Global Privacy Policy

Back to top

1. Data Controller

Elodos is operated by "Omega Om Ltd", a company registered in England and Wales.

1.1 Contact Points

For privacy-related enquiries, complaints, or to exercise your data protection rights:

Back to top

2. Definitions

The following terms have specific meanings throughout this Policy:

Back to top

3. Who We Are and Our Role

Elodos is a technology intermediary platform that facilitates peer-to-peer connections between users. Users may act as a "Lancer" and/or "Amigo" depending on their needs. Elodos does not provide travel services, courier services, logistics services, escort services, employment services, or security services. Elodos does not supervise or control user conduct and is not responsible for user-to-user actions.

Back to top

4. Categories of Personal Data We Collect

We may collect the following categories of Personal Data. Not all categories apply to all users or all jurisdictions:

Back to top

5. Where We Get Data From

We may receive Personal Data from the following sources:

• Directly from you (registration, profile updates, messages, support enquiries)
• Automatically from your device/browser (cookies, SDKs, logs)
• From other users (messages, reports, disputes, reviews)
• From service providers (identity verification, analytics, payment processors)
• From public sources (where lawfully available)
• From authorities (where required by law)

Back to top

6. Purposes of Processing and Legal Basis

We process Personal Data for the following purposes and legal bases:

The description of lawful bases for collecting or using personal information to provide services to you are as follows:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract - we have to collect or use the information so we can enter or carry out a contract with you. All your data protection rights may apply except the right to object.
• Legal obligation - we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • preventing fraud to protect our users and platform integrity enabling travellers to connect with other travellers
  • facilitating parcel coordination between users,
  • verifying user identities to ensure safety on the platform

Back to top

7. Obligation to Provide Data

Some of the personal data we ask you to provide is necessary for us to provide the Elodos Platform to you. Other data is optional and declining to provide it will not affect your ability to access core features. This section explains, for each category of data, whether providing it is mandatory or optional, the basis for that requirement, and what will happen if you choose not to provide it.

7.1 Mandatory Data - Required to Create and Use Your Account

The following data is required to enter into and perform our contract with you (the Platform Terms of Service). If you do not provide this data, we will be unable to create your account and you will not be able to use the Platform.

7.2 Mandatory Data - Required for Specific Roles or Transactions

The following data is required for specific features of the Platform. You may use the Platform without providing this data, but you will be unable to access the relevant feature.

7.3 Mandatory Data - Required by Law

The following data must be collected and retained regardless of your preferences, because we are required to do so by applicable law. Providing this data is a statutory requirement.

7.4 Optional Data - Provided at Your Discretion

The following data is entirely optional. Providing it may enhance your experience or enable additional features, but declining to provide it will not affect your ability to use the core features of the Platform.

7.5 Marketing and Communications

Where we seek your consent to send marketing communications or share your data with partners for their offers, providing that consent is entirely voluntary. You may withdraw your consent at any time with no effect on your ability to use the Platform. See Section 17 (Your Rights) and Section 18 (How to Exercise Your Rights) for how to withdraw consent.

Back to top

8. What We Do Not Do

We make the following explicit commitments:

• We do NOT sell Personal Data
• We do NOT share Personal Data with third parties for their independent marketing purposes without user consent
• We do NOT publish government ID numbers publicly
• We do NOT use Special Category/Sensitive Personal Data for advertising or profiling (except fraud prevention with safeguards)
• We do NOT use children's data for targeted advertising, profiling, or marketing

Back to top

9. User-to-User Sharing

When you use the Platform, certain information is visible to other users to facilitate connections:

• Profile name, contact details, and photo
• Ratings and reviews
• Request details (routes, dates, requirements)
• Messages exchanged between users

WARNING: Never share bank details, passwords, government IDs, or other sensitive information through messages. Elodos is not responsible for information you voluntarily disclose to other users.

Back to top

10. Service Providers (Processors)

We share Personal Data with service providers who process data on our behalf under written agreements requiring:

• Processing only on our documented instructions
• Confidentiality obligations on personnel
• Appropriate security measures
• Assistance with data subject rights requests
• Breach notification without undue delay
• Deletion or return of data upon termination

Back to top

11. Legal Disclosures

We may disclose Personal Data to authorities where required by law, court order, or governmental request, or where necessary for: safety of individuals, protecting our legal rights, investigating potential violations, responding to regulatory requests, or cooperating with criminal investigations. We will notify you of such disclosures where lawfully permitted.

Back to top

12. Business Transfers

In the event of a merger, acquisition, reorganisation, sale of assets, or bankruptcy, Personal Data may be transferred to the successor entity. We will notify you of any change in ownership or control.

