Privacy Policy

This privacy policy states which of your personal data we collect, process and use. Furthermore, it informs you about your respective rights and the duration of storage. Therefore, we kindly ask you to carefully read the following statements.

1 Responsible Controller

WIND Mobility GmbH, Leipziger Straße 26, 10117 Berlin, Germany, (hereinafter: “We” or “WIND“) is the operator both of the website www.wind.co (hereinafter, the “Website”) and the app „WIND - Smart Mobility“ (hereinafter, the “Application”) and therefore the responsible party of the personal data of the users (hereinafter: “You”, “Your” “User” or “Users”) of the Website and the Application in terms of the General Data Protection Regulation (“GDPR”).

2 Contact

(1) If You have any questions regarding the use of Your personal data, please do not hesitate to contact our data protection officer at datenschutz@wind.co or via our customer service hotline.

(2) You may also contact WIND’s German Office under Leipziger Straße 26, 10117 Berlin, Germany, email: kunde@wind.co.

3 General References and Personal Data

(1) We protect Your privacy and Your personal data. We collect, process, and use Your personal data in accordance with the content of this Privacy Policy and the GDPR and only as far as this is necessary to provide a functional Website and Application as well as our content and services.

(2) Personal data within the meaning of this Privacy Policy means any information relating to an identified or identifiable natural person. This includes the data required for registration in the Application, such as Your name or telephone number.

(3) Personal data also include information about Your use of our Website and the Application. This includes, for example, information about the location from which You access data from our Website or Application or the extent of the data transfer. This data is usually processed using server log files and cookies. Further information about server log files and cookies can be found under clauses 16 – 18.

4 Purposes

(1) Your personal data will be processed in order to allow access to the services provided by WIND and to have access to information hosted on our Website and the Application and provide the information and the services requested by You in the Application and in the Website.

(2) We also process Your personal data to comply with the legal obligations that We are subject to.

(3) Additionally, we will process Your personal data for sending commercial communications in the case that You have authorized us to do so.

5 Origin and Legal Basis for the Processing of Your Data

(1) The personal data that We process has been provided by You.

(2) Some personal data may only be processed with Your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw this consent at any time for the future. "For the future" means that Your withdrawal has no effect on the processing of data that We have made between the granting of Your consent and Your withdrawal. You do not have to justify Your withdrawal. An informal message via e-mail to datenschutz@wind.co is sufficient.

(3) We process personal data that We require to fulfill or conclude a contract with You or to carry out pre-contractual measures on the basis of Art. 6 para. 1 lit. b GDPR.

(4) Other personal data We process according to Art. 6 para. 1 lit. f. GDPR for the protection of our legitimate interests, e.g. for the technically error-free and optimized provision of our services.

(5) In addition, it may be necessary to process personal data in order to fulfill a legal obligation that We are subject to (Art. 6 para. 1 lit. c GDPR) or to protect Your vital interests (Art. 6 para. 1 lit. d GDPR).

6 Recipients

Your personal data may be transferred to public administrations, including courts, when it is required in accordance with the current legislation in force. Additionally, companies that provide services to us and are contracted by WIND, such as payment providers, can have access to Your personal data. To the extent WIND uses such contractors, a description of their services can be found below. Unless noted otherwise below, these external companies process data for WIND as data processors, i.e. based on WIND’s instructions.

7 Duration of Storage

Your personal data will be kept as long as it is necessary for the purposes established in this policy. However, it may happen that the European or national legislator requires a longer storage period. In these cases, the data is not deleted or locked until the corresponding retention period has expired. After this period, the data will be definitively deleted.

8 Download / Installation of the Application

(1) When You download / install our Application, We will ask for permission to use interfaces to access functions and contents of Your device in order to collect certain data including:

- Your location,

- Your camera,

- information about the WLAN connection,

- information about Your Bluetooth connection.

(2) Since We require the data to fulfil our contract with You, the legal basis is Art. 6 para. 1 lit. b GDPR.

