Legal
Data Protection Notice
Definitions
“Data Controller" means the natural or legal person, organization, public authority, agency, or any other body which alone or jointly with others determines the purposes and means of the processing of personal data.
“Data Incident” means any or all the following: (i) accidental or unlawful destruction of Personal Data; (ii) accidental loss, alteration, unauthorized disclosure collection, use, copying, modification, disposal, or access of Personal Data or similar risks, in particular where the Processing involves transmission of Personal Data over a network; and (iii) all other unlawful forms of Processing.
“Data Subject” means an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his physical, physiological, genetic, mental, economic, cultural or social identity, or any natural person to which Personal Data relates under applicable data protection laws.
“Personal Information” or “Personal Data” means the personally identifiable information or personal data or any other information regulated as personal data or personal information under the applicable data protection laws relating to a Data Subject and Processed by Project 3 Mobility, Buzinski krči 3b, 10010 Buzin, Zagreb, Croatia (further on: “P3M”) and/or its processors for the purposes described in this Notice.
“Process/Processing” means any operation or set of operations which is performed upon Personal Data, whether by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, blocking, erasure or destruction.
“Standard Contractual Clauses” mean the standard contractual clauses adopted by the European Commission for transfers of Personal Data to third countries (including controller-to-processor and/or controller-to-controller transfers), as amended, replaced or superseded.
Data Controllers
Processing of Personal Data in connection with vehicle operations, including test drives, validation activities, and operations on public roads, is conducted by P3M acting as the Data Controller.
For the processing of Personal Data related to the registration of interest via the waiting list on the website www.letsverne.com, including name, surname, email address, and any additional information voluntarily provided by the Data Subject, and for the processing related to the active use of the Robotaxi Service via the mobile application (registration, ordering rides, payment), P3M acts as the sole Data Controller for such processing.
P3M may also rely on external service providers and technology partners acting as Data Processors on its behalf. Such processors are bound by Data Processing Agreements and required to implement appropriate technical and organizational measures to ensure the protection of Personal Data in accordance with the applicable data protection directives.
Data Collection & Processing
Personal Data may be collected in driving scenarios and via the use of our services, serving distinct purposes.
When vehicles are operated by P3M for testing, validation, or public service operations, Personal Data may be collected using systems or sensors integrated in the vehicle or additional devices such as dash cameras. In these cases, P3M acts as the only Data Controller, relying on external service providers and technology partners acting as Data Processors on its behalf.
Personal Data is collected directly from the Data Subject when they voluntarily register to join the waiting list via the website, subscribe to updates, or participate in surveys regarding the service. The collected Personal Data includes: name, surname, email address, and, where applicable, phone number and responses to voluntary survey questions.
Service Usage (Robotaxi App): When you register and use the Verne mobile application to order rides, we collect:
Identity Data: Name, email address, phone number.
Ride Data: Specific Pick-up and Drop-off locations necessary to execute the service. Note regarding Location Tracking: While we process the real-time GPS location of the vehicle to navigate, we do not store a continuous GPS history of the ride in our user databases. We strictly limit storage to the start and end points required for the service record.
Payment Data: We do not collect or store full credit card details. Payment transactions are processed securely by an authorized external payment service provider. We only retain a payment token and transaction logs necessary to confirm payment status.
Recipients
Authorized personnel of P3M; external service providers acting as processors (e.g. hosting/cloud provider, email delivery/CRM provider, survey tool provider, payment service providers), professional advisors (acting as independent controllers where applicable), and competent public authorities where legally required.
Purposes for Data Processing
Personal Data may be processed for different purposes depending on the nature of driving activity and the systems involved.
Personal Data collected and processed by P3M during vehicle operation, whether for testing, validation, or service activities, may be processed for ensuring safety, regulatory compliance, operational efficiency, fleet monitoring, or incident analysis.
