Privacy policy

The controller of personal data is "AllWayHub" Ltd, Bulgaria, UIC 208941630, VAT BG208941630, 91 General Kolev St., floor 6, apt. 43, Odesos district, 9000 Varna.

This Policy applies to the website allwayhub.com and the AllWayHub mobile apps for iOS and Android.

Questions about your data: office@allwayhub.com.

The data we process depends on which features you use.

• Account and contact details: first name, last name, email, phone, language, time zone, sign-in details, your consents; for saved passengers — first and last name.
• Trip and passengers: route, dates, passengers’ names, order and ticket numbers; document details — only if the Carrier requires them.
• Payment: amount, currency, status and transaction identifier. AllWayHub does not receive or store the full card number or CVV.
• Transfers: pick-up and destination addresses, flight or train number, the name for the meeting sign, child seats and baggage.
• Requests: correspondence with support, reviews, attachments.
• Technical data: IP address, device, browser, event logs, session and settings cookies.

When you visit the website and apps, we process technical data so that the Service works and is protected. The legal basis is legitimate interest (Article 6(1)(f) GDPR).

We do not currently use analytics or advertising cookies or SDKs. If we start, it will be only with your consent. Details are in the Cookie Policy.

Sign-in to the Account uses the Supabase library; it stores a session cookie on our domain.

Performance of a contract (Article 6(1)(b) GDPR): we create and maintain the Account, show order history and credit bonuses.

Legitimate interest (Article 6(1)(f) GDPR): we protect the Account against hacking and abuse.

Consent (Article 6(1)(a) GDPR): personalised offers and newsletters — only if you have turned them on.

Performance of a contract: we sell the ticket, pass passengers’ data to the Carrier, accept payment, send the ticket and trip notifications, and issue refunds.

Legitimate interest: we prevent payment fraud and ask you to rate the trip after it is completed.

Legal obligation (Article 6(1)(c) GDPR): we keep accounting and tax documents for 10 years (Article 12 of the Bulgarian Accountancy Act).

Consent: subscription to the newsletter and optional notifications when placing an Order.

The Customer gives us the data of their fellow travellers and informs them about this Policy. We use this data only for their trip.

Before confirmation, the Carrier sees only the pick-up addresses and time, the number of passengers, baggage and the flight number. After confirmation, the Driver receives the name for the sign and the Passenger’s phone number — only to perform the trip.

We use ratings and reviews of Drivers for quality control. A review is published with the first name, without the surname.

The data of Carriers and Drivers — licences, vehicles, driving licences, payout details — is processed under a separate policy for partners; it is provided during onboarding.

We process the correspondence and order details in order to reply and resolve the issue. The legal basis is performance of a contract or legitimate interest.

We keep correspondence for 5 years after the request is closed.

We send newsletters with offers only with your consent. You can unsubscribe through the link in any email or in your Account settings.

After you unsubscribe, your email is kept on a suppression list so that we do not send you newsletters again.

Only adults — persons aged 18 or over — may create an Account. We process minors’ data only as the data of passengers named by an adult when placing an Order.

If you believe we have received a child’s data without a legal basis, write to office@allwayhub.com — we will check and delete it.

You provide most of the data yourself. We also receive data from the person who placed an Order in your name; from Carriers — about changes to a service; from payment providers — about payment status; from the sign-in services Google, Apple and Facebook — your name and email, if you sign in through them.

Data is transmitted over a secure connection (TLS). Staff access is limited to what their tasks require. Full card numbers and CVV codes are not accepted or stored in our systems, databases, logs or support channels.

No system is absolutely secure. If a breach creates a high risk for you, we will inform you and the CPDP within the time limits set by the GDPR.

We share data with the Carrier, the company we have a contract with, so it can perform the trip. We share only what is needed for the trip: the Passenger’s name, contact details, service and seat. The Carrier processes these data as an independent controller under its own privacy policy.

The payment provider — to accept payment and make refunds.

Hosting — Google Cloud (Cloud Run), EU region (Frankfurt).

Email delivery — Supabase Auth and the Google Workspace mail service; delivery of SMS verification codes — Vonage.

Accounting and financial services that keep our books — to the extent needed for accounting and reporting.

We do not currently share data with analytics or advertising services.

Supabase — authentication and database, EU region (Paris); this is the only third-party SDK in the apps.

Public authorities — only where required by law.

Some providers — Google, Supabase, Vonage — may process data outside the European Economic Area, including in the United States and Singapore.

We transfer data on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework) or the EU standard contractual clauses. You can request a copy of the safeguards at office@allwayhub.com.

If the Carrier is based in the EU, the Passenger’s data stays in the EU. If the trip is performed by a Carrier based outside the EEA (for example, in Ukraine or Moldova) in a country for which the European Commission has not adopted an adequacy decision, we share only the data needed for the trip and only on the basis of the EU standard contractual clauses in our contract with the Carrier.

Account — while it is active; after a deletion request it is deleted immediately.

Orders, payments and accounting documents — 10 years from 1 January of the year following the year of the Order.

Requests — 5 years after closure. Security logs — 12 months. Technical logs of requests to the website — 30 days. Consent records — while the consent is in force and for 5 years after it is withdrawn.

When the period expires, the data is deleted or anonymised.

Access: to find out what data we process and receive a copy.

Rectification: to update inaccurate or incomplete data.

Erasure: to ask us to delete data if there is no basis for keeping it.

Restriction: to temporarily stop processing, for example while accuracy is being checked.

Portability: to receive data in a machine-readable format or have it transferred to another service.

Objection: to object to processing based on legitimate interest and to direct marketing.

Withdrawal of consent: at any time; this does not affect the lawfulness of processing before the withdrawal.

How to make a request: office@allwayhub.com. We reply within one month; if necessary, we may ask you to confirm your identity.

Complaint: the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, kzld@cpdp.bg, cpdp.bg — or the supervisory authority of your country of residence.

A new edition is published with its effective date. We give advance notice of material changes — by email and by a notification in the app.