Processing of personal data

Processing of personal data Through this Policy, we want to bring you the necessary information in a clear, transparent and as explicit way as possible about the way we process your personal data, as a Data Operator. In order to be able to offer you our car-sharing services, we need to process certain personal data that belong to you, data that we collect directly from you, upon entering them in the Application at the time of registration and by uploading the documents requested in this sens. The information presented in this Policy refers exclusively to the way in which the Developer and/or the operator collects and processes your data, this information is not applicable in the situation of data collection by the companies we collaborate with if they have the capacity of operators data independent. This Personal Data Processing Policy is duly supplemented with the Terms and Conditions of the Citylink and hip.car applications. 1. Definitions and meaning of some terms The following terms used throughout this Policy will be understood as follows: a. "Application", "Hip.car Application" or "Citylink Application" refers to the software application owned by S.C. Concept Apps Development S.A. and administered by S.C. Concept Apps Development S.A in Romania and by Hip Car Sharing SRL in Moldova, which can be used to rent the vehicles available within the coverage area and/or to order rides; b. "Agreement" shall mean the Terms and Conditions of the Application c. "Personal data" or "Personal data" means any information that refers to an identified or identifiable natural person; a person can be identified, directly or indirectly, in a particular way by referring to an identification number or by using one or more factors that are specific to his physical, physiological, psychological, social, cultural or economic identity; d. "Data processing" shall mean that operation or set of operations performed on personal data or sets of personal data, regardless of whether automated means are used or not, operations such as collection, recording, storage, structuring, organizing, modifying or adapting, consulting, using, extracting, disclosing by transmission, aligning or combining, disseminating or making available in any way, restricting or destroying. e. "User" or "Client" is any natural or legal person, through their representative, who has gone through and successfully completed the registration procedure and accepted the Terms and Conditions of the Application f. "Third party" represents any natural or legal person, public authority, agency or body, apart from the User (Client), operator, the person authorized by the operator and the person who is under the direct authority of the operator or the authorized person by the operator, which are authorized to process personal data. g. "Regulation" refers to European Union Regulation no. 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC and Law 133/2011 of the Republic of Moldova. 2. The data operator The Hip.car platform was developed bySC Concept Apps Development S.A., a legal entity registered and operating in accordance with Romanian legislation, with headquarters in Str Maria Hagi Moscu, 1A, registered in the Trade Register under no. J40/14820/2020, Unique Registration Code RO30655819, holder of all rights regarding the Application. The platform is operated at the country level by operating companies that comply with the applicable legal provisions in the field of personal data protection. In Moldova, the operator of the platform is: Hip Car Sharing SRL, fiscal code 1019600009161, with headquarters at 35 Mihai Eminescu Street, Chisinau, Moldova. In Romania, the operator of the platform is: Concept Apps Development S.A, Single Registration RO30655819, with headquarters in Sector 1, Bucharest. 3. Types of data processed regarding Users For the operation of the Applications and in connection with the use of our Services, the following personal data are processed: a. Your contact details such as name, surname, e-mail, telephone number; b. In the case of rental services, the information contained in the identity card can be processed; c. In the case of rental services, the information contained in the driver's license can be processed; d. Data regarding geolocation, the street where the vehicle is located, the date and time when a race was started and ended, the distance traveled, the driving and stationary time, the current speed of the vehicle, the maximum speed and the minimum speed reached, the speed average, sudden accelerations/braking, the route traveled, the start and stop points of each route, the date and time of the last transmitted position; e. History of races performed. 1. How user data is used We comply with the General Data Protection Regulation (GDPR) applicable in the EU, as well as Law no. 133 on the Protection of Personal Data from the Republic of Moldova. We implement strict measures to ensure that our data processing procedures uphold the principles of legality, fairness and transparency, provide data security and respect the rights of data subjects. All personal data is securely stored and processed on Amazon Web Services (AWS) servers located in Frankfurt, EU, in accordance with the specific and explicit purposes for which it was collected. a. The e-mail address is collected and processed in order to register and validate your account, to be able to log into your account and to send you notifications and information in relation to the services used, for example sending an e-mail trip confirmation, payment confirmation, to recover your password, notifications related to operational problems associated with the use of the vehicle and the like. