Hely is a start-up that wants to make shared mobility easier and more accessible. By offering various vehicles of multiple mobility suppliers in one app, the user experiences more flexibility. This way sharing becomes smarter and more fun! The party responsible for the processing of your personal data is Mobility Solutions and Services B.V., acting under the name Hely, a company having its address at Barbara Strozzilaan 201, 1083 HN Amsterdam. Hely is registered with the Chamber of Commerce under number 71891463. All questions regarding the processing of personal data by Hely can be addressed to firstname.lastname@example.org. If you have any questions about or wishes in connection to your personal data, you may also contact our data protection officer: email@example.com.
Below is an overview of the purposes for which Hely processes your personal data. In this overview, Hely indicates the personal data Hely uses for a specific purpose, what the legal basis is for processing these data, and how long Hely stores the data. To keep things organised, we have grouped everything by type or data stream.
You can make use of the Hely service when there is a Hely Hub in your neighbourhood. When you provide Hely your zip code, house number, email address and phone number, Hely uses these data to see whether there is a Hely Hub in your neighbourhood and to inform you about that. When there is a Hely Hub in your neighbourhood, Hely uses your contact details to send you an invitation to complete your registration. Hely processes these personal in order to take steps at your request prior to entering into a contract (Article 6.1(b) GDPR).
If there is no Hely Hub in your neighbourhood, Hely will use your personal data to inform you about that and place you on the waiting list. As soon as there is a Hely Hub in your neighbourhood Hely will contact you. Hely will anonymize your personal data within 1 year after informing you thereof.
In order to complete your registration and to make use of the Hely service, you need to set up a personal account. You will provide Hely additional information, including your name, date of birth, address and gender. Hely processes these personal data in order to create your account and to allow you to use the Hely service. The processing of your personal data in this context is necessary for the performance of a contract in connection with the use of service to which you are a party (Article 6.1(b) GDPR). Hely stores your personal data for as long as you have an account and will anonymise your data 1 year after you deactivate your subscription for the purpose of financial processing. You are also able to reactivate your account within this term. Hely has a legal obligation to retain financial records for a period of 7 years.
At the end of the aforementioned period of 1 year, Hely will anonymize your data by replacing your name, address and other contact details with fictional data. What remains is information about which Hub you have been a member of, the use of our services and the number of contact moments (not its content). These data are used for statistical purposes. For example: in 2019, there have been 100 contact moments about the subject ‘waiting list’. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR).
If you do not have a driving license and want to make use of services that do not require a driving license, we use iDIN to verify the personal data provided by you during registration. iDIN lets you prove your identity using your bank’s log-in method. Only the data needed by Hely to confirm your identity will be shared with iDIN. Hely will receive the following information: name, address and date of birth. You will be shown exactly which data you are about to share before you actually do so. For more information, you may also consult the privacy statement of your bank. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), to verify your account. Your personal data are stored for as long as you have an account and we will anonymize your data 1 year after you deactivate your subscription.
Automated decision making refers to a decision which is taken solely on the basis automated processing of your personal data. This means processing using, for making example, software code or an algorithm, which does not require human intervention. To prevent fraud and misuse, and to keep frauds, scammers and other (car) criminals away, Hely makes use of third party services that analyse the personal data you provided upon registration. These third parties provide us with information on your reliability, creditworthiness and payment behaviour by consulting different (public) sources. Hely provides CrimiMail B.V. (RentalCheck) with your contact details on the basis of which RentalCheck does a check in several registers (such as Reporting point Misconduct Tenant (Meldpunt Wangedrag Huurder), credit score, official public records information such as fraud record information and insolvency records and phone number validation. Hely also checks whether the name you provide upon registration matches the name connected to the bank account number you provided. Hely also checks the telephone number in order to verify whether this number is indeed yours and not false. Depending on the outcome of these checks, decisions shall be made by automated means when you register for a Hely account. This means Hely may automatically decide that you pose a fraud risk; your behaviour is consistent with that of known fraudsters; or you appear to have deliberately hidden your true identity. In that case, Hely may refuse registration of your account. Automated decision-making in the context of fraud and risk prevention is necessary for entering into, and performance of, a contract between you and Hely in relation to the use of the Hely platform. In the circumstances described above and where automated decision-making is used in the assessment of your registration and fraud prevention, you can contact Hely to request that any declined decision is reconsidered by a human. If you want to opt -out of automatic decision-making, let us know, although it may mean you cannot make use of the Hely platform as automated decisions are necessary to provide the services in a safe manner. For more information about your rights in relation to the processing of your personal data, please see below. If you are in arrears of more than 3 months or have committed fraud, Hely will submit your personal data to CrimiMail’s database. Just as Hely does, third parties, such as rental companies, may also consult this database before they conclude an agreement with you. Registration as a dubious tenant at CrimiMail has several consequences. Affiliated rental companies can:
refuse to rent a vehicle to you;
ask for a higher security deposit;
require exceptional payment terms; or
require cash payment in advance.
