Privacy Policy

Version 2.0.0 · in force from 2026-09-06

1. Controller and scope

Denys Romanov, a sole trader (autónomo), Spanish NIF/NIE Y9622163N, operates Juuh (https://juuh.com) and controls the processing described here. Address: Calle Alqueria 1, 29680 Estepona, Málaga, Spain. Privacy and rights contact: legal@juuh.com.

No data protection officer has been appointed: the current activity does not fall within the cases listed in GDPR Article 37. If one is appointed, their details will be published in this policy. Privacy requests are handled at legal@juuh.com.

This policy covers visitors, account holders, Hosts, Renters, approved drivers and people who contact Juuh. A business Host, payment provider or insurer may be an independent controller for its own purposes; its identity and notice are provided when it participates.

2. Data and sources

We receive information you provide, information generated through your use of the service and necessary information from the other booking party, from verification and payment providers, from vehicle devices, from insurers and from authorities. A Host or Renter who provides another driver's data must be authorised to do so and must give that person this information; Juuh also informs them directly where required.

Data may include identity, contact details, date of birth, address, identity document and driving licence; the Host's business and tax status; payment account and transaction identifiers; the vehicle and the authority to rent it; bookings, contracts, signatures and consents; messages, reviews, handover and return photographs and incidents; IP address, device and security logs. Document images and face photographs are processed only where their necessity and retention are justified. Biometric data is subject to the additional rules in section 4.

Listings, reviews and public profiles display only: first name, profile photograph if uploaded, date of joining, verified-identity indicator, average rating, number of completed trips, average response time and, for a Host, the headline and description they publish themselves. Surnames are not published. Identity documents, bank details, private messages and precise non-public locations are not published through this feature.

3. Purposes and legal grounds

| Purpose | Data and legal ground | |---|---| | Account, booking, agreement, handover and support | Necessary identity, contact and operational data: contract or requested pre-contract steps, GDPR Article 6(1)(b) | | Driving licence, age and Host authority checks | Strictly necessary contracting data, Article 6(1)(b); additional necessary and proportionate fraud checks, Article 6(1)(f) | | Collection, refunds, settlement and invoices | Payment and transaction data: Article 6(1)(b); applicable tax and accounting duties, Article 6(1)(c) | | Recording and reporting rentals within RD 933/2021 | Required and available identity, contract, vehicle and payment fields: legal obligation, Article 6(1)(c); recipient Ministry of the Interior / SES.HOSPEDAJES | | Security, fraud prevention and defence of claims | Relevant logs, facts and evidence: Article 6(1)(f); interest in protecting accounts, vehicles, people and the rights of Juuh and its users | | GPS and telematics, only in vehicles disclosed before booking | Strictly necessary location and events: Article 6(1)(b) where indispensable to a requested function; Article 6(1)(f) for security and recovery, following a necessity and balancing assessment | | Optional cookies, measurement and advertising | Consent, GDPR Article 6(1)(a) and LSSI Article 22.2, according to your preferences and the Cookie Policy | | Promotional communications | Separate consent, Article 6(1)(a); refusal does not prevent contracting |

Required fields are identified when they are collected. Without them, verification, contracting, vehicle handover or Host payment may be impossible. Marketing data and optional cookies are not required for the core service. Legitimate interests are assessed and may be challenged by objection at legal@juuh.com.

Juuh is not currently identified as an operator subject to platform tax reporting (DAC7 / Modelo 238) and therefore collects no data for that purpose. If that duty becomes applicable, you will be informed before any data is collected to comply with it.

4. Verification, telematics and automated decisions

Identity and licence verification. The provider is Didit (https://didit.me). Before the verification session starts you are told which documents are requested, which checks are run, who receives the data and for how long, and Didit presents its own privacy information. Juuh keeps the verification result, the minimum audit fields (document type, issuing country, outcome and warnings) and a cryptographic fingerprint of the document, which prevents duplicate accounts without storing the number in the clear. The document details you enter for the agreement and for the RD 933/2021 register are kept as described in section 6.

Biometrics. A photograph is not always biometric data; technical facial matching intended to identify someone uniquely additionally requires a valid GDPR Article 9 condition. It is not activated by accepting this policy. Where explicit consent is used, a genuine alternative without that biometric identification and a simple way to withdraw are provided.

Telematics. Vehicles with telematics are identified before booking and carry the telematics notice, which sets out the data, frequency, active period, who has access and retention. Journeys are not used for advertising or to infer sensitive visits. A speed event is a technical indication, not an administrative fine.

Automated decisions. Juuh uses the following, all of which a person can review:

A merely formal review does not replace human assessment. User support is provided by people; if automated assistance is introduced in support in future, this will be disclosed at the start of the interaction and access to a person will be offered.

