Privacy
Privacy Policy
Updated: May 2026 · Rubber Wheels Oy (kumipyorat.fi)
1. Data Controller
The data controller for the Rubber Wheels Oy service is Rubber Wheels Oy (Business ID: 3610628-8).
Address: 00750 Helsinki
Contact: privacy@kumipyorat.fi
We respond to all requests within 30 days (GDPR Art. 12(3)).
2. Data We Collect
- Name and email address (account registration)
- Phone number (app login)
- Location and route data (delivery matching)
- Payment and banking information (Stripe Connect, encrypted)
- Reviews and trust scores
- Driver tax information: street address, postal code, date of birth, personal identity code, business ID (DAC7 reporting)
- Photos (sender item photos, driver proof photos)
- Chat messages (in-app between users)
- Cookies and usage logs
3. Purpose of Data Processing
- Providing the service and facilitating deliveries
- User account management and authentication
- Payment processing and settlement
- Service development and security assurance
- Fulfilling legal obligations
4. Legal Basis for Processing
| Purpose | Legal Basis |
|---|---|
| Account management | Contract (Art. 6(1)(b)) |
| Delivery matching | Contract (Art. 6(1)(b)) |
| Payment processing | Contract (Art. 6(1)(b)) |
| DAC7 reporting | Legal obligation (Art. 6(1)(c)) |
| Accounting | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Push notifications | Legitimate interests (Art. 6(1)(f)) |
| Essential cookies | Legitimate interests (Art. 6(1)(f)) |
| Analytics/marketing cookies | Consent (Art. 6(1)(a)) |
5. Retention Periods
| Data Type | Retention Period |
|---|---|
| User account | Active period + 30 days after deletion |
| Delivery history | 5 years (Accounting Act) |
| Payment records | 7 years (Accounting Act) |
| GPS location | Deleted after delivery confirmation |
| Proof photos | 12 months after delivery |
| Chat messages | 12 months after last message |
| Push tokens | Deleted on logout |
| DAC7 tax data | 7 years |
6. Data Storage and Security
Data is stored within the EU (Frankfurt, Supabase). We use industry-standard encryption methods.
7. Automated Scoring & Algorithms
Rubber Wheels Oy uses automated scoring systems:
- Trust score (0–125): Calculated from verifiable data points: email verification (+10), Stripe registration (+20), phone verification (+10), insurance (0/5/15), GPS tracking (+10), 5 deliveries (+15), 10 deliveries (+10), profile (+10), first review (+5).
- Reliability score (0–20): Deducted for cancellations (driver: −8/−12/−20, sender: −3/−5/−8). Recovers +1 per completed delivery. Penalties expire after 6 months.
- Notification targeting: Push notifications are targeted by route match and home city.
Automated scoring does not result in automated account suspension without human review. You have the right to request human review: privacy@kumipyorat.fi
8. Sponsored route suggestions (optional)
You can separately consent to receiving route-based push notifications from advertisers. This consent is off by default and is given via an explicit toggle in the app (Profile → Notifications → Route suggestions).
- Legal basis: Consent (GDPR Art. 6(1)(a)) combined with ePrivacy Directive Art. 13 requiring opt-in for electronic marketing.
- What data is used: pickup and delivery address of your active shipment (route match against the campaign geofence) and your home city at a coarse level.
- What data is NOT used: contents or weight of the cargo, your price budget, precise real-time location. We do not profile based on health, religion, ethnicity, gender identity, or political opinion.
- Data shared with the advertiser: The advertiser does not receive your personal data. They get aggregate impression and click statistics — never identifiable individual users.
- Frequency cap: At most one ad push per 24 hours and at most three per week per user, regardless of campaign count.
- Ad identification: Every push is clearly marked with a ”Sponsored · [Advertiser]” label in the title (DSA Art. 26 + EU Unfair Commercial Practices Directive).
- Quiet hours: Route-suggestion pushes respect quiet hours the same way as other push notifications.
Withdrawal of consent (GDPR Art. 7(3)): You can withdraw consent anytime from the app (Profile → Notifications → Route suggestions). Withdrawal is as easy as giving consent, and you will not receive any further route-suggestion pushes. Previously given consent remains valid until withdrawal.
Ad registry (DSA Art. 26): We maintain a public ad registry of active and completed campaigns. The registry shows the advertiser, ad content, targeting criteria and impression counts — never individual user data. The registry will be published before the first ad campaign launches at kumipyorat.fi/ad-registry.
Retention: Push delivery logs are kept for 13 months per DSA Art. 39, after which they are anonymised into per-campaign summaries.
9. Your Rights (GDPR)
- Right to access your personal data
- Right to rectify incorrect data
- Right to request erasure of your data
- Right to data portability
- Right to restrict processing
- Right to withdraw consent at any time (Art. 7(3))
- Right to object to processing based on legitimate interest (Art. 21)
- Right to human review of automated decisions (Art. 22)
- Right to lodge a complaint with the supervisory authority: Finnish Data Protection Ombudsman · tietosuoja.fi
Send your request to: privacy@kumipyorat.fi
10. Statutory Reporting (DAC7)
The EU DAC7 Directive (2021/514) requires digital platforms to collect and report driver income data to national tax authorities. Rubber Wheels Oy reports the following to the Finnish Tax Administration (Verohallinto) annually:
- Driver’s name, address, date of birth, and personal identity code
- Business ID (if the driver has a registered business)
- Income earned on the platform during the calendar year
- Bank account details (obtained from Stripe)
Legal basis: Legal obligation (GDPR Article 6(1)(c), Finnish Act 1267/2022).
Retention period: 7 years.
11. Third Parties
- Stripe — payment processing (PCI DSS certified)
- Supabase — database (EU, Frankfurt)
- Google Maps — mapping and routing services
- Expo — push notifications
- Railway — backend server (EU servers)
- Link Mobility — SMS verification
- Finnish Tax Administration (Verohallinto) — statutory DAC7 reporting
Questions about privacy?
privacy@kumipyorat.fiMinors
The service is intended for users aged 18 or above. We do not knowingly process personal data of minors. If we become aware that a minor has registered, we will delete the account and all related personal data without undue delay.
If you are a guardian and suspect that a minor has registered, please contact privacy@kumipyorat.fi.
Personal data breach handling
If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and at the latest within 72 hours of becoming aware of the breach. Notification is sent to your registered email address and, if necessary, via in-app messaging (GDPR Art. 34).
We will report personal data breaches to the Office of the Data Protection Ombudsman within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to data subjects (GDPR Art. 33).