Privacy Policy

DRIVE&JOY mobile application (iOS / Android) and the driveandjoy.cz website

Effective from: 26 July 2026 · Version 1.4

This policy explains what personal data we process in the DRIVE&JOY mobile application and on the driveandjoy.cz website, for what purpose, on what legal basis, how long we retain it, and what rights you have. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on personal data processing.

1. Data Controller

The controller is a limited liability company (s.r.o.) registered in the Czech Commercial Register maintained by the Municipal Court in Prague, file no. C 451500.

For any questions regarding the protection of personal data and to exercise your rights, please contact us at the e-mail address above.

2. What data we process in the mobile application and for what purpose

We process only data that is necessary to provide the app's services, or that you voluntarily provide.

2.1 Registration and sign-in (account)

• E-mail address, password (the password is stored exclusively as a secure cryptographic hash).
• Purpose: creating and securing your user account, sign-in, password reset, e-mail verification.

2.2 Profile

• Display name, region, bio, location, profile picture (avatar).
• Preferences: preferred vehicle view, clothing size, riding style, preferred activity types, notification settings, profile visibility level, membership tier (free / club).
• Purpose: personalisation, displaying your profile to other users (to the extent set by your visibility settings), recommending relevant events.

2.3 Garage (vehicles)

• Vehicle data: make, model, year, purpose of use, power, torque, engine type, displacement, drivetrain, transmission, modifications, vehicle nickname, notes.
• Vehicle photos.
• Purpose: maintaining your personal garage, optionally sharing a vehicle within the club (according to visibility settings).

2.4 Event bookings

• Booking data: number of attendees, total amount, currency, vehicle data for the event, waiver acceptance timestamp, contact phone, notes.
• Attendee data: name, e-mail, date of birth for each attendee.
• Purpose: processing your event booking, preparing the attendee list, performance of the participation contract.

2.5 Payments

• Payment details (card number, etc.) are processed solely by the Stripe payment gateway. DRIVE&JOY never sees or stores the full payment card number (PAN). We store only the payment identifier (stripe_payment_intent_id), the payment status and the amount.
• Purpose: processing payment for a booking and any refunds.

2.6 Community (follows and "Family")

• Follows: "who follows whom" relationships.
• "Family" groups: group name, type, membership and invitation status.
• Purpose: the app's social features — connecting community members.

2.7 Saved events (wishlist)

• The list of events you have saved.
• Purpose: quick access to favourite events and recommendations.

2.8 Transactional e-mails

• Sending booking confirmations (including an .ics calendar invitation) via the Resend service.
• Purpose: delivering confirmations and important booking information.

2.9 Technical monitoring (errors and usage events)

• The app records technical errors (error message text, technical trace — stack trace, screen name, app version, platform) and anonymous usage events (screen name, app version) linked to your account.
• Purpose: detecting and fixing bugs, monitoring stability and improving the app.
• Retention: records are kept for 90 days; they are deleted when you delete your account.

2.10 Location and ride telemetry

• Location data: geographic coordinates, speed, heading, altitude and measurement accuracy. We process location on a one-off basis to show events, routes and tracks near you, and continuously, including in the background with the screen locked, for as long as you have a ride recording or JOY Ride (co-pilot) mode running.
• Ride recording (telemetry): a time series of location and derived values (speed, acceleration / g-force, lap times on a circuit), ride distance and duration, ride summary and score, and where relevant a link to a JOY Roads route or a circuit. The detailed time series is stored as a data file in Supabase storage.
• Purpose: recording and analysing your drive, statistics and leaderboards, co-pilot navigation (JOY Ride) and ride debriefs (JOY Coach).
• Legal basis: Art. 6(1)(b) GDPR — providing a feature you switch on yourself.
• Retention: for the duration of your account, or until you delete the ride yourself; account deletion removes both the records and the stored data files.
• Background location tracking runs only while a ride recording is active and can be stopped at any time in the app or denied in your system settings. The rest of the app remains usable without location access.

2.11 Data from connected devices (Bluetooth)

• At your request the app connects over Bluetooth to an OBD-II diagnostic adapter in your vehicle or to an external GPS unit (e.g. RaceBox).
• Data processed: vehicle technical data from the adapter (RPM, speed, temperatures, engine load, etc.), more precise position and acceleration from the external unit, and the identifier of the last paired device stored locally on your phone.
• Purpose: enriching the ride recording with data straight from the vehicle.
• We use Bluetooth solely to connect to this accessory — not for advertising-related location determination or for scanning nearby devices.

