WHO IS HELY AND HOW CAN YOU CONTACT US?
Hely wants to make shared mobility easier and more accessible. By offering various vehicles of multiple mobility suppliers in one app, the user experiences more flexibility. This way sharing becomes smarter and more fun!
The party responsible for the processing of your personal data is Mobility Solutions and Services B.V., acting under the name Hely, a company having its address at Stationsplein 19A, 3818 LE Amersfoort. Hely is registered with the Chamber of Commerce under number 71891463.
All questions regarding the processing of personal data by Hely can be addressed to firstname.lastname@example.org. If you have any questions about or wishes in connection to your personal data, you may also contact our data protection officer: email@example.com.
HOW DO WE USE YOUR PERSONAL DATA?
Below is an overview of the purposes for which Hely processes your personal data. In this overview, Hely indicates the personal data Hely uses for a specific purpose, what the legal basis is for processing these data, and how long Hely stores the data. To keep things organised, we have grouped everything by type or data stream.
PRE-REGISTRATION You can make use of the Hely service when there is a Hely Hub in your neighbourhood. When you provide Hely your zip code, house number, email address and phone number, or when your employer provides this information on your behalf, Hely uses it to see whether there is a Hely Hub in your neighbourhood and to inform you about that. Some Hely Hubs are only available to specific zip codes or companies. When there is a Hely Hub in your neighbourhood, Hely uses your contact details to send you an invitation to complete your registration. Hely processes these personal data in order to take steps at your request prior to entering into a contract (Article 6.1(b) GDPR).
WAITING LIST If there is no Hely Hub in your neighbourhood or your employer does not use our services, Hely will use your personal data to inform you about that and place you on the waiting list. As soon as there is a Hely Hub in your neighbourhood Hely will contact you. Hely will anonymize your personal data within 1 year after informing you thereof.
REGISTRATION In order to complete your registration and to make use of the Hely service, you need to set up a personal account. You will provide Hely additional information, including your name, date of birth, address and gender. Hely processes these personal data in order to create your account and to allow you to use the Hely service. The processing of your personal data in this context is necessary for the performance of a contract in connection with the use of service to which you are a party (Article 6.1(b) GDPR). Hely stores your personal data for as long as you have an account and will anonymise your data 1 year after you deactivate your subscription for the purpose of financial processing. You are also able to reactivate your account within this term. Hely has a legal obligation to retain financial records for a period of 7 years.
ANONYMIZATION At the end of the aforementioned period of 1 year, Hely will anonymize your data by replacing your name, address and other contact details with fictional data. What remains is information about which Hub you used, the use of our services and the number of contact moments (not its content). These data are used for statistical purposes. For example: in 2019, there were 100 contact moments regarding the topic ‘waiting list’. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR).
USE If you rent a Hely vehicle, we may keep records on your use, i.e. the location and trip information, by means of a connectivity module (start and end of the rental period, the distance travelled in kilometres, the location of the vehicle and any defects it may have). Hely processes these data for administrative purposes and to invoice your use. This makes the processing of your personal data necessary for the performance of the contract to which you are a party (Article 6.1(b) GDPR). Hely also uses these data to analyse the use of Hely vehicles, which is necessary to safeguard Hely’s legitimate interests (Article 6(1)(f) GDPR).
DEVICE SETTINGS For the Hely app to function properly, the following will be required: the camera on your phone to scan QR codes on our vehicles, Bluetooth, and a sound internet connection to operate the locks on our vehicles. You can also report damage in the app by snapping a picture with your phone camera. In the app, you can consent to the use of the camera, Bluetooth, and turning on location services to check whether you are near a Hely Hub. You can withdraw your consent at any time by changing your phone settings. The app and the Hely service will no longer function properly, however.
The app will send you push notifications with information about the Hely service and your use, such as the start and end times of your reservations. You can deactivate or reactivate the push notifications at any time in the app’s settings menu. Receiving push notifications is optional. When deactivated, the app can still be used, but the quality of the service may suffer.
DRIVING LICENCE You can only use a shared car if you provide the document number of your driving licence. If you have a foreign driving licence, we will ask you for a copy of it. This copy or document number is requested by and provided to Hely’s partners that provide the car sharing services. They will use this information and your other personal data to assess whether you pose a fraud risk.