(3) We need access to the above interfaces and data in order to provide You with the functions and services of our Application and thus to fulfil our obligations under the general agreement as well as to enable the booking of a Bike or an Electric Scooter. For example, Your location is needed to show You the next Bike or Electric Scooter in Your area and how to get there. In addition, if You rent an Electric Scooter, We track Your location when locking and unlocking the Scooter. If a Bike is rented, We retrieve the location of the Bike directly via a GPS module integrated in the Bikes and not via Your device. Location tracking only takes place to ensure a proper lending and return process or to assist You in the event You report a service case.

(4) Access is possible from the moment the Application is installed on Your mobile device. Depending on Your settings, this access is permanent or only for the duration of the actual use of the Application. For the highest possible level of data protection, We recommend that You only allow access during the actual use of the Application. The data retrieved in each case are generally stored only for the duration of the actual use of the Application, after which they are deleted. We store Your location retrieved in the event You report a service case for a maximum duration of one year at the time of reporting. We store the location data that We collect in connection with locking and unlocking our Bikes and Electric Scooters for a maximum duration of 3 years. The data will then be made anonymous or will be blocked and deleted according to the rules stated in clause 7 of this Policy regarding “Duration of the Storage”.

9 Registration with Your Telephone Number

(1) In order to use our Application, You have to register. You can register by entering Your telephone number in the input screen provided for this purpose.

(2) The processing of Your data during registration is carried out on the basis of Art. 6 para. 1 lit. b GDPR for the conclusion and fulfilment of a contract.

(3) These data are processed solely in order to provide You with the functionality of our Application. Without registration as a User, there is no way to rent and use a Bike or Electric Scooter through the Application.

(4) As soon as You uninstall the Application and the legal retention periods have expired, the data entered during registration will be deleted.

10 Registration via Facebook Connect

(1) You also have the option to register in our Application via Facebook Connect. This is a service of Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. As the registration is performed through Facebook Connect WIND cannot control the procedure to sign on in the registration. For that reason, WIND dissociates from any responsibility arising from any breach, action or inaction of Facebook Connect or any breach of third parties that can be performed in the registration procedure. By clicking on the button integrated in our Application for this purpose, You can register with Your Facebook login data and thus speed up the login process. This process links our Application to Your Facebook profile and You consent to the processing of the public data on Your Facebook profile.

These include:

- Your Facebook name

- Your Facebook profile and cover picture

- Your birthday

- Your gender

You can find the Facebook Privacy Policy here: https://www.facebook.com/privacy/explanation.

(2) The data will be processed with Your consent and therefore on the basis of Art. 6 para. 1 lit. a GDPR. You can revoke Your consent at any time for the future. "For the future" means that Your revocation has no effect on the processing of data that We have made between the granting of Your consent and Your revocation. You do not have to give reasons for Your revocation. An informal message by e-mail to datenschutz@wind.co is sufficient.

(3) Furthermore, these data are processed on the basis of Art. 6 para. 1 lit. b GDPR for the conclusion and performance of a contract.

(4) These data are processed solely in order to provide You with the functionality of our Application. Without registration as a User, there is no way to rent and use a Bike or Electric Scooter through the Application.

(5) As soon as You uninstall the Application and the legal retention periods have expired, the data provided during registration will be deleted.

11 Google Firebase Authentication

Our Application uses Google Firebase authentication. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA for identity management. WIND cannot control the procedure to sign on in the registration. For that reason, WIND dissociates from any responsibility that may arise from any breach, action or inaction of Google Firebase or any breach of third parties that can be performed in the registration procedure. We use this service to make Your authentication easier and more convenient. This service provider has access to personal information required to perform its tasks. Google Firebase may not use them for other purposes. In addition, Google Firebase is required to treat the information in accordance with this Privacy Policy and the applicable data protection laws.

You can view the Google Firebase Terms of Use here: https://firebase.google.com/terms/.

You can find Google's privacy policy here:https://www.google.de/intl/de/policies/privacy/.

Google LLC has subscribed to the EU-U.S. Privacy Shield Framework.

