Privacy Policy (App)
Ride Hive S.R.L. (hereinafter "HIVE". “we”, “us” or “our”), is an urban mobility solution that enables users of our App to locate, activate, and operate electric scooters within predetermined areas (“Services”).
Data protection and data security, as well as its transparency are very important to us. Therefore, this Privacy Policy explains which data we collect from you, for what purposes we may use it, how we process it, when we might disclose it, for how long we keep it, as well as the ways for you to manage your personal data and exercise your rights.
As changes to the law or changes to our corporate processes may require an adaptation of the following privacy statement, we kindly ask you to read this Privacy Policy regularly. The Privacy Policy can be accessed at any time under “Privacy Policy (App)” in our HIVE App or in the footer of our website, can be saved and printed out.
§ 1 Data Controller and Scope
The controller according to the EU General Data Protection Regulation (hereinafter: GDPR) and other national data protection acts of the Member States, as well as other data protection regulations, is:
Ride Hive S.R.L.
Largo Guido Donegani, 2
20121 Milano
Italy
E-mail: help@ridehive.com
Website: www.ridehive.com
This Privacy Policy applies to the HIVE Services, which are available in the App “hive – share electric scooters” (hereinafter referred to as "our App").
§ 2 Data Protection Officer
Our external Data Protection Officer is:
Attorney at Law Dr. Karsten Kinast, LL.M
KINAST Rechtsanwaltsgesellschaft mbH
Hohenzollernring 54
50672 Cologne, Germany
E-Mail: dpo-hive@kinast.eu
Website: www.kinast.eu
§ 3 Principles of Processing Personal Data
Personal data are all information relating to an identified or identifiable natural person. This includes information such as your name, age, address, telephone number, date of birth, e-mail address, IP address or user behavior. Information that cannot (or only with a disproportionate effort) be referred to your person, e.g. by anonymizing the information, is not personal data. The processing of personal data (e.g. the collection, retrieval, use, storage or transmission) always requires a legal basis or your consent.
Processed personal data will be deleted as soon as the purpose of the processing has been fulfilled and no legally prescribed retention obligations are to be observed.
In case we process your personal data for the provision of certain offers, please find below information about the specific processes, the scope and purpose of data processing, the legal basis for processing and the respective storage period.
§ 4 Data Processing
1. App Usage
a. Scope and Purpose of the Processing
When you access and use our app, we only collect the personal data that your device automatically transmits to our server. This information is temporarily stored in a so-called log file.
The following personal data is recorded to the extent necessary for the provision of a functional app and our contents and services:
• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• The pages from which access is made (referrer URL)
• The used browser and, if applicable, the operating system of your device as well as the name of your access provider
• Geolocation data (e.g. Current Location through GPS, IP Address, or Cell Tower)
b. Legal Basis
Art. 6 para. 1 lit. f GDPR serves as the legal basis for the data processing. The processing of the aforementioned data (cf. § 4 1. a.) is necessary for the provision of our services and thus serves the protection of a legitimate interest of our company.
c. Data Deletion and Storage Period
The data subject’s personal data are deleted or blocked as soon as the purpose of the storage is fulfilled. The collection of data for the provision of the app and the storage of data in log files is absolutely necessary for the operation of the app. Consequently, there is no possibility of objection for the user. Further storage may take place in individual cases if this is required by law.
2. Registration / User Account
a. Scope and Purpose of the Processing
You have the possibility to register on our app by entering your personal data.
The processed data is used to create a customized user account that enables you to use certain contents and services like scooter rental on our app.
We make use of your e-mail address so that we can send you new access data in case you should forget these.
Furthermore, we make use of your e-mail address so that we can send you new access data in case you should forget these.
We process the following personal data for the registration/user account setup:
• E-mail address
• IP Address
b. Legal Basis
The processing of the personal data (cf. § 4 2. a.) is based on Art. 6 para. 1 lit. a GDPR on the declaration of consent that you have freely given.
c. Storage Period
As soon you delete your user account all stored data is deleted. It may be necessary to store your personal data in order to comply with legal obligations even after the account is deleted. Further storage may be necessary in individual cases if this is required by law.
The IP address is stored for three days after the registration.
d. Termination
You have the possibility to terminate the registration and to change your personal data at any time by proceeding as follows: User must open the hive App and click the tab “Manage”, then click “Cancel Account”.
3. Location Services
a. Scope and Purpose of Processing
You will be asked to give consent to location-based services, usually through a pop-within our App. If you choose to enable location-based services, we may collect your location based on information provided by you or your device, including, if available, GPS, IP address or cell tower information.
If you choose to not opt-in to location-based services, you may not have access to certain features necessary to use the rental services.
