Privacy Policy for OnMyWay

1. Controller

The controller within the meaning of the General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”) is:

Email: contact@onmyway.dev
Telephone: +49 151 12227771

Please preferably send privacy requests by email to contact@onmyway.dev.

2. Scope

This Privacy Policy applies to the OnMyWay website, the OnMyWay mobile applications and the related functions. OnMyWay is a digital matching platform through which users can offer, search for and coordinate rides, shared journeys and transport opportunities for items.

OnMyWay does not itself provide transportation services and does not process payments between users. Agreements and payments between users take place directly between the persons involved.

3. Personal data we process

Depending on how you use OnMyWay, we process the following categories of personal data:

a) Account and sign-in data

This includes, in particular, the internal user ID, email address, email-confirmation status, sign-in and session data, registration and last-sign-in times, and information required for password changes, account security and management of active sessions.

Passwords are not displayed in plain text or read by OnMyWay personnel. Sign-in data is processed to create and manage the user account, authenticate the user and protect the account against unauthorized access.

The legal basis is Article 6(1)(b) GDPR. Security measures are additionally based on Article 6(1)(f) GDPR. Our legitimate interest is protecting user accounts and the platform.

b) Profile and contact data

Where provided or required for a particular function, this may include name, display name, username, email address, telephone number, profile image, language preference, user role and other voluntary profile information.

This data is used to provide the user account, display users within the platform and enable contact between matched users.

The legal basis is Article 6(1)(b) GDPR. Voluntary information that is not required is processed on the basis of your consent under Article 6(1)(a) GDPR.

c) Ride, route, vehicle and transport data

This may include the starting point and destination, addresses or coordinates, planned time, route, intermediate stops, available seats, vehicle information, transport information, description of an item, request status, assignments between users and organizational information entered by you.

This data is processed to display offers and requests, match suitable users, calculate routes and distances, and enable performance of the agreed ride or transport.

The legal basis is Article 6(1)(b) GDPR.

d) Location and geolocation data

If you enable location access on your device, OnMyWay may process the device’s current position to show your location on the map, suggest a starting point, calculate distances or find suitable offers nearby. Depending on your device, operating system and settings, this may be an approximate or precise location.

We also process the starting points and destinations that you enter and the coordinates required for them. Other users are shown only the information necessary to search for, match and carry out the ride or transport.

Processing takes place to provide the function selected by you under Article 6(1)(b) GDPR. Where the operating system requires consent for location permission, access is additionally based on Article 6(1)(a) GDPR. You can withdraw the device permission at any time in the device settings. Certain location-based functions may then be limited.

e) Reports, complaints and appeals

If you submit a report or appeal, we process the information provided by you. This may include an email address or username, case or reference number, your role in the matter, location information, description of the circumstances, requested outcome, links or supporting information submitted by you, as well as internal review, decision, delivery information and a security and audit trail.

Please do not submit special categories of personal data or personal data relating to third parties unless it is necessary for handling the matter.

Processing is necessary to handle your request, protect the platform, prevent misuse and establish, exercise or defend legal claims. The legal bases are Article 6(1)(b) and Article 6(1)(f) GDPR. Where a legal obligation applies, Article 6(1)(c) GDPR also applies.

f) Communications and emails

We process email addresses and sending, delivery and status information to confirm email addresses, send security notices, acknowledge receipt, communicate decisions concerning reports or appeals, and send other communications required for use of the service.

The legal bases are Article 6(1)(b), (c) or (f) GDPR, depending on the purpose of the communication. OnMyWay does not send advertising newsletters without separate consent.

g) Deletion requests

For an account deletion, we process the user ID, request time, processing status, necessary security evidence and a minimized audit trail. This data is used to carry out and demonstrate the deletion securely.

The legal bases are Article 6(1)(c) and Article 6(1)(f) GDPR.

h) Technical usage and security data

When you access the website, app or interfaces, we may process the IP address or a pseudonymous security value derived from it, date and time, requested address, response status, device and browser information, operating system, app version, session identifier, and error, security and misuse signals.

This processing is necessary to provide the services, identify errors, defend against attacks, limit requests and maintain platform stability.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and misuse-free operation of OnMyWay.

4. Source of the data

We generally obtain personal data directly from you, your device, your entries and your use of the platform. Data concerning an assignment to a ride, request, report or appeal may also originate from another user involved.

If you provide information about other persons, you may submit only the information necessary for the relevant purpose and must be entitled to do so.

5. Requirement to provide data

Certain information, particularly a valid email address and fields marked as mandatory for an offer, request, report or appeal, is required for the relevant function. Without this information, OnMyWay cannot provide the relevant function or process the matter.

Voluntary fields are identifiable as such or are not necessary to use the relevant function.

6. Recipients and categories of recipients

Personal data is disclosed only where necessary for the relevant purpose. Recipients may include:

• other users, where necessary to search, match, establish contact or perform a ride or transport;
• service providers for cloud infrastructure, hosting, databases, authentication and backups;
• service providers for maps, geocoding, route calculation and geolocation functions;
• service providers for email delivery, email confirmation and required notifications;
• service providers for technical security, error analysis, misuse prevention and system operation;
• professional advisers, courts, authorities or other recipients where required by law or necessary to establish, exercise or defend legal claims.

Service providers that process personal data on our behalf are contractually bound and may process the data only on our instructions and for the agreed purposes.