12 Payment Method Credit Card via Stripe Inc.

(1) As soon as You have registered by one way or the other, You have the possibility to choose a payment method. For payment by credit card We use the payment service provider Stripe, Inc. 185 Berry Street, Suite 550 San Francisco, CA 94107, USA.

If You decide to pay via Stripe, the data You enter will be transmitted to Stripe for payment during sign-up. Stripe may not use them for other purposes. Stripe is also subject to bank client confidentiality and is obliged to treat the information in accordance with the relevant data protection laws.

Stripe's privacy policy can be found here: https://stripe.com/de/privacy. Stripe has subscribed to the EU-U.S. Privacy Shield Framework.

(2) The data are transmitted on the basis of Art. 6 para. 1 lit. b GDPR for the conclusion and performance of a contract.

(3) The data are transmitted exclusively for the purpose of providing You with the functions and services of our Application. Without depositing a method to pay the rental price of a Bike or Electric Scooter (both for single trips and for subscriptions or to top up Your credit in the Application), there is no way to rent and use a Bike or Electric Scooter through the Application.

(4) Stripe stores Your payment data itself. Please also note Stripe's data protection declaration linked above.

(5) Special features for single trips: Single trips are always charged depending on the duration of use. Therefore, We need to know Your Stripe-ID at the start and at the end of a single trip. Therefore, We store Your Stripe ID in Your customer account until You delete Your Stripe ID. If You do not have a current subscription, You can delete Your Stripe ID after each individual trip and only save it again when You use the Application. Alternatively, You can use Stripe to load credit to Your WIND account and then delete Your Stripe ID again.

(6) The Users have the right to receive, free of charges, the corresponding invoices, if it is requested.

13 Payment Method PayPal

(1) In addition, We use the payment service provider PayPal of PayPal (Europe) S.à r.l et Cie, S.C.A., so You can also pay via Your PayPal account.

If You choose to pay via PayPal, the information You provide will be sent to PayPal for payment at sign-up. PayPal may not use them for other purposes. In addition, PayPal is required to treat the information in accordance with this Privacy Policy and the applicable data protection laws.

You can find PayPal's privacy policy here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=en_EN.

PayPal pre-authorizes Your PayPal account on behalf of WIND by debiting Your User account with EUR 1, but this amount will be refunded immediately.

(2) The data are transmitted on the basis of Art. 6 para. 1 lit. b GDPR for the conclusion and performance of a contract.

(3) The data are transmitted exclusively for the purpose of providing You with the functions and services of our Application. Without depositing a method to pay the rental price of a Bike or an Electric Scooter (both for single trips and for subscriptions or to top up Your credit in the Application), there is no way to rent and use a Byke through the Application.

(4) The data is stored by PayPal itself. Please also note PayPal's privacy policy linked above.

(5) Special features for single trips: Single trips are always charged depending on the duration of use. Therefore, We need to know Your PayPal ID at the start and at the end of a single trip. Therefore, We store Your PayPal ID in Your customer account until You delete Your PayPal ID. If You do not have a current subscription, You can delete Your PayPal ID after each individual trip and only save it again when You use the Application. Alternatively, You can use PayPal to load credit to Your WIND account and then delete Your PayPal ID again.

14 Using the Application

(1) Every time You open our Application, We collect so-called server log files. These data log all requests and accesses by visitors to the Application and record all error messages from an Application. These include:

- the IP address of Your mobile device,

- Your device and card identification,

- the name of Your telephone, if You have named it using Your own name,

- the time of the request,

- the status of the request,

- the quantity of the transferred data with respect to that request.

(2) The legal basis for this is Art. 6 para. 1 lit. f GDPR. The operator of an app has a legitimate interest in the storage of this data because he needs it to detect and eliminate errors of the app, to determine the utilization of the app or to make improvements.

(3) The purpose of this type of data processing results from our legitimate interest mentioned above: This data is processed to detect and eliminate app errors in order to determine the utilization of the app or to make improvements.

(4) The data will be deleted as soon as You close our app.

