Privacy Notice — Drivers

Identity & contact (name, photo, date of birth, phone, email); compliance and professional data (driving and ΕΙΧ licences, ΚΤΕΟ, medical certificate, and — where required by transport law — a criminal‑record certificate); your assigned vehicle and the rides you receive and perform; live GPS during active rides (pickup to drop‑off); ratings and reputation; payout data (bank/IBAN, earnings, invoices via myDATA); and ride‑chat and support messages.

Health (medical certificate) and criminal‑record data are special categories under Articles 9–10 GDPR. We process them only for the suitability check required by transport law, with appropriate safeguards, and we do not use them for any other purpose.

Your profile photo, your driving‑licence photo and the optional selfie you take when you sit the Premium chauffeur certification test naturally show your face. We do NOT perform any facial recognition, face matching, biometric identification or any other algorithmic processing of face data — no faceprint or face template is ever created. The photos are reviewed by our operations team, by eye, solely to verify your identity and licence during onboarding and to confirm that the person sitting the certification test is the account holder; your profile photo is shown to the passenger so they recognise their chauffeur. These images are stored on our servers in the EU, are never shared with third parties beyond the passenger display described above, are never used for advertising or profiling, and are deleted when your account is closed. The certification selfie is optional in the sense that the Premium test is optional — you can drive without ever taking it. Pre‑trip vehicle photos and inspection videos document the CAR (front, side, cabin), not people.

To provide the platform, present offers and enable assignment and dispatch (performance of a contract); to verify licences and eligibility, maintain the EIX registry and meet transport‑law and tax obligations (legal obligation); to use live GPS for dispatch, safety and dispute resolution, and for service quality and fraud prevention (legitimate interests); and to make payouts and keep tax records (legal obligation and contract).

Passengers — limited identity (name, photo, vehicle, live location) from the moment you set off; your fleet, for dispatch and management; our payment, hosting, maps and messaging providers, as processors; and the Ministry registry and the tax authority (ΑΑΔΕ/myDATA) as legally required.

We use these providers to run the service, each under a data‑processing agreement: Stripe (driver payouts & payment processing; EU/US, under the EU–US Data Privacy Framework & Standard Contractual Clauses); Google Maps (geocoding & routing; EU/US, DPF/SCC); Hostinger (hosting & email delivery; EU); Google Firebase Cloud Messaging (ride‑offer push notifications; EU/US, DPF/SCC); and a public ADS‑B flight‑status service (airport pickup timing — flight number only). We do not sell your data or use advertising trackers.

The GPS trip trail is deleted automatically — it is kept for 120 days — long enough to answer a passenger dispute or a card chargeback, which usually arrive weeks after the ride, and no longer; compliance documents while you are active and as the law requires; payout and tax records for the period required by Greek law; account data while active and for a limited period afterwards.

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent — support@aristevo.com. Some data we are legally required to keep (for example tax and transport records).

You may lodge a complaint with the Greek Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr).

Offers are matched and ranked by region, vehicle class, proximity and rating. This does not produce legal effects within the meaning of Article 22 GDPR; contact us for human review.