How Rocky Drive handles your data.

Rocky Drive Mobility Inc. operates the Rocky Drive website, app and booking service. Rocky Drive currently operates in Canada and Germany only. For riders and drivers in Canada, the organisation responsible for your personal information is Rocky Drive Mobility Inc., Toronto, Ontario, Canada. For riders and drivers in Germany, the controller under the General Data Protection Regulation (GDPR) is Rocky Drive Mobility GmbH, Berlin, Deutschland.

Questions, requests and complaints about privacy go to support@ridex.example — put “Privacy” in the subject line and we will route it to the right team in your market.

We collect only what a ride needs, plus what the law requires us to keep. In practice that means:

• Account details — your name, email address, mobile number, sign-in method, preferred language and market (Canada or Germany).
• Trip data — pickup and destination, the route driven, times, ride class, the fixed price you were quoted, the driver assigned, and any rating or feedback you leave.
• Payment data — handled by our payment processors. We keep the payment method type, the last four digits, the billing name and your receipts. We never store full card numbers.
• Device and location data — your precise location while you set a pickup and for the duration of a ride, an approximate location to show the right market and currency, and technical details such as device type, app version and crash reports.
• Communications — messages and calls with your driver (routed through masked numbers), conversations with support, and any use of the in-app emergency button.
• Business accounts — company name, cost centres, the travellers on the account and the invoices we issue.

Each purpose below maps to a legal basis under the GDPR (performance of a contract, a legal obligation, our legitimate interests, or your consent) and to a purpose you would reasonably expect under Canada's PIPEDA.

• To quote a fixed price, match you with a verified driver and complete the ride you booked.
• To keep riders and drivers safe — verifying drivers, investigating incidents, and connecting you to emergency services when you use the emergency button.
• To take payment, issue receipts and handle refunds, disputes and chargebacks.
• To answer support requests and resolve problems with a trip.
• To meet legal obligations, including tax, invoicing and passenger-transport record-keeping in each country.
• To improve the service using aggregated, de-identified data — never by profiling individual riders.
• To send you marketing only if you have opted in. You can unsubscribe in one tap, and we will never make a ride depend on it.

• Precise location during a ride is kept for the trip plus a short window for safety and dispute handling, then deleted or reduced to the start and end points on your receipt.
• Trip and payment records are kept for as long as your account is open and then for the period tax and transport law requires — typically seven to ten years, depending on the market.
• Account details are deleted or anonymised within 30 days of closing your account, unless a legal hold or an open dispute requires us to keep them longer.
• Support conversations are kept for up to three years so we can follow up on a repeat issue.
• Driver verification records are kept for the period the relevant licensing authority requires, and deleted when a driver leaves the platform and that period ends.

We do not sell personal data, and we do not share it with advertising networks. We share it only with the parties a ride needs:

• Your driver, who sees your first name, your pickup point, your destination once the ride starts, and any note you add. Phone numbers are masked in both directions and the address is hidden from the driver after the trip.
• Licensed Mietwagen partners in Germany, who fulfil rides under the Personenbeförderungsgesetz (PBefG) and keep the trip records that law requires.
• Payment processors, fraud-prevention and receipt-delivery providers, under contracts that limit what they may do with the data.
• Cloud hosting and messaging providers in Canada and the European Union, acting only on our instructions.
• Insurers, when a claim relating to a ride is made.
• Your company's account administrator, if you ride on a Rocky Drive Business account — they see the traveller name, the trip and the cost, not your personal trips.
• Regulators, courts and law enforcement where the law requires it or where it is necessary to protect someone's safety.

Data belonging to riders and drivers in Canada is stored in Canada. Data belonging to riders and drivers in Germany is stored in the European Union. When a trip crosses those systems — a Canadian account holder riding in Germany, for example — the transfer happens under GDPR-approved safeguards such as standard contractual clauses, and under PIPEDA's accountability principle.

Wherever you are, you can ask what we hold about you, ask us to correct it, and withdraw any consent you have given. The detail depends on your market:

• Canada (PIPEDA) — you have the right to access your personal information, to challenge its accuracy and completeness, to withdraw consent subject to legal or contractual restrictions, and to complain to the Office of the Privacy Commissioner of Canada.
• Germany and the EU (GDPR) — you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent at any time, and the right to lodge a complaint with a supervisory authority, for example the data protection authority of the German state you live in.

To exercise any of these rights, email support@ridex.example from the address on your account. We answer within 30 days and never charge for a first request. You can also download your trip history and delete your account yourself from the account settings.

• Essential — sign-in, security, fraud prevention and remembering your market (Canada or Germany) and language. These are always on because the site does not work without them.
• Optional analytics — a privacy-focused measurement tool that runs only if you accept it, with IP addresses truncated and no cross-site tracking. You can change your choice at any time from the footer.
• No advertising — we use no advertising cookies, no ad networks and no social-media tracking pixels.

Rocky Drive accounts are for adults. Minors may only ride when the booking is made by an adult account holder who is responsible for them and who has arranged any child seat local law requires. We do not knowingly collect personal data from anyone under 16; if we learn that we have, we delete it.

We will post any change here and update the date at the top of the page. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect. The current version always lives at https://rockydrive.smfgroup.net/legal/privacy.