Data protection statement

General notes
As at: 10.07.18


Scope of the Privacy Policy

Free2Move is a service that gives you access to thousands of carsharing vehicles. You can switch between cars, scooters and bicylcles of different providers with just one click. Searching between different apps for the cheapest or nearest vehicle belongs to the the past. You can now easily compare ALL vehicles on a map and book your next trip.

This Privacy Policy applies to the Free2Move App

Controller

GHM Mobile Development GmbH is responsible for data processing within the meaning of the General Data Protection Regulation (GDPR). We decide about the purposes and means of processing personal data. Our contact details are: GHM Mobile Development GmbH, represented by Michel Stumpe and Fabian Kofler, Dessauer Straße 28-29, 10963 Berlin. You can reach us by e-mail at info@free2move.me

Data protection officer

activeMind AG Technologie- und Managementberatung
Chairman: Klaus Foitzick
Chairman of the supervisory board: Manfred Keßler
Kurfürstendamm 56
10707 Berlin
HRB 135796 AG München
Email: free2move@activemind.de

Purposes of data processing

Our service enables you to search for carsharing vehicles across all providers, to book these vehicles and to register with various carsharing providers. In order to offer our service and to fulfil our contractual obligations towards our users, we must process personal data. This applies to the registration of a Free2Move account and, if the user so wishes, the registration with carsharing providers.

When using our app, we also process data in order to ensure and improve the security and functionality of our app and to statistically evaluate its use.

We are convinced of our service and want to inspire even more users. That's why we advertise. In this context, we process data to measure the success of our advertising campaigns and to improve our advertising.

1. Registering a Free2Move account

When registering a Free2Move account, we process the following personal data: E-mail address, first and last name, password. If you sign-up via a social media account (e.g. Facebook or Google+), further data from the profile stored there can be transferred to us. When registering via a Facebook account, Facebook provides us with your name, e-mail address, location and date of birth. These data are not stored by us or processed in any other way. If you register via Google+, only your name and e-mail address will be transmitted and saved by us.

Your data is protected against unauthorized access and will not be shared with third parties. Legal basis for such data processing is Art. 6 (1) lit. b) of the GDPR. As far as legal regulations do not prescribe longer storage, these data will be deleted if you delete your user account.

2. Booking of carsharing vehicles

The data required to book a carsharing vehicle may vary from provider to provider. This data usually include your access data for the user account with the respective provider (e.g. customer number, email address, PIN and password). This data will be used to make bookings with your user account at the respective provider.

We only collect the access data which is necessary for a booking with the respective provider. We do not use this data for any other purpose and we do not share this data with third parties except the respective carsharing provider.

Legal basis for such data processing is Art. 6 (1) lit. b) GDPR. As far as legal regulations do not prescribe longer storage, these data are deleted from our system if you delete your user account.

When booking a vehicle via our app, we store this information as well as certain additional information (such as the operating system used, the place and time of booking or the provider). We use this information in aggregated form to generate reports on the use of our services. These reports do not contain any personal data.

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. As far as the individual information, which we summarize to reports, allows a personal reference, these data are deleted at the latest after 36 months, as far as legal regulations do not prescribe a longer storage.

3. Registration with carsharing providers

Our service offers users the opportunity to register with various carsharing providers. If you decide to register via our app, we store the information required to register with the available providers. These details include first and last name, gender, date and place of birth, address, ID and driving licence data, your mobile phone number, SEPA bank account and a PIN and password of your choice. We store this data so that you can also register with other providers at a later time without having to re-enter your details.

Legal basis for such data processing is Art. 6 (1) lit. b) GDPR. As far as legal regulations do not prescribe longer storage, these data will be deleted if you delete your user account.

When registering with a carsharing provider via our app, we also store additional anonymous information (such as the operating system used, the time of registration, the country from which the registration was made). We use this information in aggregated form to generate reports on the use of our services. These reports do not contain any personal data.

4. Verification of your identity and driving licence

To register with a carsharing provider, we need to make sure that you are actually the person you say you are and that you have a valid driving license. We work with Jumio Corp. 21 Worship Street, London, EC2A 2DW, United Kingdom ("Jumio") to verify your identity and driving licence. Jumio operates a verification service that checks the authenticity of your ID and driving licence documents and matches the images in these documents with a current photo of you. Jumio processes the following data on our behalf: First and last name, date and place of birth, address, a current photo, number of the identification document, date and country of issue of the identification document, expiry date of the identification document, a photo of the identification document, driving licence number and date of issue of the driving licence, if applicable the expiry date of the driving licence and the driving licence class.

