Privacy Notice — Passengers

Identity & contact (name, email, phone); booking data (pickup, drop‑off, stops, date/time, passenger & luggage count, vehicle class, flight number, notes you leave the driver); payment references — card details are handled by our processor and we never store full card numbers; communications (ride chat, support, ratings); optional invoice details if you request a τιμολόγιο (company, ΑΦΜ, ΔΟΥ, address); and basic technical/usage data with essential cookies.

If you call your chauffeur through the Aristevo app (instead of an ordinary phone call), the call is encrypted end to end and nobody else can listen to it. We never record or store the conversation. The app uses your microphone only during a call you place or answer, and asks for it the first time. We keep a short call log — who called whom, for which ride, when, how long it lasted and how it ended (answered, missed, declined) — for 7 days, to run the service and to settle disputes about whether contact was made (performance of a contract; legitimate interest). The network details the two phones exchange to connect (such as IP addresses) are passed on and not kept. In‑app calls are available only while your ride’s contact window is open.

If one of our apps crashes or freezes, it sends us a technical report the next time it opens: the app version, phone model and system version, the screen and the last few taps, and — if you were signed in — your account reference and the ride open at the time (no name, email, phone or location). The reports go only to our own servers; we use them to fix faults, share them with no one, and delete them after 12 months. To protect you from fake copies of our apps, the app also asks Apple (App Attest) or Google Play (Play Integrity) to confirm that it is the genuine app on a genuine phone; they return only a yes/no style result to us.

When you book on our website without an account we keep the same details as for an account holder — your name, email, mobile number and the ride — for the same purposes and periods set out in this notice. To make sure your trip page opens only for you, your browser stores a random device key (no personal data in it) and we keep only a scrambled form of it with your booking; a new device replaces it after you confirm a code sent to your email. The email code itself is kept only until it is used or expires (15 minutes). If you later choose a password, the same details become your account; you can ask us to delete them at any time (see «Delete your account»).

To create your account, fulfil your bookings and match you with a driver (performance of a contract); to take payment, issue receipts/invoices and keep tax records via myDATA (legal obligation); for safety, fraud prevention and handling complaints and disputes (legitimate interests); and for marketing and non‑essential cookies (your consent, which you can withdraw anytime).

The assigned driver/fleet — only what is needed to perform your ride (name, pickup/drop‑off, flight, notes); our payment processor, hosting, maps and messaging providers, acting as processors under contract; and the tax authority (ΑΑΔΕ/myDATA) and the Ministry transport registry where legally required.

We use these providers to run the service, each under a data‑processing agreement: Stripe (payment processing; EU/US, under the EU–US Data Privacy Framework & Standard Contractual Clauses); Google Maps (geocoding & routing; EU/US, DPF/SCC); Hostinger (hosting & email delivery; EU); Google Firebase Cloud Messaging (push notifications to our apps; EU/US, DPF/SCC); and a public ADS‑B flight‑status service (airport pickup timing — flight number only, no personal data). We do not sell your data or use advertising trackers.

Where a provider processes data outside the EEA (for example our payment processor), transfers are protected by EU Standard Contractual Clauses or an adequacy decision.

Booking and ride records for as long as needed to provide the service and handle disputes; accounting, tax and invoice records for the period required by Greek law; account data while your account is active and for a limited period afterwards.

You may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent — email support@aristevo.com.

You may lodge a complaint with the Greek Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, dpa.gr).

We use automated matching (driver selection by region, vehicle class, proximity and rating) and automated pricing. These do not produce legal effects on you within the meaning of Article 22 GDPR; contact us for human review of any decision.