the lawfulness of actions taken before withdrawal. Where processing is necessary for a core feature or for security, withdrawing a permission may make that feature unavailable.

6 What data other users can see

6.1. Before booking, potential travel companions may have access to information needed to assess the ride and establish trust: first name or display name, avatar, age, role, rating and reviews, agreed preferences, route, date, time, price, available seats, the driver’s comment, and the vehicle’s make, model and colour.

6.2. Email addresses, passwords and technical data are not displayed to other users. Phone numbers and vehicle registration plate numbers must not be publicly accessible. They may be disclosed only to participants after a booking is confirmed and only to coordinate that specific ride.

6.3. If a passenger joins at an intermediate point, Wizy may show them the driver’s actual starting point as context for the full route, along with the passenger’s pickup point, destination and estimated pickup time. An exact home address must not be used as a public point unless displaying it is necessary and the user has explicitly selected it.

6.4. After a ride ends, the name, avatar and review text may remain visible on the user’s profile. Before publishing a review, users must not include a phone number, address, payment details or other excessive data.

7 Chats, media and moderation

7.1. Chat is available to clarify ride details. A passenger may write to the driver before booking or while awaiting confirmation. The phone number is disclosed only after booking confirmation, if this feature is available.

7.2. Messages are visible to their participants. Authorised Wizy employees or contractors may obtain limited access to correspondence, media and technical metadata when necessary to investigate a complaint, resolve an error, ensure safety, prevent fraud or comply with the law. Wizy does not use private messages for third-party advertising.

7.3. Images and voice messages may contain other people’s data. By uploading such content, the user confirms that they have the right to share it. Sending intimate material without consent, documents, payment data, unlawful content, malicious files or material that infringes the rights of others is prohibited.

8 Location and maps

8.1. A user may enter an address manually or allow their location to be determined. Map and route data may be processed by specialist providers. Their distance, time and route calculations are estimates and may depend on traffic conditions and data availability.

8.2. Wizy limits access to location data to the purpose for which it was granted. The user may withdraw the system permission at any time. Searching by current location or automatically selecting a point may then stop working, but an address may be entered manually where that option is available.

9 Who we share data with

• Other users — within the scope described in section 6, to search for, book and carry out a ride.
• Service providers — for hosting and databases, authentication, maps and geocoding, push notifications, email, image and audio storage, crash diagnostics, cybersecurity and support. They receive only necessary data and act under a contract with Wizy.
• Public authorities and courts — where disclosure is required by law or a duly issued request, or is necessary to protect life, safety or rights.
• A successor — in the event of a reorganisation, sale of the business or transfer of the service, provided that appropriate data protection is maintained and users are notified where necessary.

Wizy does not sell personal data or share it with advertising brokers. If a new category of recipients or a new purpose is introduced in the future, the Policy will be updated and consent will be requested where required by law.

10 International data transfers

Some technical providers may process data on servers outside Ukraine or the user’s country. In such cases, Wizy applies the protection mechanisms required by law: data processing agreements, access restrictions, appropriate safeguards for international transfers and, where the GDPR applies, standard contractual clauses or another lawful mechanism. Information about the specific mechanism may be requested at info@wizy.net.ua.

11 Retention periods

We retain data for no longer than necessary for the relevant purpose, security, performance of the contract and legal obligations. Indicative maximum periods are set out below; a longer period applies only where required by law, where a dispute is ongoing or where a violation needs to be investigated.

Category	Retention period
Account, contact details, profile and settings	For the duration of the account; after deletion, up to 30 days, except for data lawfully retained for longer.
Rides, bookings, confirmations, refusals and cancellations	Up to 3 years after the ride or account closure, for disputes, safety and prevention of abuse.
Chats, images and voice messages	While the chat is accessible to users and for up to 3 years after the last activity, if the data is needed for complaints, safety or disputes.
Reviews and ratings	While the profile exists; after account deletion, they may be deleted or anonymised if retention is needed to preserve the integrity of the review system.
Support requests and complaints	Up to 3 years after a request is closed; longer if a dispute is ongoing or the law requires it.
Technical logs, security data and crash diagnostics	Usually up to 12 months, unless a longer period is needed to investigate an incident.
Backups	Up to 90 days after deletion from live systems, where technically possible; access to backups is restricted.
Consent records and legally significant messages	For the period necessary to demonstrate compliance with the law and defend rights.

Anonymised statistics that no longer make it possible to identify a user may be retained for longer. A chat’s visibility in the active list or archive does not necessarily correspond to its technical retention period.

