Privacy Policy
Last updated: 2 November 2026
For customers, towing companies, drivers and website visitors.
1. Who we are and who this policy covers
Towzi operates a digital platform that connects customers requesting roadside assistance with independent towing service providers. Towzi facilitates service requests, communication, tracking and payments but does not itself perform towing services.
Towzi OÜ (registry code 17585950), Lasketiiru tee 10, Muuga küla, Viimsi vald, 74004 Harju maakond, Estonia (“Towzi”, “we”), is the controller for processing the data described in this policy.
This policy covers towzi.eu, the Towzi application, customers requesting roadside assistance, towing-service companies (“towing-service providers” or “providers”), their contact persons and drivers. Towzi operates the Towzi application and website as an information society service provider within the meaning of the Estonian Information Society Services Act.
Through the platform, customers can request roadside assistance from independent towing service providers. Towzi provides the digital infrastructure for submitting and communicating requests, identifying suitable available providers, tracking accepted jobs and facilitating payments through Stripe.
The towing and roadside assistance services themselves are performed by independent towing service providers. Each provider is responsible for organising and performing its services, including managing its drivers, assigning work, determining working schedules and managing driver availability.
Towzi may use automated matching to identify suitable providers and send service offers, but the decision to accept a request and the organisation of the physical service remain with the independent provider and its drivers. Providers may also independently control information they use for their own employment, statutory, dispatch or business purposes; they must provide their own notices where required. Stripe and certain technology partners may be independent controllers for their own regulated or technical purposes, as explained in their notices.
Contact us at info@towzi.eu.
2. Information we collect
We collect the personal data necessary to operate the Towzi platform, connect customers requesting roadside assistance with independent towing service providers, facilitate communication and coordination between them, and enable payments.
Towzi does not itself provide towing or roadside assistance services. Each towing service provider independently manages its drivers, including driver assignments, working schedules, availability and the organisation and performance of towing services.
Customers requesting roadside help
| Data collected | Purpose | GDPR legal basis |
|---|---|---|
| Name, email, phone, optional profile photo | Account, communication and service coordination | Art. 6(1)(b); optional photo: Art. 6(1)(a) where consent is relied on |
| Vehicle details, request text describing the reason for assistance, customer-confirmed pickup location, GPS-recorded drop-off location and customer job photo | Identify suitable providers; coordinate and fulfil requests; calculate the distance travelled for billing | Art. 6(1)(b) |
| Name, email addresses, job records, limited Stripe payment references, invoices | Facilitate payments through Stripe, including sharing name, email address and relevant transaction information; process charges and refunds; reconcile and document services | Art. 6(1)(b); accounting/tax records: Art. 6(1)(c) |
| Discount and invite codes used, linked to the user account that used them | Apply discounts and administer the discount and invite programme; maintain internal records of code usage | Art. 6(1)(b) where necessary to provide the requested discount or programme benefit; Art. 6(1)(f) for internal programme administration |
| Reviews, complaints and supporting evidence | Service quality, safety and dispute handling | Art. 6(1)(f) |
Towing-service companies and their representatives
| Data collected | Purpose | GDPR legal basis |
|---|---|---|
| Company details, registration/VAT number, representative name and contact details | Provider onboarding, contact and verification | Representative data: Art. 6(1)(f); statutory checks: Art. 6(1)(c) where applicable |
| Business certificate, the representative’s driver’s licence, operating-licence number if given, and optional truck photos | Verify provider eligibility and operational suitability | Art. 6(1)(f); Art. 6(1)(c) only where a specific duty applies |
| Service areas, truck types, availability, ratings and job history | Match suitable providers and manage platform quality | Art. 6(1)(f) |
| Payout, commission, transaction and tax records | Settle services and comply with accounting/tax duties | Art. 6(1)(f); Art. 6(1)(c) for required records |
Individual drivers working for towing companies
| Data collected | Purpose | GDPR legal basis |
|---|---|---|
| Name, email, phone, optional photo, assigned company, truck and licence plate, and account status | Company-managed access and job coordination | Art. 6(1)(f); optional photo: Art. 6(1)(a) where consent is relied on |
| Current position, online status and live job location | Nearby dispatch and customer tracking during accepted jobs | Art. 6(1)(f), subject to necessity and balancing |
| Job offers, acceptance/declines, distance, job photos and notes | Fulfilment, fair billing, evidence and quality control | Art. 6(1)(f); Art. 6(1)(c) for required financial records |
3. Location, routes and visibility
Customers confirm their pickup location; drivers share their location for matching and tracking. Towzi retains limited location and route data for operational, billing and dispute purposes.
Before submitting a roadside assistance request, the app uses the customer’s location to display the number of nearby providers in the area. We retain the customer-confirmed pickup location but do not track the customer’s location after submission.
Provider and driver locations are recorded when the app is opened, when they go online and when they return to the app. During an accepted job, location updates are transmitted approximately every five seconds, including in the background where permitted. Customers can view the assigned provider’s live location, and company owners can view those of their drivers who are online. Each update replaces the previous location. The last recorded position stays stored until it is replaced, is hidden from operational maps when the driver goes offline, and is deleted after 24 months with no update.