Personal Data collected through the waiting list and surveys is processed for the following purposes:
maintaining a database of individuals who have expressed interest in the service;
notifying Data Subjects about service availability, onboarding opportunities, and service-related updates;
sending marketing and promotional communications only where explicit consent has been provided;
conducting aggregated statistical analysis and market research, without producing legal or similarly significant effects for individuals.
Service Provision (Robotaxi App):
To create and manage your user account;
To dispatch the autonomous vehicle to your location and transport you to your destination;
To process payments for the services rendered;
To provide customer support.
P3M may process Personal Data to ensure the safety, security and efficiency operation of automated driving services and may rely on authorized Data Processors for supporting these technical and operational functions under strict contractual safeguards.
Legal Basis for Processing
Vehicle operations:
Processing is based on Article 6(1)(f) GDPR (legitimate interest), namely (but not exclusively) ensuring safety, regulatory compliance, and operational integrity of automated driving systems. P3M has conducted a legitimate interest assessment confirming that such processing does not override the rights and freedoms of data subjects.
Service Provision (Robotaxi App):
Processing of Identity and Ride Data is based on Article 6(1)(b) GDPR (Performance of a Contract), as this data is strictly necessary to fulfill the Terms of Use and provide the requested transportation service.
Processing of Payment Data for invoicing and tax records is based on Article 6(1)(c) GDPR (Legal Obligation) to comply with applicable accounting and financial laws.
Waiting list registration:
Processing is based on Article 6(1)(a) GDPR (consent). Consent for waiting list processing is provided by ticking the relevant consent checkbox. Acceptance of the Terms of Service constitutes a contractual agreement and is not a consent under GDPR. Consent for marketing communications, where applicable, is provided separately:
Waiting list consent (Art. 6 (1)(a)) - I consent to the processing of my personal data for the purpose of registering my interest (waiting list), as described in the Data Protection Notice
Contractual acceptance (non-GDPR) - I accept the Terms of Service
Marketing consent (GDPR – Art. 6(1)(a)) - I agree to receive marketing communications
Surveys:
Processing is based on Article 6(1)(a) GDPR (consent), provided by voluntarily completing the survey (and, where applicable, ticking a separate consent box).
Marketing communications:
Processing is based on explicit consent, which may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.
For avoidance of doubt registration on the waiting list does not automatically imply consent to receive marketing communications unless explicitly indicated by the Data Subject.
Data Categories & Data Subjects
Data creation includes raw footage captured by vehicle’s external cameras, which may incidentally capture images of individuals (e.g. faces), without biometric identification or biometric processing. Examples of Personal Data are human faces, and license plate numbers.
Data Subjects may include individuals incidentally captured by the vehicle's external cameras, pedestrians, and other road users using public roads.
Individuals may also incidentally include employees of P3M and/or partner companies.
Data shall not contain special categories of data or sensitive Personal Data. If such Data is inadvertently collected, the processing of such Data shall be limited to the extent strictly necessary for specific purposes outlined in this Notice. If not strictly necessary for the purposes outlined in this Notice, such Data shall be anonymized or deleted. No special categories of data are requested for the waiting list and surveys.
For the waiting list and survey activities, Personal Data collected includes contact information (such as names, email addresses, and phone numbers) and survey responses which may include demographic information (age group, country, city, neighborhood) and technical data (phone type).
We do not knowingly collect or process Personal Data from children. The waiting list and related services are intended for individuals who have reached the age of majority. Specific terms and parental consent mechanisms will apply where robotaxi services are made available to minors.
For the Service Usage (App), Data Subjects are registered users. Categories include Identity Data (Contact details) and Transaction Data. We do not process Special Categories of Personal Data (e.g. health, religion) via the App.
Data Storage
Data is stored securely at different locations depending on processing purposes:
P3M Data Storage repositories, located within the European Union, implementing comprehensive technical and organizational measures to safeguard Personal Data.
