Privacy Policy

This privacy policy states which of your personal data we collect, process and use. Furthermore, it informs you about your respective rights and the duration of storage. Therefore, we kindly ask you to carefully read the following statements.

1 Responsible Controller

WIND Mobility Ltd (hereinafter: “We” or “WIND“) is the operator both of the website www.wind.co (hereinafter, the “Website”) and the app “WIND - Smart Mobility“ (hereinafter, the “Application”) and therefore the responsible party for the personal data of the users (hereinafter: “You”, “Your” “User” or “Users”) of the Website and the Application in terms of the General Data Protection Regulation (“GDPR”).

2 Contact

(1) If You have any questions regarding the use of Your personal data, please do not hesitate to contact our data protection officer at dpo@wind.co or via our customer service hotline + 46 20797819.

(2) You may also contact WIND’s Office under Tower Bridge House, St Katharine's Way, E1W 1DD London, United Kingdom, email: customer.uk@wind.co.

3 General References and Personal Data

(1) We protect Your privacy and Your personal data. We collect, process, and use Your personal data in accordance with the content of this Privacy Policy, GDPR and relevant data protection regulations and only as far as this is necessary to provide a functional Website and Application as well as our content and services.

(2) Personal data within the meaning of this Privacy Policy means any information relating to an identified or identifiable natural person. This includes, for example, the data required for registration in the Application, such as Your name or telephone number.

(3) Personal data also include information about Your use of our Website and the Application. This includes, for example, information about the location from which You access data from our Website or Application or the extent of the data transfer. This data is usually processed using server log files and cookies. Further information about server log files and cookies can be found under clauses 13 and 15 - 18.

4 Purposes

(1) Your personal data will be processed in order to allow access to the services provided by WIND and to have access to information hosted on our Website and the Application and provide the information and the services requested by You in the Application and in the Website.

(2) We also process Your personal data to comply with the legal obligations that We are subject to.

(3) Additionally, we will process Your personal data for sending commercial communications in the case that You have given consent to such processing.

5 Origin and Legal Basis for the Processing of Your Data

(1) The personal data that We process has been provided by You.

(2) Some personal data may only be processed with Your consent in accordance with Art. 6 para. 1(a) GDPR. You can withdraw this consent at any time for the future. "For the future" means that Your withdrawal has no effect on the processing of data that We have made between the granting of Your consent and Your withdrawal. You do not have to justify Your withdrawal. An informal message via e-mail to dpo@wind.co is sufficient.

(3) We process personal data that We require to fulfill or conclude a contract with You or to carry out pre-contractual measures on the basis of Art. 6 para. 1(b) GDPR, for example renting or using an e-scooter.

(4) Other personal data We process according to Art. 6 para. 1(f). GDPR for the protection of our legitimate interests, e.g. for the technically error-free and optimized provision of our services.

(5) In addition, it may be necessary to process personal data in order to fulfill a legal obligation that We are subject to (Art. 6 para. 1(c) GDPR), for example to identify any usage of an e-scooter and to process recourse claims for which WIND would be liable as the keeper of such vehicles, or to protect Your vital interests (Art. 6 para. 1(d) GDPR).

6 Recipients

Your personal data may be transferred to public administrations, including courts, when it is required in accordance with the current legislation in force. Additionally, companies that provide services to us and are contracted by WIND, for example such as payment providers, can have access to Your personal data. To the extent WIND uses such contractors, a description of their services can be found below. Unless noted otherwise below, these external companies process data for WIND as data processors, i.e.,based on WIND’s instructions, as agreed upon in data processing agreements with WIND. To the extent such contractors are located outside of the EU and/or the EEA, WIND ensures appropriate safeguards for such transfer of personal data.

7 Duration of Storage

Your personal data will be kept as long as described below and is necessary for the purposes established in this policy, and as a main rule for maximum for 3 years. However, it may happen that the European or national legislator, or other circumstances (e.g. suspicion of damage on people or goods), requires a longer storage period. In these cases, the data is not deleted or locked until the corresponding retention period has expired. After this period, the data will be definitively deleted.

8 Download / Installation of the Application

(1) When You download / install our Application, We require to use interfaces to access functions and contents of Your device in order to collect certain data including:

- Your location;

- Your camera;

- information about the WLAN connection;

- information about Your Bluetooth connection.