Any marketing activities to be carried out by HIVE based on your location will require your prior consent.
b. Legal Basis
Art. 6 para. 1 lit. b GDPR serves as the legal basis as the processing of your personal data (cf. § 4 3. a.) is required in order to fulfil the rental contract. This also applies to processing operations that are necessary to carry out pre-contractual measures.
If your location data is used for marketing activities processing of your personal data (cf. § 4. 3. A.) is based on Art. 6 para. 1 lit. a GDPR.
c. Storage Period
As soon as the location data are no longer necessary for the execution of the contract, they will be deleted. It may be necessary to store your personal data in order to comply with contractual or legal obligations even after the contract has been fulfilled. Further storage may be necessary in individual cases if this is required by law.
As soon as your location data are no longer necessary to provide you with marketing activities or you withdraw your consent. Further storage can be carried out in individual cases if this is required by law.
4. Rental Services
a. Scope and Purpose of the Processing
You have the possibility to rent electric scooters on our app by entering your personal data.
The processed data is used in order to provide you with certain contents and services like e-scooter rental on our app.
We process the following personal data for the rental services:
• IP address of the requesting device
• Date and time of access
• Geolocation data (e.g. Current Location through GPS, IP Address, or Cell Tower)
• Transactional Information
• Analytics and usage information about your use of the Services, including GPS routes, and status of GPS chips;
• Device information about the HIVE vehicle, including time stamps and battery status
b. Legal Basis
Your personal data (cf. § 4 4. a.) is processed in accordance with article 6 para. 1 lit. b GDPR for the performance of a contract between you and HIVE or the implementation of pre-contractual measures.
c. Storage Period
As soon as the processed data are no longer necessary for the execution of the contract, they will be deleted. It may be necessary to store your personal data in order to comply with contractual or legal obligations even after the contract has been fulfilled. Further storage may be necessary in individual cases if this is required by law.
However, if the processed data are necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible insofar as this does not conflict with contractual or statutory obligations.
5. Payments
a. Scope and Purpose of the Processing
We offer users the opportunity to purchase our Hive services by creating the user account (cf. §4 2.). The following data are collected for the payment process:
• E-mail Address
• Payment Information (Payment Method)
In order to process payments, we pass on your payment data to the credit institution responsible for the payment. These companies are obliged to use your data only for order processing and not for other purposes.
b. Legal Basis
Art. 6 para. 1 lit. b GDPR serves as the legal basis as the processing of your personal data (cf. § 4 5.a.) is required in order to fulfil the purchasing contract. This also applies to processing operations that are necessary to carry out pre-contractual measures.
c. Storage Period
As soon as the processed data are no longer necessary for the execution of the contract they will be deleted. It may be necessary to store your personal data in order to comply with contractual or legal obligations even after the contract has been fulfilled. Further storage may be necessary in individual cases if this is required by law.
However, if the processed data are necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible insofar as this does not conflict with contractual or statutory obligations.
6. Fraud Prevention
a. Scope and Purpose of the Processing
We also occasionally monitor correct usage of our Services via the Hive App in order to detect fraudulent activities (e.g. if you would register for more than one user account in order to make use of the special credits). Protecting Hive regarding fraud and fraudulent activities is a legitimate interest that we pursue.
For the purpose of fraud prevention, we process the following personal data:
• Serial number
• MAC address
• device IDs
• or other unique identifiers
b. Legal Basis
Art. 6 para. 1 lit. f GDPR serves as the legal basis, as the processing of your personal data (cf. § 4 6. a.) is required to pursue our legitimate interests.
c. Storage Period
We will store your personal data for the duration of being a user of Hive and until the user requests the deletion of their data or as soon as the processed data are no longer necessary to comply with contractual or legal obligations after. Further storage may be necessary in particular cases if this is required by law.
7. Marketing and Promotion Communications
a. Scope and Purpose of Processing
You have the opportunity to receive e-mails regarding marketing and promotion activities. In order to be able to communicate with you regularly, we need the following information from you:
● E-mail address
We use the so-called double opt-in procedure for marketing and promotion e-mails, i.e. we will only send you e-mails on this topics if you have previously confirmed your registration to this service via a link that is sent to you for this purpose. We would like to make sure that only you, as the owner of the specified e-mail address, can subscribe to the service. Your confirmation must be given promptly after receiving the confirmation e-mail, otherwise, your registration will be automatically deleted from our database.
Your data will be passed on to our third party provider regarding marketing topics.
b. Legal Basis
The processing of your e-mail address for the marketing and promotion communication is based on Art. 6 para. 1 lit. a GDPR on the declaration of consent, which you have voluntarily given.
c. Storage Period
Your e-mail address will be stored for as long as you have subscribed to the service. After you unsubscribe from the service, your e-mail address will be deleted. Further storage may take place in individual cases if this is required by law.
