Information on Data Protection Compiled in accordance with Art. 12, 13, 14 of the European General Data Protection Regulation No. 2016/679 (hereinafter referred to as “GDPR”)
This data protection information (hereinafter referred to as the “Information”) of Superpedestrian Europe B.V., Keizersgracht 241, 1016EA Amsterdam, The Netherlands, (the “Company”) is intended to apply to those persons who use the e-scooter rental and related services (including the app and the website) of the Company (hereinafter referred to as “User”). This Information particularly aims at informing the User (i) about the purposes and the duration for which his/her data will be processed and the legal basis on which his/her data will be processed, the recipients of his/her data and (ii) the rights he/she may exercise in connection with the processing of his/her personal data.
As defined by the GDPR, “personal data” is any information relating to an identified or identifiable natural person (in this case, the User). The Company shall process special categories of data of the User solely to the extent that this may be necessary for the purpose of applying for insurance compensation or in compliance with legal obligations as well as for the assertion, exercise or defence of legal claims against the public authorities and the courts. The Company defines “special categories of data” as special categories of data as per Article 9 Par 1 of the GDPR, therefore information relating to: racial or ethnic origin, political opinions, religious or any other similar beliefs, trade union membership, physical or mental health (health data), sex life or philosophical beliefs. The User will always be made aware of this fact when providing the Company with special categories of data and, where necessary, the Company will ask for the User’s express consent for the processing of this information.
By accessing or using the LINK Superpedestrian app and/or the website and/or any other electronic platform of the Company for the purpose of renting the e-scooters on offer (hereinafter the “Services”), it is understood that the User accepts the terms and conditions described in this Data Protection Information and that he/she consents to the collection, processing and communication of his/her personal data in accordance with these terms and conditions. Should the User not be in agreement with these terms and conditions, the User is requested to refrain from accessing and/or using the Services offered by the Company and to refrain from providing his/her personal information.
The Company specifically offers the User its shared e-scooter rental services. The User may rent the e-scooter for use once or several times after registering via LINK / Superpedestrian’s corresponding app for smartphones and after accepting the terms and conditions of use as described in the app being used. In order to be able to make use of the Services offered by the Company, however, it is necessary to obtain and process the data requested from the User.
The controller responsible for the processing of personal data in accordance with Article 4, point 7 of the GDPR shall be Superpedestrian Europe B.V., Keizersgracht 241, 1016EA Amsterdam, The Netherlands.
The data protection officer is Antony Hibbert with the e-mail address antony_hibbert@hotmail.com, whom the User can contact by sending a message to privacy@linkyour.city or to antony_hibbert@hotmail.com.
The Company draws attention to the fact that these data protection provisions shall apply exclusively to the services offered by the Company and not to the websites and services of other companies which the User may be able to access via the Company’s website or which the User may be able to use by making use of the Company’s Services.
Should its Services be made use of, the Company will process the following personal data at the following points in time and for the purposes as specified below: the first and last name of the User as at the time of his/her first registration, so that he/she can be identified (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); the gender and age of the User as at the time of his/her first registration, so that he/she can be identified (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); the e-mail address of the User as at the time of his/her first registration, so that he/she can be identified and so that the Company may communicate with him/her (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); the postal and billing address of the User as at the time of his/her first registration, so that he/she can be identified and his/her order can be processed (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); a contact number for the User as at the time of his/her first registration or at any other point in time when a transaction is carried out, so that the User can be identified and so that the Company may communicate with him/her (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); the payment information of the User as at the time of his/her first registration or at any other point in time during the registration, so that his/her order can be completed and the payment of the rental fee can be carried out (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); recording of telephone calls and notification of the collection location of the e-scooter (including date and time) when calls are made to the Company’s customer service or upon each collection or return of the e-scooter, for the purposes of monitoring the safety of the Company’s vehicles and preventing any unauthorised use (legal basis for the recording of telephone calls: consent pursuant to Art 6 Par 1 Letter a GDPR; legal basis for processing collection location: contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR; legitimate interest pursuant to Art 6 Par 1 Letter f GDPR); the geographical location (anonymous), to register the location where the Company’s e-scooters will be located, for reasons of security and to prevent theft (legal basis: contractual performance pursuant to Art 6 Par 1 Letter b GDPR; legitimate interest pursuant to Art 6 Par 1 Letter f GDPR); the geographical location if the User makes use of the Company’s app in order to offer him/her additional Services such as the location services described below (legal basis: contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); only in specific circumstances and subject to the relevant legal bases shall the following information be processed: (i) health data, in connection with the claim for insurance benefits for the purposes of assisting the User in the claim procedure; (ii) expert opinions from judicial authorities and the associated documents; (iii) photographic material sent to the Company by the User.
