Your rights
What the law lets you ask for.
You don't need a lawyer to use these rights. You need to ask in writing, ask for the right things, and keep the dates.
A person must look at it (GDPR Article 22)
When a decision about you is taken by an automated system and it affects you significantly, like losing your income, you have the right to have a person review it, to give your side and to contest it. Apps often say a person was involved. Asking puts that on record.
Your data and the logic behind it (GDPR Article 15)
You can ask for a copy of all the data the app holds about you: trips, ratings, complaints, flags, notes, risk scores. You can also ask for meaningful information about the logic of an automated decision and what it means for you (Article 15(1)(h)).
One month to answer (GDPR Article 12(3))
The app must answer within one month. For a complex request it can take two more months, but it must tell you so within the first month.
A complaint if they ignore you (GDPR Article 77)
If the app doesn't answer, or answers without the data, you can complain to the data protection authority where you live or work. It's free.
New: the EU rules for platform work
The Platform Work Directive (EU) 2024/2831 says apps must give you the reasons for closing or suspending your account in writing, and answer a review request within two weeks (Article 11). Each EU country must put it into its own law by 2 December 2026. Your letters cite it only where that law is in force. Until then, the GDPR rights above do the work.
Data protection authorities
| Country | Authority | Website |
|---|---|---|
| Finland | Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) | tietosuoja.fi |
| Sweden | Swedish Authority for Privacy Protection (IMY) | imy.se |
| Denmark | Danish Data Protection Agency (Datatilsynet) | datatilsynet.dk |
| Norway | Norwegian Data Protection Authority (Datatilsynet) | datatilsynet.no |
| Iceland | Icelandic Data Protection Authority (Persónuvernd) | personuvernd.is |
| Liechtenstein | Data Protection Authority of Liechtenstein (Datenschutzstelle) | datenschutzstelle.li |
| Estonia | Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) | aki.ee |
| Latvia | Data State Inspectorate of Latvia (Datu valsts inspekcija) | dvi.gov.lv |
| Lithuania | State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija) | vdai.lrv.lt |
| Poland | Polish Personal Data Protection Office (UODO) | uodo.gov.pl |
| Germany | Data protection authority of your federal state | |
| Netherlands | Dutch Data Protection Authority (Autoriteit Persoonsgegevens) | autoriteitpersoonsgegevens.nl |
| Belgium | Belgian Data Protection Authority | dataprotectionauthority.be |
| France | CNIL | cnil.fr |
| Spain | Spanish Data Protection Agency (AEPD) | aepd.es |
| Italy | Italian Data Protection Authority (Garante per la protezione dei dati personali) | garanteprivacy.it |
| Ireland | Data Protection Commission | dataprotection.ie |
| Czechia | Czech Office for Personal Data Protection (ÚOOÚ) | uoou.gov.cz |
| Greece | Hellenic Data Protection Authority | dpa.gr |
Letter 4 in your pack is filled in for the authority where you live (or where you work, if you live outside the EEA). This page is general information, not legal advice.
Locked out? Ask for a human.
Tell us what happened. If we can help, your letters arrive by email, filled in and ready to send.