This data is stored on a server in the European Union and is protected against unauthorised access. We use the data for registration with a carsharing provider only. Legal basis for such data processing is Art. 6 (1) lit. b) GDPR. The photos taken during the verification process will be deleted after 12 months. As far as legal regulations do not prescribe longer storage, the remaining data will be deleted if you delete your user account.

5. Customer service

If you contact our customer service by e-mail, the personal data transmitted with your request will be stored. We use this data only for answering your inquiry.

For the management of support requests we use Zendesk, a customer service software prvoided by Zendesk Inc. "("Zendesk"). Support requests, including e-mail addresses, are stored on a Zendesk server (in the EU or US) secured against unauthorized access

Legal basis for such data processing is Art. 6 (1) lit. f.) GDPR. The data will be deleted after 24 months at the latest.

6. User feedback

If you send us feedback on your own initiative or as part of one of our surveys, we process the data provided by you for performing the survey and for evaluating and, if necessary, implementing your feedback. Legal basis for this data processing is Art. 6 (1) lit. f) GDPR or Art. 6 (1) lit. a) GDPR, if we request your consent to participate in the survey. If you have not agreed to a longer-term use and legal regulations do not require a longer storage, the data will be deleted if you delete your user account.

7. Newsletter and own market research

If you have registered for our newsletter, we will use your e-mail address to send you information about our service (e.g. new functions of our app) on a regular basis. You can unsubscribe from the newsletter at any time by clicking the unsubscribe link in the newsletter. Legal basis for such data processing is Art. 6 (1) lit. a) GDPR.

We are always working on further improving our service. We depend on the feedback and participation of our users. To this end, we send e-mails to individual users to invite them to participate in – of course voluntary – usability tests. Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. You may opt out of receiving these e-mails at any time by sending an email to help@free2move.me

8. Information we receive as a result of using the app

When using our app, we collect data to

Mixpanel

We use Mixpanel for the statistical evaluation and analysis of the use of our app. Mixpanel is an analysis tool provided by Mixpanel Inc. "("Mix Panel"). The scope of data processing depends on whether the app is used by a registered user or an unregistered user:

The data is stored on a Mixpanel server in the US and is protected against unauthorized access. Mixpanel holds a Privacy Shield certification that guarantees an adequate level of data protection. We use this data only to statistically evaluate the use of our app and our service and to adapt our offer even better to the needs of our users on the basis of these findings. The data will not be shared with third parties and will not be used for advertising purposes.

You can object to the processing of your data for this purpose at any time by sending an e-mail to help@free2move.me

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. The data of registered users will be deleted when you delete your user account. In any case, the data will be deleted after 5 years at the latest.

Braze

We also collect information about the use of our app to better tailor our advertising and information campaigns to our users' usage habits. We use Braze, a marketing platform by Braze Inc. "("Braze"). The type and scope of data processing depends on whether the app is used by a registered user or an unregistered user.

In both cases we process the following information: Technical information about the device and operating system used, the carsharing providers stored on the device, the country from which the app is used, the number of bookings via the app and certain information about a booking (provider and vehicle details - so-called "properties"). Properties are stored for a maximum of 30 days. This data will then be deleted so that details of your use can no longer be traced.

The data is stored on a Braze server in the European Union and is protected against unauthorized access.

Braze processes this information on our behalf to compile reports on the use of our app. We use this information to send you information about our service in the form of push messages within the app. In this way we inform you about new features of our app, special offers and promotions (like competitions), but also about possible restrictions of the services of the providers you use (e.g. because of special occasions like holidays or events).

If you have not expressly agreed to receive our newsletter, we will inform you only by push messages within our app. You can deactivate the receipt of push messages at any time in the settings of your mobile device. Only we can send you push messages. We will not share your data with third parties at any time.

You can object to the processing of your data for this purpose at any time by sending an e-mail to help@free2move.me

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. The data of registered users will be deleted when you delete your user account. In any case, the data will be deleted after 24 months of inactivity of the user at the latest.

Google Analytics

For the statistical evaluation and analysis of the use of our app we also use Google Analytics, a service of Google Inc. "("Google). We do not process any personal data, but only anonymous demographic information, such as technical information about the device and operating system used, the app version, language settings and screen resolution as well as the location from which our app is used. The information generated by Google Analytics about your use of our app is usually transferred to a Google server in the US and stored there. The function for IP anonymization is activated. This means that your IP address will previously be shortened by Google within Member States of the European Union or in other countries party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the US and shortened there. The IP address is not merged with other Google data.