(2) Since We require the data to fulfil our contract with You, the legal basis is Art. 6 para. 1(b) GDPR.

(3) We need access to the above interfaces and data in order to provide You with the functions and services of our Application and thus to fulfil our obligations under our contract as well as to enable the booking of an e-scooter. For example, Your location is needed to show You the next e-scooter in Your area and how to get there. In addition, if You rent an e-scooter, We track Your location when locking and unlocking the e-scooter. Access to Your camera is needed to scan the QR code for locking and unlocking the e-scooter and for You to take a picture of the e-scooter when parking it.

(4) Access is possible from the moment the Application is installed on Your mobile device. Depending on Your settings, this access is permanent during the time the Application is installed or only for the duration of the actual use of the Application. For the highest possible level of data protection, We recommend that You only allow access during the actual use of the Application. The data retrieved in each case are generally stored only for the duration of the actual use of the Application, after which they are deleted. We store Your location retrieved in the event You report a service case for a maximum duration of one year after the time of reporting. We store the location data that We collect in connection with locking and unlocking our e-scooters for a maximum duration of 3 years. The data will then be made anonymous or will be blocked and deleted according to the rules stated in clause 7 of this Policy regarding “Duration of the Storage”.

9 Registration with Your Telephone Number

(1) In order to use our Application, You have to register. You can register by entering Your telephone number in the input screen provided for this purpose.

(2) The processing of Your data during registration is carried out on the basis of Art. 6 para. 1(b) GDPR for the conclusion and fulfilment of a contract.

(3) These data are processed solely in order to provide You with the functionality of our Application. Without registration as a User as set out in this clause or in clauses 10 and 11, there is no way to rent and use an e-scooter through the Application.

(4) As soon as You uninstall the Application and the legal retention periods have expired, the data entered during registration will be deleted.

10 Driving license verification

(1) In order to use an e-scooter in the UK, You must have the category Q entitlement on your driving license, have valid full license from an EU or European Economic Area (EEA) country or have a valid full license from another country that entitles you to drive a small vehicle (for example, cars, mopeds or motorcycles) and you entered the UK within the last 12 months. You cannot use an e-scooter if you have an overseas provisional license, learner permit or equivalent. More information here: https://www.gov.uk/guidance/e-scooter-trials-guidance-for-users#driving-licences.

(2) In order to ensure compliance with the above requirement from the UK Department for Transport (hereinafter: “DfT”), You will be asked to scan and submit Your driver’s license and take a photo and/or video of Your face via the Application. Therefore, the information collected during this process include:

- Your names;

- date and place of birth;

- Your address;

- Your signature;

- driving license number;

- driving license issue and expiry date;

- category entitlement;

- identity document photograph(s);

- face photograph(s).

(3) The legal basis for this is Art. 6 para. 1(c) GDPR: processing is necessary for compliance with a legal obligation.

(4) The purpose of this type of data processing is to verify that You are a holder of a valid driving license, hence You may use our services. WIND will not use Your driver’s license information for any other purpose.

(5) We use IDenfy – a personal identification service provided by UAB „Identifikaciniai projektai“, legal entity number 304617621, registered office address Gričiupio g. 7-212, Kaunas, Lithuania.

11 Google Firebase Authentication

(1) Our Application uses Google Firebase authentication. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA for identity management. WIND cannot control the procedure to sign on in the registration. For that reason, WIND dissociates from any responsibility that may arise from any breach, action or inaction of Google Firebase or any breach of third parties that can be performed in the registration procedure. We use this service to make Your authentication easier and more convenient. This service provider receives your personal data required to perform its tasks directly from you. Google Firebase is required to treat the information in accordance with applicable data protection laws.

(2) You can view the Google Firebase Terms of Use here: https://firebase.google.com/terms/.

(3) You can find Google's privacy policy here: https://policies.google.com/privacy?hl=en.

(4) Google LLC applies the EU Model Standard Contractual Clauses to their transfers of personal data. This ensures an adequate level of protection for Your data.

12 Payment Methods via Stripe, Apple Pay and Pay Pal

(1) As soon as You have registered by one way or the other, You have the possibility to choose a payment method.

