Data Retention Policy

Last Updated: 06.08.2024

This Data Retention Policy applies to the Raily service ("Service") operated by Summatus GmbH, a company registered in Germany with company number HRB 237306, and registered office at Frundsbergstraße 58a, Straßlach-Dingharting, 82064, Germany, operating under the brand name Raily, and its affiliated companies and subsidiaries (collectively referred to as "Company", "we", "us", "our").

The Service includes the Raily mobile applications (iOS and Android), smart glasses application, smartwatch application, website (www.raily.app), and all related services collectively provided by the Company under the Raily brand.

Introduction

1.1 PURPOSE OF THE DOCUMENT

This policy establishes the principles, timeframes, and procedures for storing and deleting personal data in the Service across all our platforms. This policy is in accordance with Regulation (EU) 2016/679 (GDPR), UK GDPR, QFC Data Protection Regulations 2021, California Consumer Privacy Act (CCPA), DIFC Data Protection Law 2020, ADGM Data Protection Regulations 2021, Saudi Arabia's Personal Data Protection Law (PDPL), and other applicable data protection laws in regions where the Company operates. This policy aims to ensure compliance with data retention requirements across all jurisdictions where Raily provides services, including but not limited to the European Union, United Kingdom, United States, Qatar, United Arab Emirates, and Saudi Arabia.

1.2 Scope

This policy applies to all personal data processed by the Company, regardless of the platform used, format, and storage location.

1.3 Responsibility

The designated Data Protection Officer (DPO) of the Company is responsible for ensuring compliance with this policy.

2. Data Retention Principles

2.1 Data Minimization

Raily stores only the data necessary for providing services and complying with legal requirements.

2.2 Storage Limitation

Personal data is stored no longer than necessary for the purposes for which it is processed.

2.3 Data Accuracy

Raily takes measures to ensure the accuracy and currency of stored data.

3. Categories of Data and Retention Periods

The following retention periods apply across all Raily platforms unless otherwise specified:

3.1 User Account Data

  • Retention period: Until account deletion by the user or 24 months after last activity.
  • Rationale: Necessary for service provision and user support.
  • Platform-specific notes: For smartwatch and smart glasses versions, only essential account data is stored on the device itself. Full account data is retained in our central servers.

3.2 User Profile Data

  • Retention period: Until account deletion by the user or data modification.
  • Rationale: Necessary for service functionality and personalization.
  • Platform-specific notes: Smart glasses version may store additional visual preference data, which is retained for the same period as other profile data.

3.3 Travel and Booking Data

  • Retention period: 36 months after trip completion.
  • Rationale: Necessary for dispute resolution and travel pattern analysis.
  • Platform-specific notes: Smartwatch version may store limited recent trip data locally, which is synced with central servers and follows the same retention policy.

3.4 Transaction Data

  • Retention period: 7 years.
  • Rationale: Tax legislation requirements.
  • Platform-specific notes: Mobile and web versions may display full transaction history. Smartwatch and smart glasses versions typically only show recent transactions, but full data is retained on our servers.

3.5 Geolocation Data

  • Retention period: 30 days.
  • Rationale: Short-term storage for service functionality.
  • Platform-specific notes: Collection and storage of geolocation data may be more frequent on mobile and smartwatch versions for real-time features. Users can adjust location sharing settings on each platform.

3.6 User Activity Logs

  • Retention period: 12 months.
  • Rationale: Security and service usage analysis.

3.7 Feedback and Support Data

  • Retention period: 24 months after request closure.
  • Rationale: Service quality improvement and dispute resolution.

4. AI-Related Data Retention:

4.1 AI Model Training Data:

  • Retention period: 24 months from last use in training.
  • Rationale: Necessary for continuous improvement of AI models and auditability.

4.2 AI Model Versions:

  • Retention period: 36 months from decommissioning.
  • Rationale: Required for accountability and potential audits.

4.3 User Interaction Logs with AI Systems:

  • Retention period: 12 months.
  • Rationale: Necessary for system improvement and user support.

4.4 AI-Generated Recommendations and Matches:

  • Retention period: 6 months after generation.
  • Rationale: Allows for user feedback and system performance evaluation.

4.5 Vectorized User Data:

  • Retention period: Until account deletion or 24 months after last activity.
  • Rationale: Essential for AI-driven personalization and matchmaking.

All AI-related data is stored in an anonymized or pseudonymized form to protect user privacy.

5. Data Deletion Procedures

5.1 Automatic Deletion

  • System automatically deletes data upon expiration of retention period.
  • Process runs monthly.

5.2 Manual Deletion

  • Upon user request for data deletion.
  • Execution timeframe: within 30 days of request.

5.3 Pseudonymization

  • Data required for analytics undergoes pseudonymization after active use period expiration.

5.4 Secure Deletion

  • Secure deletion methods are used, preventing data recovery.

6. Exceptions to Retention Policy

6.1 Legal Requirements

  • Data may be stored longer than the established period if required by law.

