Privacy policy

Privacy policy

Last updated: [date]

This policy explains which personal data WEM Life ("we") processes when you use our website, the WEM Life app and our Hives, why we do it, how long we keep it and which rights you have. It applies to customers, vehicle owners, shop and Hive staff and community members.

Who is responsible

[Company name, legal form, address, registration number] Email: [privacy contact email]

Data protection officer (if appointed): [name, contact]

For users in Thailand, [Thai entity or representative, address] is the data controller under the Personal Data Protection Act B.E. 2562 (PDPA).

What we process and why

• Account data: name, email address, phone number, language, currency, password (stored only by Google Firebase Authentication, never by us). Needed to create and run your account (contract).
• ID and driving documents: ID card or passport and driving licence you upload, and their review status. Needed to check that you may rent or list a vehicle (contract, legal obligation). Stored in private storage that only you and authorised staff can open.
• Bookings, orders and payments: what you rent or buy, dates, prices, invoices, deposits, refunds, and inspection photos taken at check-in and return. Needed for the contract and kept for tax and accounting law.
• Payment data: card and account details are entered directly with Stripe or PayPal. We never see or store full card numbers; we only keep a payment reference, the amount and the status.
• Location: only while the app is open and only when you use a feature that needs it: sending your position with an emergency or breakdown report, and finding HotBees units or partners near you. The app never tracks you in the background. If you opt in to Bee Family, we store only a rounded position (about 1 km).
• Camera and photos: used to scan a vehicle's QR sticker and to take inspection and emergency photos. Only the photos you take or choose are uploaded.
• Bluetooth: used only to talk to the vehicle's smart lock (TTLock) to unlock and lock it. We don't scan for or store other devices.
• Push notifications: a device token so we can send rental, order and emergency updates. You can switch notifications off at any time.
• Vehicle GPS tracking: vehicles can carry a GPS tracker. During a rental we process the vehicle's position, speed, trips and alerts (for example geofence or overspeed) to protect the vehicle, help in emergencies and settle disputes (legitimate interest, contract). The tracker belongs to the vehicle, not to your phone.
• Community and chat (Bee Family): your community profile, messages, meetups, blocks and reports, only if you join. Messages are visible to the people you write to.
• Reviews: ratings and texts you write after a rental or order, shown with your name.
• Website analytics and campaigns: an anonymous visitor ID, pages visited, referrer and UTM campaign parameters, to measure our own campaigns (first party, no advertising networks). The app has no advertising or third-party analytics SDK.
• Support and emergencies: what you tell us, and the case history.

Who else processes your data

We use these service providers. They process data only on our instructions (data processing agreements) and only for the purpose listed:

• Google (Firebase Authentication, Cloud Messaging, Cloud Storage, Cloud Run hosting): sign-in, push notifications, file storage, servers.
• Google Cloud Translation: automatic translation of listings and content between English, German and Thai. Your account data is not sent.
• Stripe: card payments, refunds and payouts to vehicle owners.
• PayPal: PayPal payments and refunds.
• Resend: sending emails (verification, booking and order updates).
• TTLock: smart lock access codes and unlock records for rented vehicles.
• [GPS tracker provider / SIM provider]: vehicle position data.
• [Database hosting provider, region]: our database.

Some providers process data outside the EU or Thailand (for example in the USA). Where this happens we rely on adequacy decisions, the EU-US Data Privacy Framework or standard contractual clauses, and on the corresponding safeguards under the PDPA. [Lawyer: confirm per provider.]

We also share booking details with the vehicle owner and the Hive that handle your rental, and with authorities where the law requires it. We never sell your data.

How long we keep data

• Account data: while your account exists. When you delete it, we delete or anonymise it at once (see below).
• ID and driving documents: while your account exists, deleted with it. You can remove a document from your profile at any time.
• Bookings, orders, payments, invoices and accounting records: 10 years (Germany: §147 AO, §257 HGB) or 5 years (Thailand: Revenue Code, Accounting Act), whichever applies. After deletion of your account they are kept with your name replaced by "Deleted user"; invoices already issued can't be changed by law.
• Inspection photos, unlock records and emergency cases: with the booking they belong to, as evidence for damage, deposit and safety questions.
• Vehicle GPS data: raw positions and device events are deleted automatically after [180] days; trips and alerts are kept with the booking.
• Chat messages and community profile: until you delete them or your account. When you delete your account, your messages are replaced by "message deleted".
• Push tokens: until you sign out, switch notifications off or delete your account.
• Website analytics: [26 months]; after account deletion no longer linked to you.
• Security and audit logs: [3 years].

Your rights

Under the GDPR (EU, Germany) and the Thai PDPA you have the right to:

• get access to your data and a copy of it,
• have wrong data corrected,
• have your data deleted,
• restrict or object to processing, including processing based on our legitimate interest,
• receive your data in a portable format,
• withdraw any consent at any time (for example push notifications or Bee Family location), without affecting earlier processing,
• complain to a supervisory authority: in Germany the data protection authority of your federal state or of our seat [name]; in Thailand the Office of the Personal Data Protection Committee (PDPC).

To use your rights, write to [privacy contact email]. We answer within one month (GDPR) or 30 days (PDPA).

Delete your account

You can delete your account yourself at any time: in the app under Settings → Delete account, or on the website at Delete account. We delete your profile, documents, photos you uploaded to your profile, push tokens, favourites, community profile and messages, and delete your sign-in account. Records we must keep by law (bookings, orders, payments, invoices) stay, with your name removed. While a rental, order, emergency case or payout is still open, we ask you to finish it first.

Security

All connections use HTTPS. Documents are stored privately and only shown to you and authorised staff. Access by staff is limited by role and logged.

Children

Our services are for people aged 18 and over. Renting needs a valid driving licence.

Changes

We update this policy when our services change. The date at the top shows the latest version.