12 How we protect data

Wizy applies organisational and technical measures proportionate to the risk: connection encryption, role-based access control, protection of credentials, logging of administrative actions, backups, component updates, incident monitoring and contractual requirements for providers. No system guarantees absolute security, so users must also protect their passwords, verification codes and devices.

If a security breach creates a risk to users that meets the criteria established by law, Wizy will notify the competent authority and affected individuals in the manner and within the time limits required by applicable law.

13 User rights

Depending on applicable law, the user has the right to:

• know the sources, location, purpose and conditions of processing their data;
• access their data and obtain a copy of information about its processing;
• request correction of inaccurate data or completion of incomplete data;
• request deletion or destruction of data where there is no lawful basis for its continued retention;
• withdraw consent and object to processing based on legitimate interests;
• request restriction of processing and, where the GDPR applies, portability of the data they have provided in a structured format;
• not be subject to a decision based solely on automated processing that has significant legal consequences, unless otherwise permitted by law;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights, a competent EU data protection authority where the GDPR applies, or a court.

Rights may be limited by law, the rights of others, the need to preserve evidence of a violation or to comply with a legal obligation. Wizy will explain the reason for any full or partial refusal where the law permits its disclosure.

14 How to submit a request or delete an account

14.1. Users may change some data in their profile. To request access, correction, export, objection, withdrawal of consent or account deletion, use the app settings or write to info@wizy.net.ua from the address or number associated with the account.

14.2. Before deleting an account, the user must complete or cancel active rides and bookings. After deletion, the profile becomes unavailable and the data is deleted or anonymised in accordance with section 11. Messages, reviews or ride records may remain in anonymised form or in another participant’s account where necessary to preserve the integrity of the history and protect their rights.

14.3. To prevent unauthorised access, Wizy may ask the user to verify their identity. Requests are considered without undue delay and no later than the deadline established by law; as a general rule, within 30 calendar days, and where the GDPR applies, within one month, with a possible lawful extension for complex requests.

15 Minors’ data

An individual Wizy account is intended for people aged 18 or over. A minor may participate in a ride only together with an adult who has the right to accompany them, is responsible for the booking and has agreed the ride with the driver in advance. If Wizy learns that an account has been created by a person under 18, it may restrict or delete the account and delete the data to the extent permitted by law.

16 Service and marketing messages

16.1. Wizy sends messages necessary for the service to operate: login codes, email or phone verification, booking requests and confirmations, cancellations, new messages, reminders, and changes relating to security and legal documents. Some push notifications may be disabled on the device, but critical messages may be sent through another available channel.

16.2. Advertising or partner messages are sent only after separate consent, if that feature is introduced. Users may opt out through the settings, a link in the message or by contacting support.

17 Cookies and similar technologies

17.1. The current version of the public Wizy website does not use optional analytics or advertising cookies. The website may use only technically necessary network mechanisms that are not used for cross-site tracking.

17.2. The mobile app does not rely on browser cookies, but may store login tokens, settings, cached data and push notification tokens on the device, and use identifiers and SDKs for security and crash diagnostics. This data is described in sections 3 and 5.

17.3. If Wizy adds optional web analytics, advertising pixels or tracking technologies, a separate notice or cookie policy will be published before they are activated and, where necessary, a prior consent mechanism will be introduced.

18 Automated features

Wizy may automatically sort rides, suggest cities and routes, calculate estimated time, distance and the price of a segment, send notifications and flag suspicious activity. The driver determines the ride conditions within the available rules, and bookings are confirmed by the driver or automatically according to the setting they select. Wizy does not make solely automated decisions that produce legal or similarly significant effects for a user without a legal basis provided by law and an appropriate opportunity to challenge the decision.

19 Changes to the Policy

Wizy may update this Policy when the law, functionality, processing methods or list of providers changes. A new version is published with its date. Users are informed of significant changes in the app, by email or through another available channel before those changes take effect, where possible and required by law.

20 Contacts and complaints

For questions about privacy, exercising rights or data security, contact: info@wizy.net.ua. The controller’s postal address: Kyiv Region, Obukhiv District, Myronivka, 15 Sobornosti Street, apartment 8

A complaint about the processing of personal data may be submitted to the Ukrainian Parliament Commissioner for Human Rights or a competent court. If the GDPR applies to the processing, users may also contact the supervisory authority of the European Union Member State where they live, work or where the alleged infringement took place.