Polityka prywatności

In force from: 21 August 2026Last updated: 3 September 2026Version: 1

JOLO PRIVACY POLICY

This Privacy Policy (hereinafter: the “Policy”) contains information on the processing of your personal data in connection with the use of the JOLO application (hereinafter: the “App”) and on the cookies used.

All capitalized terms that are not defined in the Policy have the meaning given to them in the Customer Terms of Service and in the Driver Terms of Service of the JOLO App.

Personal data controller

The controller of your personal data is JOLO sp. z o.o., with its registered office in Warsaw at ul. Tadeusza Czackiego 15/17, 00-043 Warsaw, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number: 0001237122, REGON: 544609790, NIP: 5253087910, share capital: PLN 50,000 (hereinafter: the “Controller”).

The Controller and the Driver process personal data as independent controllers - each for its own purposes and on its own responsibility.

Contacting the Controller

In all matters relating to the processing of personal data, you may contact the Controller at the e-mail address: admin@jolo.delivery or in writing, at the address of the Controller’s registered office.

Personal data protection measures

The Controller applies modern organizational and technical safeguards ensuring the protection of the personal data processed, appropriate to the risks and to the categories of data protected, in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the “GDPR”). In particular, the Controller protects the data against being made available to unauthorized persons, being taken by an unauthorized person, being processed in breach of the law, and against alteration, loss, damage or destruction.

Information on the personal data processed

Using the App requires the processing of your personal data. Below you will find detailed information on the purposes and legal bases of the processing, as well as on the processing period and on whether providing the data is mandatory or voluntary.

1. Conclusion and performance of the Agreement for the Provision of the App Service

Purpose of processing

Personal data processed

Legal basis

Conclusion and performance of the Agreement for the Provision of the App Service (maintaining the Account)

1) first name and surname

2) e-mail address

3) telephone number

4) in the case of Drivers, additionally: business name or name, NIP or KRS number, address of the registered office or address where the business activity is conducted

Article 6(1)(b) of the GDPR (the processing is necessary for the performance of the Agreement for the Provision of the App Service concluded with the data subject, or in order to take steps to conclude it)

Providing the above personal data is a condition for the conclusion and performance of the Agreement for the Provision of the App Service (providing it is voluntary, but the consequence of not providing it will be that this Agreement cannot be concluded or performed). The Controller will process the above personal data until the claims arising from the Agreement for the Provision of the App Service become time-barred.

2. Conclusion and settlement of Transport Orders

Purpose of processing

Personal data processed

Legal basis

Enabling a Transport Order to be concluded, performed and settled between Users, including making the data available to the other party to the Transport Order

1) first name and surname

2) telephone number

3) the Shipment’s dispatch address and delivery address, together with an indication of the floor

4) description of the Shipment and the photographs sent

5) price and settlement data of the Transport Order

6) history of Transport Orders

7) photographic documentation of the condition of the Shipment and of the course of performance of the Transport Order

Article 6(1)(b) of the GDPR (the processing is necessary for the performance of the Agreement for the Provision of the App Service, one functionality of which is to enable a Transport Order to be concluded)

Providing the above personal data is voluntary but necessary in order to place a Transport Order (the consequence of not providing it will be that the Transport Order cannot be placed or performed). The Controller will process the above personal data until the claims arising from the Transport Order become time-barred.

3. Verification of Drivers

Purpose of processing

Personal data processed

Legal basis

Carrying out the Verification of the Driver, the Vehicle and the documents and its periodic updating, as well as presenting the Driver’s status to Customers

1) the Driver’s identification data (depending on its legal form)

2) data from the Carrier’s driving license, including the image

3) data from the Vehicle’s registration certificate

4) data confirming the conclusion of a motor third-party liability insurance contract

5) the Driver Administrator’s data: first name, surname, position, telephone number, e-mail address

Article 6(1)(b) of the GDPR (in relation to the Driver) and Article 6(1)(f) of the GDPR – the Controller’s legitimate interest consisting in ensuring the security and reliability of the services provided through the App (in relation to Carriers other than the Driver)

The Driver sends the documents and data provided in the course of Verification through a channel of its own choosing from among those made available by the Controller. The Controller is not responsible for the security of transmission through external channels that the Driver has chosen to use. Providing the above personal data is voluntary but necessary in order to accept and perform Transport Orders (the consequence of not providing it will be that Verification cannot be completed successfully). The Controller will process the above personal data for the term of the Agreement for the Provision of the App Service and, after it ends, until the claims become time-barred.

4. Geolocation data

Purpose of processing	Personal data processed	Legal basis
Enabling the Customer to track the performance of a Transport Order in real time.	1) geolocation data of the Driver’s mobile device, processed during the performance of a Transport Order and made available to the Customer that is a party to that Order	Article 6(1)(b) of the GDPR – as regards making geolocation data available during the performance of a Transport Order.
Making geolocation data available is an obligation of the Driver arising from the Terms of Service; the consequence of not making it available is that the Transport Order cannot be performed. The Controller retains the record of the route travelled until the end of the day on which the Transport Order was performed.

