Privacy policy

1. Data controller

The controller of the personal data collected via the website 2Ride.PL is JC-TECH.PL Jarosław Czarnecki, ul. Myśliwska 88/2, 43-370 Szczyrk, Polish tax ID (NIP) 9372497705. Data protection contact: e-mail biuro@2ride.pl, phone +48 503 164 855.

2. What data we collect

• when booking: e-mail, phone number, pick-up and destination addresses, date, number of passengers, comments and – for airport transfers – the flight number;
• for bookings made by a hotel reception: the details provided by the reception on your behalf (phone number – only with your consent; with payment to the driver, phone and e-mail are optional), as well as the first name of the receptionist and the reception's e-mail;
• for an invoice or bill: company name, tax ID (businesses from other EU countries – country and EU VAT number) and address, or first name, surname and address; after you enter a Polish tax ID we fill in the name and address from public registers (REGON, VAT white list), and we check an EU VAT number in the European Commission's VIES system;
• for payments and tips: information about the payment (card and bank details are processed exclusively by the payment operator Stripe – we have no access to them);
• the discount code used and the amount of the discount;
• messages in the booking and – if you leave one – a review with the signature you provide;
• your location – only if you click "Use my location" in the form (used solely to fill in the pick-up address);
• anonymous visit statistics: device type, operating system, website language, page visited and the referring website – without cookies and without storing the IP address;
• technical data necessary for the website to work (e.g. IP address in server logs) and website error reports – the error message and the page address, without personal data (used only to fix faults).

3. Purposes and legal basis

• handling the booking and the ride, contact about the order (e-mail, text message, "driver on the way" and "driver waiting" notifications), payments – Article 6(1)(b) GDPR (contract), also when a hotel reception books on your behalf;
• issuing and storing accounting documents (including electronic invoices) – Article 6(1)(c) GDPR (legal obligation);
• handling complaints, website security, pursuing claims, a one-time review request after the ride, publishing reviews, anonymous visit statistics – Article 6(1)(f) GDPR (legitimate interest);
• browser push notifications and tips – based on your consent and decision; you can switch notifications off at any time.

Providing data is voluntary, but without it we cannot handle the booking.

4. Who receives the data

The data is seen only by those handling your ride: us and the driver performing it. If the ride is performed by a partner carrier (a driver with their own business), they receive the data needed to perform the ride and – when they issue the sales document – to issue the invoice or receipt. If the booking was made by a hotel reception, the reception receives copies of the confirmations by e-mail and can see the booking status.

We use trusted providers who process data on our behalf:

• Supabase – database (servers in the European Union),
• Netlify – website hosting (partly in the USA),
• Stripe – online payments and tips,
• Comarch (BetterFly) – issuing invoices,
• European Commission (VIES system) – checking the EU VAT number of a business from another EU country (that number only),
• Resend – sending e-mails,
• SMS operator (JustSend or SMSAPI) – sending text messages about the order,
• Telegram – booking notifications for us and our drivers,
• browser push notification providers (e.g. Google, Apple, Mozilla) – only if you enable notifications,
• Photon / Geoapify – address suggestions in the form (only the address being typed),
• OpenStreetMap – the map showing the minibus on the day of the ride (your browser loads the map from OpenStreetMap servers, which see your IP address).

Some providers may process data outside the European Economic Area (e.g. in the USA) – only on the basis of the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

5. How long we keep the data

• booking data (phone, addresses, e-mail, flight number, comments, messages) – 24 months after the booking is completed, cancelled or declined; after that it is deleted automatically;
• invoice / bill data – 5 years from the end of the year in which the tax payment deadline for the year of issue expired (tax regulations);
• the minibus position – only while the driver is on the way to you; it is deleted when the driver reports "I'm here";
• reviews – until deleted at your request;
• visit statistics – anonymous: visitors are counted using a one-off hash that changes daily and does not allow you to be identified.

6. Your rights

You have the right to access your data, rectify it, delete it, restrict processing, data portability and to object, as well as to withdraw consent.

The easiest way to exercise them is in My bookings: "Download my data" (a file with all your data) and "Delete my data". You can also write to us.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

7. Data of drivers and partners

Drivers and partner carriers use the staff panel. We process the data needed for cooperation: name, e-mail, phone, availability and absences, company details (name, tax ID – checked in the public registers CEIDG, REGON or the VAT white list – and bank account number), documents with number and expiry date (e.g. driving licence, medical check, psychological test, liability insurance, vehicle inspection, licence) together with the driver's declaration that the data are true (date and time it was made) and – while driving to a customer – the position from the driver's phone, only if the driver shares it (from "On my way" to "I'm here"). Keys for invoicing software are stored encrypted. The legal basis is the cooperation agreement and our legitimate interest (organising transport, passenger safety).

8. Security

Phone numbers, addresses, comments, messages, invoice details and invoicing software keys are stored encrypted – also in backups. The staff panel is protected by two-step login, and the hotel reception page by an individual link and PIN. The connection to the website is encrypted (HTTPS).

9. Cookies and browser storage

We use only essential cookies and browser storage: for logging in to "My bookings" and the panel, to remember the chosen website language, to remember that the promotion window was closed, to remember the PIN on the hotel reception page (for at most 1 hour, until the tab is closed), for panel settings (e.g. sound on the job board) and for push notifications (if you enable them). Visit statistics do not use cookies. We do not use advertising or analytics cookies – which is why we do not ask for cookie consent.