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ b. The telephone number is collected and processed in order to validate your account and to make calls and/or send you notifications and information in relation to the services used, such as sending a text message to confirm the ride, to confirm of payment, for password recovery, in relation to operational problems associated with the use of the vehicle, etc.. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ c. Name and surname are collected for the purpose of concluding and executing the contract and for payment validation. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ d. The Personal Number Code (C.N.P.) is collected and processed for the purpose of concluding and executing the contract. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ e. The information contained in the driver's license is collected and processed for the purpose of verifying whether you are legally able to drive a motor vehicle on public roads, respectively whether you have the necessary category required by law for that motor vehicle. These operations are carried out pursuant to art. 6 para. (1) lit. c) from the Regulation (legal obligation) and pursuant to art. 335 of the Criminal Code; ‍ f. The information contained in the identity card is collected and processed for the purpose of concluding and executing the contract between the parties and for the purpose of communicating your identity to the Romanian Police within the requested period in case of a request from them. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract), pursuant to art. 6 para. (1) lit. c) from the Regulation (legal obligation) and pursuant to art. 39 of the O.U.G. 195/2002; ‍ g. Race history is collected and processed for the purpose of executing the contract. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ h. The cost of the trip is collected and processed for the purpose of executing the contract. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ i. The registration number of the motor vehicle is collected and processed for the purpose of executing the contract and for the purpose of communicating to the Romanian Police, in the event of a request from them, information regarding to whom I have entrusted the motor vehicle. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract), pursuant to art. 6 para. (1) lit. c) from the Regulation (legal obligation) and pursuant to art. 39 of the O.U.G. 195/2002; ‍ j. The street where the vehicle is located is collected and processed for the purpose of executing the contract. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ k. Your location at the time of accessing the application is collected and processed for the purpose of executing the contract, specifically so that you can determine the distance traveled and the estimated time between where you are and the vehicle. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ l. Geolocation is collected and processed for the purpose of executing the contract, more precisely to observe your driving style to determine if you are driving the vehicle in a preventive and prudent manner respecting the traffic rules. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ m. The date and time of the last position transmitted are collected and processed for the purpose of executing the contract. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ n. The current speed of the vehicle is collected and processed for the purpose of executing the contract, more precisely to ensure that the legal speed limit is not exceeded. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract); ‍ o. Driving style, i.e. sudden accelerations and braking, average speed, minimum and maximum speed reached are collected and processed for the purpose of executing the contract. These operations are carried out pursuant to art. 6 para. (1) lit. b) from the Regulation (execution of the contract). 2. The following types of data are processed based on our legitimate interest: ‍ a. Your e-mail address and telephone number are collected and processed for the purpose of sending personalized offers and promotions and to carry out satisfaction surveys. These operations are carried out pursuant to art. 6 para. (1) lit. f) (legitimate interest). b. Also these data can be used for the purpose of sending offers and general promotions, if we have your consent to use the data for this purpose. These operations are carried out pursuant to art. 6 para. (1) lit. a) (consent). c. Geolocation data are collected and processed with the aim of ensuring the security and integrity of the vehicle. These operations are carried out pursuant to art. 6 para. (1) lit. f) (legitimate interest). d. Distance traveled data is collected and processed for the purpose of estimating the remaining distance the vehicle can be used to determine when it is necessary to refuel. These operations are carried out pursuant to art. 6 para. (1) lit. f) (legitimate interest). 