phoenixcarsEVphoenixcarsEV
← Home

Privacy Policy

Last updated: 28 October 2026

This Privacy Policy explains how phoenixcarsEV(“we”, “us”) collects and processes your personal data when you sign up for and use our electric car-sharing service, in line with the EU General Data Protection Regulation (GDPR).

This is a template provided for development and should be reviewed by a qualified legal advisor before production use. It is not legal advice.

1. Who is responsible (Data Controller)

phoenixcarsEV is operated by PHOENIX CARS SINGLE MEMBER P.C. (PHOENIX CARS ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.), Patriarchou Athinagora & Iasonidou 1, 546 29 Efkarpia, Thessaloniki, Greece, Γ.Ε.ΜΗ. 173891404000, VAT EL802298995, which is the data controller for the personal data described here. For any privacy request, contact privacy@phoenixcars.gr.

2. What data we collect

  • Account data: email address and password (stored hashed).
  • Identity & contact: full name, phone number, date of birth.
  • Driving licence images: photographs of the front and back of your driving licence, used to verify your eligibility to drive, and the details read from them (name, date of birth, licence number, issue and expiry dates, issuing country and categories).
  • Live selfie (biometric data): three photos taken with your camera during sign-up, and a face-match score comparing them with the photo on your licence.
  • Usage & trip data: vehicle location, trip times, and battery/lock state while you use a vehicle.
  • Technical data: essential cookies needed to keep you signed in (see our Cookie Policy).

3. Why we use it and our legal basis

  • To provide the service (create your account, unlock vehicles, billing): performance of a contract.
  • To verify your driving licence and age (18+): legal obligation and our legitimate interest in road safety and fraud prevention. Processing of licence images is carried out on the basis of your explicit consent given at sign-up.
  • Automatic licence check (OCR): with your consent at sign-up, the licence images are read automatically to fill in your details and check that the licence is valid, not expired, issued in the EU/EEA, and that the name and date of birth match your account.
  • Face check (biometric data, Art. 9 GDPR): only with your separate, explicit consent. We check that the selfie is live (not a photo or a screen) and compare your face with the photo on your licence, to make sure the licence belongs to you. This runs entirely on our own servers; your face data is not sent to any third party. If you do not consent, an administrator checks your account by hand instead.
  • No automatic refusals (Art. 22 GDPR): when every check passes, your account is activated automatically. If anything is unclear, a person at phoenixcarsEV reviews it. We never reject an account by automated means alone.
  • To send service emails (registration, activation, account notices): performance of a contract.
  • Optional marketing emails: only with your separate consent, which you can withdraw at any time.

4. How long we keep it

We keep your account and licence data for as long as your account is active and as required to meet legal, accounting and fraud-prevention obligations. Licence images are deleted once verification is complete or when your account is closed, whichever is sooner, unless we are required to retain them. Your selfie and face-match score are kept only with your account, encrypted, so a reviewer can confirm the result, and are deleted when your account is closed or erased. You can withdraw your biometric consent at any time by emailing us; your selfie is then deleted and your account is checked by hand.

When you exercise your right to erasure, we anonymise your account: your name, email, phone, date of birth and licence images are irreversibly removed and your login is disabled. Records we must retain for accounting (such as trip and payment history) are kept only in de-identified form that can no longer be linked back to you.

5. Who we share it with

We share data only with service providers acting on our behalf (for example email delivery and payment processing) under appropriate data processing agreements, and with authorities where legally required. We do not sell your personal data.

To read your driving licence we use Mistral AI (Mistral AI SAS, Paris, France) as a processor. The licence images are sent to its OCR service over an encrypted connection, only to extract the text, and are processed within the EU under a data processing agreement. Your selfie is never sent to Mistral or any other provider.

To protect sign-up and sign-in from automated abuse we use Google reCAPTCHA v3. When you submit those forms, reCAPTCHA collects technical information (such as your IP address, browser details and how you interact with the page) and sends it to Google to assess whether the request comes from a person. This is based on our legitimate interest in keeping accounts secure. Google's Privacy Policy and Terms apply.

6. Our mobile apps (iOS and Android)

The phoenixcarsEV apps ask only for the permissions they need, and only when you use the feature:

  • Location (while using the app): to show cars near you, check that a ride starts and ends inside the service area, and warn you before you leave it. We do not track your location in the background or when no ride is active. During a ride, the car itself reports its position, which is stored with the trip.
  • Camera: to photograph your driving licence and take the live selfie at sign-up, and to photograph the car before and after each ride. Photos are uploaded only for these purposes.
  • Photo library (optional): only if you choose to pick your licence photos from your library. Selfies can only be taken live.
  • Notifications (optional): ride, zone and account messages. We store a device token to deliver them; you can turn them off in your phone settings.

The apps contain no advertising, do not track you across other apps or websites, and do not sell or share your data for advertising. Your login is stored in the phone's secure storage (Keychain / Keystore). You can delete your account inside the app (Account → Delete account) or at phoenixcars.gr/delete-account.

7. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate data;
  • erase your data (“right to be forgotten”);
  • restrict or object to processing;
  • data portability;
  • withdraw consent at any time (without affecting prior processing); and
  • lodge a complaint with your national data protection authority.

To exercise any of these rights, email privacy@phoenixcars.gr. We will respond within one month.

8. Security

Passwords are hashed with bcrypt. Driving licence images, the details read from them, your selfie and other sensitive credentials are encrypted at rest using AES-256-GCM, so they are never stored in readable form in our database. Traffic is served over HTTPS, and access to personal data is restricted to authorised administrators. We apply appropriate technical and organisational measures to protect your data.

9. Changes

We may update this policy. Material changes will be notified and the version date above will be updated.