(2) For payment, We use the payment service provider Stripe, Inc. 185 Berry Street, Suite 550 San Francisco, CA 94107, USA.

If You choose one of the payment methods offered by Stripe, Your Stripe ID will be transmitted to Stripe for payment during sign-up.

Stripe is subject to bank client confidentiality and is obliged to treat the information in accordance with the relevant data protection laws.

Stripe's privacy policy can be found here: https://stripe.com/se/privacy.

Stripe applies the EU Model Standard Contractual Clauses to their transfers of personal data. This ensures an adequate level of protection for Your data.

(3) We use Apple as a service provider for payment by credit card. If You have enabled Apple Pay on Your iOS-device and choose to pay via Apple Pay, Your transaction data will be transmitted in an encrypted way to Apple Inc., located at One Apple Park Way, Cupertino, CA 95014, USA. Apple decrypts the data, determines Your card’s payment network, and re-encrypts the data before it transmits the transaction information to Stripe. Apple retains anonymous transaction information, including the approximate purchase amount, Our name and the name of Our Application, the approximate date and time and whether the transaction completed successfully. Apple uses this data to improve Apple Pay and other products and services.

More information on Apple Pay´s security and privacy can be found here: https://support.apple.com/en-us/HT203027.

You can also see more details about Apple Pay and Your privacy on your iOS-device. Go to Wallet & Apple Pay in Settings on your device and tap "See how your data is managed."

The data are transmitted to our payment service providers on the basis of Art. 6 para. 1(b) GDPR.

The data are transmitted exclusively for the purpose of providing You with the functions and services of our Application. Without depositing a method to pay the rental price of an e-scooter (both for single trips and to top up Your credit in the Application), there is no way to rent and use an e-scooter through the Application.

Single trips are always charged depending on the duration of use. Therefore, We need to know Your Stripe-ID at the start and at the end of a single trip. Therefore, We store Your Stripe ID in Your customer account until You delete Your Stripe ID. You can delete Your Stripe ID after each individual trip and only save it again when You use the Application. Alternatively, You can use Stripe to load credit to Your WIND account and then delete Your Stripe ID again.

Upon request, You have the right to receive, free of charge, the corresponding invoices.

(4) In addition to payment by credit card, You can also pay via Your PayPal account that is offered by PayPal of PayPal (Europe) S.à r.l & Cie, S.C.A., Luxembourg.

If You choose to pay via PayPal, You provide Your PayPal ID to WIND and Your account information to PayPal for payment at sign-up. PayPal is required to treat the information in accordance with and the applicable data protection laws.

You can find PayPal's privacy policy here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=en_EN.

Your data is processed by WIND on the basis of Art. 6 para. 1(b) GDPR for the conclusion and performance of a contract.

The payment data is stored by PayPal itself. Please also note PayPal's privacy policy linked above.

Single trips are always charged depending on the duration of use. Therefore, We need to know Your PayPal ID at the start and at the end of a single trip. Therefore, We store Your PayPal ID in Your customer account until You delete Your PayPal ID. You can delete Your PayPal ID after each individual trip and only save it again when You use the Application. Alternatively, You can use PayPal to load credit to Your WIND account and then delete Your PayPal ID again.

13 Using the Application

(1) Every time You open our Application, We collect so-called server log files. These data log all requests and accesses by visitors to the Application and record all error messages from an Application. These include:

- the IP address of Your mobile device;

- Your device and card identification;

- the name of Your telephone, if You have named it using Your own name;

- the time of the request;

- the status of the request;

- the quantity of the transferred data with respect to that request.

(2) The legal basis for this is Art. 6 para. 1(f) GDPR. The operator of an app has a legitimate interest in the storage of this data because he needs it to detect and eliminate errors of the app, to determine the utilization of the app or to make improvements.

(3) The purpose of this type of data processing results from our legitimate interest mentioned above: This data is processed to detect and eliminate app errors in order to determine the utilization of the Application or to make improvements.

(4) The data will be deleted as soon as You close our Application.

