Data privacy notice for use of COUP (Berlin)
Updated on 25.05.2018
The following data protection notice explains how your data will be collected and processed when using COUP.
Please take note of the notice that your e-mail address will be used for commercial purposes in the section "Making contact for purposes of communication".
Please also note our request to cover/redact non-essential data as part of the verification of your identity and driving license in the section "Data collection when registering for COUP."
RESPONSIBILITY FOR DATA PROTECTION
Under data protection law, the entity responsible for the data collection and data processing in this app is
COUP Mobility GmbH
For some of the data processing applications listed below, COUP Mobility GmbH may also share legal responsibility for data protection with our respective cooperation partners. Therefore, you may also exercise some rights directly with the respective cooperation partner. You can find information on this in the respective part of this data protection notice.
In order to protect the safety of your data during transfer, we will use an encryption method for the app that corresponds to the current State of the Art.
REQUIRED APP PERMISSIONS
We require the following authorisations from you in order for you to be able to use the COUP service. All data that we have access to as part of the authorisations will only be used for the purposes described in this data protection notice. We will not collect any data that we do not genuinely need for the purposes described. The legal basis for the processing of your app data is Art. 6 Sect. (1)(b) of the EU General Data Protection Regulation.
We need access to your camera in order to verify your driving license and your identity. We are legally obligated to do so. You can find more information on identity and driving license verification in the section "Data collection when registering for COUP".
Using Bluetooth, the COUP app computes what is referred to as the Challenge with which you can access your scooter and then return it after your trip.
We need information on your location in order to be able to show you whether there is a scooter near you and how you can reach it using Google Maps (Google Ireland Limited). You can find more information on data processing by Google Maps in the section "Data processing while using COUP (app and scooter)".
DATA COLLECTION WHEN REGISTERING FOR COUP
SECTION 1: CREATING YOUR COUP ACCOUNT
To create your COUP account, we will ask you for the following data: E-mail address, a password that you create yourself, your phone number, a credit card number, a valid MM/YY, CVC, and the card owner's name.
The use of your data is based on Article 6 Sect. (1)(b) of the EU General Data Protection Regulation:
SECTION 2: IDENTITY AND DRIVING LICENSE VERIFICATION
We are legally obligated to verify your identity and your driving license. In doing so, the processing of your data is based on Article 6 Sect. (1)(c) of the EU General Data Protection Regulation. Our cooperation partner Jumio (268 Lambert Avenue, Palo Alto, CA 94306, USA) assists us with the identity and driving license verification with a photo-based process. In this process, you will be asked to photograph your identity card (or alternatively, your passport) and your driving license. In addition, we will ask you to take a picture of yourself. This is so that we can determine that the documents presented belong to you.
We ask that you cover/redact the following non-essential data on your identity card before the verification process: Access number, document number.
The photo of the ID card and the picture of yourself will be deleted as soon as they are no longer needed for the verification process. The data will not be permanently stored. We will save the photo of your driving license for as long as you use our service for verification reasons.
The data that Jumio processes will be processed in India, the USA, and the United Kingdom. In order to ensure sufficient protection of your data even in the USA and India, we have signed the EU standard contractual clause with Jumio.
We are also legally obligated to repeat the verification of your driving license at regular intervals (approx. once per year).
SECTION 3: VERIFICATION OF YOUR E-MAIL ADDRESS
After you have finished the registration, you will receive an e-mail from us at the e-mail address you provided. This e-mail will contain a link that you need to click. Only then will your COUP account be activated. With your confirmation, we wish to ensure that the e-mail address you provided is also actually correct.
DATA COLLECTION WHILE USING COUP (APP AND SCOOTER)
The following analysis of your COUP usage (using pseudonyms) is based on Art. 6 Sect. (1)(f) of the General Data Protection Regulation, meaning our authorised interest in the evaluation of our app, and on § 15 Sect. 3 of the German Telemedia Act.
Using Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), we can show you whether there is a scooter near you and how you can reach it. To do so, Google Maps requires information on your location.
We would like to understand how COUP users use our app so that we can be able to optimise it continuously. To do so, we collect the following technical data (among others): The time at which you open the COUP app, your behaviour within the app (e.g., selecting a product), the duration of your app usage and the time you spend in specific parts of the app, device information (e.g., information on your operating system and the app version).
You can deactivate the data collection and data processing at any time in your app settings (Home screen > Settings > COUP > COUP tracking).
We use Adjust (adjust GmbH, Saarbrücker Str. 37A, 10405 Berlin, Germany) to optimise our marketing activities. The data collected via Adjust will provide information on, for example, the download of the COUP app, the online advertising channel that was generated via the download, the time the app was opened, the duration of app usage, and on frequently used app functions (particularly on successful login and completed trips). Adjust uses the user's IP and Mac addresses that are, however, hashed after collection and used by Adjust only in a pseudonymous form.
You can deactivate the data collection and data processing at any time in your app settings (Home screen > Settings > COUP > COUP tracking).
There are what we call "cloudboxes" installed in your scooter which send GPS data on your location to our service provider Invers (INVERS GmbH, Untere Industriestraße 20, 57250 Netphen, Germany) at regular intervals. Invers itself cannot map any of the data sent on your scooter—only we can do that. A reconstruction of your location based on the GPS data sent and the mapping of the sent cloudbox serial number on the scooter will only be made in the following cases and for the following purposes:
- Warning when leaving the business district: According to the Terms and Conditions, you may only end your trip with your COUP scooter within the COUP business district (Art. 6 Sect. (1)(b) of the EU General Data Protection Regulation).
- Ending the rental, e.g., after an unusually long period of use, for your and our interests (Art. 6 Sect.(1)(f) of the EU General Data Protection Regulation).