Back to top

13. Cross-Border Transfers

As a global platform, we may transfer Personal Data to countries outside your jurisdiction. We implement appropriate safeguards for such transfers:

13.1 UK Transfers

For transfers from the UK, we rely on: UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses, Transfer Risk Assessments, and approved certification schemes where available.

13.2 EU/EEA Transfers

For transfers from the EU/EEA, we rely on: European Commission adequacy decisions, EU Standard Contractual Clauses (SCCs), supplementary measures where required, and Transfer Impact Assessments.

13.3 Other Jurisdictions

For transfers from other jurisdictions, we comply with local requirements including contractual safeguards, regulatory approvals, and adequacy assessments as required by applicable law. See the Jurisdiction-Specific Provisions section for details.

You may request a copy of the safeguards we use for international transfers by contacting privacy@elodos.com.

Back to top

14. Retention Periods

We retain Personal Data only as long as necessary for the purposes described in this Policy:

Retention periods may be extended where required by law, ongoing litigation, investigation, or safety concerns.

Back to top

15. Security Measures

We implement appropriate technical and organisational measures to protect Personal Data, following UK Government Cyber Security Guidance:

Technical Measures

• Encryption in transit (TLS/SSL) and at rest
• Secure password hashing
• Multi-factor authentication options
• Firewalls and intrusion detection/prevention systems
• Regular security testing and vulnerability assessments
• Secure development practices and code review

Organisational Measures

• Access controls based on least-privilege principle
• Employee security training and awareness
• Confidentiality obligations for personnel
• Incident response procedures
• Business continuity planning
• Regular security audits
• Vendor security assessments

No system is completely secure. We cannot guarantee absolute security but commit to prompt action if a breach occurs.

Back to top

16. Data Breach Notification

In the event of a Personal Data breach, we will: assess the breach and its likely impact, contain and mitigate the breach, notify the relevant supervisory authority within required timeframes (e.g., 72 hours from the point at which we are made aware of such breach under UK/EU GDPR, as soon as practicable under DPDP Rules), notify affected individuals if the breach is likely to result in high risk to their rights and freedoms, and document the breach and our response. Breach notification procedures follow UK Government guidance on managing data breaches.

Back to top

17. Data Subject Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access - to obtain a copy of the personal data we hold about you;
• Right to rectification - to have inaccurate data corrected;
• Right to erasure - to request deletion of your data in certain circumstances;
• Right to restriction - to request that we limit how we use your data;
• Right to data portability - to receive your data in a structured, machine-readable format (where processing is based on consent or contract);
• Right to object - to object to processing based on legitimate interests or for direct marketing purposes;
• Right to withdraw consent - where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact privacy@elodos.com. We will respond within one month of receiving your request (this period begins once we have received your request and any information required to verify your identity).

17.1 Automated Decision-Making and Profiling

We do use automated decision-making that produces legal effects or similarly significant effects on you.

Where we make such decisions, we will:

• Inform you that a decision has been made;
• Provide you with meaningful information about the logic involved and its likely consequences;
• Enable you to make representations about the decision;
• Enable you to request human intervention and to contest the decision.

To request human review of an automated decision or to raise a concern, please contact privacy@elodos.com.

17.2 Right to Complain

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk | Telephone: 0303 123 1113 | Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO. Please contact us first at privacy@elodos.com.

Back to top

18. How to Exercise Your Rights

To exercise your rights under applicable data protection law, please contact us at privacy@elodos.com or use the in-app privacy settings. We will respond free of charge within one month of receiving your request. Where a request is complex or we have received a high volume of requests, we may extend this period by a further two months. If we extend the deadline, we will inform you within one month of receiving your request and explain the reasons for the delay.

We may ask you to verify your identity before processing your request where we have reasonable doubt as to who is making it. We will only request information necessary for this purpose.

We may refuse requests that are manifestly unfounded or excessive, including repetitive requests. We may also decline to comply where permitted by law - for example, where disclosure would adversely affect the rights and freedoms of others, or where it would prejudice the prevention, detection, or investigation of crime. Where we refuse a request, we will inform you of the reasons, your right to lodge a complaint with the Information Commissioner's Office (ICO), and your right to seek a judicial remedy.

All responses will be provided in a concise, transparent, and intelligible form.

Right to Complain

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk | Telephone: 0303 123 1113 | Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO. Please contact us first at privacy@elodos.com.

Back to top

19. Cookies and Similar Technologies

You can manage cookies through: our cookie consent banner, your browser settings, mobile device settings (reset advertising IDs, limit ad tracking), and opt-out tools provided by third parties.

Back to top

20. United Kingdom

If you are in the UK, we process your Personal Data in accordance with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Data (Use and Access) Act 2025, and Privacy and Electronic Communications Regulations (PECR).

Supervisory Authority: Information Commissioner's Office (ICO), ico.org.uk, Telephone: 0303 123 1113.