5. Reviews and ratings

Purpose of processing

Personal data processed

Legal basis

Publication of Reviews and ratings concerning Drivers and the moderation thereof

1) the content of the Review and the rating

2) the first name or name of the author of the Review

3) the first name of the Driver to which the Review relates

Article 6(1)(f) of the GDPR – the Controller’s legitimate interest consisting in building the credibility of the services provided through the App and in supporting Users in selecting a Driver

Providing the above personal data is voluntary. The Controller will process the above personal data until the Review is removed or an objection is effectively raised.

6. Complaints, reports and legal obligations

Purpose of processing

Personal data processed

Legal basis

1) conducting complaint proceedings

2) examining reports and appeals concerning prohibited content

3) handling enquiries submitted by Users

4) fulfilling tax and accounting obligations (including issuing invoices and retaining accounting documentation)

5) fulfilling obligations related to the protection of personal data

6) examining reservations raised after the performance of a Transport Order and handling cancellations and the settlement of Cancellation Fees

1) first name and surname or name

2) e-mail address

3) other data contained in the message sent to the Controller

4) the contact details provided (correspondence address, telephone number)

5) address of the registered office

6) NIP

Article 6(1)(c) of the GDPR (the processing is necessary for compliance with the legal obligations to which the Controller is subject)

AD 1–3: Providing the above personal data is a condition for receiving a response to a complaint, report or enquiry and for exercising the rights arising from the provisions on the Controller’s liability for the non-conformity of the Service with the Agreement and from the provisions of the Digital Services Act (providing it is voluntary, but the consequence of not providing it will be that no response can be received). The Controller will process the above personal data for the duration of the complaint proceedings or of the examination of the report and, where the above rights are exercised, until they become time-barred.

AD 4: Providing the above personal data is voluntary but necessary in order for the Controller to fulfill the tax and accounting obligations to which it is subject. The Controller will process the above personal data for a period of 5 years from the end of the year in which the tax payment deadline fell.

7. Activity analysis, marketing and the pursuit of claims

Purpose of processing

Personal data processed

Legal basis

1) analysis of activity in the App

2) carrying out marketing activities concerning the Controller’s own services

3) establishing, pursuing or defending claims

4) ensuring the security of the App and preventing abuse

1) date and time of the visit

2) IP address

3) device identifier

4) data concerning activity in the App

5) first name and surname and contact details

6) data saved in the Account

Article 6(1)(f) of the GDPR – the Controller’s legitimate interest consisting in analyzing and improving the App, carrying out direct marketing, ensuring security, and establishing, pursuing or defending claims

Providing the above personal data is voluntary but necessary in order to achieve the above purposes. The Controller will process the above personal data until an objection is effectively raised, until the claims become time-barred or until the purpose of the processing is achieved – whichever occurs first.

8. Issuing invoices in the App

Purpose of processing

Personal data processed

Legal basis

issuing, in the name and on behalf of the Driver, invoices documenting the performance of Transport Orders and sending them to the National e-Invoicing System

1) identification data of the parties to the Transport Order,

2) NIP number (if provided).

Article 6(1)(b) of the GDPR as regards the relationship with the Driver, and Article 6(1)(c) of the GDPR as regards the obligations arising from the provisions on value added tax

Providing the above personal data is voluntary but necessary in order to achieve the above purposes. The Controller will process the above personal data for a period of 5 years from the end of the year in which the tax payment deadline fell.

Profiling

In order to create your profile for marketing purposes and to send you direct marketing tailored to your preferences, the Controller will process your personal data by automated means, including by profiling it – this will not, however, produce any legal effects concerning you or similarly significantly affect your situation.

The scope of the personal data profiled corresponds to the scope indicated above in relation to the analysis of your activity in the App and to the data you save in the Account. The legal basis for the processing of personal data for the above purpose is Article 6(1)(f) of the GDPR. Providing the above personal data is voluntary but necessary in order to achieve the above purpose. The Controller will process personal data for the purpose of profiling it until an objection is effectively raised or until the purpose of the processing is achieved.