In certain cases, authorized data processors may process Personal Data on behalf of P3M, strictly under contractual terms ensuring equivalent protection standards, including encryption, access control, and full compliance with GDPR.
Any transfer or storage of Personal Data outside the European Union is subject to appropriate safeguards, such as Standard Contractual Clauses or equivalent legal mechanisms.
Personal Data collected for the waiting list and surveys is retained for a period of 24 months from the date of collection unless the Data Subject withdraws consent earlier or becomes an active customer, in which case the data will be transferred to the customer account (on the basis of customer-service provided relationship) and retained in accordance with applicable contractual and statutory retention obligations (e.g. accounting/tax), after which it will be deleted or anonymized. Upon onboarding, further processing will be based on the performance of a contract and/or compliance with legal obligations, as applicable.Aggregated/anonymous survey results may be retained longer as they no longer constitute personal data. Raw vehicle footage is retained only for a limited period unless required for incident investigation, legal claims, or regulatory compliance, after which it is deleted or anonymized.
Retention Periods for App Users:
Active Accounts: Data is retained for the duration of the service relationship.
Account Deactivation: If you choose to "Deactivate" your account via the App, your personal data is retained for a grace period of 3 months to allow for account recovery, after which it is automatically deleted.
Account Deletion: If you choose to "Delete" your account via the App, your personal data is erased immediately.
Ride Data: Upon the deletion of your account (or expiration of the grace period), your ride history is anonymized.
Financial Records: Invoices and payment transaction records are retained for the period prescribed by the applicable Accounting Act and Payment Services laws (typically 11 years in Croatia).
Protection of Data
Data is protected by applying adequate Technical and Organizational Measures, ensuring data confidentiality, integrity, and availability throughout the data lifecycle. These measures include encryption, access controls, regular security assessments, and staff training.
Transfer of Data outside EU
Transfer of personal data outside the EU will be conducted in compliance with GDPR requirements, including the use of appropriate safeguards such as Standard Contractual Clauses or ensuring the receiving country has an adequate level of data protection.
Where Personal Data is transferred to processors located outside the European Economic Area, such transfers are safeguarded by the EU Standard Contractual Clauses and additional technical and organizationalmeasures, ensuring an adequate level of protection for Data Subjects.
Waiting list data is stored and processed within the EEA. Where any access from outside the EEA occurs (e.g. by a service provider’s support teams), such access will be subject to appropriate safeguards, including SCCs where applicable, and additional technical and organizational measures (e.g. encryption, access controls).
Data subjects rights
Vehicle operations
Please note that these rights are necessarily limited due to the fact that P3M does not collate nor index Personal Data (there is no mechanism allowing, for example, a search through the clips database for a frame or frames containing any particular vehicle or individual). As a result, it is highly unlikely that P3M would be able to identify a particular individual within its clips database unless that individual could provide additionalinformation, such as the location and time at which he/she believes the relevant video clip or clips were collected. Nonetheless, P3M will review and respond to any requests on a case-by-case basis. In the unusual casewhere an individual registers an objection with the driver of a P3M-operated test vehicle in real or close-to-real time, drivers are instructed to make a record of such objections and to relay them for review. In such exceptional case, by contrast to the above, it would usually be possible to identify and delete the relevant video clip or clips.
As outlined in the General Data Protection Regulation (GDPR), Data Subjects have various rights concerning the processing of their Personal Data. These rights empower individuals to maintain control over their Personal Information and ensure that it is handled fairly and lawfully.
Below are the rights afforded to Data Subjects:
The Right to be Informed: Data Subjects have the right to be informed about the collection and use of their Personal Data. This includes the purposes for processing, the categories of Personal Data involved, and the recipients of the data.
The Right of Access: Data Subjects have the right to obtain confirmation from the Data Controller as to whether Personal Data concerning them is being processed, and, if so, to access that data and obtain additionalinformation about its processing.
