Legal
Data Protection Notice
Definitions
“Data Controller" means the natural or legal person, organization, public authority, agency, or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
“Data Incident” means any or all the following: (i) accidental or unlawful destruction of Personal Data; (ii) accidental loss, alteration, unauthorized disclosure collection, use, copying, modification, disposal, or access of Personal Data or similar risks, in particular where the Processing involves transmission of Personal Data over a network; and (iii) all other unlawful forms of Processing.
“Data Subject” means an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his physical, physiological, genetic, mental, economic, cultural or social identity, or any natural person to which Personal Data relates under applicable data protection laws.
“Personal Information” or “Personal Data” means the personally identifiable information or personal data or any other information regulated as personal data or personal information under the applicable data protection laws relating to a Data Subject and Processed by Project 3 Mobility, Buzinski krči 3b, 10010 Buzin, Zagreb, Croatia (further on: “P3M”) and/or its processors for the purposes described in this Notice.
“Process/Processing” means any operation or set of operations which is performed upon Personal Data, whether by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, blocking, erasure or destruction.
“Standard Contractual Clauses” mean the standard contractual clauses adopted by the European Commission for transfers of Personal Data to third countries (including controller-to-processor and/or controller-to-controller transfers), as amended, replaced or superseded.
Data Controllers
Processing of Personal Data in connection with vehicle operations, including test drives, validation activities, and operations on public roads through Verne Robotaxi App, is conducted by P3M acting as the Data Controller.
Uber app ride using the Verne autonomous vehicle: When you request or take aa ride through the Uber app using the Verne autonomous vehicle, P3M and Uber Technologies, Inc. a Delaware corporation, with its principal place of business at 1725 3rd Street, San Francisco, California 94158 (“UTI”) and Uber B.V., a private limited liability company established in The Netherlands, having its offices at Burgerweeshuispad 301, 1076HR, Amsterdam, Netherlands registered at the Amsterdam Chamber of Commerce under number 56317441 (both jointly referred to as: “Uber”), act as Joint Controllers in relation to certain processing activities specifically described under “Data Collection & Processing” below. This Joint Controller Agreement between P3 and Uber details service performance when you use Verne’s autonomous vehicle for an Uber ride, setting respective roles and responsibilities regarding the data we share and the right of the data subject to exercise his/her rights against each of the parties.
Uber separately acts as a Data Controller for Personal Data processed through the Uber Platform for its own purposes, in accordance with Uber’s applicable Privacy Notice.
P3M also acts as an independent Data Controller for certain Personal Data collected through the vehicle and subsequently processed within P3M’s autonomous-driving infrastructure for P3M’s autonomous navigation and self-driving purposes, as further described below.
For the processing of Personal Data related to the registration of interest via the waiting list on the website www.letsverne.com, including name, surname, email address, and any additional information voluntarily provided by the Data Subject, and for the processing related to the active use of the Robotaxi Service via the mobile application (registration, ordering rides, payment), P3M acts as the sole Data Controller for such processing.
P3M may also rely on external service providers and technology partners acting as Data Processors on its behalf. Such processors are bound by Data Processing Agreements and required to implement appropriate technical andorganizational measures to ensure the protection of Personal Data in accordance with the applicable data protection directives.
Data Collection & Processing
Personal Data may be collected in driving scenarios and via the use of our services, serving distinct purposes.
When vehicles are operated by P3M for testing, validation, or public service operations, Personal Data may be collected using systems or sensors integrated in the vehicle or additional devices. In these cases, P3M acts as the Independent Data Controller, relying on external service providers and technology partners acting as Data Processors on its behalf.
Personal Data is collected directly from the Data Subject when they voluntarily register to join the waiting list via the website, subscribe to updates, or participate in surveys regarding the service. The collected Personal Data includes: name, surname, email address, and, where applicable, phone number and responses to voluntary survey questions.
Service Usage (Verne Robotaxi App): When you register and use the Verne mobile application to order rides, we collect:
Identity Data: Name, email address, phone number.
Ride Data: Specific Pick-up and Drop-off locations, as well as autonomous vehicle data, necessary to execute the service.
Payment Data: We do not collect or store full credit card details. Payment transactions are processed securely by an authorized external payment service provider. We only retain a payment token and transaction logs necessary to confirm payment status.