14 Customer support via AnswerConnect

(1) For WIND’s customer support, We use AnswerConnect - AnswerConnect, 11 Rutland St, Edinburgh, EH1 2DQ, UK - as our customer support line provider. When you contact WIND’s customer support line, AnswerConnect will process your data in order to resolve your issue or answer your question.

(2) AnswerConnect processes the following data:

- Your name,

- Your phone number,

- Your location,

- the duration of Your ride

- the number of the e-scooter You used

- Your reason for dispute or for contacting customer support

(3) These data are processed on the basis of Art. 6 para. 1(b) GDPR for the conclusion and performance of a contract.

(4) You can find AnswerConnect’s privacy policy here: https://www.answerconnect.co.uk/privacypolicy

(5) We process this data to be able to fulfil our contractual obligation to You – to make sure You have always been charged the correct amount and that all Your concerns and questions about the service are addressed and resolved in due course.

The purpose of this type of data processing stems as well from our legitimate interest: data is processed to detect and eliminate errors or flaws in our service in order to improve the service and shorten the time it takes to resolve future disputes.

(6) The data will only be stored for as long as the dispute or inquiry is active (i.e.,unresolved) and will subsequently be deleted immediately or made anonymous. The remaining data is stored anonymously for an unlimited period of time.

15 Google Maps

(1) Our Application uses Google Maps API applications. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In this context, We must store Your IP address. Usually this information is transferred to a Google server in the USA and stored there. However, this transmission is made anonymous and Google LLC applies the EU Model Standard Contractual Clauses to their transfers of personal data. A conclusion on Your person is thus excluded. This enables us to display interactive maps directly in the Application and enables You to use the map functions. This application is essential for the functionality and complete provision of our content and services. You can view the Google Terms of Use here: https://policies.google.com/terms?hl=en.

The additional terms of use for Google Maps/Google Earth can be found here: https://www.google.com/help/terms_maps.html.

You can find Google's privacy policy here: https://policies.google.com/privacy?hl=en-US.

(2) These data are processed on the basis of Art. 6 para. 1(b) GDPR for the conclusion and performance of a contract.

(3) We process this data to show You the location of the nearest e-scooter and how to get there. Furthermore, We can show You the expected running distance and running time to the selected e-scooter.

(4) The data will only be stored for the duration of the respective booking period and will then be deleted.

(5) The IP address of Your computer will only be stored for the duration of Your visit and will subsequently be deleted immediately or made anonymous by shortening it. The remaining data is stored anonymously for an unlimited period of time.

16 Visiting our Website

(1) Whenever You access our Website, We collect the following information about Your computer:

- the IP-address of Your computer;

- the operating system of Your computer;

- the type of browser You are using (Firefox, Google Chrome, etc.) and its version;

- the request of Your browser;

- the time of this request;

- the status of the request;

- the amount of data transferred in the context of this request;

- date and time of access;

- the URL of the Website from which You accessed our Website (so-called referrer URL);

- the URL of the Website You are visiting from our Website.

(2) The legal basis for this is Art. 6 para. 1(f) GDPR. The operator of a Website has a legitimate interest in the storage of this data because he needs it to detect and eliminate errors of the Website, to determine the utilization of the Website or to make improvements.

(3) The purpose of this type of data processing follows from our legitimate interest mentioned above: This data is processed to detect and eliminate Website errors in order to determine the utilization of the Website or to make improvements.

(4) The IP address of Your computer will only be stored for the duration of Your visit and will subsequently be deleted immediately or made anonymous by shortening it. The remaining data is stored anonymously for an unlimited period of time.

17 Cookies

(1) We use cookies on our Website. These are small text files that are stored on Your device and that store certain settings and data for sharing with our system through Your browser.

(2) A cookie usually contains the name of the domain from which the cookie data was sent, as well as information about the age of the cookie and an alphanumeric identifier. Cookies allow our systems to recognize the User's device and make any presets available immediately. As soon as a User accesses the Website, a cookie is transmitted to the hard disk of the respective User's device.

(3) The cookies We use will only store the information about Your use of the Website as explained above. This is not done by an assignment to You personally, but by assigning an identification number to the cookie ("Cookie ID"). A combination of the Cookie ID with Your name, Your IP address or similar data that would allow a mapping of the cookie to You does not occur.

