Legally Binding Version: German

This privacy policy applies to the mobile application "Jourma Driver" for iOS and Android.

Version: 1.0 — September 2026

Thank you for using our mobile application "Jourma Driver" (hereinafter "Driver App" or "App"). The Driver App is a business application: it is used by drivers who carry out passenger transfers on behalf of a tour operator. It is not intended for travellers. The protection of your Personal Data is important to us, and we want you to know precisely which data the App processes, when, for what purpose and who receives it. We process your Personal Data in accordance with the General Data Protection Regulation (DSGVO) and the data protection provisions applicable in Germany.

1. Contact Details of the Data Controller

The Data Controller within the meaning of the DSGVO for the technical operation of the Driver App (see Section 4.2) is:

Jourma GmbH Taunustor 1 60310 Frankfurt am Main / Deutschland

Managing Director (Geschaftsfuhrer): Hakan Kocabas Commercial Register: Amtsgericht Frankfurt am Main, HRB 136208 USt-IdNr. (VAT ID): DE412018648

Telefon: +49 69 5050604633 E-Mail: info@jourma.de Website: https://jourma.de

2. Contact Details for Data Protection Matters

If you have any questions regarding data protection, please contact:

E-Mail: datenschutz@jourma.de

Postal address: Jourma GmbH, Taunustor 1, 60310 Frankfurt am Main, Deutschland.

3. Scope of This Privacy Policy

This Privacy Policy applies to:

(a) the mobile application "Jourma Driver" for iOS and Android (hereinafter "Driver App" or "App"); (b) the Jourma backend services used by the Driver App (transfer dispatch, live vehicle tracking, messaging between driver and dispatcher); (c) all associated App services and features.

This Privacy Policy does not cover the data processing carried out by your tour operator outside the Driver App (e.g. in its own personnel, payroll or fleet systems). Please refer to the privacy information provided by your tour operator for this. The Jourma travel app for travellers is covered by a separate privacy policy.

4. Roles: Your Tour Operator and Jourma

The Driver App is made available to you by your tour operator, i.e. your employer or the company for which you carry out transfers as a contractor (hereinafter "Operator"). You cannot register yourself. Your Operator creates your account in its operator portal, decides who receives an account and can deactivate your account at any time. Two parties are therefore involved in the processing of your data:

4.1 The Operator as Data Controller

Your Operator is the Data Controller within the meaning of Art. 4 Nr. 7 DSGVO for the employment- or contract-related data that it enters about you and manages in the operator portal: first name, last name, e-mail address, telephone number, driving licence number and expiry date, and the vehicle assigned to you. The Operator also decides which transfer jobs are assigned to you and which of its dispatchers may access your data. Jourma processes this data exclusively on behalf of and in accordance with the instructions of the Operator as a Data Processor within the meaning of Art. 28 DSGVO, on the basis of a Data Processing Agreement, in order to operate the transfer dispatch service. Questions about this data and requests to exercise your rights with regard to it should be addressed to your Operator in the first instance (see Section 12.7).

4.2 Jourma as Data Controller

Jourma GmbH is the Data Controller for the technical operation of the Driver App and the associated backend services, in particular for the login and authentication of your account, push notification tokens, crash diagnostics and security logs. The contact details in Sections 1 and 2 apply to this processing.

5. Which Data We Process, and When

As a general principle, the Driver App processes Personal Data only insofar as this is necessary to carry out transfer jobs safely and traceably and to operate the App securely. The Driver App contains no advertising SDK and no analytics or tracking SDK. We process the following categories of data:

5.1 Account Data

First name, last name, e-mail address, telephone number, driving licence number and expiry date, registration plate of the vehicle assigned to you, and your preferred language. This data is entered by your Operator when your account is created and is displayed to you in the App. Corrections are made by your Operator.

5.2 Authentication Data

Login is handled by Amazon Cognito (Amazon Web Services, Frankfurt region). Your password is stored exclusively in hashed and salted form and is at no time visible to Jourma or to your Operator. In addition, session tokens and the time of your logins are processed. If you forget your password, your Operator can trigger a password reset.

5.3 Location Data During a Transfer Job

The Driver App processes your precise location (GPS), but only while a transfer job that you have started in the App is running — from the moment you tap "Start job" ("Yola çık") until you tap "Finish job" ("İşi bitir"). During this period, the App transmits your position every few seconds, including in the background (e.g. with the screen locked or while a navigation app is in the foreground), so that the travellers assigned to the job and your dispatcher can see the live position of the vehicle and the estimated time of arrival.

No location data is collected before a job has been started, after a job has been finished, when no job is running, or when you close the App. There is no location tracking outside transfer jobs.

The current live position is held for approximately two minutes and is continuously overwritten. Individual route points are stored at most every 45 seconds as the route history of the respective job.