Uber app ride using the Verne autonomous vehicle - when you request or take a ride through the Uber app using a Verne autonomous vehicle, P3M and Uber act as Joint Controllers in relation to the following processing activities:
processing of your requested Pick-up and Drop-off locations for the purpose of calculating and providing the requested trip, including determining the best route and estimated time of arrival;
collection and transfer to P3M’s autonomous-driving infrastructure of Personal Data collected through the vehicle’s external sensors during the Uber Trip, including external video recordings and vehicle geolocation data.
Uber separately processes Personal Data collected through the Uber app and Uber Platform for its own purposes as an Independent Data Controller, in accordance with Uber’s applicable Privacy Notice.
Following the collection and transfer of autonomous vehicle data to P3M’s autonomous-driving infrastructure, P3M acts as an Independent Data Controller in relation to the further processing, as described in this Notice.
Recipients
Authorized personnel of P3M; external service providers acting as processors (e.g. hosting/cloud provider, email delivery/CRM provider, survey tool provider, payment service providers), professional advisors (acting as independent controllers where applicable), and competent public authorities where legally required.
For Uber app ride using a Verne autonomous vehicle, certain Personal Data is processed by and exchanged between P3M and Uber for the joint processing activities described under “Data Collection & Processing” above.
Purposes for Data Processing
Personal Data may be processed for autonomous vehicle operation, and provisioning of our services for specific purposes as described below.
Personal data is processed for Verne autonomous vehicle operation in order to:
calculate a trip offer, including determination of the best route and estimated time of arrival based on the requested pick-up and drop-off locations;
dispatch the autonomous vehicle to your (Pick-up) location and transport you to your destination
operate autonomous vehicle and manage fleet operation, vehicle and passenger safety, regulatory compliance, validation, incident investigations, and service improvement.
Personal Data collected through the waiting list and surveys is processed for the following purposes:
maintaining a database of individuals who have expressed interest in the service;
notifying Data Subjects about service availability, onboarding opportunities, and service-related updates;
sending marketing and promotional communications only where explicit consent has been provided;
conducting aggregated statistical analysis and market research, without producing legal or similarly significant effects for individuals.
Service Provision (Verne Robotaxi App):
To create and manage your user account;
To dispatch the autonomous vehicle to your location and transport you to your destination;
To process payments for the services rendered;
To provide customer support.
For Uber app rider service provisioning, personal data is processed jointly with Uber in order to:
calculate a trip offer, including determination of the best route and estimated time of arrival based on the requested pick-up and drop-off locations
dispatch the autonomous vehicle to your (Pick-up) location and transport you to your destination
operate autonomous vehicle and manage fleet operation, vehicle and passenger safety, regulatory compliance, validation, incident investigations, and service improvement
P3M acta as an independent Data Controller in relation to the further processing of Personal Data within P3M’s autonomous-driving infrastructure.
P3M may process Personal Data to ensure the safety, security and efficient operation of automated driving services and may rely on authorized Data Processors for supporting these technical and operational functions under strict contractual safeguards.
Legal Basis for Processing
Vehicle operations:
Processing personal data for autonomous vehicle operation is based on Article 6(1)(b) GDPR (Performance of a Contract), as this data is strictly necessary to fulfill the Terms of Use and provide the requested transportation service.
Processing is based on Article 6(1)(f) GDPR (legitimate interest), to manage autonomous vehicle operations validation, incident investigations, testing, safety,as well as autonomous vehicle operations and service improvement.
Processing of regulatory compliance data is based on Article 6(1)(c) GDPR (Legal Obligation) to comply with applicable road traffic safety laws.
Service Provision (Verne Robotaxi App):
Processing of Identity and Ride Data is based on Article 6(1)(b) GDPR (Performance of a Contract), as this data is strictly necessary to fulfill the Terms of Use and provide the requested transportation service.
Processing Payment Data for invoicing and tax records is based on Article 6(1)(c) GDPR (Legal Obligation) to comply with applicable accounting and financial laws.
