Privacy Policy

This Privacy Policy explains how Steinemann - Taxi GmbH processes personal data in connection with the VELDOO product. It applies in particular to the public website, demo and contact enquiries, registrations, contract administration, support and processing activities for which Steinemann - Taxi GmbH is itself the controller.

Where passenger, driver, booking, dispatch or patient transport data is processed on behalf of a VELDOO customer, the relevant customer is generally responsible for the processing. In that case, Steinemann - Taxi GmbH acts as a processor in accordance with the contract concluded with the customer.

1 Controller

The controller for the processing activities described in this Privacy Policy is:

Steinemann - Taxi GmbH

VELDOO product

Stettemerstrasse 20

CH-8207 Schaffhausen

Switzerland

Email: info@veldoo.com

UID/VAT: CHE-101.400.526

Commercial register number: CH-290.4.013.665-1

Data protection enquiries may be sent to the email address above.

2 Scope and roles

2.1 This Privacy Policy applies to persons who visit our website, request a product demo, contact us, register a company account, act as a contract or billing contact, or use our support.

2.2 For Customer Data processed in VELDOO by a taxi, limousine or patient transport company, that company generally determines the purposes and means of processing. Data subjects should normally first contact that company to request access, correction or deletion of such data.

2.3 We process Customer Data as a processor only in accordance with the contract, the data processing agreement and the customer’s documented instructions. Mandatory legal obligations of our own remain reserved.

3 Legal bases and principles

3.1 We process personal data in accordance with the Swiss Federal Act on Data Protection. Where the General Data Protection Regulation applies to activities in Germany, Austria or elsewhere in the European Economic Area, we rely in particular on performance of a contract and pre-contractual steps, legal obligations, legitimate interests or consent.

3.2 Legitimate interests include in particular the secure and efficient operation of the website and Platform, handling business enquiries, preventing misuse and fraud, enforcing legal claims and improving our services.

3.3 Where we obtain consent, it is voluntary and may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

3.4 We observe the principles of lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation and security.

4 Categories of data processed

• Master and contact data, in particular name, company, role, address, email address and telephone number
• Account and permission data, in particular username, roles, login events and security settings
• Contract, plan, invoice and payment data
• Communication and support data from email, telephone, WhatsApp, demo bookings and support enquiries
• Technical usage data, in particular IP address, browser, device, operating system, timestamps, functions accessed and log data
• Customer Data from booking, dispatch, the driver app, fleet and customer management, insofar as we process it on a customer’s behalf
• Location and route data, insofar as the relevant function is enabled and processing is necessary and lawful
• Information about special transport needs that may reveal health information in connection with patient transport

5 Website and technical logs

5.1 When our website is accessed, we process technically necessary data such as the IP address, date and time, page accessed, referrer, browser, operating system and device information. Processing is necessary to deliver content, maintain stability and detect attacks or misuse.

5.2 Where the GDPR applies, this processing is based on our legitimate interest in a secure and functioning website. Technical logs are retained only for as long as necessary for operation, troubleshooting and security. Security-relevant entries may be stored longer until an incident has been clarified and documented.

6 Contact demo and WhatsApp

6.1 If you contact us by form, email, telephone, WhatsApp or through a demo booking, we process your information to respond to the enquiry, arrange the appointment and, where applicable, prepare a contract.

6.2 Depending on the content, the legal basis is taking pre-contractual steps, performing a contract or our legitimate interest in handling business communications. We send advertising by electronic message only with consent or where permitted under the applicable unfair competition or marketing law.

6.3 If you contact us via WhatsApp, companies in the Meta group also process data. This may include telephone numbers, profile details, communication content and technical metadata. For confidential or sensitive information, please use email or a secure channel provided by us instead.

7 Registration contract billing and payment

7.1 During registration and contract formation, we process company, contact, account, plan and billing data to initiate and administer the contract, provide access, invoice services and manage the business relationship.

7.2 For card payments or other electronic payments, we may use Stripe or another payment service provider identified during the payment process. Payment service providers process certain data on their own responsibility or on our behalf. Full card details are generally processed directly by the payment service provider unless the selected payment method requires otherwise.

7.3 We retain contract and invoice documents in accordance with commercial, tax and evidentiary obligations. Where the GDPR applies, this is based on performance of a contract and legal obligations.

8 Platform data processed on behalf of customers

8.1 VELDOO customers may process data relating to passengers, clients, drivers, vehicles, bookings, trips, communications, billing and operational processes. The relevant customer generally determines the purposes, scope and retention.

8.2 We use this data only to provide, secure, maintain and support the Platform and in accordance with documented instructions. Our employees receive access only to the extent required for their duties.

8.3 Further details on the subject matter, duration, types of data, categories of data subjects, security measures, subprocessors and deletion are governed by the data processing agreement.