(4) The legal basis for the processing of personal data using cookies is Article 6 para. 1(f) GDPR, as We have a legitimate interest in improving the operation of our Website. For direct marketing purposes, the legal basis is your consent (Article 6 para 1(a) GDPR).

(5) We use the data We process using technically unnecessary cookies (website’s cookies and third-party cookies (Google Analytics)) to tailor and improve our Website to Your individual interests. This includes, for example, advertising that corresponds to Your personal interests. For further information, please click the “Learn more” button on our website. The duration of storage varies depending on whether the cookies are session cookies or temporary cookies. Session cookies are automatically deleted after You leave our Website. Temporary cookies are stored on Your device for a certain period as decided by You. Cookies that We use for statistical purposes are automatically deleted after a defined period.

(6) As a User, You have full control over the use of cookies and the data processed in this way. If You do not want to use cookies, You can set Your browser so that the storage of cookies will not be accepted. Please note that in this case You may be able to use our Website only partially or not at all.

(7) Finally, please be informed that You have the right to withdraw Your consent so that We cannot use cookies, setting Your browser in the terms mentioned below:

- If You use Microsoft Internet Explorer, in the menu option Tools, selecting Internet Options and accessing Privacy.

- If You use Firefox for Mac in the Preferences menu option, selecting Privacy, accessing the Show Cookies section, and for Windows in the Tools menu option, selecting Options, accessing Privacy and then using a custom configuration for the history.

- If You use Safari, in the Preferences menu option, selecting Privacy.

- If You use Google Chrome, in the Tools menu option, selecting Options (Preferences in Mac), accessing Advanced and then in the Content Configuration option in the Privacy section, and finally checking Cookies in the Content Settings dialog.

18 Google Analytics

(1) We use Google Analytics. This is an analysis tool provided by Google Inc, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Inc. applies the EU Model Standard Contractual Clauses to their transfers of personal data. This ensures an adequate level of protection for Your data. We use this technology to make our Website more interesting for You and to optimize its functionality. The following data is processed for this purpose:

- the IP address of Your computer;

- if necessary, the operating system of Your computer;

- the type of browser You are using (Firefox, Google Chrome, etc.) and its version;

- the referrer URL;

- the time of the request.

(2) This kind of processing of Your personal data is based on Art. 6 para. 1(f) GDPR, as We have a legitimate interest in improving the services of our Website and our advertising.

(3) The purpose of the processing is our legitimate interest in improving the services of our Website.

(4) If You only wish to accept our own cookies, but not those of our service providers and partners, You can select the setting in Your browser "Block third party cookies".

19 Amazon Web Services

(1) We use the Amazon Web Services Inc., 410 Terry Avenue North, Seattle WA 98109, USA for storage of personal data. Amazon Web Services Inc. applies the EU Model Standard Contractual Clauses to their transfers of personal data. This ensures an adequate level of protection for Your data. In this context, information is transmitted exclusively to servers in the Frankfurt am Main region in Germany and stored there.

(2) Amazon may not use the data for other purposes. In addition, Amazon is obliged to treat the information in accordance with the relevant data protection laws.

(3) More information can be found in Amazon's privacy policy: https://aws.amazon.com/compliance/data-privacy-faq/.

20 DfT – rental e-scooter trials

(1) As one of the participants in the rental e-scooter trials in the UK, We are required to securely share some data pertaining to Your use of e-scooters with the DfT. The data shall enable the DfT to understand the effects of e-scooters and to allow ministers to take an informed decision on how e-scooters should be regulated to promote safe and sustainable travel.

(2) The data that We may share with the DfT include:

- Pseudonymised data: details of the length, duration and location of e-scooter trips. These data will not be attributable to any personally identifiable data.

- Personal data for the sole purpose of research: month and day of the week, and a time band (i.e., a Wednesday in March, between 7-12am) for the trip; the duration and distance of the trip; the area (the ONS Lower Super Output Area that corresponds to a trip’s start point); responses You may provide to questions asked after each trip.

(3) More information about the standards You can expect when DfT asks for, or holds, Your personal data: https://www.gov.uk/government/organisations/department-for-transport/about/personal-information-charter.

21 Data Security

We protect our Website and Application and other systems by technical and organizational measures against loss, destruction, access, modification, or dissemination of Your data by unauthorized persons. These measures include but are not limited to access control, input control and order control.

