PERSONAL DATA PROCESSING POLICY

Placement date August 5, 2021

This Personal Data Processing Policy (hereinafter referred to as the “Policy”) defines the general principles and procedure for processing personal data and measures to ensure their security at EvaSoft Corporation when organizing the operation of the site located at https:// ozcar.app (hereinafter referred to as "Site"), as well as the Ozcar mobile application (hereinafter referred to as the "Application") .
Before using the Site or Application, please read the terms of this Policy.

1. Terms


The Operator and Users use the following terms in the meaning given below:
1.1 Automated processing of personal data means processing of personal data by means of computer technology;
1.2 Agency Agreement means an agency agreement concluded between the Operator and the User; the text of the standard form of the agreement is permanently posted in the public domain on the Website and in the Application.
1.3 Preliminary rental agreement means an agreement concluded between the Owner and the Renter at the time of confirmation of the reservation, on the intention of both Parties to enter into an agreement on the rental of a vehicle without a crew in the future on the terms established by such an agreement, the text of the standard form of the agreement is constantly publicly available in the Service.
1.4 Operator's database means a set of information and data located in the Operator's information system for the purpose of storing personal data of Users and other information.
1.5 Blocking of Personal Data means temporary suspension of processing of Personal Data (except when processing is necessary to clarify Personal Data).
1.6 Legislation means the current legislation of the Russian Federation.
1.7 Information system of Personal data means a set of Personal data contained in databases of Personal Data and providing for their processing.
1.8 Confidentiality of Personal Data means the obligation of persons who have gained access to Personal Data not to disclose to third parties and not to distribute Personal Data without the consent of the User of Personal Data, unless otherwise provided by the Legislation.
1.9 Depersonalization of Personal Data means actions as a result of which it becomes impossible to determine the ownership of Personal Data by a specific Personal Data Subject without the use of additional information.
1.10 Processing of Personal Data means any action (operation) or a set of actions (operations) performed with or without the use of automation tools with Personal Data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of Personal Data.
1.11 Operator is "EvaSoft Corporation", registered at 2810, N Church St, PMB 52218, Wilmington, DE, 19802, USA independently or jointly with other persons organizing and (or) carrying out the processing of Personal Data, as well as determining the purposes of processing Personal Data, the composition of Personal Data to be processed, actions (operations) performed with Personal Data.
1.12 Personal data means any information related directly or indirectly to a defined or identifiable individual (User). The User provides his or her own Personal Data when using the Site or the Application.
1.13 User means an individual accessing and using the Site or the Application.
1.14 User Agreement means an agreement on the use of the Site and the App concluded between the Operator and the User, the text of which is constantly publicly available on the Site and in the Application.
1.15 Provision of personal data means the actions of the User aimed at disclosing Personal data to a certain person or a certain circle of persons.
1.16 Application means Ozcar software designed to work on mobile devices with iOS and Android platforms, with the help of which the Operator provides services.
1.17 Site means a software and hardware complex consisting of a site hosted on the domain name ozcar.app , computer programs, databases, disk space and equipment.
1.18 Subject of Personal Data is the User to whom the Personal Data relates.
1.19 Cross-border transfer of Personal Data means the transfer of Personal Data to the territory of a foreign state to an authority of a foreign state, a foreign individual or a foreign legal entity.
1.20 Destruction of Personal Data means actions as a result of which it is impossible to restore the content of Personal Data in the Personal Data information system.

2. General provisions


2.1 This Policy regarding the processing of Personal Data and Data has been developed under applicable law, other legislative and regulatory legal acts and determines the security requirements and procedures work with Personal Data and User Data.
2.2 Measures to ensure the security of Personal Data are an integral part of the Operator's activities.

