Privacy Statement Hely (by Mobility Solutions and Services B.V.) - ENGLISH VERSION

Hely considers the protection of your personal data to be of  great importance. We have  created this privacy statement to explain how we process your data, potentially share it with other parties, and what rights you have in this regard. We recommend that you read this privacy statement carefully. This privacy statement applies to everyone who uses Hely's services either via the Hely app (App) or the website. Please refer to  our User Terms for more information regarding the use of the Hely services.

1. Who is responsible for processing your data?

In this privacy statement, Hely, represented by Mobility Solutions and Services B.V. (hereinafter: "Hely" or "we"), describes how we, as the data controller (within the meaning of the General Data Protection Regulation), process your personal data that you provide to us or that we obtain through the use of our App and the vehicles. Hely also describes which type of data we provide to Partners with whom Hely collaborates to facilitate the Service to you as the User. If you apply for a job with us, we process your data as described in this separate privacy statement: https://jobsatpon.com/privacy-statement/.

2. What is personal data?

Information about an identified or identifiable natural person is personal data. Whether certain information qualifies as personal data also depends on whether Hely has legal means that can reasonably be expected to be valid to identify an individual.

3. Personal data we process

We process personal data because you provide data to us when entering into an Agreement with us or when you use our services via your employer or privately. We may receive data from and/or provide data to Partners with whom Hely collaborates to enable services. These Partners are data controllers for the personal data they process and may provide to us. For more information on how these Partners process your personal data and your related rights, we refer you to the Partners' privacy statements.

Hely services may include various types of mobility services, including but not limited to the use of shared vehicles and adjacent mobility solutions such as shared cars, shared bicycles, and ride registration. If you enter into an Agreement with Hely, we may process the following personal data to provide the service:

• Name and address
• Phone number for user verification and customer service purposes
• Email address (business email when the Service is facilitated by the employer)
• Date of birth
• Driver's license details (driver's license number, first and last name, and expiration date)
• Credit card and other payment details

If you use Hely's services or directly contact us, we process the following (personal) data in the context of our service, depending on your exact usage:

• Data used to access the App, such as your username and password (your password is stored encrypted and is not visible to us)
• Data about the use of vehicles, such as: type of ride (business/private) and from the start and end of each ride: date, time, location, distance, duration, and mileage
• Your communication preferences and settings
• Browsing behavior, set by our own observations or cookies, including data related to your device, such as a MAC address, IP address, or other number, and the pages you visit
• Customer satisfaction data such as your responses or feedback to our surveys
• Data about your use of our customer service

As a user of the App, you may choose to travel with a shared car. To ensure that you are authorized to operate these vehicles, we need to verify your identity and the validity of your driving authorization. To make this as easy as possible, we ask you to scan a copy of your driver's license with our App and then take a 'selfie'. We then compare the ID photo with the selfie through digital identity analysis to establish that you truly belong to the shown ID. The validation of your identity is carried out by our Partner Onfido. We ask for your permission in the App before processing these data. We also perform a validation with the RDW on the validity of the driver's license and the associated driving authorization. We delete the scanned driver's license and photo as soon as your identity/driving authorization is established but always within 10 days. We do not use the data for other purposes. After making the scan, your social security number (BSN) is immediately automatically covered/masked using artificial intelligence techniques. Your BSN is not visible to us. Your signature is only used during the validation of the document to determine the authenticity of the document and is not further processed in our systems for other purposes. It is also possible to manually cover your BSN.

If the above scan method does not work or you do not wish to use this scan method, we can also check your data in another way: you can video call us (this video call is not recorded/saved). Contact our customer service department for this, see article 13.

For using these services, we take the following data from your driver's license: driver's license number, first and last name, and expiration date. We do this to prevent you from potentially unlawfully operating a vehicle.

4. Processing: legal grounds and legitimate interests

The processing of personal data takes place based on the following legal grounds:

• Consent;
• Execution of the Agreement with you;
• Legal obligation;
• Legitimate interest of Hely or a third party. Legitimate interests include: security, fraud prevention, and crime prevention, IT management, research and analysis to improve products or services, and legal purposes.

