Voziko Platform Privacy Policy

Last updated: 2026-11-06

1. Who we are

This platform is operated by Polemarhi d.o.o. ("Voziko", "we"), Vojvode Mišića 46/1, 35250 Paraćin, Serbia, PIB 112505565. Contact: [email protected].

For the data described here, we are the data controller — this covers only the people and records of running the platform business: taxi-company account and admin users, billing, support, sales contacts, and security/technical logs.

Separately, when we process riders' data AND drivers' personal data on a taxi company's behalf, we act as that company's processor, not controller — the taxi company is the controller of both. That processing is governed by our Data Processing Agreement and described in each company's Privacy Policy and Driver Privacy Notice; it is not covered by this policy.

2. Whose data this covers, and what we collect

This policy covers the data for which Voziko is the controller:

Taxi companies (account/admin users): company legal name, address, registration/tax number, contact email and phone, and the account login.

Billing: subscription and payment records for the taxi company's use of the platform.

Support and sales: messages, tickets and contact details when a company or prospect contacts us.

Security/technical logs: technical data such as IP address and device/browser info for account users, used to run, secure and troubleshoot the service (held in logs).

Directory visitors (near-me search): if a visitor to the public directory uses "find taxis near me", the browser sends approximate coordinates to Voziko to find nearby companies; we reverse-geocode them to a city via our map provider and store only city-level information, never the precise coordinates.

Not covered here (we are only the processor): drivers' personal data and riders' data. The taxi company is the controller of both; we process them solely on the company's instructions under the Data Processing Agreement. Driver data is described in the company's Driver Privacy Notice; rider data in the company's Privacy Policy.

3. Why we use it, and our legal basis

To provide and operate the platform for you — performance of our contract with you.
To keep the service secure, prevent abuse, and troubleshoot — our legitimate interest.
To meet legal and accounting obligations — legal obligation.

We do not use personal booking or contact data for advertising or profiling, and we do not sell it.

Privacy-friendly analytics: On public marketing pages and in the rider booking flow, we use Umami without cookies to collect aggregated usage statistics, including page views and booking/contact form events. Umami is self-hosted by Voziko in the EU on Railway. IP addresses are not stored in Umami; query strings and personal booking/contact details are not sent to analytics. Analytics data is kept for 24 months. Driver, dispatcher, tenant-admin and platform-admin areas are not tracked. The data-protection role for analytics on taxi-company booking pages is not settled.

4. Who we share it with (sub-processors)

We use these providers to run the service. The current list — with purpose, data received, region, contract status, and whether your browser contacts each one directly — is published on the Voziko Sub-processor List page. In summary:

Supabase — purpose: database, accounts, real-time. Data: account/login data. Region: EU (Frankfurt). Direct browser contact: yes, for sign-in and real-time driver updates. Contract status: Not confirmed. Provider publishes a DPA; our acceptance is not confirmed.
Railway — purpose: application hosting. Data: requests in transit; logs may include IP. Region: EU (Amsterdam, Netherlands). Direct browser contact: no. Contract status: Not confirmed. Provider publishes a DPA; our acceptance is not confirmed.
Cloudflare — purpose: DNS, security, content delivery and encrypted database backups (R2). Data: all requests and IP; encrypted backups. Region: global edge; R2 storage region not confirmed. Direct browser contact: yes. Contract status: DPA incorporated in the provider's terms.
Brevo — purpose: transactional and support/sales email (password resets, contact/lead form, feedback, go-live notifications). Data: recipient email address and any details submitted in those forms. Region: EU (France). Direct browser contact: no. Contract status: Not confirmed. Provider's DPA not reviewed.
Geoapify — purpose: geocoding (address ↔ location). Data: search text/coordinates. Region: EU. Direct browser contact: no. Contract status: No signed DPA; provider's standard terms.
OpenFreeMap — purpose: map tiles. Data: map area (tiles fetched by our server; IP not sent). Region: EU operator (Hyperknot Software Kft., Hungary); server location not published. Direct browser contact: no. Contract status: No DPA; processor role not settled.
GitHub Actions — purpose: scheduled jobs, including the encrypted database backup. Data: database contents, briefly unencrypted on a temporary server while the backup is made. Region: GitHub does not publish a server region. Direct browser contact: no. Contract status: DPA incorporated in the provider's terms; Actions not named, covered by its default for all Online Services.
Push notification services (Google, Mozilla, Apple, Microsoft) — purpose: deliver ride alerts to drivers. Data: push subscription and encrypted message content. Region: global infrastructure, region not published. Direct browser contact: yes, for the driver's browser. Contract status: Not confirmed for any of the four; Apple's role is open.
Business transfers — if Voziko's business is involved in a merger, acquisition or sale of assets, the data covered by this policy may be transferred to the counterparty, which must continue to protect it as described here.

We disclose data to authorities only where legally required.

5. Storage location and transfers

The main database is in the EU (Frankfurt); the storage region of the encrypted backups is not confirmed. Some providers are located or operate outside the EU. Examples: Cloudflare runs a global network, push notification services run on global infrastructure, and GitHub Actions, whose run locations are not published, runs scheduled jobs, including the encrypted database backup, during which data is briefly unencrypted on a temporary server. For Brevo, access from the US and India is an open question. The transfer mechanism for each provider is stated on the Voziko Sub-processor List page.

6. How long we keep it

Account data is kept while your account is active, and after the account is closed we delete it on your request. Accounting and tax records are kept for the periods set by law; private-sector electronic invoices are kept for 10 years from the end of the year of issue (Art. 15 of the Serbian Electronic Invoicing Act).

Onboarding (concierge) requests you submit so we can set up your company — contact and company details, and any driver details you list — are deleted 90 days after submission, whether or not an account was created.

Data we delete is also removed from our backups within about 30 days, as older backups expire.

7. Your rights

You can access, correct, delete, restrict, object to, or receive a copy of your data — contact [email protected]. You may also complain to your country's data-protection authority (in Serbia, the Commissioner / Poverenik, www.poverenik.rs).

8. Changes

We may update this policy; the "last updated" date shows the current version.