3. Principles of Personal Data Processing


3.1 The Operator shall process Personal Data and/or Data in accordance with the following principles:
3.1.1 Legality and fair basis for processing Personal Data and/or Data. The Operator takes all necessary measures to comply with the requirements of the Legislation, does not process Personal Data in cases where this is not allowed by the Legislation, does not use Personal Data to the detriment of the User.
3.1.2 Processing only those Personal Data and (or) Data that meet the pre-declared purposes of their processing. Compliance of the content and scope of processed Personal Data with the stated processing purposes. Prevention of the processing of Personal Data that is incompatible with the purposes of collecting Personal Data, as well as excessive in relation to the stated purposes of their processing.
3.1.3 The operator processes Personal Data solely to fulfill contractual obligations to the User.
3.1.4 Ensuring the accuracy, sufficiency and relevance of Personal Data and (or) Data in relation to the purposes of processing Personal Data and (or) Data. The Operator shall take all reasonable measures to keep the processed Personal Data up-to-date, including but not limited to exercising the right of each Subject to receive his/her Personal Data for review and to request the Operator to clarify, block or destroy it if the Personal Data is incomplete, outdated, inaccurate, illegally obtained or unnecessary for the above stated processing purposes.
3.1.5 Storage of Personal Data and (or) Data in a form that allows identifying the User of Personal Data and (or) Data no longer than required by the purposes of processing of Personal Data, unless the period of storage of Personal Data is established by federal law, contract, a party to which or the beneficiary is the User of Personal Data.
3.1.6 Inadmissibility of combining databases created for incompatible purposes of Personal Information Systems and (or) Data.

4. Composition of Personal Data and purposes of their processing

Purposes of processing

Ensuring the User's registration on the Site or in the Application and creating a personal account;
Ensuring the possibility of communication between the Operator's support service and the User in the process of implementation of contractual obligations;
Composition of Personal Data

Email address;
Mobile phone number;
Conclusion and execution of the User Agreement on the use of the Site and the Application;
Conclusion and execution of the Agency Agreement between the Operator and the User;
Registration of cars on the Site and in the Application for rental;
Regulation of the process of car reservation using the Site and Application;
Regulation of the process of conclusion and execution of a preliminary vehicle rental agreement between Users;
Verification of the User's identity and the validity of the data provided by the User;
Settlement of disputes between Users;
Making settlements and payments in accordance with the User Agreement, the Agency Agreement and the preliminary vehicle rental agreement;
Full Name;
Email address;
Mobile phone number;
ID data and the photo of the ID.
Home address;
Photo of the User;
The driver's license's data, date of issue, photo of the driver's license;
Photo of the vehicle registration certificate;
Photos of other documents necessary to verify the identity of the User and the accuracy of the information provided by him;
Make, model and year of manufacture of the User's car;
The license plate number of the User's car;
SLI policy data;
Vehicle VIN number;
Description of the car and its configuration;
Photos of the exterior and interior of the car;
A photo of the vehicle inspection document;
Make, model and year of manufacture of the User's car;
The license plate number of the User's car;
SLI policy data;
The cost of the car;
Vehicle VIN number;
Description of the car and its configuration;

Verification of the User's solvency, creditworthiness and trustworthiness to the extent necessary to ensure the safety of other Users and the safety of their property;
Checking the User's Vehicle;
Detection and suppression of cases of fraud and other potentially harmful and illegal activities when renting vehicles;
Full Name;
Date of Birth;
ID data and the photo of the ID.
Home address;
Credit history and creditworthiness data;
The presence of traffic fines;
SLI policy data;
Involvement of the User in incidents of an unlawful nature;
Information about the payment by the User of personal property taxes;
Data about the User's car obtained as a result of its verification: the presence or absence of a ban on registration actions, participation in an accident, vehicle registration certificate data, the car being stolen or wanted, checking car ownership;
Collecting feedback on the Site and Application;
Ensuring the safety of Users and the safety of their property;
Monitoring the proper execution of the preliminary vehicle rental agreement;
Full Name;
Email address;
Mobile phone number;
Car booking and rental history;
Analysis of possible errors in the operation of the Site and Application and improvement of their work;
Conducting statistical and other research based on anonymized personal data;
Technical data generated through the use of the Site and the Application:
  • cookies,
  • IP addresses,
  • user ID assigned by the Site,
  • pages visited,
  • number of page visits,
  • information on navigating through the pages of the Site,
  • duration of the user session,
  • entry points (third-party sites from which the user follows a link to the Site),
  • exit points (links on the Site that take the user to third-party sites),
  • User's browser,
  • digital browser fingerprint (canvas fingerprint),
  • information about the version of the operating system and the User's device,
  • information about the use of automation tools when accessing the Site.
  • the time and date of visiting the Site and Application;
  • information about the location of the User's device (based on cellular network data and GPS signals).

