Privacy Policy

01Introduction

Shotl Transportation, S.L (referred to as "we", "us", "our" or "Shotl" in this policy) primarily refers to all personal information that is collected and used about Shotl Users for the purposes of the Spanish Data Protection and Digital Rights Act 3/2018 (the "Data Protection Act").

Shotl is registered in Carrer Jesús Serra Santamans 2, Sant Cugat del Vallès, 08174 (Barcelona) with VAT number B-66974718.

This notice describes the personal data we collect, how it is used and shared, and your choices regarding this data. Shotl is the data controller for the personal data collected in connection with the use of Shotl services.

02Scope

This notice applies to Users of Shotl's services, including Users of Shotl's mobile application, websites and services (collectively, the "Services") and through other interactions and communications you have with us. This notice specifically applies to:

Users: public transport operators, public transport agencies, municipalities, transport consortia, private transport operators and corporations.
Drivers: individuals who provide transport to users individually.
This notice also governs Shotl's other collection of personal data in connection with its services. For example, we may collect the contact information of individuals who use accounts owned by Shotl for business Users, or of owners or employees of suppliers and third-party operators.
All those subject to this notice are referred to as "Users" in this notice.

03Personal information we collect about you

3.1 Information that you provide to us — We collect information you provide directly to us through your access or use of the Services, such as when you create or modify your account, request on-demand services, "Contact Us" support, or otherwise communicate with us.

User Data: identifying data, contact details, personal characteristics data, transaction data of goods and services, economic and financial data, geolocation data and navigation data in the App.

3.2 Information we collect through your use of our Services — When you use our Services, we collect personal information (i.e. information that could be used to contact you directly such as full name, phone number, credit/debit card information, or email address). We also use GPS technology to determine your current location. Some of our location-enabled Services require your personal data for the feature to work.

We collect transaction information related to the use of our services, including the type of services requested or provided, ride details, payment transaction information, date and time the service was provided, amount charged, distance travelled, and payment method.

We collect data about how Users interact with our services. This includes data such as access dates and times, app features or pages viewed, app crashes and other system activity, and type of browser. We may collect data about the devices used to access our services, including the hardware models, device IP address or other unique device identifiers, operating systems and versions, software, preferred languages, advertising identifiers, device motion data, and mobile network data.

3.3 Information we collect from other sources — We may also receive information from other sources and combine that with personal data we receive from you or collect through our Services. This may include:

If your employer uses one of our enterprise solutions, we may receive information about you from your employer.
Law enforcement officials, public health officials and other government authorities.
Vendors who validate user phone numbers of the user (for sign-up or password recovery).
To manage payments regarding final passenger accounts and card information.

04Information you send us through our website

Our website does not track or profile visitors. It collects personal information only when you send it to us through one of its forms, and uses it only for what that form is for:

Contact forms (the Contact page and the forms on our client pages) — your name, work email, organisation and, if you give them, the type of organisation, your country and your message. We use them to answer your enquiry and follow it up. Lawful basis: your consent, given with the form, and steps you ask us to take before a possible contract.
Simulation request — the stops you place on the map, the passengers, vehicles and timetable you describe, your comments and your contact details. We use them to prepare your simulation and to contact you about it. Lawful basis: your consent, given with the form, and steps you ask us to take before a possible contract.
Mobility guides — your name, work email, organisation, where you are in the process and, if you give it, what you are working on. We use them to send you the guides and to follow up on the documents you download. Lawful basis: your consent, given with the form. The form also sets a cookie, described in our Cookie Policy, so that you are not asked for these details again for 30 days.
Newsletter — your email address, the language of the page you signed up from and, where available, the country your connection comes from (derived from your IP address and not stored as such). You confirm the subscription from an email before you receive anything, and you can unsubscribe from any newsletter. Lawful basis: your consent.
Every request — like any website, our servers receive your IP address, browser type and the page requested. We use your IP address for up to one hour to limit repeated form submissions, and keep technical logs to operate and secure the service. Lawful basis: our legitimate interest in keeping the website available and secure. We also count visits with Umami, a statistics tool hosted on our own servers that sets no cookies and records no information that identifies you (see our Cookie Policy).