22 No Disclosure of Your Personal Data

We will not disclose Your personal data to third parties, except if You have given Your consent to the data transfer or if We are authorized or obliged to transfer data due to legal provisions and/or official or court directions. This may refer to cases including but not limited to the provision of information for the purposes of insurance claim investigations, law enforcement, danger prevention or the enforcement of intellectual property rights.

23 Data Protection and Third-Party Websites

(1) This Website may contain hyperlinks to or from third-party websites. If You follow a hyperlink to one of these websites, please note that We cannot assume any responsibility or guarantee for external contents or data protection conditions. Please verify the respective applicable data protection provisions before You transfer personal data to these websites.

(2) Data communication via the internet cannot be guaranteed to be error-free and/or available at all times according to the current state of technology. In this respect, We are not liable for the constant and uninterrupted availability of our trading system.

24 Amendments of this Privacy Policy

We reserve the right to amend this privacy policy at any time with future effect. The respective latest version is available at all time on the Website and the Application. Please access the Website and app regularly to find out about the applicable privacy policy.

25 Your Rights and Contact Information

(1) Right to withdraw Your consent acc. Art. 7 para. 3 GDPR: In cases where the processing of Your personal data is only possible with Your consent, You can revoke this consent at. You do not have to justify Your withdrawal. An informal message via e-mail to dpo@wind.co is sufficient.

(2) Right of access by the data subject in acc. Art. 15 GDPR: You may request confirmation from us at any time whether We process personal information concerning You. In this case, You have the right to request information about:

- the purposes for which We process Your personal information;

- the categories of personal data We process;

- the recipients or categories of recipients to whom We have disclosed or will disclose the data;

- the storage duration (as far as possible);

- the right of rectification, erasure or restriction of our processing, as well as the right of opposition to such processing;

- the existence of a right of appeal to a supervisory authority;

- the origin of Your data, as far as they were not collected by us;

- the existence of automated decision-making including profiling and, where appropriate, detailed information on the logic, scope and impact of such processing.

For this purpose and / or for more information, please contact us via dpo@wind.co. If You have any questions, comments or inquiries regarding the processing of Your personal data, please also contact us at the contact details provided.

(3) Right to rectification acc. Art. 16 GDPR: You can view Your personal data at any time free of charge and, if necessary, request their correction and supplementation.

(4) Right to erasure acc. Art. 17 GDPR: You can view Your personal data at any time free of charge and request cancellation if:

- these are no longer needed for the purpose for which they were processed;

- You have revoked Your consent and there is no other legal basis for the processing;

- You have filed an objection against the processing of Your data acc. Art. 21 GDPR;

- We have processed Your data unlawfully;

- the deletion is required to fulfill a legal obligation under EU or national law.

(5) Right to restriction of processing acc. Art. 18 GDPR: You can view Your personal data at any time free of charge and, if necessary, request their blocking if:

- You deny their accuracy;

- the processing is illegal, but You reject the deletion of the data;

- We no longer need the data, but You need it for the assertion, exercise or defense of legal claims;

- You have filed an objection against the processing of Your data acc. Art. 21 GDPR, but it is not yet certain whether our interests in processing outweigh Your interests.

(6) Right to data portability acc. Art. 20 GDPR: At our request, We are required to provide You with data that We process automatically based on Your consent or in fulfillment of a contract in a portable and secure format. The direct transfer of data to another person responsible is also possible at Your request. However, it only takes place if technically feasible.

(7) Right to object acc. Art. 21 GDPR: In cases where We use Your data on the basis of Art. 6 para. 1(f) GDPR, You have the right to appeal against the processing, as far as there are reasons for this, which result from Your particular situation or the objection against direct mailing.

(8) Right to lodge a complaint with a supervisory authority acc. Art. 77 GPDPR: If You think that We have violated data protection regulations, You can contact a regulatory authority for data protection in the non-public area, in particular the supervisory authority of your habitual residence, your work place or the location of such violation, as well as the UK Information Commissioner’s Office (ICO). For more information about your rights, visit the ICO’s website: www.ico.org.uk.

WIND Mobility

2021/02/22