5. Terms of Personal Data Processing


5.1 Processing of Personal Data by the Operator is allowed in the following cases:
51.1 If the User has consented to the processing of his Personal Data obtained during registration.
5.1.2 If there are grounds provided for by the Legislation that allow the processing of personal data in the absence of the User's consent to the processing of his Personal Data.
5.2 The grounds for processing Personal Data are:
5.2.1 Legal provisions governing the Operator's activities.
5.2.2 Statutory documents of the Operator.
5.2.3 Agreements concluded between the Operator and the User, including the User Agreement, as well as agreements concluded between Users.
5.2.4 User's consent to the processing of his/her Personal Data.
5.3 The Operator does not process Personal Data belonging to special categories and relating to race and nationality, political views, religious or philosophical beliefs, health status, intimate life of the Personal Data Subject, membership of the Personal Data Subject in public associations, except as expressly provided by the Legislation.

6. Collection and processing of Personal Data and other Data


6.1 The Operator collects information in the following ways:
6.1.1 Personal data provided by the Users: The Operator collects Personal data that is entered into the data fields on the Site and in the Application by the Users themselves or other persons on their behalf.
6.1.2 Automated collection of technical information when using the Site and the Application.
6.1.3 Automated collection of information using telematic devices placed on the User's car.
6.1.4 Obtaining Personal Data from third parties or from publicly available sources.
6.2 Processing of personal data involves the operator performing the following actions: collection; recording; systematization; accumulation; storage; clarification (updating, modification); extraction; use; transfer (distribution, provision, access), including cross-border transfer; depersonalization; blocking; removal; destruction; transfer to third parties, in cases provided for in this Policy.
6.3 The processing of Personal Data is carried out both with the use of automation tools and without the use of such tools.

7. User Rights


7.1 The User exercises the following rights in relation to their Personal Data:
7.1.1 deciding on the provision of their personal data to the Operator and third parties and consent to their processing freely, by their own will and in their own interest;
7.1.2 withdrawing their consent to the processing of personal data;
7.1.3 receiving information from the Operator regarding the processing of personal data by sending a corresponding request;
7.1.4 requiring the Operator to clarify personal data, block or destroy them if they are incomplete, outdated, inaccurate, illegally obtained or not necessary for the stated purposes of processing;
7.1.5 demanding to stop processing personal data in order to promote goods, works, services on the market by making direct contacts with them using means of communication;
7.1.6 appealing against the actions or omissions of the Operator to the authorized body for the protection of the rights of subjects of personal data or in court;
7.1.7 exercising other rights stipulated by the Legislation.

8. Rights and obligations of the Operator and User


8.1 The operator undertakes to use Personal Data under the Data Protection Act 2018 and local regulations of the operator.
8.2 With regard to the User's Personal Data, the Operator undertakes to maintain their confidentiality, except as provided by the Legislation.
8.3 The operator is obliged to take measures necessary and sufficient to ensure fulfillment of responsibilities, provided by the Legislation. The operator independently determines the composition and list of such measures.
8.4 The Operator shall be obliged to inform the User or their representative of the availability of Personal Data relating to the relevant User in the manner prescribed by the Law, as well as provide an opportunity of familiarization with such Personal Data on a free-of-charge basis, in the manner prescribed by the Law.
8.5 In cases of unauthorized processing of Personal Data, the Operator shall stop processing such Personal Data. If it is impossible to ensure the lawfulness of processing of Personal Data, the Operator shall destroy such Personal Data in the manner prescribed by the Law.
8.6 If it is revealed that the personal data is inaccurate, the Operator shall be obliged to block such personal data and clarify it in the manner prescribed by the Law.
8.7 The operator performs other duties, provided by the Legislation.
8.8 The Operator has the right to transfer the User's Personal Data to third parties with the consent of the User.
8.9 The Operator has the right to transfer the User's Personal Data without the User's consent to the following entities:
8.9.1 to state bodies, including bodies of inquiry and investigation, and local governments at their reasoned request;
8.9.2 to the Operator's partners in order to fulfill contractual obligations to the User;
8.9.3 to other entities in cases expressly provided for by law.
8.10 The Operator has the right to transfer the User's Personal Data to third parties without the consent of the User in the following cases:
8.10.1 the transfer is necessary as part of the use of the Site by the Users and (or) the execution of the agreement on the use of the Site;
8.10.2 transfer takes place by way of legal succession from the Operator to newly established legal entities, with all obligations to comply with the terms and conditions of this Policy transferred to the acquirer;
8.10.3 in other cases expressly provided for by the Legislation.

