Privacy Policy

EEA: Naviuma Platform GmbH, [Company Legal Address, Munich, Germany].

United Kingdom: Naviuma Platform UK Ltd, [UK Registered Office Address, London, United Kingdom].

Data Protection Officer (both entities): dpo@naviuma.com.

EU Representative (Art. 27 GDPR): [EU Article 27 Representative — to be appointed]. UK Representative (UK GDPR Art. 27): [UK GDPR Article 27 Representative — to be appointed].

This Policy applies to personal data processed by Naviuma as controller — for example account, billing, and support interactions — under both the EU GDPR and the UK GDPR (together with the UK Data Protection Act 2018). Where Naviuma processes personal data on behalf of a business user, the Data Processing Agreement (DPA) applies instead.

• Identity & contact data (name, business email, phone, role).
• Company data (legal name, address, tax ID / VAT / VRN, licences, insurance).
• Operational data (ride requests, offers, bookings, driver assignments, vehicle metadata).
• Passenger data provided during manifest submission (name, flight details, service notes).
• Payment metadata (Stripe references — full card numbers are never stored by Naviuma).
• Technical data (IP, device, log events, cookies).

Legal bases are cited under EU GDPR; the equivalent provisions of the UK GDPR apply to UK users.

• Providing the Platform (Art. 6(1)(b) — contract).
• Verification, fraud prevention, compliance (Art. 6(1)(c) & (f)).
• AI-assisted onboarding to preview public company information (Art. 6(1)(f) — legitimate interest).
• Transactional email notifications (contract).
• Optional marketing communications (Art. 6(1)(a) — consent; UK PECR consent where applicable).

Personal data may be shared with the counterparty of a booking, with Subprocessors listed in the Subprocessor List, and with authorities where legally required.

Transfers from the EEA to third countries rely on the EU Standard Contractual Clauses (2021/914) and, where applicable, supplementary measures or an adequacy decision.

Transfers from the UK rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, together with a transfer risk assessment where required.

• Account and contract records: for the duration of the relationship plus statutory retention (typically 10 years under German commercial and tax law; 6 years under UK HMRC rules).
• Passenger manifests: 90 days after service completion, then anonymised.
• Logs and cookies: as described in the Cookie Policy.

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw any consent given.

You may lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement. In Germany, the lead authority for Naviuma is the Bavarian Data Protection Authority (BayLDA). In the United Kingdom, the competent authority is the Information Commissioner's Office (ICO, https://ico.org.uk).

See the Security & Compliance document for technical and organisational measures.

Material changes are announced 30 days in advance. The current version and effective date are always visible at the top of this page.

Questions about this document may be sent to legal@naviuma.com.

Naviuma Platform GmbH [Company Legal Address, Munich, Germany]