During a job, location data is temporarily processed to calculate the distance travelled. Raw route points are discarded upon completion of the job, while a simplified route is retained for 24 months for dispute resolution, if applicable. Pickup and drop-off coordinates, job completion location and chargeable distance are retained for seven years in accordance with Estonian accounting requirements. Users may disable location permissions, although doing so may limit dispatch and tracking functionality.
4. Photos, documents and sensitive information
Vehicle photos help verify the job. Identity documents receive restricted access.
Customers submit a vehicle photo when requesting service, and drivers capture arrival and completion photos, potentially including number plates and surroundings. These are taken with the app’s camera and cannot be selected from the phone gallery. Customers may attach photos from their own device to complaint reports. The customer can see the arrival and completion photos of their own paid job; authorised Towzi staff can review job evidence for every job. Driver’s licence uploads are restricted to the uploading account and authorised administrators, not other customers or providers, and are deleted when verification ends.
Avoid photographing people, unrelated vehicles, documents or sensitive information unless necessary. Do not include medical or other special-category data in descriptions or photos. If such information is incidentally received, we limit access and remove it when no longer necessary.
5. Purposes and GDPR legal bases
We use information to deliver jobs, protect the platform, comply with the law and respond to you. We do not sell your profile data.
The role-specific tables in Section 2 explain our principal purposes and legal bases for processing your data. In addition, we use necessary data for fraud prevention, safety, disputes and service improvement under legitimate interests (Art. 6(1)(f)); to meet accounting, tax and lawful disclosure duties under legal obligation (Art. 6(1)(c)); and for optional marketing or non-essential technologies where valid consent is required (Art. 6(1)(a)). Device location permissions enable the app to access location data but do not, by themselves, constitute consent under the GDPR. We process personal data only where a valid legal basis applies, including contractual necessity, legal obligations or legitimate interests, as appropriate. Where we rely on legitimate interests, we assess these against individuals’ rights and freedoms. Information required to provide the service is mandatory, while optional features, such as profile photographs and marketing communications, are voluntary.
6. Matching, provider choice and automated decisions
The app suggests suitable nearby providers; the individual driver decides whether to accept.
Matching considers location and proximity, declared service and truck capability, service area, availability and whether the company is approved. The system determines which eligible drivers receive an offer; drivers may accept, decline or not respond. Offer and completion patterns, ratings and suspensions may be reviewed for quality and abuse prevention.
If automated scoring, suspensions, access restrictions or pricing with such effects are introduced, we will assess Article 22, provide the required explanation and safeguards, and update this notice. Contact us to challenge an account-related decision and request human consideration at info@towzi.eu.
7. Who sees or receives information
Only parties involved in a job and necessary service partners or competent authorities receive relevant data.
Before acceptance, eligible towing-service providers see the service type selected, pickup address, distance, estimated time of arrival and job description. The selected provider company and driver receive customer name, phone and pickup details; a customer sees provider or company details, and the assigned truck’s live location. The provider company may retain access to its job history.
If you leave written feedback after a completed job, we share your comment with the towing-service provider that performed the service to help maintain and improve service quality. Feedback is shared separately from receipts and billing records, and your individual star rating is not disclosed to the provider. We remove unnecessary personal details before sharing comments, although the provider may still recognise the job or customer from the content. Complaints and supporting evidence are handled separately and shared only where necessary to investigate and resolve the matter.
Towzi uses these service partners: Supabase (EU-hosted database, authentication and storage), Stripe and Stripe Connect (payments, see Section 8), Google (Maps, routing and address lookup; Firebase Cloud Messaging for push notifications; Google Play for delivering the app and its updates), Apple (push notifications on iPhones; the App Store and TestFlight for delivering the app), Zone Media (website and email hosting) and Umami Software (visit counts for the towzi.eu website). Service partners process data under appropriate agreements where acting as processors; some also act as independent controllers.
We may disclose necessary records to advisers where applicable, and to competent authorities where legally required. We do not sell personal data or share it for third-party advertising.
8. Payments
Stripe handles full card details; Towzi stores only limited payment references and job records.
Payment card details are entered through Stripe’s payment platform as part of the payment process in the Towzi app. Towzi shares your name, email address and relevant transaction information with Stripe to facilitate payment processing. Towzi does not receive or store complete card numbers or card security codes. Towzi can access limited payment information, including the card brand, expiry date, the last four digits of a card number and a Stripe-generated card fingerprint. This fingerprint helps Towzi recognise the same card across payment records and locate associated customer and transaction records within Stripe’s interface. Stripe may independently process identity, financial and device data for payment compliance and fraud prevention.
9. Website, devices and communications
We use limited cookies and analytics to operate and improve our website, and contact you about your account and services.
The sign-up form on towzi.eu sends what you enter (your email address, the county or city you pick and, for a business, the company name, phone number and truck type) to our mailbox at info@towzi.eu. It is not stored in a database. We use it only to reply to you about Towzi.