9 Location data and patient transport

9.1 Depending on the enabled function, VELDOO may process current or historical location data from drivers, vehicles or devices. The relevant customer must transparently inform its users, ensure a sufficient legal basis and restrict access to what is necessary.

9.2 Information about wheelchair requirements, dialysis, therapy or clinic trips and other special transport needs may reveal health information. Such data is processed only where necessary for the agreed organisation of transport and where the customer has an appropriate legal basis.

9.3 Customers should not record diagnoses or medical details where less detailed information is sufficient for the transport. Sensitive personal data is handled with enhanced access restrictions and appropriate technical and organisational measures.

10 Recipients and service providers

10.1 We disclose personal data only where necessary to perform a contract, use an appointed service provider, comply with a legal obligation, safeguard legitimate interests, or where consent has been given.

10.2 Recipients may include hosting and cloud providers, payment service providers such as Stripe, communications providers such as Twilio, WhatsApp or companies in the Meta group, providers of demo or calendar functions, email and support providers, Google in connection with reCAPTCHA, IT security providers, advisers, insurers and competent authorities.

10.3 Processors are contractually bound. Where we process Customer Data as a processor, we provide our customers with an up-to-date list of the subprocessors used.

11 Cookies consent and reCAPTCHA

11.1 We use technically necessary cookies and similar storage technologies to provide the website, login, security and functions requested by the user. Where the GDPR applies, subsequent data processing is based on performance of a contract or legitimate interests.

11.2 Analytics, marketing or other non-essential technologies are activated in Germany and Austria only after valid consent has been obtained. Consent may be withdrawn at any time through the cookie settings with effect for the future.

11.3 The cookies, providers, purposes and storage periods currently used are shown in the consent dialog or cookie settings. Refusing non-essential technologies does not impair essential functions.

11.4 We may use Google reCAPTCHA to protect forms. In particular, IP addresses and device and interaction data may be transmitted to Google. reCAPTCHA is used only where the requirements of applicable law are met.

11.5 Google Analytics, remarketing or comparable advertising technologies are used only if they are actually implemented, identified in the consent dialog and validly enabled before activation.

12 Transfers to other countries

12.1 Recipients may be located in Switzerland, the European Economic Area or other countries. For cross-border transfers, we assess the applicable legal requirements.

12.2 Where the recipient country does not provide an adequate level of data protection, we use appropriate safeguards, in particular recognised standard contractual clauses, and adopt additional protective measures where necessary. Statutory exceptions remain reserved.

12.3 When services of international providers are used, access by foreign authorities under local law cannot be ruled out. We take this risk into account when selecting and configuring services.

13 Retention and deletion

13.1 We store personal data only for as long as necessary for the relevant purpose, performance of a contract, security or statutory retention and evidence obligations.

13.2 Contact and demo enquiries are deleted or anonymised once the enquiry is completed and no business relationship arises, unless legal or legitimate grounds require longer retention.

13.3 Contract, accounting and tax records are retained for the applicable statutory periods, generally seven to ten years. Technical logs are deleted or anonymised after the period required for operation and security.

13.4 Customer Data is governed by the contract, the data processing agreement and the customer’s instructions. After the contract ends, Customer Data is deleted after agreed export and deletion periods unless a legal obligation requires further storage. Backups are overwritten in accordance with the defined backup cycles.

14 Rights of data subjects

14.1 Under applicable law, data subjects have rights including access, correction, deletion, restriction of processing, data disclosure or portability, and objection. Consent may be withdrawn at any time with effect for the future.

14.2 Rights may be exercised via info@veldoo.com. We may request appropriate information to verify identity. If a request concerns data that we process on behalf of a VELDOO customer, we forward it to the responsible customer or assist the customer in handling it.

14.3 Persons in Switzerland may contact the Federal Data Protection and Information Commissioner. Persons in the European Economic Area may lodge a complaint with the data protection supervisory authority at their habitual residence, place of work or the place of the alleged infringement.

15 Automated decision-making

As part of the processing activities for which we are the controller and which are described in this Privacy Policy, we do not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them. If this changes, we will inform data subjects in accordance with legal requirements.

16 Data security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, disclosure and access. Depending on the risk, these measures include access controls, role and permission concepts, encryption, logging, backups, update processes and service-provider reviews.

No electronic process is entirely risk-free. Customers and users must therefore also adequately protect their devices, accounts and access credentials and report security incidents without delay.

17 Representative in the European Union

Where the requirements of Article 27 GDPR are met and no statutory exception applies, Steinemann - Taxi GmbH will appoint a representative in the European Union. The contact details will be published here and on the website before the relevant regular processing begins.

18 Changes to this Privacy Policy

We may amend this Privacy Policy if our services, processing activities or the legal situation change. The version published on the website applies. We will provide appropriate notice of material changes.

Effective date: 22 October 2026