2.12 Chat and messages

• Data processed: message content, attachments (photos), sender and recipient, timestamp, reactions, read status, muting and blocking of users, content reports.
• Purpose: delivering messages between community members, moderating reported content and operational safety.
• Messages are not end-to-end encrypted. Transmission is encrypted (TLS) and content is stored in the database; in justified cases (a content report) a moderator may access it. Deleted messages are removed from the view of conversation participants.
• Retention: for the duration of the conversation, or of your account.

2.13 Push notifications

• Data processed: the device token used for delivery (on iOS the Apple Push Notification service), platform and registration time; plus the content of the notifications sent and their read status.
• Purpose: delivering alerts (messages, events, reminders, social interactions) to the extent you configure in Notification settings.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating the service; notifications can be turned off at any time in the app and in system settings.
• The token is tied to a specific device and is deleted when the device signs out or the account is deleted.

2.14 JOY+ subscription

• The subscription is purchased and billed through the App Store (Apple). The app does not receive your payment details — only whether you have an active subscription and until when.
• We use RevenueCat to manage subscriptions; it processes a user identifier and purchase status on our behalf.
• Purpose: unlocking and renewing JOY+ premium features.
• Legal basis: Art. 6(1)(b) GDPR — performance of the subscription contract.

2.15 Club merchandise orders

• Data processed: order items, delivery and billing details, e-mail address, amount and payment status.
• Orders are fulfilled by Shopify (store and shipping); payment is processed by Stripe (including Apple Pay). We never see or store the full payment card number.
• Purpose: fulfilling and delivering your order, handling complaints, accounting and tax obligations.
• Legal basis: Art. 6(1)(b) GDPR — performance of the purchase contract; Art. 6(1)(c) for accounting records.

2.16 Map data

• When a map is displayed (events, JOY Roads routes, co-pilot) your device requests map tiles from Mapbox, which in doing so processes your device's IP address and the coordinates of the displayed viewport.
• Purpose: rendering the map.

2.17 What we do NOT use in the app

• We use no cookies and no advertising tracking in the mobile app.
• We do not track you across other companies' apps and websites and we do not share data with advertising networks or data brokers. That is why the app never asks for tracking permission (App Tracking Transparency).
• The motorsport news feed loads public content and processes no personal user data.

3. What data we process on the driveandjoy.cz website

On the public driveandjoy.cz website we process personal data only to the extent that you yourself submit through forms, plus anonymous visitor statistics. The website does not require a user account.

3.1 Contact form

• Data processed: name, e-mail address, phone number (optional), the content of your message.
• Purpose: receiving and handling your enquiry or request and any follow-up communication with you.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest (to respond to the enquiry and manage communication). If the enquiry is aimed at concluding a contract, Art. 6(1)(b) applies — steps taken prior to entering into a contract.
• Retention: for the period necessary to handle the enquiry and a reasonable period thereafter for any follow-up communication; the data is then erased, unless a legal retention period requires otherwise.
• Recipients: Supabase (storing the message in the database), Resend (sending the e-mail with the message content to our address), Vercel (website hosting and delivery).

3.2 Event registration

• Data processed: name, e-mail address, phone number, vehicle details (make, model, year of manufacture, power, registration plate / licence plate), number of people, information about your experience, a note, and confirmation of consent to the processing of personal data (GDPR acknowledgement).
• Purpose: processing your registration for a specific event, preparing the attendee list, event-related communication and sending a registration confirmation.
• Legal basis: Art. 6(1)(b) GDPR — performance of the participation contract, or steps taken prior to entering into a contract at your request. Your confirmation serves as evidence that you were informed of the processing terms.
• Retention: for the period necessary to organise the event and settle your participation; data with accounting or tax relevance is then retained for the period set by statutory time limits (see Section 5).
• Recipients: Supabase (database), Resend (confirmation e-mail), Vercel (website hosting), and where relevant the organiser of the specific event (to the extent necessary for the attendee list).

3.3 Request for a beta invitation to the mobile app

• Data processed: e-mail address.
• Purpose: adding you to the list of people interested in the beta version of the mobile app and sending an invitation.
• Legal basis: Art. 6(1)(a) GDPR — consent granted by submitting the form. You may withdraw consent at any time (see Section 8).
• Retention: until the invitation is sent, or until you withdraw consent or your interest in the beta programme ceases.
• Recipients: Supabase (database), Resend (sending the invitation), Vercel (website hosting).