Waiting list registration:
Processing is based on Article 6(1)(a) GDPR (consent). Consent for waiting list processing is provided by ticking the relevant consent checkbox. Acceptance of the Terms of Service constitutes a contractual agreement and is not a consent under GDPR. Consent for marketing communications, where applicable, is provided separately:
Waiting list consent (Art. 6 (1)(a)) - I consent to the processing of my personal data for the purpose of registering my interest (waiting list), as described in the Data Protection Notice
Contractual acceptance (non-GDPR) - I accept the Terms of Service
Marketing consent (GDPR – Art. 6(1)(a)) - I agree to receive marketing communications
Surveys:
Processing is based on Article 6(1)(a) GDPR (consent), provided by voluntarily completing the survey (and, where applicable, ticking a separate consent box).
Marketing communications:
Processing is based on explicit consent - Article 6(1)(a) GDPR (consent), which may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.
For avoidance of doubt, registration on the waiting list does not automatically imply consent to receive marketing communications unless explicitly indicated by the Data Subject.
Uber app ride:
Processing of Personal Data necessary to provide the transportation service requested using the Uber app is based on Article 6(1)(b) GDPR (Performance of a Contract).
Data Categories Processed per Purpose
For vehicle operations we process autonomous vehicle data which includesPick-Up and Drop-Off locations, route information, information from external sensors, vehicle positioning, and similar.
For the waiting list and survey activities, Personal Data collected includes contact information (such as names, email addresses, and phone numbers) and survey responses which may include demographic information (age group, country, city, neighborhood) and technical data (phone type).
For the Service Usage (Verne Robotaxi App), Data Subjects are registered users. Categories include Identity Data (Contact details) and Transaction Data. We do not process Special Categories of Personal Data (e.g. health, religion) via the App.
For Uber app rides, Personal Data is processed jointly by P3M and Uber, which includes requested Pick-up and Drop-off locations, route calculation, service provisioning, and autonomous vehicle data.
All services are intended for individuals who have reached the age of majority.
We do not request any special category of personal data, as they are not necessary for any of our service provisioning.
Data Storage
Data is stored securely at different locations depending on processing purposes:
P3M Data Storage repositories, located within the European Economic Area, implementing comprehensive technical and organizational measures to safeguard Personal Data.
In certain cases, authorized data processors may process Personal Data on behalf of P3M, strictly under contractual terms ensuring equivalent protection standards, including encryption, access control, and full compliance with GDPR.
Personal Data collected for the waiting list and surveys is retained for a period of 24 months from the date of collection unless the Data Subject withdraws consent earlier or becomes an active customer, in which case the data will be transferred to the customer account (on the basis of customer-service provided relationship) and retained in accordance with applicable contractual and statutory retention obligations (e.g. accounting/tax), after which it will be deleted or anonymized. Upon onboarding, further processing will be based on the performance of a contract and/or compliance with legal obligations, as applicable. Aggregated/anonymous survey results may be retained longer as they no longer constitute personal data.
Retention Periods for Verne Robotaxi App Users:
Active Accounts: Data is retained for the duration of the service relationship.
Account Deactivation: If you choose to "Deactivate" your account via the App, your personal data is retained for a grace period of 3 months to allow for account recovery, after which it is automatically deleted.
Account Deletion: If you choose to "Delete" your account via the App, your personal data associated with your account is erased or anonymized without undue delay.
Ride Data: Upon the deletion of your account (or expiration of the grace period), your ride history is anonymized.
Financial Records: Invoices and payment transaction records are retained for the period prescribed by the applicable Accounting Act and Payment Services laws (typically 11 years in Croatia).
Data Protection
Data is protected by applying adequate Technical and Organizational Measures, ensuring data confidentiality, integrity, and availability throughout the data lifecycle. These measures include encryption, access controls, regular security assessments, and staff training.
Furthermore, our operations are ISO 27001:2022 certified.
Transfer of Data outside EEA
Transfer of personal data outside the EEA is conducted in compliance with GDPR requirements, including the use of appropriate safeguards such as EU-US Data Privacy Framework, Standard Contractual Clauses or ensuring the receiving country has an adequate level of data protection.
Uber app rider data is shared with Uber due to our Joint Controller Agreement and transferred to USA under EU-US Data Privacy Framework, where applicable, or other appropriate safeguards in accordance with the GDPR.
Data subjects rights
As outlined in the General Data Protection Regulation (GDPR), Data Subjects have various rights concerning the processing of their Personal Data. These rights empower individuals to maintain control over their Personal Information and ensure that it is handled fairly and lawfully.