The processing of location data requires the operating system's location permission including background use ("Always" on iOS or "Allow all the time" on Android). You can withdraw this permission at any time in the system settings; without it, however, a transfer job cannot be started or continued in the App.

5.4 Job Activity

For each transfer job, the App records: status changes of the individual stops (e.g. arrived, departed, completed) with time and position at that moment; passenger check-ins (which traveller boarded at which time); and no-show marks if a traveller does not appear at the pick-up point. When marking a no-show, you may optionally take a photo of the pick-up point in the App. This photo serves solely to document the place and time of the pick-up attempt and is stored together with the job. Please do not photograph any persons or faces.

5.5 Messages

Preset messages that you send to travellers from the App (e.g. "I have arrived", "Slight delay"), free-text messages that you receive from your dispatcher, and the read status of these messages with timestamps. Messages are stored with the respective job.

5.6 Push Notifications

To notify you of new job assignments, changes to a job and dispatcher messages, the App registers a push notification token with Firebase Cloud Messaging (Android) or the Apple Push Notification service (iOS). The token is linked to your account and is deleted when you log out or your account is deactivated. Push notifications require the operating system's notification permission, which you can withdraw at any time in the system settings; in that case, job assignments and messages will only be visible when you open the App.

5.7 Device Data

Device model, operating system version, App version and device language, for compatibility and support purposes.

5.8 Crash Diagnostics

If the App crashes or an error occurs, technical diagnostic data is transmitted to Sentry (see Section 9): error message and stack trace, device model, operating system version, App version and a pseudonymous event identifier. Crash diagnostics contain no location data, no message content and no photos.

5.9 Security Logs

When the App communicates with our servers, the IP address, timestamp, requested function and the result of login attempts are logged. This data is used to detect and prevent attacks and misuse.

6. Legal Bases for the Processing of Personal Data

Data entered by your Operator (Section 4.1): Your Operator processes this data for the performance of your employment or service contract (Art. 6 Abs. 1 lit. b DSGVO) and, where applicable, on the basis of national employee data protection law (e.g. Sec. 26 BDSG in Germany). Jourma processes this data as a Data Processor on behalf of the Operator (Art. 28 DSGVO).

Location data, job activity and messages: The processing is necessary for the performance of your contract with the Operator (Art. 6 Abs. 1 lit. b DSGVO) and for the performance of Jourma's contract with the Operator. In addition, it is based on the Legitimate Interest of the Operator and of Jourma in a safe, reliable and traceable transfer service (Art. 6 Abs. 1 lit. f DSGVO): travellers and dispatchers must be able to see where the vehicle is during a transfer, and in the event of complaints, accidents or disputed no-shows, it must be possible to reconstruct what happened. The processing of location data is technically limited to the running transfer job; this limitation is the safeguard that ensures the proportionality of the processing. No monitoring of drivers outside transfer jobs takes place.

Technical operation, security and crash diagnostics (Section 4.2): Art. 6 Abs. 1 lit. f DSGVO — our Legitimate Interest in the secure, stable and functional operation of the App and our systems, as well as Art. 6 Abs. 1 lit. b DSGVO with regard to the performance of our contract with the Operator.

Consent (Art. 6 Abs. 1 lit. a DSGVO): Insofar as the operating system of your device requires a permission (location permission including background use, notification permission), the processing is additionally based on the permission you grant. You can withdraw these permissions at any time in the system settings with effect for the future. Withdrawal of the location permission means that transfer jobs can no longer be carried out with the App.

Legal obligations (Art. 6 Abs. 1 lit. c DSGVO): Insofar as we are subject to statutory retention obligations.

7. Purposes of Data Processing

Personal Data is processed for the following purposes:

Transfer dispatch: Assignment of transfer jobs to you, display of job details, stops and passengers, and recording of job activity (Art. 6 Abs. 1 lit. b, f DSGVO).
Live vehicle tracking: Display of the vehicle's live position and estimated time of arrival to travellers and dispatchers during a running transfer job, and calculation of routes and arrival times (Art. 6 Abs. 1 lit. b, f DSGVO).
Traceability: Storage of the route history, job activity, messages and no-show documentation so that the Operator can respond to complaints, verify disputed no-shows and clarify incidents (Art. 6 Abs. 1 lit. b, f DSGVO).
Communication: Delivery of preset messages to travellers and of dispatcher messages to you, including push notifications (Art. 6 Abs. 1 lit. b, f DSGVO).
Provision and security of the service: Login and authentication, ensuring the continuous functionality and security of our information technology systems, detection and prevention of misuse (Art. 6 Abs. 1 lit. f DSGVO).
Error analysis: Analysis of crashes and technical errors to improve the stability of the App (Art. 6 Abs. 1 lit. f DSGVO).
Data protection matters: Processing and responding to your data protection-related requests and storage of your requests for the fulfilment of documentation obligations (Art. 6 Abs. 1 lit. f DSGVO).
Compliance: Enforcement of our own legal claims and compliance with other legal provisions (Art. 6 Abs. 1 lit. c, f DSGVO).