The Right to Rectification: Data Subjects have the right to request the correction of inaccurate or incomplete Personal Data concerning them. This ensures that Personal Data held by the Data Controller is accurateand up to date.
The Right to Erasure (Right to be Forgotten): Under certain circumstances, Data Subjects have the right to request the erasure of their Personal Data. This right applies when the Personal Data is no longer necessary for the purposes for which it was collected, or when the Data Subject withdraws consent and there are no overriding legitimate grounds for processing.
The Right to Restrict Processing: Data Subjects have the right to request the restriction of processing of their Personal Data under certain circumstances. This right may be exercised when the accuracy of the Personal Data is contested, or when the processing is unlawful, but the Data Subject opposes erasure.
The Right to Data Portability: Data Subjects have the right to receive a copy of their Personal Data in a structured, commonly used, and machine-readable format. This right applies when Personal Data is processed based on consent or for the performance of a contract, and the processing is carried out by automated means.
The Right to Object: Data Subjects have the right to object to the processing of their Personal Data in certain situations. This includes processing based on legitimate interests or for direct marketing purposes. Upon objection, the Data Controller must cease processing the Personal Data unless compelling legitimate grounds for the processing override the interests, rights, and freedoms of the Data Subject.
Rights in Relation to Automated Decision-Making and Profiling: Data Subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Exceptions apply if the decision is necessary for entering into or performance of a contract, authorized by law, or based on the data subject's explicit consent. For the avoidance of doubt, automated processing used to dispatch autonomous vehicles, optimize routes, or match ride requests does not produce legal or similarly significant effects (within meaning of art. 22 of the GDPR) for Data Subjects beyond what is strictly necessary for the performance of the transportation contract, and does not involve automated decision-making producing effects independent of the user’s request for service.
Data Subjects can exercise these rights by contacting the Data Controller using the contact information provided in this Data Protection Notice. The Data Controller will respond to requests within the timelines prescribed by the GDPR and will take appropriate measures to address the Data Subject's concerns.
Data Subjects also have the right to lodge a complaint with a supervisory authority if they believe that their rights under the GDPR have been infringed. In Croatia, the competent supervisory authority is the Croatian Personal Data Protection Agency (AZOP), Zagreb, Ulica Metela Ožegovića 16, email: azop@azop.hr.
b. App Users (Robotaxi Service)
Users can exercise their rights directly via the Verne App settings. This includes:
Right to Access and Portability: You can view your ride history and export your profile data.
Right to Erasure: You can trigger immediate deletion of your data using the "Delete Account" function.
Right to Rectification: You can update your profile details directly in the App. For other inquiries, you may contact the DPO using the details below.
c. Waiting list and online registration
For Personal Data collected via the waiting list, P3M enables full exercise of Data Subject rights, including access, rectification, erasure, restriction, portability, and withdrawal of consent, via the contact details provided below or unsubscribe mechanisms included in communications. Requests will be handled within one month (extendable) pursuant to GDPR. Withdrawal of consent may be exercised by an email directed to DPO and/or via unsubscribe link (where applicable).
Vehicle Identification
Clip-collecting test vehicles are marked with a special sticker informing about data collecting activities and providing information about data control.
Contact Information
If you have any questions about this Data Protection Notice or wish to exercise any of your data protection rights, please contact us.
P3M Data Protection Officer can be contacted at:
Project 3 Mobility d.o.o.
Buzinski krči 3b, 10010 Buzin, Zagreb, Croatia
Data Protection Officer (DPO): dpo@p3m.com
Updates to this Notice
We may update this Data Protection Notice periodically to reflect changes in our data collection activities or legal requirements. We encourage you to review this Notice regularly for any updates. Thank you for trusting P3M as we advance autonomous driving technology while protecting your privacy and data rights.
Future updates may also reflect changes in the list of processors engaged by P3M, while the overall responsibilities of P3M as Data Controller remain unchanged.
Effective Date
3rd of February 2026
Verne ®2026