3.4 Visitor statistics (cookieless analytics)

• To measure traffic we use our own tool that uses no cookies or other identifiers stored on your device and performs no cross-site tracking.
• Data processed: the page visited (URL), approximate country, device type and the source of the visit (referrer). Your IP address and browser identifier (user-agent) are not stored in a readable form — a cryptographic fingerprint is derived from them (SHA-256). The fingerprint is computed with a daily salt and a secret server key; without the secret key the fingerprint cannot be linked back to the visitor. It is used only to roughly distinguish visits within a single day. An automatic filter excludes access by bots and search engines.
• Purpose: anonymous visitor statistics and improving the website's content and performance.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in measuring the website's performance and security. Because no cookies or personal identifiers are stored on your device, no cookie consent is required for this tool (no cookie banner).
• Retention: only in the form of aggregated, anonymised statistical data.
• Recipients: Supabase (storing the anonymous records), Vercel (website hosting).

3.5 Website technical error logging

• If a technical error occurs while the website is displayed, we record the error message text, a technical trace (stack trace), the page address and the website version. The record contains no name, e-mail address or other direct identifier of the visitor.
• Purpose: detecting and fixing technical defects and ensuring the website works properly.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the functionality and security of the website.
• Retention: 90 days.
• Recipients: Supabase (storing the records).

4. Legal basis for processing (Article 6 GDPR)

The detailed legal basis for each web processing activity is stated directly with it in Section 3.

5. Data retention

• Account, profile, garage, community and wishlist data is retained for the duration of your account. After account deletion it is erased (except for data we are legally required to retain).
• Booking and payment data is retained for the period required by accounting and tax legislation (Act No. 563/1991 Coll., on accounting; Act No. 235/2004 Coll., on VAT) — up to 10 years.
• Data from website forms (contact form, event registration, beta invitation request) is retained for the period necessary to fulfil the relevant purpose; data with accounting or tax relevance is then retained under the statutory time limits above. Specific periods are stated with each processing activity in Section 3.
• Ride recordings (telemetry), including the stored data files, are retained for the duration of your account, or until you delete the ride yourself.
• Chat messages and attachments are retained for the duration of the conversation, or of your account.
• Push notification tokens are deleted when the device signs out or the account is deleted.
• Technical error and usage event records (app and website) are retained for 90 days; records linked to an account are also deleted when the account is deleted.
• Transactional e-mails are retained for the period necessary at the e-mail service provider.

6. Recipients of data (processors and other recipients)

We share your data only with the following vetted recipients, who process it under data processing agreements:

7. Transfers to third countries

Some recipients (Resend, Apple, Vercel, RevenueCat, Shopify, Mapbox and possibly Stripe) may process data in the USA, or in Canada (Shopify — a country covered by an adequacy decision). Such transfers are carried out on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission, or on the basis of an adequacy decision (EU–US Data Privacy Framework). This ensures an adequate level of protection for your data.

8. Your rights

In relation to your personal data you have the following rights:

• Right of access (Art. 15) — to obtain information about what data we process.
• Right to rectification (Art. 16) — to have inaccurate data corrected.
• Right to erasure (Art. 17) — the "right to be forgotten" (unless a legal retention obligation prevents it).
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21) to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent.

You can exercise these rights by e-mailing the controller's address in Section 1 (info@driveandjoy.cz). Most in-app data can be managed directly in the app (editing your profile, deleting a vehicle, cancelling a booking, deleting your account); for data submitted via the website, please contact us at the address above to have it corrected or erased.

9. Cookies and tracking

The DRIVE&JOY mobile app uses no cookies and no third-party advertising/analytics tracking, and does not track you across other companies' apps and websites. Local device storage is used only to run the app — sign-in (session token), caching of displayed content and temporary storage of an unsent ride recording until it can be uploaded.

The driveandjoy.cz website uses no third-party advertising or analytics cookies. Traffic is measured using our own tool without cookies and without storing personal identifiers on your device (see Section 3.4), which is why the website does not display a cookie consent banner. Only technically necessary data for the security and basic operation of the website may be used.

10. Security

We take appropriate technical and organisational measures to protect your data: encrypted transmission (HTTPS/TLS), password hashing, database-level access control (Row Level Security), and segregation of payment data at a certified provider (Stripe, PCI-DSS).

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes in the app or by e-mail. The current version is always available at this address.

12. Contact and complaints

For questions, contact us at info@driveandjoy.cz.

You also have the right to lodge a complaint with the supervisory authority:

Office for Personal Data Protection (ÚOOÚ)

Pplk. Sochora 27, 170 00 Prague 7, Czech Republic

www.uoou.cz