15 Google Maps

(1) Our Application uses Google Maps API applications. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In this context, We must store Your IP address. Usually this information is transferred to a Google server in the USA and stored there. However, this transmission is made anonymous and Google LLC has subscribed to the EU-U.S. Privacy Shield Framework. A conclusion on Your person is thus excluded. This enables us to display interactive maps directly in the Application and enables You to use the map functions. This application is essential for the functionality and complete provision of our content and services. You can view the Google Terms of Use here: https://policies.google.com/terms?hl=en. The additional terms of use for Google Maps/Google Earth can be found here: https://www.google.com/help/terms_maps.html. You can find Google's privacy policy here: https://www.google.com/intl/de/policies/privacy/.

(2) These data are processed on the basis of Art. 6 para. 1 lit. b GDPR for the conclusion and performance of a contract.

(3) We process this data to show You the location of the nearest Bike or Electric Scooter and how to get there. Furthermore, We can show You the expected running distance and running time to the selected Bike or Electric Scooter.

(4) The data will only be stored for the duration of the respective booking period and will then be deleted.

16 Visiting our Website

(1) Whenever You access our Website, We collect the following information about Your computer:

- the IP-address of Your computer,

- the operating system of Your computer,

- the type of browser You are using (Firefox, Google Chrome, etc.) and its version,

- the request of Your browser,

- the time of this request,

- the status of the request,

- the amount of data transferred in the context of this request,

- Date and time of access,

- the URL of the Website from which You accessed our Website (so-called referrer URL),

- the URL of the Website You are visiting from our Website.

(2) The legal basis for this is Art. 6 para. 1 lit. f GDPR. The operator of a Website has a legitimate interest in the storage of this data because he needs it to detect and eliminate errors of the Website, to determine the utilization of the Website or to make improvements.

(3) The purpose of this type of data processing follows from our legitimate interest mentioned above: This data is processed to detect and eliminate Website errors in order to determine the utilization of the Website or to make improvements.

(4) The IP address of Your computer will only be stored for the duration of Your visit and will subsequently be deleted immediately or made anonymous by shortening it. The remaining data is stored anonymously for an unlimited period of time.

17 Cookies

(1) We use cookies on our Website. These are small text files that are stored on Your device and that store certain settings and data for sharing with our system through Your browser.

A cookie usually contains the name of the domain from which the cookie data was sent, as well as information about the age of the cookie and an alphanumeric identifier. Cookies allow our systems to recognize the User's device and make any presets available immediately. As soon as a User accesses the Website, a cookie is transmitted to the hard disk of the respective User's device.

The cookies We use will only store the information about Your use of the Website as explained above. This is not done by an assignment to You personally, but by assigning an identification number to the cookie ("Cookie ID"). A combination of the cookie ID with Your name, Your IP address or similar data that would allow a mapping of the cookie to You does not occur. (2) The legal basis for the processing of personal data using cookies is Article 6 para. 1 lit. f GDPR, as We have a legitimate interest in improving the operation of our Website and using the data for direct marketing purposes.

(2) We use the data We process using technically unnecessary cookies to tailor our Website to Your individual interests. This includes, for example, advertising that corresponds to Your personal interests.

(3) The duration of storage varies depending on whether the cookies are session cookies or temporary cookies. Session cookies are automatically deleted after You leave our Website. Temporary cookies are stored on Your device for a certain period. Cookies that We use for statistical purposes are automatically deleted after a defined period.

(4) As a User, You have full control over the use of cookies and the data processed in this way. If You do not want to use cookies, You can set Your browser so that the storage of cookies will not be accepted. Please note that in this case You may be able to use our Website only partially or not at all.

(5) Finally, please be informed that You have the right to withdraw Your consent so that We cannot use cookies, setting Your browser in the terms mentioned below:

- If You use Microsoft Internet Explorer, in the menu option Tools, selecting Internet Options and accessing Privacy.

- If You use Firefox for Mac in the Preferences menu option, selecting Privacy, accessing the Show Cookies section, and for Windows in the Tools menu option, selecting Options, accessing Privacy and then using a custom configuration for the history.