8. Contact form
a. Scope and Purpose of Processing
You have the opportunity to contact us using a form provided on our app. In the course of sending your inquiry via the contact form, reference is made to this data protection declaration in order to obtain your consent. If you use the contact form, the following personal data will be processed:
• E-mail address
• Name
• Information you voluntarily provide to us in your contact message
The purpose of entering your e-mail address is to assign your request and to be able to reply to you. When using the contact form, your personal data will not be forwarded to third parties.
b. Legal Basis
The data processing described above (cf. § 4 7. a.) for the purpose of establishing contact is carried out voluntarily in accordance with Art. 6 para. 1 lit. a GDPR on the declaration of consent submitted by you.
c. Storage Period
As soon as the request you have made has been dealt with and the relevant facts have been finally clarified, your personal data processed by the contact form will be deleted. Further storage may take place in individual cases if this is required by law.
9. Contact via E-Mail Request
a. Scope and Purpose of Processing
If you send us an e-mail to one of our various e-mail addresses, requesting information about our company, products or technical issues and submit your request, the only processed data category is your e-mail address and the personal data you provide in our correspondence with you including, if necessary:
● Name
● E-Mail Address
● Information you voluntarily provide to us in your E-mail request
We will ask for your consent before using personal information for other purposes.
b. Legal Basis
The legal basis for the above referenced data is Art. 6 para. 1 lit. f GDPR, since there is both an interest in establishing contact and communication between you and our company as well as a justified company interest in processing these data in order to be able to process your request.
c. Storage Period
The period of time for which the above mentioned data will be stored depends on the purpose for you having made contact. Your data will be routinely erased once the purpose behind the communications has lapsed and storage is no longer necessary (e.g. once your enquiry/message has been dealt with/responded to). Further storage may take place in individual cases if this is required by law.
§ 5 Third Party Transfers
We only share your personal information with third parties if:
● you have given your express consent pursuant to Art. 6 para. 1 lit. a GDPR,
● it is legally permissible and necessary for the fulfilment of a contractual relationship with you pursuant to Art. 6 para.1 lit. b GDPR,
● there is a legal obligation to pass on the data in accordance with Art. 6 para. 1 lit. c GDPR,
● the disclosure pursuant to Art. 6 para. 1 lit. f GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data.
We may share your personal data with affiliated and non-affiliated organizations as follows:
§ 6 Third Country Transfers
The storage as well as the processing of your personal data as described above may require that your personal data are ultimately transferred to, and/or stored at, a destination outside of your country of residence, including countries outside the European Economic Area (“EEA”), whose legislation on the protection of personal data differs from that of the European Union, for the purposes of internal management services as well as of commercial communication and promotional operations.
In the event that the recipient country does not ensure a level of data protection equivalent to that of the European Union, we undertake to take all appropriate guarantees, either on the basis of an adequacy decision, in particular with US Privacy Shield certified companies, or, in the absence of such a decision, on the basis of appropriate guarantees, such as binding corporate rules, standard contractual clauses adopted by the European Commission, a code of conduct or a certification mechanism duly approved by the competent authority. A copy of the appropriate and suitable safeguards for those international data transfers, which can be obtained by sending an e-mail to the following address: help@ridehive.com.
§ 7 Cookies
We use Cookies on our website. As you have the possibility for webview in the App, such cookies may be in place when using such functions of the App as well. Cookies are small files which are sent by us to the browser of your terminal device and stored there as part of your visit to our internet pages. Some functions of the webview cannot be offered without the use of technically necessary Cookies. Other Cookies allow us to perform various analysis.
Before we set any, not technically necessary, Cookies, we obtain your consent via the Cookie Banner respectively the Cookie Settings in accordance with Art. 6 para. 1 lit. a GDPR. You can of course change your preferences at any time in the Cookie Settings.
Further information can be obtained from our Cookie Policy on ridehive.com.
§ 8 Tools for Tracking and Analysis
We use tracking and analysis tools to ensure continuous optimization and user-oriented design of our App. With the help of tracking measures it is also possible for us to statistically record the use of our App by users and to further develop our online offer for you with the help of the knowledge gained.
In the context of our App, we use third-party provider to help us tracking and analysing usage behaviour.
-
Adjust
a. Scope and Purpose of Processing:
Adjust defines data processing as the “collection, use, retention, alteration, transmission, blocking or deletion of personal data”. For the purpose of processing, “device and connection data are read out when visiting a website and when interacting with online advertisements and are stored for the recognition of a user as well as for tracking his usage behavior.”