05Who processes what you send through our website

Messages from our forms are emailed to our team at hello@shotl.com, and a confirmation is emailed to you; the guides' download form also sends us your details. These suppliers process the information on our behalf, under contract:

Amazon Web Services (Ireland) — hosting of the website and delivery of the emails sent from our forms.
Google (Google Workspace) — the mailbox where our team receives and answers your messages.
Intuit Mailchimp — our newsletter list and its emails. Mailchimp is based in the United States; the transfer is covered by the safeguards described in "International data transfers".
We keep enquiries for as long as needed to answer and follow them up and, if we work together, for as long as our relationship lasts; after that, as set out in "How long do we store your information?".

06Use of your personal information

We use your personal information for a variety of reasons, set out by category below.

Account management — used for the setup and management of User accounts: to enable Users to create accounts, log in to your app, or verify their credentials.
Advertising and/or marketing — used to display or target ads, marketing communications, or measure ad performance: displaying ads in your app, sending push notifications to promote other products or services, or sharing data with advertising partners.
Analytics — used to collect data about how Users use the app or how it performs: to see how many Users are using a particular gesture, to monitor app health, to diagnose and fix bugs or crashes, or to make future performance improvements.
App functionality — used for features that are available in the app: to enable app features, or to authenticate Users.
Developer communications — used to send news or notifications about the app or the developer: sending a push notification to inform Users about an important security update.
Fraud prevention, security and compliance — used for fraud prevention, security, or compliance with laws: monitoring failed login attempts to identify possible fraudulent activity.
Personalised commercial and promotional communications — to send commercial and promotional communications through telematic or conventional means, in relation to goods and services similar to those previously contracted or acquired from Shotl. This includes personalised electronic communications with information regarding products, services, events, courses, programs, promotions and relevant news for users. For example, customers and transport agencies can send communications to their final users and passengers using our dashboard (push notifications).
Quality and satisfaction surveys — to carry out and analyse quality and satisfaction surveys related to the goods and services provided by Shotl: we issue a final survey when a ride has completed.

07Disclosure of your personal information by us

We only disclose your personal information outside of Shotl in limited circumstances. If we do, we will put in place appropriate controls and data sharing agreements that require recipients to protect your personal information, unless we are legally required to share that information. Any contractors or recipients that work for us will be obliged to follow our instructions. We do not sell your personal information to third parties.

We may disclose your information to our third-party service providers, agents, and subcontractors (Suppliers) for the purposes of providing services to us or directly to you on our behalf. When we use Suppliers, we only disclose to them any personal information that is necessary for them to provide their services and only where we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

We take steps to ensure that any third-party partners who handle your information comply with data protection legislation and protect your information to the same extent that we do. We only disclose personal information which is necessary for them to provide the service they are undertaking on our behalf. We will aim to anonymise your information or use aggregated non-specific data sets where possible.

The categories of third parties with whom we may share your data, and the lawful basis for each, are as follows:

Affiliates — we may share your personal data with our affiliates in order to improve and enhance the user experience. Lawful basis: legitimate interest.
Asset purchasers — we may share your personal information with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will engage best efforts to try to ensure that the entity to which we transfer your personal information uses it in a manner that is consistent with this privacy policy. Lawful basis: legitimate interest; performance of a contract.
IT service providers — system-based processing of personal details as part of organisational and operational requirements, e.g. cloud hosting services, application development and support services, IT infrastructure services, email services, call recording services; and helping maintain the safety, security and integrity of our services and Users. Lawful basis: performance of a contract.
Law enforcement agencies and authorities — to assist law enforcement agencies for the purposes of preventing, detecting, investigating, or prosecuting criminal offences. Lawful basis: legal obligation.
Courts, regulators and government authorities — where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party; to investigate or address claims or disputes relating to the use of Shotl's services, to satisfy requirements under applicable laws, regulations, or operating licences or agreements, or pursuant to legal process or governmental request, including from law enforcement. Lawful basis: legal obligation.
Legal and professional advisors — the provision of business consulting, audit and legal services including access to and analysis of personal data as part of business initiatives, statutory audits, legal claims, and ad-hoc consultancy advice. Lawful basis: performance of a contract; legitimate interest.
Other Users — to provide, maintain and improve our services, including to facilitate payments, send receipts, provide products and services you request, develop new features, provide User support, develop safety features, authenticate Users, and send product updates and administrative messages; to perform internal administration and operations, including preventing fraud and abuse of our services, troubleshooting software bugs and operational problems, conducting data analysis, testing and research, and monitoring and analysing usage and activity trends; to send you communications we think will be of interest to you, where permissible and according to local applicable laws; and to notify you about changes to our terms, services or policies. Lawful basis: legitimate interest; performance of a contract.

