Etapia
EN

Privacy policy

Last updated: [Date]

This page explains which personal data is processed when you visit this website and use Etapia, for what purpose, and what rights you have.

1. Controller

[Company name], [Street and number], [Postcode and town], [Country]
Email: [Privacy email address]

Further details are in the imprint.

2. Visiting the website

For every page request the web server writes the technically necessary details to a log: IP address, date and time, the address requested, status code, amount of data sent, the referring page and the browser's identifier.

  • Purpose: delivering the page, finding errors and fending off attacks
  • Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR)
  • Retention: [Retention of the server logs, e.g. 14 days]

Fonts, maps, route calculation and address search run on our own servers. The website loads nothing from third parties and uses no analytics or advertising services.

3. Cookies and browser storage

The home page sets no cookies. It only remembers in your browser's storage (localStorage) that you closed the cookie notice.

The Etapia application stores only what it needs to work in the browser:

  • the sign-in token, so you stay signed in until you sign out
  • the language you chose
  • for drivers who allow push messages, the registration with the browser's push service

These are strictly necessary (§ 165(3) of the Austrian Telecommunications Act 2021, Art. 6(1)(b) GDPR) and need no consent. You can delete them at any time in your browser's settings.

4. Registration and user account

Anyone who registers a bus company or is invited to one provides the bus company's name, a username, first and last name, email address, password and language. The password is stored only as a hash.

  • Purpose: providing the account and performing the contract for using Etapia
  • Legal basis: contract (Art. 6(1)(b) GDPR)
  • Retention: until the account is deleted; invoices to our customers are kept as long as tax and company law require (seven years in Austria, § 132 BAO)

5. Data that bus companies enter in Etapia

Bus companies keep their customers, trips, drivers, buses, offers and invoices in Etapia. Each bus company is the controller of that data; we process it only on its behalf and on its instructions (Art. 28 GDPR), under a data processing agreement. Please direct questions about this data to the bus company. One bus company's data is not visible to other bus companies.

6. Emails and push messages

Etapia sends offers, order confirmations, invoices and messages to drivers by email through [Email delivery service, registered office].

If a driver allows push messages, each message travels encrypted through the push service of their browser (Google for Chrome and Android, Apple for Safari and iOS, Mozilla for Firefox). The push service sees the device's address, not the content. These providers may also process data outside the EU. Push messages can be turned off at any time in the phone's or browser's settings.

7. Hosting and recipients

The website, the application and the database run at [Hosting provider, registered office, server location], which acts as our processor. Beyond that we pass on data only where the law requires it.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Write to [Privacy email address].

You can also lodge a complaint with the supervisory authority; in Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.