Upon accessing and using the website or app on which the Services are offered, the following personal data are also automatically processed via the end device used by the User so as to be able to provide the User with the requested rental service of shared e-scooters (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR): information regarding the User’s end device or the software he/she uses (for example, the browser with which he/she accesses the Internet); IP addresses, information relating to navigation in connection with the use of the app (for example, browsing history), the URL (Uniform Resource Locator) and information about the location of the end device used by the User which is obtained via GPS or Bluetooth; information associated with access to the Company’s Services (for example, the date and time, phone calls, information about incidents related to the end device, such as the blocking and/or sudden termination of the app in the User’s end device); information pertaining to the use of the User’s account to access third-party websites, apps and/or services.
The Company has the right to collect, use and pass on location data, including the geographical location of the e-scooter rented by the User in real time, for the purpose of being able to provide the vehicle rental service (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR). To this end, GPS techniques, Bluetooth and the User’s IP address, hotspots, Wi-Fi, Crowdsourcing and other technologies, where available, may be used to determine the approximate location of the User’s end device and how far away he/she is. This data shall be collected and processed in an anonymous form (if necessary after obtaining the User’s consent).
Besides the aforementioned points in time and purposes, the Company may also process the User’s data for the purpose of registration and participation of the User in events, surveys, competitions, draws and sponsored promotions that are organised as part of the Services offered by the Company (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR; where required, consent pursuant to Art 6 Par 1 Letter a GDPR). Likewise, the Company may also process data in order to send the User announcements and any other information regarding the Company’s Services by means of e-mail, SMS or instant messaging (legal basis: contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR; legitimate interest in accordance with the fulfilment of the contract pursuant to Art 6 Par 1 Letter b GDPR; if necessary, consent in accordance with the fulfilment of the contract pursuant to Art 6 Par 1 Letter b GDPR). When customer service or technical service is called upon, data will also be processed. Data will be processed in the aforementioned cases so as to be able to provide the Customer with all the service functions of the Company, and in particular: (i) to verify and process the use of the Company’s Services; (ii) to effect payments in connection with the rental of the shared e-scooters; (iii) to update the information concerning the activities carried out by the User as part of the exchange of the shared e-scooter; (iv) to respond to requests from the User; (v) to aid the User in recovering a lost or stolen scooter and to provide assistance to the User in the event of accidents or other incidents; (vi) to keep the User informed about the development of new Services of the Company, as well as about special offers and promotions (legal basis: contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR; legitimate interest pursuant to Art 6 Par 1 Letter f GDPR; if required, consent pursuant to Art 6 Par 1 Letter a GDPR).
The Company is permitted to process the aforementioned personal data of the User on the basis of the User’s use of the Services described herein so that the Company can fulfil its contractual obligations and the contractual conditions expressly accepted by the User upon registration and to enable the User to make use of the shared e-scooters (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR). The data that is collected shall also be used (i) to tailor the Company’s Services according to the User’s characteristics and to increase customer satisfaction (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR; legitimate interest pursuant to Art 6 Par 1 Letter f GDPR; if required, consent pursuant to Art 6 Par 1 Letter a GDPR); (ii) to provide the Customer with the best possible service and to be able to address complaints (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); (iii) to prevent fraud (legal basis legitimate interest pursuant to Art 6 Par 1 Letter f GDPR); (iv) to process matters relating to accounting, risk management and the storage/archiving of data (legal basis of statutory obligation pursuant to Art 6 Par 1 Letter c GDPR; legitimate interest pursuant to Art 6 Par 1 Letter f GDPR); (v) to guard against, detect and investigate fraudulent or other unlawful activities or to reduce the risk of such incidents occurring (legal basis legitimate interest pursuant to Art 6 Par 1 Letter f GDPR); (vi) to communicate the handover deadlines to the Customer, as well as to provide information about the Company’s Services as well as other updates and developments (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR); (vii) for statistical, analytical and research purposes, but at all times on a completely anonymous basis and without aggregation of the data collected, as well as for the purpose of determining the degree of consent, for analysing the Customers’ consumption habits and for carrying out market studies, also by means of questionnaires prepared by the Company regarding the quality of the Services provided (legal basis legitimate interest pursuant to Art 6 Par 1 Letter f GDPR; if required, consent pursuant to Art 6 Par 1 Letter a GDPR); (viii) for purposes other than those for which the personal data were collected, provided this is legally permissible pursuant to Art 6 Par 4 GDPR.