Recipients of personal data

The recipients of personal data will be the following third-party entities that work with the Controller:

1. the hosting company;

2. Stripe, Inc. and Stripe Payments Europe, Ltd. – the payment operator through which Transport Orders are settled and the identity of Drivers is verified;

3. Google Ireland Limited and Google LLC – as regards analytics, mapping, advertising and tag management services;

4. Meta Platforms Ireland Limited – as regards marketing tools;TikTok Technology Limited – as regards marketing tools;LinkedIn Ireland Unlimited Company – as regards marketing tools;LAmarketing – a marketing agency established in Ukraine, carrying out analytics and advertising activities on behalf of the Controller;ObserviX, Inc. (Delaware C-Corporation, 20 N Wacker Drive, Suite 1200, Chicago, IL 60606, USA) – the provider of the technology used by the marketing agency, to the extent that it obtains access to the data

5. the company providing accounting services;

6. a law firm;

7. the other party to the Transport Order – as regards the data necessary for its conclusion, performance and settlement; the Customer receives the data of the Driver and of the Carrier, and the Driver receives the data of the Customer and of the recipient of the Shipment;

8. the National e-Invoicing System operated by the Head of the National Revenue Administration - as regards the data contained in invoices.

In addition, personal data may be transferred to public or private entities where such an obligation arises from generally applicable laws, from a final court judgment or from a final administrative decision.

Transfers of personal data to a third country

In connection with the Controller's use of services supplied by Stripe, Google, Meta Platforms, TikTok and LinkedIn, your personal data may be transferred to third countries, including the United States.

The basis for transfers of data to the United States is Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework – in relation to entities holding a valid certification under that framework. Otherwise, the basis for the transfer is, as applicable, a European Commission decision finding an adequate level of protection of personal data in the third country concerned, or the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021. In connection with cooperation with a marketing agency established in Ukraine, personal data may be transferred to Ukraine. Ukraine is not covered by a European Commission decision finding an adequate level of protection of personal data; the basis for the transfer are the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented by additional safeguards resulting from the transfer impact assessment carried out.

You may obtain from the Controller a copy of the data transferred to a third country.

Your rights

In connection with the processing of personal data, you have the following rights:

1. the right of access to personal data and to receive a copy of it;

2. the right to rectification of personal data;

3. the right to erasure of personal data;

4. the right to restriction of the processing of personal data;

5. the right to portability of personal data;

6. the right to object to the processing of personal data based on the Controller’s legitimate interest, including to profiling;

7. the right to withdraw consent at any time – to the extent that the processing is carried out on the basis of consent, whereby the withdrawal of consent does not affect the lawfulness of the processing carried out before it was withdrawn;

8. the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

In order to exercise the above rights, please contact the Controller at the address indicated in the “Contacting the Controller” section.

1. The Controller informs you that the App uses “cookies”, i.e. computer data, in particular text files, stored on Users’ terminal devices. Cookies may originate from the Controller as well as from entities whose services the Controller uses.

2. The Controller uses cookies for the following purposes:

1) ensuring the proper functioning of the App – cookies make it possible for the App to operate smoothly and for its functionalities to be used;

2) improving the performance of the App – cookies make it possible to detect errors on certain subpages;

3) compiling statistics – cookies are used in order to analyze how Users use the App;

4) carrying out marketing activities – cookies enable the Controller to send Users advertising tailored to their preferences.

3. The Controller may place on your device both session cookies (deleted after the browser is closed) and persistent cookies (stored for a specified period).

4. Detailed information on the cookies used in the App (covering their name, provider, purpose and storage period) is made available in the cookie banner displayed when you first open the App and in the consent management panel, which can be accessed at any time. Through the panel, you may enable or disable cookies of individual categories, with the exception of necessary cookies, and change those settings at any time.

5. The data collected by means of cookies does not allow the User to be directly identified.

6. The Controller uses the following cookies and tools that use cookies:

Name	Provider	Purpose	Storage period
Necessary cookies	the Controller	Ensuring the proper functioning of the App, including maintaining the session of a logged-in User	Session-based – until the browser is closed
Google Maps	Google	Displaying maps and planning the carriage route	up to 6 months
Google Ads	Google	Measuring the effectiveness of advertising campaigns and remarketing	up to 13 months
Google Analytics 4	Google	Analysing traffic and User behaviour and generating statistics	up to 2 years
Google Tag Manager	Google	Managing tracking codes launched in the App	The tool does not store its own cookies – it launches the cookies of the other tools listed in the table
Meta Pixel	Meta Platforms	Measuring the effectiveness of advertising on Facebook and Instagram and remarketing	up to 3 months
TikTok Pixel	TikTok	Measuring the effectiveness of advertising and remarketing	up to 13 months
LinkedIn Insight Tag	LinkedIn	Measuring conversions, the effectiveness of advertising and remarketing	up to 12 months
LAmarketing Pixel (ObserviX)	ObserviX, Inc.	Marketing analytics and attribution	up to 365 days

7. Through most commonly used web browsers, you may check whether cookies have been installed on your device, as well as delete installed cookies and block their future installation by the App. Disabling or restricting the handling of cookies may make it more difficult to use the App.

Final provisions

In matters not regulated by the Policy, generally applicable laws apply, in particular the GDPR and the Act of 10 May 2018 on the Protection of Personal Data.

The Policy is effective as of 21 August 2026.