Hely wishes to inform you on the developments of its services, if you have signed up for Hely’s newsletters. If, at any moment, you do not wish to receive newsletters of Hely anymore, you can unsubscribe by using the opt-out option that is provided in every newsletter that Hely sends you. To subscribe you have to provide us with your zip code, house number, telephone number and email address. The processing thereof is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely direct marketing. Hely retains your email address for as long as you are subscribed to the newsletter and not longer than 3 months after you unsubscribe.
Hely included email tracking and link tracking features in its emails by embedding a small transparent image pixel in the outgoing email. If the email is opened, Hely has access to certain information, such as the name and surnames of the recipient; the recipient’s email address; subject of the email; date and time in which the email was sent; confirmation that the recipient received the email; confirmation that the recipient has opened the email after it has been received; timestamp of each email opening; the history of the times (number, date and time) the recipient has opened the received email; IP from which the email was opened; browser and operating system used by the recipient who opened the email; number of links included in the email; text and URL of such links; number of clicks made on each of them by the recipient; timestamp of each click on the link; IP from which the link was clicked on and browser and operating system used by the person who has clicked on the link. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely to analyse the reach and effectiveness of the emails send by Hely. The information is retained for 3 months.
To provide customer service Hely may collect your personal data to respond to your questions you submit through email or the contact form on the website, including helping you with any issues which may arise regarding our website and/or services. If you use the online chat function on our website, app or via Facebook, the data processed by Hely for this purpose are browser data and data that you enter in the contact form to or a chat conversation with Hely. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely being able to serve you efficiently and to optimize Hely´s customer service. If you have a Hely account, your personal data are stored for as long as you have an account and will anonymize your data within 1 year after you deactivate your account. In other cases, Hely will delete your personal data within 9 months after responding to your message or resolving you complaint.
If you apply for a position at Hely, you will provide your personal data such as your first and last name, full address, email address, phone number and your CV and other attachments to your application. Hely uses this information to review your application and respond to your application. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), for recruitment. Hely retains your personal data for 4 weeks after rejection or, with your consent (Article 6(a) GDPR), for a period of 1 year.
external hosting providers, including cloud providers for the storage and management of data;
third parties that provide tools for analytical purposes (as described above);
other specific tasks that have been outsourced include IT support, email marketing (such as MailChimp), customer service (such as the chat function).
In addition, Hely will provide your personal data to external parties, such as police and government institutions if Hely is obliged to do so on the basis applicable laws and / or regulations or by means of a court order or a legal verdict, or has obtained consent from you for the provision to third parties.
Some of our service providers are also located outside the European Economic Area (EEA), in this case the United States. To comply with EU data protection laws around international data transfer, Hely only allows service providers outside the EEA to process your personal data if they are self-certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield framework (Article 46.2(a) GDPR) or in accordance with a contract entered into between the Hely and the service provider, incorporating the European Commission’s Standard Contractual Clauses, which ensures that adequate data protection arrangements are in place (Article 46.1(c) GDPR). For more information on where and how the relevant document may be accessed or obtained, please contact us at firstname.lastname@example.org.
Under the GDPR, you have a number of rights with regard to your personal data and the processing thereof:
You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to your personal data and additional information about the processing of your personal data.
You have the right to request the rectification of inaccurate personal data concerning you.
You have the right to ask us to erase your personal data (right to be forgotten) for example if the personal data are no longer necessary in relation to the purposes for which they were collected; you withdraws consent on which the processing is based, and where there is no other legal ground for the processing; or the personal data have been unlawfully processed.
You have the right to obtain restriction of processing of your personal data, for example when you have contested the accuracy of your personal data.
You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the processing is based on your consent or on a contract.
You have the right to object to processing of personal data which is based on our legitimate interests. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you always have the right to object to processing of personal data for such marketing. In that case, we shall no longer process your personal data for such purposes.
Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You may send your request to email@example.com. Hely shall respond to your request without undue delay and in any event within 1 month of receipt of the request. That period may be extended by 2 further months where necessary, taking into account the complexity and number of the requests. Hely shall inform you of any such extension within 1 month of receipt of the request, together with the reasons for the delay. If Hely does not take action on your request, Hely shall inform you without delay and at the latest within 1 month of receipt of the request of the reasons for not taking action. In that case, you also have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.
In case you suspect a breach of data protection legislation and the matter is not solved amicably between us in negotiations, you also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.
Sign up to stay updated on Hely Hubs near you through our newsletter. If there’s a hub near you, you’ll receive an e-mail right away to activate your account. Read more about how we process your data on hely.com/privacy.