The Company hereby expressly declares that it may disclose the User’s data to the public authorities and/or local law enforcement agencies, including the police, to the extent that this is obligatory under the applicable statutory provisions (legal basis of statutory obligation pursuant to Art 6 Par 1 Letter c GDPR). Similarly, to the extent that it is legally entitled to do so, the Company will disclose the data to other third parties if this is necessary to protect its legitimate interests and the interests of the User or other persons (legal basis of legitimate interest pursuant to Art 6 Par 1 Letter f GDPR) or for the fulfilment of a contract (legal basis of contractual fulfilment pursuant to Art 6 Par 1 Letter b GDPR).
Third-party IT systems and software procedures used to provide the Services or to enable the use of the app (e.g. Apple Store, Google Play, etc.) process certain personal data when they are in operation, the transmission of which occurs when using the Internet communication protocol or the communication protocol of the smartphone or end device used. The Company shall not assume any liability for the processing of personal data by these systems and IT software. Users can inform themselves of the data protection provisions of the relevant third-party companies on their websites.
The personal data is processed by electronic means, specifically when using the app, and is transferred to the Company’s website software via secure connections. The personal data will, however, never be permanently stored in the end device: the User may delete it at any time by using the functions provided for this purpose in the app.
Users download the app voluntarily and can then uninstall the app again at any time. The authorisations and consents granted by the User can also be changed or revoked for the future at any point in time. Likewise, the processing of personal data, such as geolocation, can be prevented. Files that have been created, such as expenditure reports, can also be deleted at any time. Personal data processed for the aforementioned purposes shall be processed by the Company for the duration of the fulfilment of the contract or for the duration specified by the statutory retention periods. Apart from that, data can also be required and processed for the defence and assertion of legal claims within the legal or contractual warranty and compensation periods. If data processing is based on the User’s consent, the Company shall process the data for the duration of its validity.
The User may exercise his/her rights under data protection law by sending a corresponding message to the e-mail address privacy@linkyour.city and/or support@link.city and/or antony_hibbert@hotmail.com. If data processing is based on the User’s consent, he/she can revoke it at any time, such as by an e-mail to the aforementioned e-mail addresses. In such a case, the data that has been stored up to this point will be erased or anonymised, and subsequently it will only be used for statistical purposes with no personal connection. The revocation of consent shall not affect the lawfulness of the processing carried out on the basis of consent until revoked. Provided certain legal requirements are satisfied, the User has the right of access to personal data regarding him/her (Art 15 GDPR), the right of rectification of personal data regarding the User (Art 16 GDPR), the right of erasure (Art 17 GDPR), the right of restricting processing (Art 18 GDPR) as well as the right of data portability (Art 20 GDPR). The User especially has the right to object at any time to the processing of personal data regarding him/her if the processing is required to carry out a task that is in the public interest or is done to exercise public authority (Art 6 Par 1 Letter e GDPR) or if the processing is done to safeguard the legitimate interests of the Company (Art 6 Par 1 Letter f GDPR), unless the processing is done for mandatory reasons worthy of protection that outweigh the User’s interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims. If data is processed to perform direct advertising, the User is definitely entitled to the right of objection. The User may furthermore request that his/her personal data not be used for automated decision-making, including profiling. It is, however, pointed out that the Company is entitled to use such decision-making procedures (i) if such decision making proves necessary for the conclusion or fulfilment of a contract; (ii) if such type of decision making is authorised by Union law or by the law of the Member State concerned in which the shared e-scooter rental service is provided; (iii) if such type of decision making is performed with the express consent of the User. You can find the statutory provisions about the rights for data subjects here: http://eur-lex.europa.eu/legal-content/DE/ALL/?uri=CELEX%3A32016R0679 Furthermore, you have the right to file a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, e-mail: dsb@dsb.gv.at). If your personal data is amended, we request an appropriate notice.