- Service questions when using your COUP scooter (e.g., valuable items in the luggage compartment, scooter will not unlock, scooter will not lock, scooter cannot be found, support if there is an accident) (Art. 6 Sect. (1)(b) of the EU General Data Protection Regulation).
- Proof in the event of an accident: If there is an accident or other case of damage (e.g., damage to the scooter), then it is in our authorised interest to be able to prove that you were driving the scooter (Art. 6 Sect. (1)(f) of the EU General Data Protection Regulation).
- Transparent billing: We record the start, park and end points for your trips in your booking history (Art. 6 Sect. (1)(b) of the EU General Data Protection Regulation).
- Placement of scooters at the locations at which you have reservations (anonymous evaluation): We wish to adjust our service to your needs (Art. 6. Sect. 1 (f) of the EU General Data Protection Regulation).
MAKING CONTACT FOR PURPOSES OF COMMUNICATION
Push messages allow us to inform you in the quickest ways possible about the status of your booking (e.g., roller is located outside of our business district, or you have forgotten to end your booking) and the service level of the COUP platform (e.g., interruptions, limitations). If you would like to opt out of this exclusive information option, you can deactivate our push messages at any time in your smartphone settings (Home screen > Settings > Messages) (Art. 6 Sect. (1)(b) of the EU General Data Protection Regulation).
We are informing you that due to our authorised interest in direct advertising (Art. 6 Sect. (1)(f) of the EU General Data Protection Regulation) that we will use your name and your e-mail address to send you information on exclusive COUP offers at regular intervals if you have booked a ride that is subject to charges. This involves offers on reduced-cost trips. If you are not interested in the offers and benefits in our informational e-mails, you can opt out of our information service at any time. If you have separately opted in to receiving our newsletter, you will also stop receiving the newsletter.
CONTACT BY TELEPHONE
Telephone contact will be made in order to be able to quickly and individually solve problems that arise as part of the individual rental processes (e.g., impossible to rent or return), meaning fulfilling the contract, Art. 6 Sect. (1)(b) of the EU General Data Protection Regulation.
TRANSFERRING YOUR DATA TO ORDER PROCESSORS OR THIRD PARTIES
Aside from the service providers listed above under "DATA COLLECTION WHEN REGISTERING FOR COUP" and "DATA COLLECTION WHILE USING COUP (APP AND SCOOTER)", we have involved order processors for the following processing activities:
- Request management
- Data storage (cloud)
- E-mail services
- Postal services/shipping
· Ticket management
Your data will only be forwarded to third parties as long as this is permissible or mandatory according to the EU's General Data Protection Law. You can be certain that COUP—for instance, in the event of a request by an investigating body—will have those responsible for data protection at COUP check every request for transferring protected data in advance.
If we transfer data to recipients located outside of the EEC, we will ensure prior to transfer that the recipient has either an appropriate level of data protection (e.g., due to an adequacy decision by the EU Commission for the respective country or an agreement to what is referred to as the EU standard contractual clause of the European Union with the recipient) or your approval of the transfer.
YOUR RIGHTS WITH REGARD TO COUP
We would like to briefly provide you information on the data protection rights that you can exercise with regard to COUP.
INFORMATION AND THE RIGHT TO BE INFORMED
You have the right to obtain information about your personal data that we have stored. To do so, please send us an e-mail to email@example.com.
RIGHT OF RECTIFICATION
COUP may only process relevant data about you. If you—for example, through exercising your right to information—should determine that any data about you is not relevant or has become irrelevant, then we are absolutely obligated to rectify this immediately.
Right to Erasure/ RIGHT TO LIMIT PROCESSING (RIGHT TO BLOCK)
COUP will only process your data for the purposes listed in this data protection notice. For the time being, we only need this data for as long as you are using our service. After this time is up, we are legally obligated with regard to specific data categories to store your data for a specific period of time. However, because we no longer need your data at this time in order to fulfil the intended purposes listed in this data protection notice, we will limit its processing, meaning we will block it for other purposes.
If you would like to delete your account, you have two options:
- Either you can request deletion within the app [Profile > Account] or
- You can send us an e-mail about this to firstname.lastname@example.org from the e-mail address with which you registered with COUP. Please also specify your full name.
You can demand that your data be deleted or its processing be limited even while using the COUP service.Deletion is, however, only possible for data that we do not need for performing the contractual relationship with you or for legally mandated archiving purposes or for verification purposes.
RIGHT OF OBJECTION
Insofar as you have a legal right to objection with regard to the data processing described in this data protection notice, we will inform you of this at the appropriate point. You also have the option to exercise your right of objection conveniently at the appropriate points.
A right of objection against (further) data processing is always available to you when processing on the basis of the legal principle "legitimate interest” and when processing based on agreement.
RIGHT TO COMPLAIN TO THE REGULATORY AUTHORITIES:
You have the right to file a complaint with the data protection authorities. To do so, you can for example contact the data protection authority that is responsible for the location of your residence or for your federal state, or you can contact the data protection authority that is responsible for us. That would be the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
In addition, you have the right to receive data that you have provided us communicated in a structured, accessible and machine-readable format and—as long as it is technically feasible—to demand that the data be forwarded to a third party.
CONTACT WITH THE PERSON RESPONSIBLE FOR DATA PROTECTION AT COUP
You can contact the person responsible for data protection at COUP directly via the following e-mail address: email@example.com.
CHANGING THE DATA NOTICE
We reserve the right to occasionally adjust parts of this data protection notice that do not require agreement so that they always fulfil the current legal requirements or to implement changes to our services in the data protection notice, such as when introducing new services. The new data protection notice will then apply to your subsequent visit. If there is a change to our services or if the introduction of a new service requires your prior approval, we will inform you of this in a timely manner and request your approval.