Privacy Policy

1. Who processes your data

This policy describes how we process the personal data of users of the EuMo website and app for drivers and vehicle owners at eumo.cz (the “service”) and of its visitors. The service is operated by:

For anything concerning personal data, contact us by email at talalayev@outlook.com or by post to our registered office.

2. When we are the controller and when the workshop is

As the controller, we process the data we need to provide the service: your user account, the vehicles you add to it, the verification of their ownership, sharing vehicles with other people, workshop reviews, notifications, searching the workshop directory, business accounts (organisations) and records about the security of the service. This policy covers that processing.

The workshop you deal with is the controller of the data about your order and repair: the appointment request you send it (with or without an account), estimates and their approval, work orders and their progress, inspection reports, tyre storage, invoices and their online payment, and the messages you exchange with the workshop in the chat. The same applies to job applications to a workshop (see the privacy notice for job applications). We process that data only as the workshop's processor, on its instructions. If you want to exercise your rights over that data, please contact the workshop; its identity and contact details are on its page in the workshop directory and on the documents it sends you.

If a workshop that uses EuMo has you on record as a customer with the same email address or phone number as your account, we link your account to that record so that you can see your repairs, estimates and invoices from that workshop in your account. This does not transfer ownership of any vehicle — you have to confirm that yourself.

3. What data we process and why

• User account — email, name, phone number, billing address (optional), password (stored only as a bcrypt hash), passkeys, chosen language, notification settings and the version of the terms you accepted. Purpose: registration, sign-in and providing the service. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Vehicles — VIN, registration plate, make, model, year, country of registration, roadworthiness test and insurance dates, and odometer readings. We complete the vehicle details by VIN from the Czech Register of Road Vehicles (via dataovozidlech.cz). Purpose: keeping your vehicles and their service history. Legal basis: performance of a contract.
• Vehicle ownership verification — when you add a vehicle by scanning documents, the photos of the registration certificate and of your identity document are read by an artificial intelligence service (Anthropic), which fills in the vehicle details; we do not keep the images, and from the identity document we keep neither your name, date of birth nor document numbers, only the result of the check. Documents you upload for verification (e.g. the registration certificate, a purchase contract, a register extract, an identity document) are reviewed by a member of our staff. Reading a document is only supporting evidence: it does not verify ownership by itself — that is confirmed by a workshop that sees the vehicle and its papers, and disputed cases by our staff. Purpose: preventing anyone from claiming someone else's vehicle. Legal basis: performance of a contract and our legitimate interest in protecting vehicle owners (Art. 6(1)(b) and (f) GDPR).
• Sharing a vehicle — a link to the vehicle's service history (without the owner's details and without prices) and the access you grant to another person or company, including the email address or phone number you send the invitation to. Legal basis: performance of a contract.
• Workshop reviews — rating, comment and date; a review shows your first name and the initial of your surname as the workshop has them on record. Only a workshop where you have a completed work order can be reviewed. You can delete your review at any time. Legal basis: performance of a contract.
• Searching for workshops — if you allow it in your browser, we use your location to sort workshops by distance. We do not store your location with your account; it may only briefly appear in the server's technical logs. An address you type into an address field is looked up with OpenStreetMap (Nominatim). Legal basis: our legitimate interest in providing the feature you ask for.
• Notifications — emails, text messages and in-app notifications about your repairs, appointments, estimates, invoices, messages and account security, and records of their delivery (for emails also whether they were opened, as reported by the email provider). Notifications about security, payments and approvals cannot be turned off; the others can be turned off in your settings, and text messages can be turned off entirely. We send no marketing messages. Legal basis: performance of a contract and our legitimate interest in delivering important messages.

4. How long we keep data

• Account and vehicle data for as long as the account exists; when it is closed we delete it, unless we need it to comply with a legal obligation or to protect legal claims. Records a workshop keeps about you follow that workshop's rules.
• Documents uploaded for ownership verification are deleted 90 days after the verification ends; the record of its outcome (without the documents) stays with the vehicle.
• Sign-ins (sessions) for at most 30 days after last use; email verification and password reset links are valid for 24 hours, and unused links and invitations are deleted 30 days after they expire; ended access to shared vehicles 30 days after it ends.
• In-app notifications for 12 months after they are read (24 months if unread), email and text message delivery records for 13 months.
• Chat messages with a workshop for as long as the account and the conversation exist; the workshop may keep them as its communication with a customer.
• A workshop review until you delete it.
• Accounting and tax documents of business accounts for the period set by accounting and tax law (usually 5 to 10 years).
• Security records (audit log) for as long as needed to evidence security-relevant actions and to protect legal claims.

5. Who receives the data

Workshops receive only what concerns your relationship with them: the appointment request you send, chat messages, estimate approvals, a vehicle you give them access to, and a published review. People and companies you share a vehicle with can see what you allow them to.

Otherwise we disclose data only to processors who help us run the service, to the extent their task requires and under a data processing agreement:

6. Transfers outside the European Union

Some processors are based in the USA or can access data from there. Such transfers rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or, for recipients that have not joined it, on standard contractual clauses approved by the European Commission. We will provide a copy on request.

7. Cookies and browser storage

We use no analytics, advertising or other tracking cookies. We store in your browser only what is strictly necessary for the service you asked for. Under § 89(3) of the Czech Electronic Communications Act (Art. 5(3) of the ePrivacy Directive) this needs no consent, so we do not ask for it:

• Website visitors who are not signed in get no cookies at all.
• the refresh_token cookie — set only after you sign in, keeps you signed in (valid for 30 days) and is read only by the api.eumo.cz server; the sidebar_state cookie remembers in the signed-in area whether the side menu is collapsed (7 days),
• local browser storage: the time of your last activity (security lock after inactivity), your chosen language, the last signed-in account and sign-in method (for a quick sign-in), whether you set up a passkey on the device, where to return after signing in, whether you act for yourself or for an organisation, expanded menu sections, voice message playback settings, a dismissed app install offer, and that you have seen the cookie notice,
• a service worker and its cache of the app's files (fast loading and installing the app).

Some pages load content from other servers, which thereby learn your IP address and browser details: the sign-up, sign-in and no-account booking pages load Cloudflare Turnstile, which checks that a form is not being sent by a bot; workshop maps load tiles from OpenStreetMap; downloading an invoice as a PDF loads a font from cdn.jsdelivr.net. You go to Stripe's payment page only when you choose to pay online. Your browser shares your location only when you ask for it and allow it.

You can delete stored data at any time in your browser settings; you will then have to sign in again. If we ever wanted to use cookies that are not strictly necessary, we would ask for your consent first.

8. Your rights

You have the right:

• to access your data and get a copy of it,
• to have inaccurate data corrected,
• to erasure, if we no longer need the data or process it unlawfully — including closing your whole account,
• to restriction of processing,
• to portability of the data you provided to us,
• to object to processing based on our legitimate interest,
• to withdraw consent where processing is based on consent.

You can change your name, phone number and notification settings yourself in your account settings. Send any other request, including closing your account, by email at talalayev@outlook.com or by post to our registered office; we will handle it within one month. For data controlled by a workshop (section 2), please contact the workshop; if you send such a request to us, we will pass it on. You can also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.

9. Security

Communication with the service is encrypted (HTTPS). Passwords are stored only as bcrypt hashes, you can also sign in with a passkey, security-relevant actions are written to a tamper-proof record, and files and databases are stored in data centres in the EU.

10. Changes to this policy

We may update this policy, for example when we add a feature or change a processor. The current version is always on this page with the date of the last update; we inform users of material changes by email. Related document: Terms of Use.