The copy of your driving licence and the document number are also transferred to our partner RentalCheck. You can find more information below under the heading ‘automated decision-making’.
IDIN If you do not have a driving license and want to make use of services that do not require a driving license, we use iDIN to verify the personal data provided by you during registration. iDIN lets you prove your identity using your bank’s log-in method. This is only possible if you have a Dutch bank account. Only the data needed by Hely to confirm your identity will be shared with iDIN. Hely will receive the following information: name, address and date of birth. You will be shown exactly which data you are about to share before you actually do so. For more information, you may also consult the privacy statement of your bank. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), to verify your account. Your personal data are stored for as long as you have an account and we will anonymize your data 1 year after you deactivate your subscription.
AUTOMATED DECISION-MAKING Automated decision-making refers to a decision which is taken solely on the basis automated processing of your personal data. This means processing using, for making example, software code or an algorithm, which does not require human intervention.
To prevent fraud and misuse, and to keep frauds, scammers and other (car) criminals away, Hely makes use of third party services that analyse the personal data (including the document number or copy of your driving licence) you provided upon registration. These third parties provide us with information on your reliability, creditworthiness and payment behaviour by consulting different (public) sources. Hely provides CrimiMail B.V. (RentalCheck) with your contact details on the basis of which RentalCheck does a check in several registers, such as the Tenant Misconduct Reporting Point (Meldpunt Wangedrag Huurder).
Hely also checks whether the name you provide upon registration matches the name connected to the bank account number you provided. Hely also checks the telephone number in order to verify whether this number is indeed yours and not false.
Depending on the outcome of these checks, decisions shall be made by automated means when you register for a Hely account. This means Hely may automatically decide that you pose a fraud risk; your behaviour is consistent with that of known fraudsters; or you appear to have deliberately hidden your true identity. In that case, Hely may refuse or block (registration of) your account. Hely will also use automated decision-making to temporarily or permanently block your account if your payments are in arrears. Your account will be unblocked as soon as your payment has been received. It is also possible that that you will not receive an invitation from Hely because you have displayed deviant behaviour.
Automated decision-making in the context of fraud and risk prevention is necessary for entering into, and performance of, a contract between you and Hely in relation to the use of the Hely platform. If, in these circumstances, you should object to the results of the credit check and the automated decision to deny you access to the service, or to temporarily or permanently block you, you can contact Hely to request human intervention. If you want to opt out of automatic decision-making, let us know, although it may mean you cannot make use of the Hely platform as automated decisions are necessary to provide the services in a safe manner.
For more information about your rights in relation to the processing of your personal data, please see below. If you are in arrears of more than 3 months or have committed fraud, Hely will submit your personal data to CrimiMail’s database. Just as Hely does, third parties, such as rental companies, may also consult this database before they conclude an agreement with you. Registration as a dubious tenant at CrimiMail has several consequences. Affiliated rental companies can:
Refuse to rent a vehicle to you;
ask for a higher security deposit;
require exceptional payment terms; or
require cash payment in advance.
NEWSLETTERS Hely wishes to inform you on the developments of its services, if you have signed up for Hely’s newsletters. If, at any moment, you do not wish to receive newsletters of Hely anymore, you can unsubscribe by using the opt-out option that is provided in every newsletter that Hely sends you. To subscribe you have to provide us with your zip code, house number, telephone number and email address. The processing thereof is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely direct marketing. Hely retains your email address for as long as you are subscribed to the newsletter and not longer than 3 months after you unsubscribe.
EMAIL TRACKING Hely included email tracking and link tracking features in its newsletters and emails by embedding a small transparent image pixel in the outgoing email. If the email is opened, Hely has access to certain information, such as the name and surnames of the recipient; the recipient’s email address; subject of the email; date and time in which the email was sent; confirmation that the recipient received the email; confirmation that the recipient has opened the email after it has been received; timestamp of each email opening; the history of the times (number, date and time) the recipient has opened the received email; IP from which the email was opened; browser and operating system used by the recipient who opened the email; number of links included in the email; text and URL of such links; number of clicks made on each of them by the recipient; timestamp of each click on the link; IP from which the link was clicked on and browser and operating system used by the person who has clicked on the link. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely to analyse the reach and effectiveness of the emails sent by Hely. The information is retained for 3 months.
