Privacy policy

XANQOS Ride privacy notice Development version 2026-10-05. Published for development review with the operator’s authorization. The service described below must be checked against the final deployment and provider agreements before production use. Who is responsible and how to contact us Xanqos GmbH, Am Mohrenshof 8, 28277 Bremen, Germany, represented by Arif Kuzgun, is your contact for XANQOS Ride platform privacy matters. Email: info@xanqos.ai. Telephone: +49 421 790 87301. Xanqos is responsible for processing it determines for its own platform operations, account administration, support and security. Where a fleet company determines how its customers' rental data is used, that company is responsible for that processing and Xanqos may provide the software on its instructions. The rental company's identity and contact details must be shown with its offer and booking documents. You can contact us if you need help identifying the organization responsible for your request. Information processed through the service Depending on the features you use, XANQOS Ride processes: - Account and contact information, including name, email, telephone, address, sign-in records, language and notification preferences. - Driver eligibility information, including date of birth, driving-licence details, uploaded verification documents and the operator's review status. - Rental information, including selected vehicle, station, booking times, tariff, accepted terms, changes, cancellations and rental history. - Payment and accounting information, including payment-provider references, payment status, wallet movements, deposits, invoices and refunds. When you use hosted Stripe checkout, you enter card details directly with Stripe; XANQOS Ride uses provider references and any payment-method summaries supplied for the service. - Return information, including distance, condition photographs, cleanliness and damage reports, and any fuel or battery readings you provide. Avoid including bystanders or unrelated documents in photographs. - Support messages, operational tasks and evidence, and records of authorized staff actions. - Technical information required to deliver and protect the service, such as connection information, session identifiers and error/security records. Information comes from you, your authorized fleet organization and the service providers involved in your transaction. Some data, such as payment status and booking totals, is generated during the service. Required fields are identified in the relevant flow. Without necessary identity, booking or payment information, we may be unable to provide the requested rental. Purposes and legal bases We use necessary information to create and administer accounts, arrange rentals, verify eligibility, process payments and refunds, provide booking documents and handle support. Where this is necessary for your contract or requested steps before a contract, the basis is Article 6(1)(b) GDPR. Processing needed to comply with applicable accounting or other legal duties is based on Article 6(1)(c). Protecting accounts, preventing misuse, investigating errors and establishing or defending claims may rely on Article 6(1)(f), subject to balancing those interests against your rights. Where processing relies on consent, Article 6(1)(a) applies and you may withdraw consent for the future. The final notice must identify any optional consent-based feature actually enabled. Who receives information Access is limited according to role, company and task. Fleet operators and authorized staff receive information needed to manage their rentals. Assigned service partners receive the information required for their assigned work, rather than unrestricted access to customer accounts or financial records. Providers may receive data necessary for hosting, database operation, file storage, payment processing, transactional email and maps. The current integration plan names Stripe for payments, IONOS for email, Amazon S3 for uploads and HERE for maps. Credentials alone do not mean that a provider is active. Before publication, the provider schedule must identify the deployed services, contracting entities, roles and relevant privacy information. A supplied Google Maps key does not by itself enable Google Maps. Disclosures to authorities, advisers or other parties are limited to a valid legal requirement or another applicable legal basis. Where a provider processes data on instructions, the relevant processing agreement must be in place. Location, browser storage and automated rules The present release excludes remote vehicle lock/unlock and has no connected continuous vehicle-tracking service. Map searches and displayed locations may be sent to the configured map provider when that feature is used. Device location must be requested explicitly if a flow uses it; declining access should lead to the supported manual location or review flow. The service uses browser storage for authentication, security and interface preferences. Any optional analytics, advertising or third-party storage must be separately identified and handled according to its applicable requirements before activation. The software applies booking eligibility, availability and price rules. If you believe a result is incorrect, contact the operator or info@xanqos.ai for review. This draft does not certify the absence of every form of automated decision-making in a future deployment. Retention and deletion Account information is needed while providing the account and resolving outstanding matters. Account closure removes or anonymizes profile information and queues personal identity/profile uploads for deletion in the current implementation. Financial and rental evidence is handled separately where retention is necessary for legal duties or unresolved claims. Closing an account does not automatically erase records that must lawfully be retained; a privacy request can still be submitted by email when self-service closure is unavailable. Retention must be limited by the purpose, applicable legal obligations and any necessary claim-handling period. The final operational schedule must specify review/deletion periods for identity evidence, return photographs, support records, logs and backups. No fixed period or completed S3 lifecycle setup is asserted in this draft. International processing The requested S3 storage region is eu-north-1. This selection alone does not establish that every provider processes data exclusively in the EEA. Before enabling a transfer outside the EEA, the responsible organization must identify the destination and applicable mechanism, such as an adequacy decision or appropriate safeguards. Information about applicable safeguards and how to obtain a copy can be requested from our privacy contact. The final notice must reflect the actual arrangements. Your rights and complaints Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, withdrawal does not affect the lawfulness of earlier processing. We may need proportionate information to verify a requester's identity. Contact info@xanqos.ai to exercise your rights. You may also complain to a competent data-protection supervisory authority, including the authority in your place of habitual residence, work or the alleged infringement. Information about the Bremen authority is available at https://www.datenschutz.bremen.de/. Changes The published notice will carry a version and date. Material changes to processing must be communicated appropriately before they take effect. This draft date is not a production effective date.