The Services offered by the Company are not intended for minors under the age of 18. As a result, the Company will not knowingly and intentionally process any personal data of minors in the context of the Services provided by the Company.
The Company shall not assume any liability for service offers of other companies linked on its website and which do not belong to the Company (e.g. partner companies). Moreover, the fact that such links are present cannot be construed as a recommendation or approval on the part of the Company of the terms and conditions of these other companies. Those third-party websites are bound by their own terms and conditions of use (including data protection information) and it is solely the responsibility of the User to inform himself/herself of those terms and conditions and to decide whether to accept the applicable terms and conditions of use and business. The Company expressly declines any liability for the processing of personal data by third-party websites or platforms.
The User’s personal data will be handled with the highest degree of confidentiality and security. The Company has implemented all technical and organisational measures that are in compliance with the provisions of the GDPR as well as other applicable statutory provisions in the field of data protection and accepted practice and that have proven to be expedient. Additionally, and in compliance with the provisions of the GDPR, the Company adheres to the most stringent security procedures when processing and transmitting Users’ personal data in order to prevent any data incidents, misuse and the use of the data by unauthorised parties. As such, the Users’ personal data are treated as the Company’s assets and are diligently protected against loss, alteration, destruction and access by unauthorised entities. Our employees as well as legal representatives are obligated to ensure that the said data is kept confidential and is protected from unauthorised access by the Company’s internal and external employees through the use of various security techniques. It should nevertheless be noted that there is no completely secure method of data transmission on the Internet and no electronic and physical storage media that are absolutely secure. For this reason, the Company encourages the User to also undertake his/her own measures to protect his/her data so as to prevent unauthorised parties from accessing his/her password or account. The Company shall assume no liability whatsoever for lost, stolen or hacked passwords or accounts, or for account activities carried out as a result thereof by unauthorised parties.
The Company hereby declares that the User’s personal data may be transmitted to affiliated companies and branch or partner companies, or to the public administration (in particular to the administrative authorities of those municipalities in which the Services are provided and the shared e-scooters are rented), as well as to subcontracted companies and employees for the purposes mentioned. To the extent necessary, however, such transfer is subject to the corresponding consent granted by the User, who may revoke this consent at any time for the future. In the event that the Company should process the User’s personal data for purposes other than those described in this Data Protection Information, the Company shall inform the User thereof and, if necessary, request the User’s express consent. In particular, the Company may transmit the personal data received from the User to its partner companies and processors (for example, IT service providers) within the framework of technical controls and/or payments effected by the User. Likewise, the Company may transmit the User’s personal data to third parties should the cooperation of an external supplier be necessary for the Company to fulfil its contractual obligations and provide the User with its shared e-scooter rental services (for example, for storage services, payment processing and invoicing, push messages, storage, bandwidth usage and content editing tools). On the basis of its legitimate interests, the Company may also transmit the User’s data to those third-party companies contracted to provide repair and maintenance services. The Company moreover reserves the right to transmit information relating to the User where this is obligatory for legal reasons or where the Company is of the opinion, to the best of its knowledge and belief, that access to, storage or disclosure of the data is necessary in order to: (i) resolve a complaint addressed to the Company; (ii) fulfil the Company’s obligations in legal proceedings; (iii) enable the fulfilment of contracts entered into with the User in accordance with the Company’s general terms and conditions; (iv) perform necessary actions in response to emergencies that may threaten public health or that may result in serious injury or in the death of any person; (v) protect the rights, property or personal safety of the Company’s employees and representatives; (vi) conduct investigations into possible violations of the applicable laws and regulations; and to (vii) detect, prevent, or take action against fraudulent activities and/or security problems.
The Company is controlled under company law by Superpedestrian Inc. For this reason, it may be required to transmit the User’s personal data to the parent company for intra-group administrative purposes. Any such transmission of data shall, however, always take place under the supervision of the data controllers involved and in fulfillment of the legitimate interests of the two aforementioned companies, as well as in accordance with the statutory provisions.