Below are the rights afforded to Data Subjects:
The Right to be Informed: Data Subjects have the right to be informed about the collection and use of their Personal Data. This includes the purposes for processing, the categories of Personal Data involved, and the recipients of the data.
The Right of Access: Data Subjects have the right to obtain confirmation from the Data Controller as to whether Personal Data concerning them is being processed, and, if so, to access that data and obtain additional information about its processing.
The Right to Rectification: Data Subjects have the right to request the correction of inaccurate or incomplete Personal Data concerning them. This ensures that Personal Data held by the Data Controller is accurate and up to date.
The Right to Erasure (Right to be Forgotten): Under certain circumstances, Data Subjects have the right to request the erasure of their Personal Data. This right applies when the Personal Data is no longer necessary for the purposes for which it was collected, or when the Data Subject withdraws consent and there are no overriding legitimate grounds for processing.
The Right to Restrict Processing: Data Subjects have the right to request the restriction of processing of their Personal Data under certain circumstances. This right may be exercised when the accuracy of the Personal Data is contested, or when the processing is unlawful, but the Data Subject opposes erasure.
The Right to Data Portability: Data Subjects have the right to receive a copy of their Personal Data in a structured, commonly used, and machine-readable format. This right applies when Personal Data is processed based on consent or for the performance of a contract, and the processing is carried out by automated means.
The Right to Object: Data Subjects have the right to object to the processing of their Personal Data in certain situations. This includes processing based on legitimate interests or for direct marketing purposes. Upon objection, the Data Controller must cease processing the Personal Data unless compelling legitimate grounds for the processing override the interests, rights, and freedoms of the Data Subject.
Note - P3M does not carry out Automated Decision-Making, including Profiling, which produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
Additional information:
Verne App Users (Robotaxi Service) can exercise their rights directly via the Verne App settings themselves, which includes:
Right to Access and Portability: You can view your ride history and export your profile data.
Right to Erasure: You can trigger immediate deletion of your data using the "Delete Account" function.
Right to Rectification: You can update your profile details directly in the App. For other inquiries, you may contact the DPO using the details below.
Uber App Riders – Joint Processing
Where P3M and Uber act as Joint Controllers as described in this Notice, you may exercise your rights against either P3M or Uber in accordance withapplicable data protection law.
P3M and Uber Joint Controller Agreement details service performance when you use Verne’s autonomous vehicle for an Uber ride, setting respective roles and responsibilities regarding the data we share and the right of the data subject to exercise his/her rights against each of the parties. Further information regarding the essence of the arrangements between P3M and Uber concerning their respective responsibilities as Joint Controllers is available upon request from P3M’s Data Protection Officer.
Generally:
You can exercise your data subject rights by contacting the P3M DPO via:
· Post: Project 3 Mobility d.o.o. Buzinski krči 3b, 10010 Buzin, Zagreb, Croatia. or
· Email: dpo@p3m.com
We shall respond to requests within the timelines prescribed by the GDPR and will take appropriate measures to address the Data Subject's concerns.
Data Subjects also have the right to lodge a complaint with a supervisory authority if they believe that their rights under the GDPR have been infringed. In Croatia, the competent supervisory authority is the Croatian Personal Data Protection Agency (AZOP), Zagreb, Ulica Metela Ožegovića 16, email: azop@azop.hr.
Vehicle Identification
Clip-collecting vehicles are marked with a special sticker informing about data collecting activities and providing information about data processing.
Contact Information
If you have any questions about this Data Protection Notice or wish to exercise any of your data protection rights, please contact us.
P3M Data Protection Officer can be contacted at:
Project 3 Mobility d.o.o.
Buzinski krči 3b, 10010 Buzin, Zagreb, Croatia
Data Protection Officer (DPO): dpo@p3m.com
Updates to this Notice
We may update this Data Protection Notice periodically to reflect changes in our data collection activities or legal requirements. We encourage you to review this Notice regularly for any updates. Thank you for trusting P3M as we advance autonomous driving technology while protecting your privacy and data rights.
Future updates may also reflect changes in the list of processors engaged by P3M, while the overall responsibilities of P3M as Data Controller remain unchanged.
Effective Date
18th of August 2026
Verne ®2026