“The purpose of the collection of this data is the processing of data for analyzing the user activities of end-users and thus optimizing the advertising campaigns [...]. Data Processing includes the following data:
● IP addresses
● MAC addresses
● Device IDs including all advertising IDs
● HTTP Header including Processor’s SDK version and user agent (country, language, local settings, (version of the) operating system) as well as the app-version
● User device and web activity information
● App and event token”
See Adjust’s General Terms and Conditions
b. Legal Basis:
Adjust’s services are GDPR compliant and are defined in a written agreement (DPA) as defined in art. 28 European General Data Protection Regulation (“GDPR”). (https://www.adjust.com/terms/gdpr/)
c. Storage Period:
The storage period of the data passed on to Adjust for processing is limited to 180 days.
2. Flurry
a. Scope and Purpose of Processing:
Flurry analyzes the data collected by Wunder Fleet. This data concerns the characteristics and activities of end users of your applications. Flurry’s service collects, retains and uses the information collected in our use of the service, “including without limitation, [...] precise location data as defined by [our] settings, characteristics and activities of end users of your applications, and, with respect to the User Acquisition Analytics Service and the Device Data Ingestion Service, the characteristics and activities of your applications, customers, campaigns, and marketing efforts (collectively, the “User Data”).”
As the Data Controller, Wunder Fleet determines the personal data that Flurry will process on our behalf.
For further information, refer to Flurry’s Terms of Service.
b. Legal Basis:
Flurrys’s services are GDPR compliant and are defined in a written agreement (DPA) as defined in art. 28 European General Data Protection Regulation (“GDPR”):
“Personal Data (as defined under GDPR) collected and provided by you from data subjects within the European Economic Area and the processing thereof under the Agreement is governed by the terms and conditions of the Data Processing Agreement (hereinafter, the “DPA”)“.
See Point 14 of Flurry’s Terms of Service.
c. Storage Period:
The storage period of the data passed on to Adjust for processing is limited to 180 days.
§ 9 Hyperlinks
Our App contains hyperlinks to websites of other providers. When you activate these hyperlinks, you will be directed directly to the other providers' website. You will recognize this when the URL is changed. Please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal information to these websites.
§ 10 Your Rights as a Data Subject
If your personal data are processed, you are a data subject within the meaning of the General Data Protection Regulation (GDPR) and the following rights apply to you:
● Pursuant to Art. 15 GDPR you can request information about your personal data processed by us.
In particular, you may obtain information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the right to lodge a complaint with a supervisory authority, the origin of your data, if not collected from us, about transfer to third countries or international organisations, and the existence of automated decision-making, including profiling and, where applicable, meaningful information about the logic involved.
● Pursuant to Art. 16 GDPR you can immediately demand the correction of incorrect data or the completion of your personal data stored with us.
● Pursuant to Art. 17 GDPR, you may request the deletion of your personal data stored by us, provided that the processing is not necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims.
● Pursuant to Art. 18 GDPR, you can request the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful, if we no longer need the data and if you refuse their deletion because you need to establish, exercise or defend legal claims. You are also entitled to the right under Art. 18 GDPR if you have objected to the processing in accordance with Art. 21 GDPR.
● Pursuant to Art. 19 GDPR, you have the right to receive the personal data concerning yourself in a structured, commonly used and machine-readable format and to transmit such data to another controller.
● Pursuant to Art. 20 GDPR, you may request that the personal data you have provided us with be received in a structured, current and machine-readable format or you may request that it be transmitted to another person responsible.
● Pursuant to Art. 7 para. 3 GDPR you can withdraw your consent at any time. As a consequence, we are no longer allowed to continue the data processing based on this consent for the future.
● Pursuant to Art. 77 GDPR, you have the right to complain to a supervisory authority. You can contact the supervisory authority of your habitual residence, place of work or our company headquarters (Largo Guido Donegani, 2 20121 Milano, Italy).
You can exercise these rights by contacting HIVE at help@ridehive.com or by filling out and sending us the contact form found on our app.
§ 11 Right to Object
In case the processing of your personal data is based on legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR insofar as there are reasons which arise from your particular situation or if the objection refers to direct marketing. In the case of direct marketing, you have a general right to objection which will be considered without mentioning any particular situation.
§ 12 Data Security and Security Measures
We are committed to protecting your privacy and treating your personal information confidentially. In order to avoid any manipulation, loss or misuse of your data stored by us, we take extensive technical and organizational security measures that are regularly reviewed and adapted to technological progress. This includes, among other things, the use of recognized encryption methods (SSL or TLS).
However, we would like to point out that due to the structure of the internet, it is possible that the rules of data protection and the above mentioned security measures may not be observed by other persons or institutions for which we are not responsible.
In particular, unencrypted data - e.g. if this is done by e-mail - can be read by third parties. We have no technical influence on this. It is the responsibility of the user to protect the data provided by him against misuse by encryption or in any other way.