OnMyWay does not sell personal data and does not disclose it for personalized advertising or cross-provider tracking.

7. Transfers outside the European Economic Area

Technical service providers may process data inside or outside the European Economic Area. A transfer to a third country takes place only where the requirements of Articles 44 et seq. GDPR are fulfilled.

Where the European Commission has adopted an adequacy decision for the relevant country, the transfer is based on Article 45 GDPR. Otherwise, we use appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses approved by the European Commission and, where required, additional technical or organizational safeguards. Derogations under Article 49 GDPR are used only in the individual situations provided for there.

Information about safeguards used for a specific transfer can be requested at contact@onmyway.dev.

8. Retention periods

We store personal data only for as long as necessary for the relevant purpose:

• Account and profile data is generally stored for the duration of the active account and is deleted or anonymized following a valid account deletion under the procedure described below.
• Ride, route, vehicle, transport, assignment and request data is stored for performance of the relevant function and generally for up to 90 days after completion or cancellation. It is then deleted or anonymized unless an ongoing dispute, security review or legal retention obligation applies.
• Reports and appeals, including associated processing and audit records, are generally deleted or anonymized 90 days after the matter has been finally closed, subject to legal exceptions.
• Technical security, error and rate-limiting data is generally stored for no longer than 90 days. Data concerning a specific security incident may be retained for as long as necessary to investigate, defend against or pursue the incident.
• Personal data concerning a completed account-deletion request is generally deleted or anonymized 90 days after completion, subject to legal exceptions. Thereafter, only anonymized proof or proof that cannot be attributed to an individual may remain.
• Isolated backups remain separated from ordinary production access and are not restored for normal operations. They are overwritten or deleted according to the infrastructure provider’s backup retention schedule.

Data may be retained for longer where a statutory retention obligation applies or where it is necessary to establish, exercise or defend legal claims. In that case, processing is restricted to that purpose.

9. Account deletion

You can request deletion of your OnMyWay account through the “Delete account” page by contacting contact@onmyway.dev. To prevent abusive deletion requests, we may verify your identity before processing.

We process a valid deletion request without undue delay and generally within one month. If the request is exceptionally complex or a large number of requests are being processed at the same time, the period may be extended by up to two additional months in accordance with Article 12(3) GDPR. In that case, we will inform you of the extension and the reasons for it within the first month.

Further details are available on the “Delete account” page.

10. Permissions on mobile devices

OnMyWay accesses only device functions required for a function selected by you. This may include location permission in particular. Operating-system permissions can be changed or withdrawn at any time in the device settings.

Withdrawal applies for the future. Functions that depend on the relevant permission may then be unavailable or limited.

11. Cookies and local storage

OnMyWay does not use advertising cookies, cross-provider tracking cookies or non-essential marketing trackers.

Cookies or local browser or device storage may be used for sign-in, session management, security, language settings and technically necessary functions. This technical information is required for the function requested by you and is not used for personalized advertising.

If non-essential analytics or marketing technologies are introduced in the future, we will update this Privacy Policy and obtain your consent before processing where required.

12. Automated matching and decisions

OnMyWay may use the starting point, destination, time, route, capacity or other criteria provided by users to suggest possible matches or sort results.

This technical matching is only a recommendation. OnMyWay does not make a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Users decide for themselves whether to make contact or conclude an agreement.

13. Data security

We use appropriate technical and organizational measures to protect personal data against loss, accidental alteration, unauthorized disclosure and unauthorized access. These measures include access restrictions, role-based permissions, encrypted transmission, session and authentication protection, logging of security-relevant events, backups and regular review of access rules.

No system can guarantee absolute security. If a personal-data security incident occurs, we comply with the applicable statutory assessment, notification and communication obligations.

14. Your rights

Subject to the statutory requirements, you have the following rights in particular:

• right of access under Article 15 GDPR;
• right to rectification under Article 16 GDPR;
• right to erasure under Article 17 GDPR;
• right to restriction of processing under Article 18 GDPR;
• right to data portability under Article 20 GDPR;
• right to object under Article 21 GDPR;
• right to withdraw consent at any time with effect for the future;
• right not to be subject to a decision based solely on automated processing within the meaning of Article 22 GDPR, where the statutory conditions are met.

To exercise your rights, contact contact@onmyway.dev. To protect your data, we may request reasonable proof of identity.

We will inform you of the action taken without undue delay and no later than one month after receipt of your request. The period may be extended by up to two months under the conditions of Article 12(3) GDPR.

15. Objection to processing

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

We will then no longer process the relevant data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact the authority responsible for us:

Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: https://www.datenschutz-berlin.de/

You may also contact the supervisory authority at your habitual residence, place of work or place of the alleged infringement.

17. Minors

OnMyWay is intended only for persons who meet the age and legal-capacity requirements stated in the Terms and Conditions. We do not knowingly invite minors to create an account without legally valid consent or representation.

If you believe that a minor’s personal data is being processed unlawfully, please contact contact@onmyway.dev.

18. Changes to this Privacy Policy

We may amend this Privacy Policy if functions, processing activities or legal requirements change. The current version will be published on this page together with the date of the latest update.

Where required by law, we will inform users appropriately about material changes.

19. Language versions

This Privacy Policy is available in German, English and Ukrainian. The German version is the authoritative version. The translations are provided for information and are intended to communicate the same content clearly.