Privacy Policy — QuickPickups Driver App

1. Data Controller

QUICKPICKUPS S.L. (VAT B22944938), based in Barcelona, Spain, is the controller of the personal data collected through the QuickPickups Driver mobile app ("the App"). Privacy contact: [email protected].

2. Data we collect

The App collects the following types of data: • Identification data: name, surname, email, phone, ID number (DNI/NIE), profile photo. • Professional data: licence number and compliance documents (ID, driving licence, VTC licence, insurance, roadworthiness certificate, vehicle registration). • Vehicle data: licence plate, make, model, colour, photos. • Tax data: company tax ID, IBAN for payments. • GPS location: your position only while you have an active service (see section 4). • User-generated content: photos of luggage, no-show evidence, notes, addresses you type when creating a booking. • Technical identifiers: push notification token (FCM), device model, app version and crash reports with an internal identifier. • Usage data: services accepted/rejected, quality indicators, payment history.

3. Purpose of processing

We process your data to: • Manage your driver account and verify your identity and credentials. • Assign you transport services and coordinate them in real time. • Share your position with the manager, the passenger and the agency of the service in progress. • Process your payments and issue your invoices. • Send you push notifications about new services, changes and urgent alerts. • Share your professional data (name, phone, photo, vehicle) with the agencies and platforms that book the service so they can validate and coordinate it. • Diagnose and fix App errors. • Comply with legal obligations (tax, labour, insurance).

4. When your location is collected and shared

The App only reads and sends your position WHILE THERE IS AN ACTIVE SERVICE: from 30 minutes before the pickup time until you finish the service, and at most 2 hours after the pickup. • On Android, while your position is being sent you will see a persistent notification telling you so. • On iOS, your position is only sent while the App is open. • The App does NOT request background location permission. During the service, your position is shared with your manager, with the passenger (so they can see where you are and the estimated time of arrival) and with the agency or platform that booked the service. Outside an active service the App neither collects nor shares your location.

5. Legal basis

The processing of your data is based on: • Contract performance (Art. 6.1.b GDPR): to manage your collaboration as a driver, assign you services, send you notifications about them and share your position during the service, which is a necessary condition to provide it. • Compliance with legal obligations (Art. 6.1.c GDPR): for tax, labour and transport (taxi/VTC) regulations. • Legitimate interest (Art. 6.1.f GDPR): for fraud prevention, operational safety, handling of claims and service improvement. Position tracking during the service is carried out with prior express information to drivers, in line with art. 90 of the Spanish LOPDGDD (applied by analogy). • Consent (Art. 6.1.a GDPR): only for marketing communications, if we ever send them. You can withdraw it at any time without affecting your ability to operate.

6. Data sharing with third parties

Your data may be shared with: • Travel agencies and booking platforms that send us the service (for example, Mozio or Trip.com): name, phone, profile photo, licence plate and your position during the service, only for that service and under the corresponding data processing agreements. • The passenger of the service: first name, licence plate, vehicle model and colour, and your position and estimated time of arrival during the service. • Technology providers, as data processors under GDPR: – Google Firebase Cloud Messaging: delivery of push notifications. – Google Firebase Crashlytics: App crash reports (internal identifier, device model and App version). – Mapbox: geocoding of the addresses you type when creating a booking. – Brevo: email delivery. – Stripe: end-client payments (does not process your data as a driver beyond what is needed to reconcile the service). • Tax Authority and Social Security: when required by law. For navigation, the App opens Google Maps or Waze as external apps through a link; it does not embed the Google Maps SDK and does not share your position with Google through this route beyond whatever the app you choose does. We do NOT sell your data to third parties for marketing purposes.

7. Retention

We retain your data for the following periods: • Invoices, payment orders and supporting documents: 6 years (art. 30 of the Spanish Commercial Code; minimum 4 years under the General Tax Law). • Records of services provided and their proof (photos, pickup and drop-off coordinates): 5 years. • Continuous GPS location: 90 days. • Compliance documents: for as long as the relationship lasts; destroyed when the account is deleted. • Contract and data processing agreement: 6 years after the end of the relationship. When the account is deleted, personal data is anonymised after 30 days. Data we must keep due to legal obligations is no longer linked to you from the App.

8. Your rights (GDPR)

You have the right to: • Access your data. • Rectify it if incorrect. • Request its erasure when no longer needed. • Object to certain processing. • Data portability. • Restrict processing. • Withdraw consent for processing based on it. To delete your account: in the App, go to Profile → Delete account. We will send a 6-digit code to your email to confirm it is you. The account is deactivated immediately and for 30 days you can cancel the request using the link you will receive by email; after that period, your data is deleted or anonymised irreversibly. If you no longer have the App, write from your account email to [email protected] with the subject "Delete account". For the other rights, write to [email protected] from your account email. We will respond within a maximum of 30 days. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

How to delete your QuickPickups Driver account

9. Security

We apply technical and organisational measures to protect your data: • Encrypted communications with TLS 1.2+. • Passwords stored with secure hash. • Access limited to authorised personnel. • Audit logs for critical actions. However, no system is 100% infallible. We recommend not sharing your password and logging out when using the App on a shared device.

10. Minors

The App is exclusively for professional drivers over 18 years old. We do NOT collect data from minors. If we detect that a minor has created an account, we will delete it immediately.

11. Operating system permissions

The App requests the following permissions on your device: • Location (while using the App): to send your position only during an active service, as described in section 4. Background location is not requested. On Android, a persistent notification is shown while your position is being sent. • Camera: so you can take photos of your profile, vehicle, documents and service evidence (luggage, no-shows). • Notifications: to alert you of new services, changes and messages from the manager. • Network / Internet access: to communicate with our servers. The App does not request gallery or storage permission: when you upload a photo or document, you pick it with the system picker and the App only accesses that file. You can revoke any of these permissions in your device settings, but some features of the App may stop working.

12. Changes to this policy

We may update this policy. When we do, we will notify you through the App (banner) and by email. Significant changes will require your new acceptance within the App before you can operate.

13. Contact

For any inquiries about this policy or your personal data: • Privacy: [email protected] • General support: [email protected] • Web: https://quickpickups.es