9. User Consent to the Processing of Personal Data


9.1. The User decides to provide their Personal Data to the Operator when registering on the Site or in the Application and gives consent to their processing freely, willingly and in their own interest.

10. Making legally significant decisions on the basis of automated processing of personal data

10.1 In order to ensure the safety of the Users of the Site and the Application, the Operator performs an automated check of the Users and the data provided by them.
10.2 Verification is carried out using automated algorithms based on information:
10.2.1 provided by the User,
10.2.2 obtained from publicly available sources,
10.3 The Operator carries out an automated check of data about Users who want to rent a car, as well as about their cars.
10.4 Based on the results of the check, the Operator may approve or refuse to register the User's vehicle.
10.5 Approval of the User's vehicle registration entails the conclusion of an Agency Agreement between the User and the Operator, as well as enabling the User to place advertisements for vehicle rentals and enter into vehicle rental agreements.
10.6 Refusal to register a car entails the impossibility for the User to perform these actions.
10.7 The Operator performs an automated verification of data about Users who wish to book and rent a car.
10.8 Based on the results of the check, the Operator has the right to grant the User permission to book a car or refuse to book a car.
10.9 Granting a reservation permit entails enabling the User to submit a reservation request for the purpose of subsequently entering into a Vehicle Rental Agreement.
10.10 Failure to make a Reservation makes it impossible for the User to reserve and rent cars.
10.11 The user may raise an objection to a decision based on an automated review by contacting Support via the Site and Application. The appeal must be motivated and point out the shortcomings of the decisions made.
10.12 The User has the right to protect their rights and legitimate interests by appealing to the authorized body for the protection of the rights of subjects of personal data or the court in case the User believes that the actions of the Operator are unlawful.


11. Cross-border transfer of Personal Data


11.1 The Operator shall be entitled to carry out a cross-border transfer of User Personal Data in foreign countries, ensuring adequate protection of the rights of Personal Data Subjects, except in cases where such transfer is prohibited or restricted in order to protect the constitutional order of State of Delaware, morality, health, rights and lawful interests of citizens, national defense and state security.
11.2 The Operator must ensure that the foreign country to whose territory Personal Data is transferred provides adequate protection of the rights of Personal Data Subjects before the cross-border transfer of Personal Data begins.
11.3 The Operator shall be entitled to transfer Personal Data across borders in foreign countries that do not provide adequate protection of the rights of Personal Data Subjects, subject to the written consent of the User, as well as in other cases expressly provided by the Legislation.

12. Personal Data Security


12.1 The operator applies measures to ensure the security of the User's personal data.
12.2 Third parties may process the User's Personal Data strictly in accordance with the Operator's instructions and in cases where they agree to keep the information confidential and to keep it safe.
12.3 The Operator applies appropriate security measures to prevent accidental loss, use or availability of the User's Personal Data for unauthorized use, modification or disclosure.
12.4 The Operator restricts access to the User's Personal Data only to those employees, agents, contractors and other third parties who require it in connection with business purposes or purposes stipulated by the Law.
12.5 Access to the Information Systems containing Personal Data is secured by a password system. Passwords are set by authorized employees of the Operator and are individually communicated to Operator employees who have access to Personal Data.
12.6 The Operator has procedures in place to deal with any suspected violation of security requirements in relation to Personal Data, and also notifies the User and any relevant regulatory authorities of such violations where required by law.

13. Other provisions


13.1 This Policy and the relationship between the User and the Operator arising in connection with the application of the Policy shall be subject to the Law.
13.2 All possible disputes shall be resolved in accordance with the Law.
13.3 Before applying to the court, the User must comply with the mandatory pre-trial procedure and send the relevant claim to the Operator in writing. The time limit for responding to a claim is thirty (30) business days.
13.4 If for any reason one or more provisions of this Policy are found to be invalid or unenforceable, the validity or enforceability of the remaining provisions of this Policy shall not be affected.
13.5 The Operator has the right to change this Policy (in whole or in part) unilaterally at any time without prior agreement with the User. All changes will become effective the day after they are posted on the Site or App.
13.6 The User undertakes to independently monitor the changes to the Policy by reviewing the current version.

14. Operator's details


EvaSoft Corporation
Legal address 2810, N Church St, PMB 52218, Wilmington, DE, 19802, USA
Postal address 2810, N Church St, PMB 52218, Wilmington, DE, 19802, USA
E-mail support@ozcar.app