Privacy Notice — Drivers

Identity & contact (name, photo, date of birth, phone, email); compliance and professional data (driving and ΕΙΧ licences, ΚΤΕΟ, medical certificate, and — where required by transport law — a criminal‑record certificate); your assigned vehicle and the rides you receive and perform; live GPS during active rides (pickup to drop‑off); ratings and reputation; payout data (bank/IBAN, earnings, invoices via myDATA); and ride‑chat and support messages.

Health (medical certificate) and criminal‑record data are special categories under Articles 9–10 GDPR. We process them only for the suitability check required by transport law, with appropriate safeguards, and we do not use them for any other purpose.

Your profile photo, your driving‑licence photo and the optional selfie you take when you sit the Premium chauffeur certification test naturally show your face. We do NOT perform any facial recognition, face matching, biometric identification or any other algorithmic processing of face data — no faceprint or face template is ever created. The photos are reviewed by our operations team, by eye, solely to verify your identity and licence during onboarding and to confirm that the person sitting the certification test is the account holder; your profile photo is shown to the passenger so they recognise their chauffeur. These images are stored on our servers in the EU, are never shared with third parties beyond the passenger display described above, are never used for advertising or profiling, and are deleted when your account is closed. The certification selfie is optional in the sense that the Premium test is optional — you can drive without ever taking it. Pre‑trip vehicle photos and inspection videos document the CAR (front, side, cabin), not people.

If you call your guest through the Aristevo app (instead of an ordinary phone call), the call is encrypted end to end and nobody else can listen to it. We never record or store the conversation. The app uses your microphone only during a call you place or answer, and asks for it the first time. We keep a short call log — who called whom, for which ride, when, how long it lasted and how it ended (answered, missed, declined) — for 7 days, to run the service and to settle disputes about whether contact was made; a call you place to a guest is also recorded on the ride as a contact attempt, which counts towards a no‑show (performance of a contract; legitimate interest). The network details the two phones exchange to connect (such as IP addresses) are passed on and not kept. In‑app calls are available only while your ride’s contact window is open.

If one of our apps crashes or freezes, it sends us a technical report the next time it opens: the app version, phone model and system version, the screen and the last few taps, and — if you were signed in — your account reference and the ride open at the time (no name, email, phone or location). The reports go only to our own servers; we use them to fix faults, share them with no one, and delete them after 12 months. To protect you from fake copies of our apps, the app also asks Apple (App Attest) or Google Play (Play Integrity) to confirm that it is the genuine app on a genuine phone; they return only a yes/no style result to us.

To provide the platform, present offers and enable assignment and dispatch (performance of a contract); to verify licences and eligibility, maintain the EIX registry and meet transport‑law and tax obligations (legal obligation); to use live GPS for dispatch, safety and dispute resolution, and for service quality and fraud prevention (legitimate interests); and to make payouts and keep tax records (legal obligation and contract).

Passengers — limited identity (name, photo, vehicle, live location) from the moment you set off; your fleet, for dispatch and management; our payment, hosting, maps and messaging providers, as processors; and the Ministry registry and the tax authority (ΑΑΔΕ/myDATA) as legally required.

We use these providers to run the service, each under a data‑processing agreement: Stripe (driver payouts & payment processing; EU/US, under the EU–US Data Privacy Framework & Standard Contractual Clauses); Google Maps (geocoding & routing; EU/US, DPF/SCC); Hostinger (hosting & email delivery; EU); Google Firebase Cloud Messaging (ride‑offer push notifications; EU/US, DPF/SCC); and a public ADS‑B flight‑status service (airport pickup timing — flight number only). We do not sell your data or use advertising trackers.

The GPS trip trail is deleted automatically — it is kept for 120 days — long enough to answer a passenger dispute or a card chargeback, which usually arrive weeks after the ride, and no longer; compliance documents while you are active and as the law requires; payout and tax records for the period required by Greek law; account data while active and for a limited period afterwards.

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent — support@aristevo.com. Some data we are legally required to keep (for example tax and transport records).

You may lodge a complaint with the Greek Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr).

Offers are matched and ranked by region, vehicle class, proximity and rating. This does not produce legal effects within the meaning of Article 22 GDPR; contact us for human review.