Back to top

21. European Economic Area

If you are in the EU/EEA, we process your Personal Data in accordance with the EU General Data Protection Regulation (Regulation 2016/679). You have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.

Back to top

22. India

If you are in India, we process your Personal Data in accordance with the Digital Personal Data Protection Act 2023 (DPDP Act) and DPDP Rules 2025. You have rights to: access your data, request correction, request erasure, nominate a person to exercise rights on your behalf in case of death or incapacity. For complaints, contact our designated contact point (privacy@elodos.com). If unresolved, you may escalate to the Data Protection Board of India.

Consent requests provided to Indian users will be made available in English and in Hindi (or such other Eighth Schedule language as you may select). You may request the consent notice in any language included in the Eighth Schedule of the Constitution of India by contacting privacy@elodos.com

You may withdraw your consent at any time through [in-app consent management page / privacy@elodos.com]. The ease of withdrawing consent is comparable to the ease with which it was given. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Back to top

23. United States

23.1 Overview

If you are located in the United States, the following provisions describe the privacy rights available to you under applicable US laws, depending on your state of residence:

23.2 California Residents

As a California resident, you have the following rights under the CCPA/CPRA:

(a) Right to Know

You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection or use, and the categories of third parties with whom it was shared.

(b) Right to Delete

You may request deletion of personal information we have collected from you, subject to statutory exceptions (e.g., where retention is necessary to complete a transaction, detect fraud, or comply with a legal obligation).

(c) Right to Correct

You may request correction of inaccurate personal information we hold about you.

(d) Right to Opt-Out of Sale / Sharing

You have the right to direct us not to sell or share your personal information. Elodos does not currently sell or share personal information for cross-context behavioural advertising.

(e) Right to Limit Use of Sensitive Personal Information

You have the right to direct us to limit our use and disclosure of sensitive personal information (including government-issued identification numbers and biometric data) to that which is necessary to provide the services you have requested.

(f) Right to Non-Discrimination

We will not deny you services, charge you different prices, or provide a lower quality of service because you exercised any of your CCPA/CPRA rights.

(g) Shine the Light

California residents may request, once per calendar year and free of charge, a list of any third parties to whom we disclosed personal information for their direct marketing purposes during the preceding year.

23.3 Residents of Other States

If you are a resident of Virginia, Colorado, Connecticut, Iowa, Florida, Montana, Nebraska, New Jersey, New Hampshire, Oregon, Texas, or Utah, you may contact us at privacy@elodos.com - subject line: "US Privacy Rights Request - Know your rights - [Your State]" and we will provide you a detailed guidance on your rights and the mechanism to exercise your rights.

23.4 How to Exercise Your US Privacy Rights

To exercise any of the rights in this Section 23, please contact us at privacy@elodos.com - subject line: "US Privacy Rights Request - [Your State]". We will respond within one month (extendable to three months in case of complex requests or multiple requests, after duly informing you within a period of 45 days) from the date of receipt of your request. Identity verification may be required. We may refuse manifestly unfounded or excessive requests, or where law permits (e.g., where disclosure would adversely affect others' rights or compromise investigations).

Back to top

24. Children's Data

Elodos is designed for adults aged 18 and over. Users must be at least 18 years old to create an account. We do not knowingly collect Personal Data from children except as follows:

24.1 Travel Companion Requests

A Lancer may create a Travel Companion Request for a child (under 18). In such cases, we collect only: child's name, age, and travel details strictly necessary for the request. The Lancer warrants they are the parent, guardian, or lawfully authorised to provide this information.

24.2 Age Verification and Account Creation

• Minimum age to create an account: 18 years
• Age verification: Self-declaration during registration, with additional verification for certain features
• We reserve the right to request proof of age and terminate accounts of users under 18

No accounts permitted for users under 18, regardless of parental consent

24.3 Restrictions on Children's Data

• Children's data is used only for: facilitating the request, safety and compliance, legal obligations, and anonymised analytics
• We do NOT use children's data for targeted advertising, profiling, or marketing
• We do NOT sell, rent, or share identifiable children's data externally (except service providers as necessary)
• Heightened security safeguards and retention limits apply

24.4 International Age Requirements

While our global minimum age is 18, we acknowledge that jurisdictions have varying age of consent requirements for data processing (e.g., UK: 13, EU: 13-16 depending on member state, US COPPA: under 13, South Korea: under 14). As we do not permit users under 18, these varying thresholds do not apply to our Platform users. However, for Travel Companion Requests involving children, we ensure compliance with local requirements regarding children's data processing

Back to top

25. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date. For material changes, we will provide notice through the Platform or by email where required. Continued use of the Platform after changes constitutes acceptance of the updated Policy.

Back to top

26. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices:

Back to top