- If You use Safari, in the Preferences menu option, selecting Privacy.

- If You use Google Chrome, in the Tools menu option, selecting Options (Preferences in Mac), accessing Advanced and then in the Content Configuration option in the Privacy section, and finally checking Cookies in the Content Settings dialog.

18 Google Analytics

(1) We use Google Analytics. This is an analysis tool provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Inc, has subscribed to the EU-U.S. Privacy Shield Framework. We use this technology to make our Website more interesting for You and to optimize its functionality. The following data is processed in this context:

- the IP address of Your computer,

- if necessary, the operating system of Your computer,

- the type of browser You are using (Firefox, Google Chrome, etc.) and its version,

- the referrer URL,

- the time of the request.

(2) This kind of processing of Your personal data is based on Art. 6 para. 1 lit. f GDPR, as We have a legitimate interest in improving the services of our Website and our advertising.

(3) The purpose of the processing is our legitimate interest in improving the services of our Website and our advertising.

(4) If You only wish to accept our own cookies, but not those of our service providers and partners, You can select the setting in Your browser "Block third party cookies".

19 Amazon Web Services

We use the Amazon Web Services Inc.410 Terry Avenue North, Seattle WA 98109, USA. . Amazon Web Services Inc. has subscribed to the EU-U.S. Privacy Shield Framework. In this context, information is transmitted exclusively to servers in the Frankfurt am Main region and stored there.

Amazon may not use the data for other purposes. In addition, Amazon is obliged to treat the information in accordance with this data protection declaration and the relevant data protection laws.

More information can be found in Amazon's privacy policy: https://aws.amazon.com/de/compliance/data-privacy-faq/.

20 The Facebook "Like” button

We have integrated the Facebook "Like-Button" on our Website. This is a plugin of the social network "Facebook", provider Facebook Inc, 1 Hacker Way, Menlo Park, California 94025, USA. Facebook Inc has subscribed to the EU-U.S. Privacy Shield Framework Regardless of whether You are logged in to Your Facebook account or not, the plugin establishes a direct connection between Your browser and the Facebook server and sends Facebook the information that You have visited our Website using Your IP address. If You are logged into Your Facebook account while visiting our Website, You can link our content to Your Facebook account by clicking the "Like" button. The exact content of the data transmitted to Facebook and how they are used by Facebook, eludes our knowledge. The privacy policy of Facebook can be found here: https://de-de.facebook.com/policy.php.

21 Twitter

We have included a Twitter plugin on our Website that allows You to link the content of our app to Your Twitter account. This is a function of the social network "Twitter", provider Twitter Inc, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. Twitter Inc has subscribed to the EU-U.S. Privacy Shield Framework If You are logged into Your Twitter account while using the app, a link will be established. The exact content of the data transmitted to Twitter and how Twitter uses it eludes our knowledge. The privacy policy of Twitter can be found here: https://twitter.com/privacy

22 Instagram Plugins

We have integrated an Instagram plugin on our Website. The provider of this plugin is Instagram Inc, 1601 Willow Road, Menlo Park, CA 94025, USA. To publish content from our app to Your Instagram account, You must be logged in. If this is the case, Instagram can link Your visit to our app to Your Instagram account. The exact content of the data transmitted to Instagram in this way and how it is used by Instagram is beyond our knowledge. Instagram's privacy policy can be found here: https://instagram.com/about/legal/privacy/.

23 Data Security

We protect our Website and app and other systems by technical and organizational measures against loss, destruction, access, modification, or dissemination of Your data by unauthorized persons. These measures include but are not limited to access control, input control and order control.

24 No Disclosure of Your Personal Data

We will not disclose Your personal data to third parties, except if You have consented to the data transfer or if We are authorized or obliged to transfer data due to legal provisions and/or official or court directions. This may refer to cases including but not limited to the provision of information for the purposes of law enforcement, danger prevention or the enforcement of intellectual property rights.