5. Purposes for processing personal data

When processing your personal data, we work carefully. We only use data necessary for the service. Hely processes your personal data for the purposes listed below. The number behind each purpose corresponds to the legal ground mentioned in Article 5 of this privacy statement. 

• Administration, including invoicing and collecting funds for the use of our Services individually (you) or collectively (for example your employer)  [grounds 2 or 3];
• Communicating with and informing you and/or contract Partners (such as your employer) [grounds 2 or 4];
• Providing customer service, including questions regarding the Services of Hely in line with the Agreement , handling complaints and requests [ground: 2];
• In certain cases, maintaining communication with service Partners within our network to proactively contact users in the context of defects or malfunctions [grounds: 2 or 4];
• Processing information and create management reports on rides and related costs; made with (mobility) services via the Hely app to you and/or your employer. The information provided to your employer and the processing of personal data into management information is not directly traceable to you [grounds 2 or 4];
• Providing insight to the Hely app user and/or employer on individual transactions made and related costs. Private transactions and details of business transactions are only visible to the User [ground 2]; Hely provides the employer with all data necessary to comply with (tax) legislation and for the employer to properly manage the fleet, such as handling fines [ground 2];
• Checking whether the User complies with the (additional) binding Instructions  of Hely or the Location Partner/the Business Account, such as an employer [ground 2 ].

• Processing personal data into own management information [grounds 2 or 4];
• Conducting market research, including measuring customer satisfaction, to improve our business operations, brands, services, and products [ground: 4];
• Complying with legal obligations, resolving disputes, and enforcing our rights and Agreements [grounds: 2, 3, or 4];
• Analyzing cookies on our website(s). We do this to tailor the content of our communications to your personal preferences as best as possible [grounds: 1 or 4];
• Preventing or recovering damage caused by fraud, theft, or other misuse of the services provided [ground 4].

6. No processing of data from Users under 18 years

We do not intend to collect data from Users under 18 years. We advise parents to be involved in their children's (online) activities to prevent Hely from processing their personal data. Users of Hely's services must be at least 18 years or older.

7. Sharing with third parties

Hely shares your personal data with third parties in, among other things, the following cases and with corresponding reasons. The number behind each purpose corresponds to the legal ground mentioned in Article 5 of this privacy statement. Hely shares your data with:

• Service Partners from Hely's distribution network to facilitate the Service [grounds: 1, 2, or 4], for example:
•  
  • Telematics providers for recording trips (start/stop location and number of kilometers)
  • External hosting and cloud providers for data storage and management
  • Authentication providers for verifying driver identity and driver's license validity
  • Payment providers for facilitating payments and determining creditworthiness
• If we are legally required to provide personal data to third parties [ground: 3];
• With your employer(s), if applicable. Your data is shared with your employer to provide insight into trip registration for business purposes and to substantiate invoiced charges. Your employer may be legally required to maintain a trip administration for business trips [ground: 2];
• With Partners who are part of the Service, such as classifying, administering, and settling trips, both business and private [ground 2];
• With law enforcement authorities such as the Public Prosecutor's Office or regulators when we detect or suspect a violation of third-party rights, criminal offenses, or abuse. We only provide the necessary (personal) data to third parties who have a legitimate interest or to authorities serving the public interest. [grounds: 3 or 4];
• With parties assisting Hely in its services and not acting as processors, such as payment providers, collection agencies, accountants, and (legal) advisors. [grounds: 2, 4];
• With third parties acting as 'processors', such as hosting service providers and research agencies, to conduct market research or customer satisfaction surveys. If these third parties are classified as processors under applicable data protection legislation, Hely will enter into written Agreements with these third parties. These service providers will only process personal data in accordance with Hely's instructions and under Hely's control.

If personal data is transferred to a recipient abroad, this usually only happens to a recipient in a country that, according to the European Commission, offers an adequate level of protection for personal data. If personal data is sent to a recipient in a country that does not offer adequate protection, Hely will ensure that the legally required safeguarded. If you wish to receive more information about the transfer of your personal data to countries outside the European Economic Area, you can contact Pon's Data Protection Officer (see Article 13).