3. In order to be able to improve the application and the services provided to you, we process the following anonymized data for statistical purposes: a. The location, date and time of the start and end of each route are collected and processed with the aim of creating vehicle usage statistics in certain locations and geographic areas in order to be able to determine the need for vehicles in a certain area and to ensure their availability in the most requested of these locations. b. The distance traveled is collected and processed in order to estimate the distances for which a motor vehicle can be used and to determine when it is necessary to refuel it. c. The time driven and stationary are collected in order to estimate the period when refueling of the vehicle would be necessary. d. The route traveled is collected for the purpose of checking the vehicle's fuel consumption on certain routes where traffic may be more congested. When we collect and process the data listed above for statistical purposes, they are extracted and analyzed through the application without making any correlation between data and the natural persons who would use the vehicle at the time. SC Concept Apps Development S.A. does not process and does not have access to your bank card data, these data are processed by payment processors: Plationline / Stripe / Fondy. 3. Disclosure of data to a third party ‍For the optimal and full functioning of the Application, we use services and products developed by third parties. They may have access to some of your personal data that you have provided in the Application, however, the data is processed in accordance with the guidelines and instructions provided by us and will not be used for purposes other than those previously mentioned . Subject to the above, this data may be disclosed to: ‍ a. Companies specialized in marketing campaigns or market research, acting for the Developer and/or operator; b. IT service providers who could assist the Developer and/or the operator in the maintenance of systems, sites and applications so that they function optimally. In the situations described above, personal data may be disclosed only on the basis of a contract concluded with third parties, whereby the parties undertake to process the data exclusively for the purpose for which they were entrusted, to respect the obligation of confidentiality, ensure data security and comply with the legislation in force regarding the protection of personal data. Your personal data may also be disclosed to some authorities and/or public institutions such as the police, the prosecutor's office, the court and/or other competent state bodies, based on and according to the legal provisions. 4. Security of personal data and their storage period The developer and/or operator collects and processes only the personal data it needs for the purposes set out in point 1.4. from this document. If the data collected by us is no longer necessary to achieve the purpose for which it was originally collected, we will delete this data. The developer and/or operator grants access to your personal data only to employees and/or collaborators with whom it has concluded confidentiality agreements regarding data processing. Except for the third parties mentioned above, we will not allow other entities to access your personal data without first informing you. 1. Security of personal data ‍ ‍The developer and/or operator takes the security of personal data very seriously, as a result we use a series of procedures and technologies designed to protect personal information. We implement the following procedures, technologies and organizational measures for the security of personal data: a. we use personal data encryption procedures; we have the ability to ensure the confidentiality, integrity, availability and continuous resistance of personal data processing systems and services; b. in the event of a security incident of a technical or physical nature, we can restore the availability of personal data and access to them in due time; c. we have a process to periodically test, evaluate and assess whether the technical and organizational measures are effective and guarantee the secure processing of personal data. d. We regularly update and review our policies and procedures to comply with legal provisions on the protection of personal data. With these in mind, we will list a number of measures we take: we have and use policies and procedures regarding the protection of personal data; e. We carry out data security impact assessments; f. We carry out assessments when we use legitimate interest as a legal basis for data processing; g. We conduct audits and implement data protection safety measures; h. We take care to train our employees on the protection of personal data; only the employees and/or collaborators of the Developer and/or the operator will have access to certain personal data and only to the extent that they need this access to be able to carry out their activity based on the relationship they have with the Developer and/or the operator. 2. Personal data storage period During the execution of the contract we store the following types of data: a. Name, surname, phone number, e-mail, login data, information from the identity card, information from the driver's license. This data will be stored for as long as you are a Citylink user and customer; b. Geolocation data will be stored for a period of 5 years; c. Race history will be stored for a period of 5 years; d. The cost of the trip will be stored for a period of 5 years; e. Upon termination of the contract, the data stored by us will be deleted or kept for a short period of time to be able to respond to legal obligations as follows: f. The login data and the account will be deleted no later than the next day after the termination of your status as a Citylink user and customer, if the next day falls on a non-working day, the deadline will be extended until the next working