25 Data Protection and Third-Party Websites

(1) This Website may contain hyperlinks to or from third-party websites. If You follow a hyperlink to one of these websites, please note that We cannot assume any responsibility or guarantee for external contents or data protection conditions. Please verify the respective applicable data protection provisions before You transfer personal data to these websites.

(2) Data communication via the internet cannot be guaranteed to be error-free and/or available at all times according to the current state of technology. In this respect, We are not liable for the constant and uninterrupted availability of our trading system.

26 Amendments of this Privacy Policy

We reserve the right to amend this privacy policy at any time with future effect. The respective latest version is available at all time on the Website and the app. Please access the Website and app regularly to find out about the applicable privacy policy.

27 Your Rights and Contact Information

(1) Right to withdraw Your consent acc. Art. 7 para. 3 GDPR: In cases where the processing of Your personal data is only possible with Your consent, You can revoke this consent at any time in the future. "For the Future" means that Your revocation has no effect on the processing of data that We have made between the granting of Your consent and Your revocation. You do not have to justify Your withdrawal. An informal message via e-mail to datenschutz@wind.co is sufficient.

(2) Right of access by the data subject in acc. Art. 15 GDPR: You may request confirmation from us at any time whether We process personal information concerning You. In this case, You have the right to request information about:

- the purposes for which We process Your personal information

- the categories of personal data We process,

- the recipients or categories of recipients to whom We have disclosed or will disclose the data,

- the storage duration (as far as possible),

- the right of rectification, erasure or restriction of our processing, as well as the right of opposition to such processing,

- the existence of a right of appeal to a supervisory authority,

- the origin of Your data, as far as they were not collected by us,

- the existence of automated decision-making including profiling and, where appropriate, detailed information on the logic, scope and impact of such processing.

For this purpose and / or for more information, please contact us via datenschutz@wind.co. If You have any questions, comments or inquiries regarding the processing of Your personal data, please also contact us at the contact details provided.

(3) Right to rectification acc. Art. 16 GDPR: You can view Your personal data at any time free of charge and, if necessary, request their correction and supplementation.

(4) Right to erasure acc. Art. 17 GDPR: You can view Your personal data at any time free of charge and request cancellation if:

- these are no longer needed for the purpose for which they were processed,

- You have revoked Your consent and there is no other legal basis for the processing,

- You have filed an objection against the processing of Your data acc. Art. 21 GDPR,

- We have processed Your data unlawfully,

- the deletion is required to fulfill a legal obligation under EU or national law.

(5) Right to restriction of processing acc. Art. 18 GDPR: You can view Your personal data at any time free of charge and, if necessary, request their blocking if:

- You deny their accuracy,

- the processing is illegal, but You reject the deletion of the data,

- We no longer need the data, but You need it for the assertion, exercise or defense of legal claims,

- You have filed an objection against the processing of Your data acc. Art. 21 GDPR, but it is not yet certain whether our interests in processing outweigh Your interests.

(6) Right to data portability acc. Art. 20 GDPR: At our request, We are required to provide You with data that We process automatically based on Your consent or in fulfillment of a contract in a portable and secure format. The direct transfer of data to another person responsible is also possible at Your request. However, it only takes place if technically feasible.

(7) Right to object acc. Art. 21 GDPR: In cases where We use Your data on the basis of Art. 6 para. 1 lit. f GDPR, You have the right to appeal against the processing, as far as there are reasons for this, which result from Your particular situation or the objection against direct mailing.

(8) Right to lodge a complaint with a supervisory authority acc. Art. 77 GPDPR: If You think that We have violated data protection regulations, You can contact a regulatory authority for data protection in the non-public area, in particular the supervisory authority of your habitual residence, your work place or the location of such violation, as well as the

Berlin Data Protection Commissioner

(Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Friedrichstraße 219

10969 Berlin

Visitor’s entrance: Puttkamer Straße 16 - 18 (5th Floor)

Phone: +49 30/138 89-0

Fax: +49 30/215 50 50

E-Mail: mailbox@datenschutz-berlin.de

WIND Mobility GmbH

December 2018