SERVICE To provide customer service Hely may collect and process your personal data to be of service to you and to respond to any questions you submit through email or the contact form on the website, including helping you with any issues which may arise regarding our website and/or services. If you use the online chat function on our website, app or via Facebook, the data processed by Hely for this purpose are browser data and data that you enter in the contact form to or a chat conversation with Hely. If you contact Hely by telephone, the call will be recorded for training purposes.
The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely being able to serve you efficiently and to optimisee Hely´s customer service. If you have a Hely account, your personal data are stored for as long as you have an account and will anonymize your data within 1 year after you deactivate your account. In other cases, Hely will delete your personal data within 9 months after responding to your message or resolving your complaint.
CAREERS If you apply for a position at Hely, you will provide your personal data such as your first and last name, full address, email address, phone number and your CV and other attachments to your application. Hely uses this information to review your application and respond to your application. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), for recruitment. Hely retains your personal data for 4 weeks after rejection or, with your consent (Article 6(a) GDPR), for a period of 1 year.
DOES HELY SHARE YOUR PERSONAL DATA?
If your employer facilitates Hely’s services, certain data regarding the use of vehicles, such as trip data, may be disclosed to your employer. Given that this pertains to business trips, your employer is obliged to keep records of these data for the Dutch Tax and Customs Administration, as they would otherwise not be deductible.
To provide some services, Hely shares your personal data with service providers. These service providers process your personal data on behalf of Hely. The processing by service providers is governed by a so-called data processing agreement in which Hely has ensured that the service provider shall only process the personal data on instructions of Hely. Third parties are:
external hosting providers, including cloud providers for the storage and management of data;
third parties that provide tools for analytical purposes (as described above);
other specific tasks that have been outsourced include IT support, email marketing (such as MailChimp), customer service (such as the chat function).
In addition, Hely will provide your personal data to external parties, such as police and government institutions, e.g. to pay traffic fines, if Hely is obliged to do so on the basis applicable laws and / or regulations or by means of a court order or a legal verdict, or has obtained consent from you for the provision to third parties.
DOES HELY TRANSFER YOUR PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA?
Some of our service providers are also located outside the European Economic Area (EEA), in this case the United States. To comply with EU data protection laws around international data transfer, Hely only allows service providers outside the EEA to process your personal data if they apply the European Commission’s Standard Contractual Clauses (Article 46.2(c) GDPR). For more information on where and how the relevant document may be accessed or obtained, please contact us at firstname.lastname@example.org.
WHAT ARE YOUR RIGHTS?
Under the GDPR, you have a number of rights with regard to your personal data and the processing thereof:
RIGHT TO ACCESS You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to your personal data and additional information about the processing of your personal data.
RIGHT TO RECTIFICATION You have the right to request the rectification of inaccurate personal data concerning you.
RIGHT TO BE FORGOTTEN You have the right to ask us to erase your personal data (right to be forgotten) for example if the personal data are no longer necessary in relation to the purposes for which they were collected; you withdraws consent on which the processing is based, and where there is no other legal ground for the processing; or the personal data have been unlawfully processed.
RIGHT TO RESTRICTION You have the right to obtain restriction of processing of your personal data, for example when you have contested the accuracy of your personal data.
DATA PORTABILITY You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the processing is based on your consent or on a contract.
RIGHT TO OBJECT You have the right to object to processing of personal data which is based on our legitimate interests. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, you always have the right to object to processing of personal data for such marketing. In that case, we shall no longer process your personal data for such purposes.
WITHDRAW CONSENT Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You may send your request to email@example.com. Hely shall respond to your request without undue delay and in any event within 1 month of receipt of the request. That period may be extended by 2 further months where necessary, taking into account the complexity and number of the requests. Hely shall inform you of any such extension within 1 month of receipt of the request, together with the reasons for the delay. If Hely does not take action on your request, Hely shall inform you without delay and at the latest within 1 month of receipt of the request of the reasons for not taking action. In that case, you also have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.
WHAT ARE COOKIES AND HOW DOES HELY USES THEM?
In case you suspect a breach of data protection legislation and the matter is not solved amicably between us in negotiations, you also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.