8. Analytical, statistical, and scientific processing

We may process your data for market research, historical analysis to discover trends and correlations in data, or to contribute to research for societal and/or scientific purposes. This data may include travel movements, used modalities, times, transfer locations, costs, preferences, customer service contact, or customer satisfaction surveys, where we take appropriate measures (such as hashing, aggregation, and encryption) to protect your privacy so that personal data is no longer directly traceable to you as a natural person (pseudo-anonymous). We process your data based on the legal ground of legitimate interest. You have the option to stop processing personal data for the purposes described in this article at any time via the settings menu in the App or via privacy@hely.com.

9. Retention of your data

We retain personal data as long as necessary, for example, as long as you are a customer or continue to show interest in Hely's services. In some cases, we are also legally required to retain your data. We use the following retention periods:

• Data we process to provide our services to you, we retain as long as you continue to use the service, such as your name, contact details, and other account details.
• Hely retains your personal data as long as your account is active and anonymizes your personal data within 1 month after you deactivate your account unless the financial settlement has not completely occurred yet. You can also reactivate your account within this period.
• Data we process when you contact our customer service, we retain as long as you are a customer or up to a maximum of two years after the last contact. An exception applies to phone calls that may be recorded for training purposes; these are deleted within 30 days. Also, data related to complaints may be retained for up to five years after handling the complaint.
• Financial/tax data required for, for example, invoices, contracts, or internal reports, we retain for at least seven years based on tax legal obligations. 

At the end of the retention period, Hely will permanently delete or anonymize your data.

10. Tracking website visits

When you visit or use our website(s), services, applications, communication services (such as email), and tools, we may use cookies, web beacons, and other similar technologies to store information to personalize advertisements and provide you with a better, faster, and safer customer experience. If you do not want cookies, you can not use the website. For more details about the use of cookies, we refer you to our cookie statement (https://www.hely.com/cookies/). On our website(s), you may find links to other websites. We are not responsible for how these websites handle your personal data. Please refer to the privacy statement of the website you visit.

11. Your rights, including the right to object

You have the right to know which personal data we process about you and to whom we provide your personal data. You also have the right to obtain information about the Hely app provided to you. If you have given consent for the processing of your personal data, you also have the right to withdraw it. If you wish to access, correct, update, restrict, or delete the personal data we process about you, object to the processing of personal data, or direct marketing, or if you wish to receive an electronic copy of your personal data to transfer it to another company (to the extent this right to data portability is provided to you by applicable law), you can contact our customer service department using the contact details mentioned in Article 13. We request you to describe as clearly as possible which personal data your request relates to. We will respond to your request as soon as possible, but in any event within the legally required timeframes. Finally, you have the right to file a complaint with the Data Protection Authority. You can only exercise your rights to the extent permitted by law. To verify that a request is made by you, we may ask for a copy of your ID with this request. In this case please make sure to make your make your photo, MRZ (machine-readable zone; the strip with numbers at the bottom of the passport), passport number, and Citizen Service Number (BSN) unrecognizable. We will destroy the copy of your ID immediately after identifying you.

12. Security and data protection

We implement appropriate security measures to prevent misuse, loss, unauthorized access, unwanted disclosure, and unauthorized modification as much as possible. Hely has taken both technical and organizational measures to secure your personal data, such as applying encryption techniques. These security measures are periodically reviewed based on threats and current security standards.

13. Contact

Hely is legally established under the name Mobility Services & Solutions B.V. at Stadsring 115, 3817 AX in Amersfoort and has an office at the same address. For questions and/or comments regarding this privacy statement, you can contact: 

Hely 

Attn: Customer Support

Stadsring 115 

3817AX Amersfoort 

Tel. 085 0012126 

support@hely.com 

privacy@hely.com (specific privacy questions) 

We have a Data Protection Officer registered with the supervisory authority, the Data Protection Authority. This is someone who supervises the application and compliance with privacy legislation such as the General Data Protection Regulation (GDPR) within our organization. Our Data Protection Officer can be reached by email at privacy@pon.com and by post at the above address (attn. 'Privacy Office').

14. Changes

The way we process personal data and the composition or amount of data we process may change. Therefore, we reserve the right to amend this privacy statement. You will be notified if necessary. This privacy statement was last updated on July 10, 2024.