Your data is not used for advertising, is not passed on to advertising networks, is not sold and is not used to train AI models.

8. Data Recipients

8.1 Your Operator

The dispatchers of your Operator can see in the operator portal: your account data (Section 5.1); the live position of the vehicle during a running transfer job; the route history of completed jobs; the job activity including check-ins, no-show marks and no-show photos; and the messages exchanged with you, including their read status.

8.2 Travellers

Travellers assigned to a transfer job see in their Jourma app: your first name and last name, the registration plate of the vehicle, the telephone number entered for you by the Operator (so that they can contact you), and the live position of the vehicle during their own transfer. Travellers do not see your route history, other jobs, your driving licence details or your e-mail address.

8.3 Service Providers (Data Processors)

We use the service providers listed in Section 9 for hosting, authentication, route calculation, push notifications and crash diagnostics. These service providers act exclusively in accordance with our instructions and are bound to comply with data protection regulations on the basis of a Data Processing Agreement pursuant to Art. 28 DSGVO.

8.4 Other Recipients

Public authorities and governmental bodies, insofar as we are legally obliged to disclose your data, in particular in the case of binding requirements, official requests, court orders and legal proceedings (Art. 6 Abs. 1 lit. c DSGVO).
External business partners, such as auditors, insurance companies, legal advisors or supervisory authorities, insofar as this is necessary in the specific case (Art. 6 Abs. 1 lit. b or f DSGVO).

9. Data Processors and Third-Party Providers

(a) Amazon Web Services (AWS) — Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxemburg — Cloud infrastructure for all backend services of the Driver App, authentication (Amazon Cognito) and calculation of routes and estimated times of arrival (Amazon Location Service, which receives the vehicle position and the coordinates of the stops for this purpose). Data is processed and stored in the EU region (Frankfurt, eu-central-1).

DPA: Integrated into the AWS service agreement.
Privacy notice: https://aws.amazon.com/privacy/
Third-country transfer: Not required (processing within the EU).

(b) Google Firebase Cloud Messaging — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland — Delivery of push notifications on Android devices. Processes the push notification token and the notification content (e.g. job identifier and a short notification text).

DPA: https://firebase.google.com/terms/data-processing-terms
Third-country transfer: Google LLC, Mountain View, USA (Adequacy Decision; certified under the EU-US Data Privacy Framework).

(c) Apple Push Notification service (APNs) — Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Irland — Delivery of push notifications on iOS devices. Processes the push notification token and the notification content.

Privacy notice: https://www.apple.com/legal/privacy/
Third-country transfer: Apple Inc., Cupertino, USA — Standard Contractual Clauses (SCCs) (Art. 46 Abs. 2 lit. c DSGVO).

(d) Sentry — Functional Software, Inc., 45 Fremont Street, San Francisco, USA — Crash diagnostics and error analysis (Section 5.8). We use Sentry with EU data residency: the diagnostic data is stored on servers within the EU.

DPA: https://sentry.io/legal/dpa/
Privacy notice: https://sentry.io/privacy/
Third-country transfer: Standard Contractual Clauses (SCCs) (Art. 46 Abs. 2 lit. c DSGVO), insofar as access from the USA takes place in individual cases (e.g. for support purposes).

The Driver App uses no advertising SDK, no analytics or tracking SDK and no AI service providers. Your data is not sold.

10. Transfer to Third Countries

All data of the Driver App is stored and processed in the European Union (Frankfurt am Main). A transfer to so-called third countries (outside the European Union (EU) or the European Economic Area (EEA)) takes place only in connection with the delivery of push notifications and, in individual cases, crash diagnostics (see Section 9).

Adequacy Decision (Art. 45 DSGVO): For Google LLC (Firebase Cloud Messaging), we base the data transfer on the Adequacy Decision of the European Commission, as Google LLC has certified under the EU-US Data Privacy Framework.

Standard Contractual Clauses (SCCs) (Art. 46 Abs. 2 lit. c DSGVO): For Apple Inc. (Apple Push Notification service) and Functional Software, Inc. (Sentry), we have put in place the EU Standard Contractual Clauses as appropriate safeguards.

11. Duration of Data Storage

We store your Personal Data only for as long as is necessary for the respective purposes for which it was collected. The following retention periods apply in detail:

Data category	Retention period
Account data (Section 5.1)	For the duration of the account (until deactivation or deletion by the Operator) plus statutory retention periods
Live position during a job	Approximately 2 minutes (continuously overwritten)
Route history, job activity, messages, no-show photos	12 months after the transfer date; then deleted or anonymised
Push notification token	Until logout, deactivation of the account or renewal of the token
Crash diagnostics (Sentry)	90 days
Security logs	30 days

Statutory retention periods and deletion obligations remain unaffected, e.g. pursuant to Sec. 257 HGB or Sec. 147 AO (up to 10 years for tax-relevant documents). After expiry of the statutory retention periods, the data is deleted, unless further storage is necessary and covered by a Legal Basis.