08Cookies

Our website sets only a few cookies, none of them for analytics or advertising. Shotl is the data controller of any information we obtain from them. Please refer to our Cookie Policy for the full list.

09International data transfers

We are a global organisation, and your personal information may be stored or processed in any country where we have our facilities or in which we engage service providers and subcontractors.

We have put in place appropriate safeguards in accordance with applicable legal requirements to ensure that your data is adequately protected.

10What are your rights?

You have certain rights in respect of your personal data, and we have processes to enable you to exercise these rights. Your rights are as follows:

Opt out / unsubscribe — you can request to be removed from our marketing mailing list, from the unsubscribe button in the email itself.
Right to access (also known as a Subject Access Request) — you have the right to obtain confirmation as to whether we process personal data about you, receive a copy of your personal data held by us, and obtain certain other information about how and why we process your personal data.
Right to rectification — you have the right to request for your personal data to be amended or rectified where it is inaccurate, and to have incomplete personal data completed.
Right to erasure (the Right to be Forgotten) — you have the right to deletion of your personal data where: the data are no longer necessary for the purposes for which they were collected; our lawful basis is consent and you withdraw it; our lawful basis is legitimate interest, you object and we have no overriding legitimate grounds; you object to processing for direct marketing; your data has been unlawfully processed; or erasure is required to comply with a legal obligation.
Right to object — you have the right to object where our lawful basis for processing is a legitimate interest pursued by us, and to our processing for direct marketing purposes.
Right to data portability — you have the right to request for your personal information to be prepared and arranged and sent to another organisation, or ask us to do so if technically feasible.
Right to withdraw consent — where we process personal data based on consent, individuals have a right to withdraw their consent at any time, using the contact details in the "How to contact us" section.
Right to lodge a complaint with a supervisory authority — you may lodge a complaint with the supervisory authority in your country of residence, place of work, or the country in which an alleged infringement has occurred. The competent national supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain — +34 901 100 099 / +34 91 266 35 17 — www.aepd.es.

11Security

Your Shotl profile is password-protected so that only you and authorised Shotl employees have access to your account information. Shotl staff will never reach out to you and ask for any personal account information, including your password.

We make every effort to ensure that your personal data is secure on its system. We have staff dedicated to maintaining our security standards as set forth herein. We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the ongoing integrity and confidentiality of personal information, and we evaluate them on a regular basis.

Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, we cannot guarantee the security of any personal data you transmit to us, and you do so at your own risk. If you have any further questions on this issue, refer to our Terms of Service.

Please note that all rights are subject to qualifications and limitations. There may be instances and justifiable grounds to deny a request where we are required or permitted by law to do so. We will always be clear and communicate this to you if and when these instances arise.

12Data Protection Officer

We have appointed a Data Protection Officer ("DPO") to oversee compliance with this policy. The DPO can be contacted at privacy@shotl.com.

13How long do we store your information?

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

Maintain business records for analysis and/or audit purposes.
Comply with record retention requirements under the law.
Defend or bring any existing or potential legal claims.

14Updates to this notice

We may occasionally update this notice. If we make significant changes, we will notify Users in advance of the changes through the Shotl apps or through other means, such as email. We encourage Users to periodically review this notice for the latest information on our privacy practices.

Where information cannot, for technical reasons, be deleted entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

15How to contact us

If you have questions or concerns regarding the way in which your personal information is being used, please contact our data privacy team by emailing privacy@shotl.com.

If you are unsatisfied with the manner in which your information is being processed, please raise a complaint by reaching out to hello@shotl.com. If you would like to lodge a complaint to your local supervisory authority, please get in touch and we will provide you with instructions and contact details.

If you would like to stop receiving commercial or promotional communications, please email privacy@shotl.com or unsubscribe through any of the communications received.

We are committed to working with you to obtain a fair resolution to any complaint or concern you may have. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the data protection authority of your country.