6.2 Scientific and Statistical Purposes

  • Anonymized data may be stored longer for research purposes.

7. Data Subject Rights

Request processing procedure via Data Subject Rights Request Form (PDF)

7.1 Right to Explanation of AI Decisions

- Users have the right to request an explanation of how AI systems have influenced their matches or recommendations.

- We will provide this information in a clear, understandable format within 30 days of the request. Request processing procedure via Data Subject Rights Request Form (PDF).

7.2 Right to Human Review

  • Users can request human review of any AI-made decision that significantly affects them.
  • This review will be conducted by trained staff within 14 days of the request.

7.3 Right to Correct AI-Inferred Data

  • Users can view and correct any data or preferences inferred by our AI systems through their profile settings at any time.
  • Corrections will be immediately reflected in future AI processing.

8. AI Data Security Measures

8.1 Encryption:

 All AI-related data, including training data and model parameters, is encrypted using AES-256 encryption at rest and TLS 1.3 in transit.

8.2 Access Control:

Access to AI systems and related data is strictly limited to authorized personnel and governed by role-based access control (RBAC).

8.3 Audit Trails:

All access to and modifications of AI systems and data are logged and regularly audited.

8.4 Back upand Recovery:

Regular backups of AI models and critical data are performed, with a robust recovery plan in place.

8.5 Anonymization:

Where possible, data used for AI training and inference is anonymized to protect individual privacy.

9. Audit and Control

9.1 Regular Audit

  • Quarterly audit of data retention policy compliance is conducted, including specific checks on AI-related data handling.

9.2 AI System Monitoring

  • Continuous monitoring of AI system performance, including checks for bias and accuracy.
  • Monthly reviews of AI decision patterns to ensure compliance with ethical guidelines.

9.3 Reporting

  • Audit results, including AI system performance and compliance, are provided to management, DPO, and relevant regulatory bodies if required.

9.4 UAE Requirements

  • For data transfers from the UAE (including DIFC and ADGM), Raily implements appropriate safeguards as required by DIFC Data Protection Law 2020 and ADGM Data Protection Regulations 2021.

9.5 Saudi Arabia Requirements 

  • For data transfers from Saudi Arabia, Raily complies with the requirements set forth in the Personal Data Protection Law (PDPL). This includes obtaining necessary approvals from the Saudi Data and Artificial Intelligence Authority (SDAIA) for cross-border transfers, where required.

10. Staff Training

10.1 Training Program

  • All employees working with personal data undergo mandatory training on this policy and data protection requirements in all jurisdictions where Raily operates.

11. International Data Transfers

11.1 Standard Contractual Clauses

  • EU Standard Contractual Clauses are used for data transfers outside the EEA/

11.2 Additional Safeguards

  • Appropriate supplementary measures are implemented for data transfers outside the EEA, UK, or Switzerland/

11.3 QFC Requirements

  • For transfers to countries not recognized as adequate by QFC, Raily implements appropriate safeguards as required by QFC Regulations/

12. Compliance with Specific Regulations

12.1 GDPR and UK GDPR Compliance

  • This policy ensures compliance with GDPR and UK GDPR requirements for data retention/

12.2 QFC Compliance

  • Raily maintains detailed records of processing activities in accordance with QFC Regulations.
  • Raily notifies the QFC Data Protection Office of any serious breaches as required.

12.3 CCPA Compliance

  • This policy addresses CCPA requirements, including consumer rights to data deletion and opt-out of personal information sales.

12.4 UAE Compliance 

  • Raily complies with DIFC Data Protection Law 2020 and ADGM Data Protection Regulations 2021.
  • Raily notifies the relevant UAE authorities of any data breaches in accordance with local laws.

12.5 Saudi Arabia Compliance 

  • Raily adheres to the Saudi Arabia Personal Data Protection Law (PDPL).
  • Raily notifies the Saudi Data and Artificial Intelligence Authority (SDAIA) of any data breaches as mandated by law.

13. Policy Updates

13.1 Regular Review

  • Policy is reviewed annually or upon significant changes in data processing.

13.2 Update Procedure

  • Changes are approved by DPO and company management.

14. Platform-Specific Considerations

14.1 Mobile Applications (iOS and Android)

  • Full functionality and data collection as described in this policy.
  • May collect additional device-specific information for app optimization.

14.2 Smart Glasses Application

  • Focuses on visual data and augmented reality features.
  • May collect additional data about visual preferences and environment interactions.
  • Users can manage visual data collection in the app settings.

14.3 Smartwatch Application

  • Primarily used for quick notifications and basic interactions.
  • May collect additional health and activity data if user opts in.
  • Limited local storage; most data synced with central servers.

14.4 Web Version

  • Full functionality except for device-specific features.
  • May use cookies and similar technologies as described in our Cookie Policy.
  • Users can manage their data and privacy settings across all platforms by accessing their account settings on our website or primary mobile app.

For questions related to this policy, please contact the DPO: dpo@raily.app