day; g. The name, first name, phone number, e-mail, the information found in the application account from which it appears which vehicle you used and also the date and time will be stored for a period of 6 months from the date of termination of your quality of Citylink user and customer. This information is stored in order to be able to respond to legal obligations, for example to provide the traffic police with information regarding the driver's data; h. Copies of the identity card and driver's license will be stored for a period of 6 months from the date on which the Citylink user and customer status ceases. This information is stored in order to be able to respond to legal obligations, such as providing the traffic police with information regarding the data of the driver of the vehicle or in the event of a possible investigation regarding the entrustment of the vehicle to a minor; i. Geolocation and driving style data will be deleted no later than the day following the termination of your status as a Citylink user and customer, if the following day falls on a non-working day, the deadline will be extended to the first working day which follows. If the software and technological means allow us, we will anonymize this data so that the storage period is no longer applicable, because the geolocation information will no longer be associated with you. Your personal data will also be processed as a result of issuing invoices as provided in the Terms and Conditions of the Application. The data is to be kept in accordance with the provisions applicable in fiscal matters. In the event of legal, judicial procedures and/or investigations or inquiries being carried out by public authorities in connection with the conclusion, execution and termination of the Contract (Terms and Conditions of the Application) and also in case of any disputes related to the execution of the Contract, the terms regarding the storage period of personal data will be suspended 5. Rights of Citylink Users/Customers Given your capacity as a user and customer, you have the following rights in relation to your personal data: a. The right to information means that you are informed by this policy about how we process the data, how long we store this data, what rights you have in relation to your data, to whom the data is disclosed in the situation where such disclosure takes place and others. Last but not least, if this policy will be updated, you will be informed. b. The right of access to data means that you have the possibility to be confirmed or denied by the Developer and/or operator if your data is processed, in the event of a confirmation regarding data processing by us you will have access to this data. c. The right to rectification of data refers to your right to obtain the completion or rectification of incomplete or inaccurate data that the Developer and/or operator processes. d. The right to data portability means that you have the right to receive the data about you and that you have provided to the Developer and/or operator in a structured, commonly used and machine-readable format , to be able to transmit them to another operator, in the situation where: d.1. Processing is based on consent or a contract; d.2. The processing is carried out by automatic means. e. The right to data erasure means that you have the possibility to request the erasure of your personal data without any undue delay. You can request account deletion from the chat in the application (Support) or through the chat on www.hip.car, accessing the Account deletion option. You must bear in mind that this right is not absolute and is limited by legal provisions. f. The right to restrict processing is a right limited in time and leads to the blocking of the processing of your data by the Developer and/or operator In such a situation it will be impossible for us to offer you car-sharing services. g. The right to oppose refers to the right to be able to object at any time to the processing of your personal data for marketing purposes, in such a situation our car-sharing services will not be affected in any way. You also have the possibility to object to data processing based on our legitimate interests, but this right is absolute and will be taken into account depending on your particular situation. h. The right not to be the subject of a decision based solely on automated processing means that in the situation where the Developer and/or the operator intends to use automated systems to issue decisions, it will inform you, ensuring that the provisions are complied with legal, specifically the decision will be reviewed by an employee of the Developer and/or the operator and you will have the right to express your point of view and challenge the decision. i. The right to file a complaint before an authority refers to the possibility of filing a complaint in Romania before the National Authority for the Supervision of the Processing of Personal Data when you consider that the processing of your data takes place in violation of the legal provisions. 6. Contact date If you have any questions, concerns, requests or suggestions regarding this policy, or if you wish to exercise your rights under Section 5, please do not hesitate to contact us. To submit a request, please send us a written request, dated and signed, using the following contact details: Romania Address: Str Maria Hagi Moscu, 1A, sector 1, Bucharest Email: contact@hip.car Phone: +40724 895 465 Moldova: Adresa: Mihai Eminescu 35, Chișinău E-mail: contact@hip.car Telefon:+37322011102.