Upon deactivation or deletion of your account by the Operator: Your account data and push token are deleted, subject to statutory retention obligations. Route history, job activity and messages of completed jobs are retained for the period stated above, as they form part of the Operator's transfer documentation, and are then deleted or anonymised.

12. Your Rights as a Data Subject

You have the following rights:

12.1 Right of Access (Art. 15 DSGVO)

You have the right to obtain information about the Personal Data concerning you. This includes, in particular, information about the purposes of processing, the categories of Personal Data, the recipients, the retention period and the existence of further rights.

12.2 Right to Rectification (Art. 16 DSGVO)

Insofar as Personal Data concerning you is inaccurate, you have the right to demand that it be rectified without undue delay. Account data (name, contact details, driving licence data, vehicle) is corrected by your Operator in the operator portal.

12.3 Right to Erasure (Art. 17 DSGVO)

Under the conditions set out in Art. 17 DSGVO, you have the right to demand the erasure of Personal Data concerning you, in particular where the data is no longer necessary for the purposes for which it was collected, where the retention period has expired, where an objection has been lodged or where the processing is unlawful. Please note that route history and job activity form part of the Operator's transfer documentation and may be subject to retention obligations.

12.4 Right to Restriction of Processing (Art. 18 DSGVO)

You have the right to demand the restriction of the processing of your Personal Data, in particular where the accuracy of the data is contested, the processing is unlawful, or the data is no longer required but you need it for the establishment, exercise or defence of legal claims.

12.5 Right to Data Portability (Art. 20 DSGVO)

You have the right to receive the Personal Data concerning you, which you have provided, in a structured, commonly used and machine-readable format, insofar as the statutory requirements are met.

12.6 Right to Object and Withdrawal of Permissions (Art. 21 DSGVO, Art. 7 Abs. 3 DSGVO)

Pursuant to Art. 21 DSGVO, you have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 Abs. 1 lit. f DSGVO. We will then no longer process your Personal Data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can withdraw the location and notification permissions granted to the App at any time in the system settings of your device, with effect for the future. The withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal. Please note that transfer jobs can no longer be carried out with the App without the location permission.

12.7 How to Exercise Your Rights

For the data entered and managed by your Operator (Section 4.1) — account data, job assignments, route history, job activity and messages — your Operator is the Data Controller. Please address your requests to your Operator in the first instance. If you contact Jourma with such a request, we will forward it to your Operator and support the Operator in responding to it.

For the processing for which Jourma is the Data Controller (Section 4.2) — login and authentication, push notification tokens, crash diagnostics and security logs — please contact us by e-mail at datenschutz@jourma.de or by post at the address stated in Section 1.

13. Right to Lodge a Complaint

If you believe that the processing of your Personal Data infringes data protection regulations, you have the right pursuant to Art. 77 DSGVO to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The contact details of the supervisory authority responsible at our place of business are:

Der Hessische Beauftragte fur Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1 65189 Wiesbaden / Deutschland

Telefon: 0611-1408 0 E-Mail: poststelle@datenschutz.hessen.de

14. Necessity of Providing Data and Account Deletion

Use of the Driver App requires an account created by your Operator with the data listed in Section 5.1. Without this data, no account can be created. Carrying out transfer jobs requires the location permission including background use; without it, a job cannot be started. The provision of this data is necessary for the performance of your contract with the Operator and for the use of the App.

Account deletion: Your account is deactivated or deleted by your Operator in the operator portal, for example when your employment or contract ends. You may also send a request for deletion of your account to support@jourma.de; in that case, we will coordinate with your Operator as the Data Controller before the account is deleted. The account data will then be deleted, subject to statutory retention obligations and the retention periods stated in Section 11.

15. Automated Decision-Making

Automated decision-making including profiling within the meaning of Art. 22 DSGVO, which produces legal effects or similarly significantly affects you, does not take place. Transfer jobs are assigned by the dispatchers of your Operator, not by an automated system. The estimated times of arrival calculated by the App are of a purely informational nature. Jourma does not evaluate your location or job data for the purpose of assessing your performance.

16. Updates to This Privacy Policy

We reserve the right to supplement or amend this Privacy Policy as necessary, in particular in the event of changes to our services, new legal requirements or the introduction of new processing activities. The current version is available in the Driver App and on our website at all times. In the event of material changes, we will inform you via the Driver App or via your Operator.

Privacy Policy for the Jourma Driver App — Jourma GmbH