The data to which this Data Protection Information relates is processed in the European Union. Subject to paragraph 22, we shall not transmit the Users’ data to countries outside the European Union without the Users’ consent. In the event that the Company nevertheless transmits the User’s personal data to a country or territory located outside the European Union, the Company shall ensure that this transmission is carried out on the basis of the legal principles set out in the GDPR pursuant to Chapter V of the GDPR and that the recipient of the data is obligated to ensure the security of this data with protective measures that are as effective as those required by law in Austria and in the European Union.
As part of its business activities, the Company may carry out extraordinary transactions or transactions affecting the Company’s capital (for example, mergers, acquisitions or demergers of companies). Under such circumstances, the transmission or communication of the User’s personal data may become necessary in order to carry out such transactions. The User confirms that he/she is aware that the personal data he/she submits to the Company may be transmitted to the acquiring or acquired company in the event of the sale or acquisition of a company or the merger of the Company with a third-party company in accordance with the applicable statutory regulations and the provisions described in this Data Protection Information. The Company cannot guarantee, however, that the provisions described in this Data Protection Information will be adopted by the acquiring company in such a case.
The Company draws attention to the fact that the cookies it uses may be stored on the User’s PC or mobile phone while he/she is accessing the Services offered. The session cookies that are stored on the User’s device during the session or during the use of the Services remain active only for the duration of the current visit and only as long as the browser is in operation. Such cookies, however, are not stored on the hard drive and are deleted as soon as the browser is closed. Some examples of this are the cookies from the Google Analytics list, which are employed by the Company for the purposes of gaining a better understanding of how its website and shared e-scooter rental services are utilised by Users, as well as for the purposes of improving the Users’ navigation experience. In addition, the Company makes use of tracking pixels in the HTML e-mails to the extent permitted by law, which help the Company to gauge the response to its messages and communications and to verify that the e-mails are being forwarded correctly. For the purposes of direct marketing, the Company may cooperate with Facebook, Google and other companies providing third-party advertising services and ad exchange services, as well as with business partners and providers of advertising channels and advertising networks. Social networks such as Twitter, Google, Facebook and LinkedIn may also process information associated with the User’s navigation behaviour. They may, for instance, record visits to the Company’s website and to other sites offering specific services and which the User has accessed. The User is therefore strongly advised to familiarise himself/herself with the privacy and cookie policies of each of these companies in order to understand how his/her personal data will be used by these companies and how, should the need arise, he/she can withdraw his/her consent to the processing of the data or delete such data. Similarly, the User has the opportunity to find out about the options available to him/her for disabling the tracking cookies used by some marketing service providers and how to configure the relevant settings in his/her end device. The User can find information on how to change the settings in Apple and Android devices on the relevant websites. He/she can manually configure the cookie settings in his/her computer or mobile phone device in various ways. The Company urges the User to visit the websites of the companies in question so as to thoroughly familiarise him-/herself with the options available to him/her. Should the User wish to prevent all cookies from being stored, he/she may select the corresponding function in his/her browser (activate “Do not track”). The User should be aware, however, that in the event of the complete blocking / deactivation of cookies, it may affect the proper operation of the website and the access to the Services, and the User’s navigation experience may not be satisfactory. In any event, the Company adheres to the statutory regulations applicable with regard to cookies. The User has the option of deactivating the cookies at any time by configuring the corresponding setting in his or her browser. The use of cookies is based on the legal basis of legitimate interest pursuant to Art 6 Par 1 Letter f GDPR or, if required, on the basis of consent pursuant to Art 6 Par 1 Letter a GDPR.
This data protection notice may be amended at any time. The Company will announce any such amendment on its website (and through any other means of communication it deems appropriate through which it can contact the User) and such announcement will also inform the User of what changes have been made and the date on which they become effective. The updated information shall be effective as soon as it has been published. The updated information shall furthermore replace all previous versions and shall also be applicable to the data already collected by the Company at an earlier point in time. In the event that the User does not accept the updated information, the User shall no longer be able to make use of the Company’s Services. If the User continues to access and use the Company’s Services after the updated information comes into effect, the User shall be deemed to have accepted the updated information.
For any comments, complaints, requests and enquiries regarding this Data Protection Information, the User’s rights, the Company’s Services and the Company’s promotions and promotional material, the User may contact the Company’s data protection officer at any time by sending a message to the e-mail addresses privacy@linkyour.city and/or antony_hibbert@hotmail.com.