Data protection statement

Controller: Tayeb Lalaoui, operator of Rydely, Rue de la Confédération, 1204 Genève, Suisse. Data protection contact: Tayeb Lalaoui — info@rydely.ch (data protection and rights requests). No separate DPO appointed.

• identity, contact details, account, language, country and currency;
• vehicles, published journeys and search criteria;
• bookings, payments and transaction statuses;
• messages, notifications, reviews, reports and support interactions;
• technical and security data and logs needed for operation;
• consent and audience measurement data when these services are enabled.

Information comes from your entries, interactions with the other participant and, when payments are enabled, statuses returned by the payment provider. Published journey data and some driver/vehicle information appear in public search; not all are restricted to people who have already booked. Messages and booking data have separate visibility rules.

Fields needed for an account or booking must be completed to provide the corresponding function. Optional notes, comments and choices must not contain unnecessary sensitive information or third-party data without a reason.

• providing, securing and improving Rydely’s essential functions;
• connecting participants and fulfilling bookings;
• processing payments and related administrative obligations;
• preventing abuse, handling reports and ensuring safety;
• complying with the legal obligations binding on Rydely.

Data is accessible to authorised staff and providers necessary for the service, for example hosting, authentication, payment, security, notifications and support. Data strictly necessary for a journey may be disclosed to the other participant concerned.

When data is disclosed abroad, Rydely must inform the individuals concerned of the receiving country and, if an adequate level of protection is not recognised, the safeguards used or the applicable exception.

Transfers and safeguards: Hosting, database and emails in Switzerland with Infomaniak Network SA. Transfers outside Switzerland linked to active providers: Twilio Inc. (phone verification and SMS codes: number and message content), mainly processed in the United States, Swiss-U.S. Data Privacy Framework certification and standard contractual clauses; Stripe (payments: payment and transaction data), contract with Stripe Payments Europe Limited (Ireland) and possible transfers to the United States to Stripe, LLC, certified under the Swiss-U.S. Data Privacy Framework, with standard contractual clauses adapted to Swiss law. Google services (sign-in, maps and addresses) remain disabled; this section will be updated before any activation.

Rydely retains data only as long as necessary for the relevant purposes and legal obligations. Detailed periods to validate: Prelaunch target policy: ordinary technical logs limited to 30 days; account data needed during use, followed by sorting and deletion of unnecessary data within 30 days after closure. Accounting documents subject to Swiss law are archived for 10 years from the end of the financial year. For an identified unpaid debt or dispute, only necessary records are isolated with restricted access for the justified duration of the case and applicable time limits, with periodic review. Indefinite retention of the entire account is not planned. The detailed register and deletion tasks still need to be implemented and tested before publication.

Technical and organisational measures are implemented according to risk to protect data confidentiality, integrity and availability.

Under the conditions of the Swiss Data Protection Act, you may request information on processing of your data and, depending on the situation, rectification, delivery, deletion or cessation of certain processing.

Requests are sent to Tayeb Lalaoui — info@rydely.ch (data protection and rights requests). No separate DPO appointed. Individuals may also consult the information and remedies published by the Federal Data Protection and Information Commissioner (FDPIC). The ordinary period for an access request is 30 days; if information cannot be provided within that period, the person must be informed of the time required, under applicable rules.

Where the GDPR applies to processing in addition to Swiss law, Rydely meets the corresponding additional obligations, particularly concerning information, legal bases and individuals’ rights.

This statement is updated when processing, providers or legal requirements change significantly.

Providers actually used and their roles: Local tests validated: Infomaniak for email codes, alerts and account recovery; Google for optional sign-in (name, email, profile photo) and Maps/Places/Routes for addresses, maps and meeting points; Twilio for phone verification and SMS codes. Google receives search text and selected places or points; Twilio receives the number and information needed for the message; Infomaniak processes the recipient and email content, which may include sign-in details. The browser also communicates with Google when maps are displayed. GPS arrival coordinates are sent only when the user permits and uses that function. Contracting entities, processing countries, transfer safeguards and contracts still require confirmation before public launch. Better Auth, PostgreSQL and Redis are hosted by Rydely. No real Stripe payment is enabled. Public deployment remains pending.

The compliance engine may allow, refuse or require review of a publication. Its legal classification, information on consequences and review procedures must be documented before launch: The compliance engine evaluates publication requests and may require review or reject a request under applicable rules. Reports alone do not trigger an automatic sanction. Human review requests: info@rydely.ch. The criteria actually enabled, their effects and the legal classification of decisions must be documented before opening.

Inventory of cookies, local storage and SDKs, with their durations and choice mechanisms: Authentication and language preference use storage necessary for the service. Rydely has enabled no optional advertising or analytics tool in the tested scope. Displaying Google Maps involves communication with Google: cookies/SDKs, durations and any required consent must be reviewed before launch. At the user’s request, a trusted device may be remembered for 30 days, renewed on sign-in. Email codes: five minutes; recovery link: 30 minutes and single use. Security email delivery was verified locally; deletion tasks and the retention register remain to be completed. Data information remains separate from acceptance of service terms; an optional marketing choice must not be required to create an account.