Further information on data processing within the framework of Google Analytics and Google's privacy policy can be found here: https://support.google.com/analytics/answer/6004245?hl=en. Google holds a Privacy Shield certification that ensures an adequate level of data protection. You can object to the processing of your data for this purpose at any time by sending an e-mail to help@free2move.me

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. These data will be deleted after 26 months at the latest.

Google Firebase

We use Google Firebase Cloud Messaging, a Google service, to send push messages within our app. The information sent by Google Firebase is usually transmitted to a Google server in the US and stored there for a maximum of four weeks. To send the messages, anonymized installation UUIDs are used. In addition, we use Google Firebase Crashlytics to detect and process app crashes. An anonymous installation UUID is also used in crashlytics to identify crashes. The crash information will be stored for a maximum of 180 days. Google Firebase transmits all information in encrypted form.

Further information on data processing within the framework of Google Firebase and Google's privacy policy can be found here: https://firebase.google.com/support/privacy/.

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR.

Adjust

We use Adjust to measure the success of our advertising campaigns. Adjust is an analysis tool provided by Adjust GmbH ("Adjust") with which the effectiveness of mobile advertising campaigns can be measured. Adjust uses IP and hashed Mac addresses of users of the app for analysis, but only in anonymous form. It is not possible to identify the user.

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. The data will be deleted after 6 hours at the latest.

9. Facebook Analytics

If you have registered for our app via your Facebook account, we receive information from Facebook about your interactions on Facebook with our content (posts and ads) and about certain actions within our app (such as installing the app, starting a usage, clicking a registration link, creating a Free2Move account or booking a car). We only receive aggregated information that does not allow any conclusions about the user's person. We use this information to get to know our users better and to better tailor our Facebook ads to their usage habits.

The purpose and scope of data processing by Facebook as well as your rights in this respect visà-vis Facebook and setting options for the protection of your privacy are set out in Facebook's data protection information at https://www.facebook.com/privacy/explanation. You can find the settings for controlling ads on Facebook at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

Legal basis for such data processing is Art. 6 (1) lit. f) GDPR. The data will be deleted after 24 months at the latest.

10. Your rights with regard to the processing of personal data

As a person concerned, you have various rights in connection with the processing of your personal data.

If you wish to assert your rights to information, correction, deletion, restriction of processing, object to data processing or revoke your consent to data processing, please send an e-mail to help@free2move.me

Right to information

You have the right to information about your personal data processed by us and to the following information:

Right to rectifaction

You have the right to immediately request the rectifcation of inaccruate personal data concerning you and, taking into account the purposes of the processing, the completion of incomplete personal data - also by means of providing a supplementary statement.

Right to erasure

You have the right to request the immediate erasure of personal data concerning you and we are obliged to delete this data immediately if one of the following reasons applies:

If we have made personal data public and are obliged to erase personal data in accordance with Art. 17 (1) GDPR, we will take appropriate measures, including technical measures, taking into account the available technology and the implementation costs, to inform controllers who process the personal data you have requested the erasure by such controllers of any links to or copies or replications of, those personal data.

These rights do not apply to the extent that processing is necessary.

Right to restriction of processing

You have the right to request us to restrict processing if one of the following conditions is met:

Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit this data to another controler without hindrance, provided that the processing is based on a consent pursuant to Article 6 (1) lit. a) or Article 9 (2) lit.a ) GDPR or on a contract pursuant to Article 6 (1) lit. b) GDPR and the processing is carried out by automated means.

When exercising your right to data portability, you have the right to have your personal data transferred directly by us to another controller, insofar as this is technically feasible.

Right of objection

You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you which is based on Article 6(1) lit. e) or f) GDPR, including profiling based on these provisions. We will no longer process your personal data unless we can desmonstrate compelling legitimate reasons for the processing that override your interests, rights and freedoms or the processing serves to assert, exercise or defend legal claims.

Right of revocation

You have the right to revoke your consent tot he processing of your personal data at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until revocation

Right to lodge a complaint

If you consider that the processing of personal data concerning you infringes the GDPR, you can lodge a complaint with a superverisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority which is competent at our place is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstraße 219, 10969 Berlin, Visitors' Entrance: Puttkamer Straße 16 - 18 (5th floor), Phone: 030/138 89-0, Fax: 030/215 50 50, E- Mail: mailbox@datenschutz-berlin.de