Privacy Policy

apartment Data controller

The controller of your personal data is An7Way Sp. z o.o., ul. Przykładowa 1, Warsaw.

• Contact for our Data Protection Officer: iod@an7way.com
• General contact for data questions: privacy@an7way.com
• You can file a complaint with the President of the UODO (Poland's data protection authority, uodo.gov.pl) if you think our processing breaks GDPR.

database What data we collect

We only process what we need to run the carpooling platform.

• Account data: username, email, password (stored encrypted), date of birth, country.
• Technical data: IP address, login date and time, last activity.
• Location data (GPS) you provide when searching for or plotting routes.
• Driver vehicle data: make, model, model year, color.
• Profile picture (optional).
• Chat message content, plus ratings and reviews you give other users.

gavel Purposes and legal bases for processing

We process data under Art. 6 GDPR, depending on the purpose:

• Performance of a contract (Art. 6(1)(b)) — setting up and running your account, posting listings, searching routes.
• Consent (Art. 6(1)(a)) — marketing messages, functional and analytics cookies.
• Legitimate interest (Art. 6(1)(f)) — keeping the Service secure, fighting abuse, pursuing claims.
• Legal obligation (Art. 6(1)(c)) — handling complaints, possible tax and accounting duties.

schedule How long we keep your data

• We keep account data as long as the account exists, plus up to 3 years after deletion — in case of legal claims.
• We keep technical logs (IP address, login history) for a max of 12 months.
• Message content and ride history stick around as long as your account exists.
• After those windows close, the data gets deleted or permanently anonymized.

share Who gets your data

Your data only goes to trusted parties we need to run the service:

• Our hosting and server infrastructure provider.
• Our email provider — for verification messages and notifications.
• OpenStreetMap Nominatim geocoding — for plotting routes from the locations you enter.
• Other users of the Service — public profile data (username, rating, photo) and whatever's needed to make the ride happen.
• Government authorities — only when the law requires it.

We don't sell your data or share it with third parties for marketing.

public Sending data outside the EEA

As a rule, we process data inside the European Economic Area (EEA).

• If a provider is based outside the EEA, we only transfer data under proper legal safeguards (like standard contractual clauses approved by the European Commission).

verified_user Your rights

When it comes to your personal data, you have the right to:

• Access your data and get a copy of it.
• Correct inaccurate data.
• Erase your data ("the right to be forgotten") — subject to record-keeping requirements.
• Restrict processing and object to it.
• Move your data to another controller.
• Withdraw consent anytime — it won't affect the lawfulness of processing done before you withdrew it.
• File a complaint with the President of the Personal Data Protection Office (UODO).

smart_toy Automated decisions

An7Way doesn't make decisions about users based solely on automated processing, including profiling, that would carry legal weight or similarly impact them.

• User ratings and rankings (the review system) are for info only, not an automated decision under Art. 22 GDPR.

shield_lock Data security

• Passwords are stored hashed and never shown in plain text — not even to admins.
• Your connection to the Service is encrypted (HTTPS).
• Only authorized staff, bound by confidentiality rules, can access personal data.

cookie Cookies

The details on cookie types and local data the Service uses:

• Essential — login session and CSRF protection (Laravel session, XSRF-TOKEN). Required for the Service to work.
• Preferences — remembers your chosen interface language (stored locally in your browser).
• Cookie consent — info about your choice in the cookie banner, stored locally in your browser.
• You can change or pull back your consent for functional/analytics cookies anytime — via the consent banner or your browser settings.

child_care Minors' data

The Service is for people 16 and up — under our Terms of Service, signing up requires confirming this age.

• We don't knowingly collect personal data from kids under 16.
• If we find out a minor's data was shared without the required consent, we'll delete it right away.

update Changes to this Privacy Policy

• We can update this Privacy Policy — we'll give you 14 days' notice by email for any major changes.
• The current version always lives at an7way.com/privacy.
• Continuing to use the Service after changes take effect means you accept them.