5. Recipients

We share only necessary data with the other booking party and approved drivers; with the providers listed below; with the insurer and assistance provider identified in the booking; and with advisers and authorities where appropriate. A dispute does not justify disclosing the entire verification file or every journey to the other party.

| Service | Entity, role and access | Countries and transfer safeguard | |---|---|---| | Payments, refunds and settlement | Stripe Payments Europe, Limited (Ireland) and its group companies. Processor for executing the payment; independent controller for its own fraud, anti-money-laundering and account verification duties | Ireland (EU), with access by Stripe, Inc. from the United States under standard contractual clauses and the applicable adequacy framework | | Identity and licence verification | Didit (https://didit.me). Processor for the requested check; presents its own privacy information before the session | European Economic Area and, where applicable, third countries under standard contractual clauses with a transfer assessment | | Hosting, database and backups | Managed server and S3-compatible object storage providers. Processors; no access to content beyond what is needed to operate the service | European Union | | Content delivery, attack protection and DNS | Cloudflare, Inc. Processor; it acts as a reverse proxy and therefore processes IP addresses and request metadata | United States and its global network, under standard contractual clauses and the applicable adequacy framework | | Transactional email and SMS | Resend, Inc. (email) and 46elks AB, Sweden (SMS). Processors; they receive the recipient and the message content | United States (Resend) under standard contractual clauses; Sweden (46elks), EU | | Maps and geocoding | OpenFreeMap and the OpenStreetMap Foundation's Nominatim service. They receive the map or address request, not your account | European Union and United Kingdom | | Telematics | Traccar, hosted on Juuh's own infrastructure. No third party receives position data through this channel | European Union | | Analytics and advertising | None currently active. If any is enabled, it is identified in the Cookie Policy before it runs and works only with your consent | — |

Processors act under contracts and security measures. Independent controllers meet their own duties. You may request the current list of processors and a copy of the transfer safeguards at legal@juuh.com, with unrelated confidential information redacted. Cookie consent does not replace international transfer safeguards.

6. Retention

| Category | Period or criterion | |---|---| | Account and profile | While the account is active and until you ask for it to be deleted. We do not currently apply automatic deletion for inactivity; if that is introduced it will be announced here before it applies | | RD 933/2021 electronic register | Three years from completion of the contracted service, for data subject to that duty | | Contracts and claims | Five years from performance of the contract, under Article 1964 of the Civil Code; longer only while a claim, dispute or official request is open | | Tax and accounting data | Four years from the end of the relevant filing deadline (General Tax Act) and six years for commercial books and records where Article 30 of the Commercial Code applies | | Verification outcome and document fingerprint | While the account exists and for the limitation period of claims that depend on it | | Copies of identity documents or licences, where kept | In encrypted storage with restricted access; deleted once they are no longer needed for the booking, the claim or the legal duty that justified them. You may request deletion at legal@juuh.com | | Telematics events | While needed for the booking, for vehicle security or for an open claim; access is restricted and logged. You may object to legitimate-interest processing or request deletion at legal@juuh.com | | Messages, support and security logs | While the account exists and for the limitation period of related claims; security logs are kept for as long as needed to investigate incidents | | Consents and marketing | Sending stops when consent is withdrawn; evidence of consent is kept for as long as it may be required to demonstrate that sending was lawful | | Cookies and similar technologies | Specific table in the Cookie Policy | | Backups | Overwritten on their rotation cycle, with restricted access; deletions are reapplied on restore |

A legal order or litigation may require specific evidence to be kept for longer. Once the purpose ends and the required periods expire, data is deleted or effectively anonymised. Closing an account does not erase an invoice or prevent an outstanding claim from being handled.

7. Your rights

You may request access, correction, deletion, restriction, portability where applicable and objection — including objection to legitimate interests and to advertising — at legal@juuh.com or by post. In your account, under Settings → Privacy and consents, you can also manage your consents and submit a rights request. You may withdraw consent without affecting the lawfulness of earlier processing. Requests are free except for statutory exceptions; additional identity information is requested only where necessary and proportionate.

We normally respond within one month; if complexity requires a lawful extension of up to two further months, we will tell you within the first month. You may complain to the Spanish Data Protection Agency at https://www.aepd.es or to the competent authority where you habitually live or work.

8. Changes of controller or of this policy

We notify significant changes before the new processing where required. A future company does not automatically replace Denys Romanov as controller. If a transfer takes place, you will be told the identity of the new controller, the date, the purpose, the data affected, the legal basis and your rights. New consents will not be required where they are not legally necessary, and previous consents will not be extended to incompatible purposes.

All of Juuh’s terms and policies

Continue to Juuh