To stop abuse of the form, the server keeps a one-way code made from the sender’s network address. It is removed the next time the form is used once 1 hour has passed. The address itself is never stored.
The site sets one cookie, towzi_lang, which remembers the language you picked. It has no advertising.
To count visits, the site uses Umami, a visitor statistics service. Each page you open sends Umami the address of that page, the address of the page that linked you to it, your screen size and your browser’s language. From the request Umami also works out your browser, operating system, type of device and country. Umami sets no cookie. It uses your network address to work out the country and to tell one visit from another, and does not keep it. Nothing is sent if your browser is set to send Do Not Track.
If you allow push notifications, we store a device token that lets us send you job updates. It is replaced when you sign in on another device and removed when it stops working. The app keeps your session, language and theme on your phone, and during a job the job’s number and pickup location.
Towzi’s own code does not collect your device model, operating system version or advertising ID, and we run no analytics or crash-reporting tools of our own. Three parts of the app made by other companies send technical data from your device directly to those companies: Google Maps (device model, operating system version, an identifier for the map, crash reports from the map, and how the map is moved), Firebase Cloud Messaging (an installation identifier, device model and operating system version) and Stripe (a device identifier, device model and how the payment screen is used, for fraud prevention and your bank’s 3D Secure check). Google and Stripe also use this data to maintain and improve their own services.
We use email and push notifications for service updates and account-related communications. Marketing communications are sent only where permitted by applicable law.
10. International transfers and security
Core hosting is in Europe, but some vendors may access information from outside the EEA.
Our database and file storage are hosted in the EU (Frankfurt, Germany) by Supabase. The website and our email are hosted in Estonia by Zone Media. Visit counts for the website are held by Umami, on servers in the EU and the United States.
Where personal data is transferred outside the European Economic Area (EEA), we apply appropriate safeguards in accordance with the GDPR, including adequacy decisions or Standard Contractual Clauses, where applicable. You may contact us for further information about these safeguards.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse and disclosure.
11. Retention and deletion
We set different deletion periods for different records; closing an account does not erase mandatory accounting data.
Data collection and retention at a glance:
| Category | Collected? | Retention |
|---|---|---|
| Account and driver/company profiles | Yes | While active; deleted or anonymised within 60 days of approved account deletion, unless legally required |
| Current driver position | Yes | Hidden from operational maps when the driver goes offline; deleted after 24 months with no update |
| Customer pickup/drop-off and billable distance | Yes | 7 years from the end of the relevant financial year where part of legally required accounting records |
| Simplified job route | Yes | 24 months after completion; or the same period after dispute closure, if applicable |
| Arrival/completion job photos | Yes | 60 days after completion; or 60 days after dispute closure, if applicable |
| Customer request photos and photos from cancelled jobs | Yes | 60 days after job completion or cancellation |
| Complaints and support cases, with their photos | Yes | 180 days after the case closes, unless a longer legal hold is necessary |
| Transaction, invoices and payouts | Yes | 7 years from the end of the relevant financial year. Estonian accounting law applies |
| Discount and invite code usage linked to user accounts | Yes | Retained until 12 months after the code is used, then deleted or anonymised, unless needed longer to resolve an ongoing dispute or meet a legal obligation. Discount details forming part of required accounting records follow the retention period for those records |
| Declined or unanswered job offers | Yes | 30 days |
| Accepted offers on jobs that were later cancelled | Yes | 60 days |
| Written reviews | Yes | 12 months |
| Star ratings | Yes | Kept without their comments, because they make up a company’s average |
| Verification and driver’s licence files | Yes | Deleted when verification ends, unless we are legally required to keep them longer |
| Saved card full number and security code | No, held by Stripe | Not stored by Towzi |
| Website language cookie | Yes | Until the cookie expires or you clear it |
| Website form abuse code | Yes | Approximately 1 hour, cleared on the next submission |
| Website sign-ups and enquiries | Yes | 12 months |
| Push tokens | Yes | Until invalid or replaced |
| Alert logs | Yes | 60 days |
12. Your GDPR rights and choices
You can request access, correction, deletion and other controls, subject to legal exceptions.
You may request access, rectification, erasure, restriction, portability (where applicable), or object to processing based on legitimate interests, including profiling. You may withdraw consent at any time without affecting earlier lawful processing. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local EEA supervisory authority.
Email info@towzi.eu or use Delete account in the app or https://towzi.eu/delete-account/. We may verify your identity proportionately and normally respond within one month, extendable by two further months for complex requests with notice. A provider company can remove its drivers in the app; drivers may also contact Towzi directly for requests regarding their data. Uninstalling the app does not close an account.
13. Minors and changes to this Privacy Policy
Towzi is for adults; important policy changes will be explained and notified.
The service is intended for people aged 18 or older. If we discover an underage account, we will take appropriate steps to restrict it and remove data where required. We will update the revision date when this notice changes and provide appropriate advance notice of material changes through the app, website or email.
14. Contact
Write to our privacy contact for any question or request.
Towzi OÜ, Lasketiiru tee 10, Muuga küla, Viimsi vald, 74004 Harju maakond, Estonia. Email: info@towzi.eu.