Privacy Policy
I. Scope
This Privacy policy provides relevant information on the personal data processing performed by Wind Tel-Aviv (By-Byke) Ltd. (hereinafter: “We” or “WIND“) through the website available at www.wind.co (hereinafter, the “Website”) and the app „WIND - Smart Mobility“ (hereinafter, the “Application”) available on Apple store and Google Play (hereinafter collectively referred to as the ‘App Stores’).
By using the Website and/or the Application, all our users (hereinafter: “You”, “Your” “User” or “Users”) shall be deemed to have read the provisions of this Privacy policy.
We reserve the right to amend this privacy policy at any time with future effect. The respective latest version is available at all time on the Website, the App Stores and the Application. Please access the Website and the Application regularly to find out about the applicable privacy policy.
II. Definitions
(1) User:any natural person who is identified or is identifiable on the basis of the personal data processed when accessing and using our Website and the Application.
(2) Personal data: any information relating to a User. This includes the data required for registration in the Application, such as Your name or telephone number. Personal data also include information about Your use of our Website and the Application. This includes, for example, information about the location from which You access data from our Website or Application or the extent of the data transfer. This data is usually processed using server log files and cookies. Further information about server log files and cookies can be found under below.
(3) Controller:Wind Tel-Aviv (By-Byke) Ltd. which determines the purposes and means of the processing of Your personal data and/or the purposes and means for the processing are legally defined, therefore imposed on us.
(4) Processing: collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
(5) Consent: any freely given, specific, informed and unambiguous indication of the Users’ intention, by which they, by a statement or a clear affirmative action, signify agreement to the processing of their personal data for certain operations.
(6) Contract, Individual Rental Contract as defined in our Terms of Service, available here: https://windco.force.com/FAQ/s/?language=en_US.
(7) Services: the rental of an Electric Scooter together with the provision of the WIND Application.
(8) Transfer: the transfer of data to third countries or international organizations outside the EU.
III. Contact information
(1) You may contact WIND’s German Office as follows:
Address: Leipziger Straße 26, 10117 Berlin, Germany
Email address: info@wind.co
Website: www.wind.co
(2) If You have any questions regarding this Privacy Policy and/or the use of Your personal data, please do not hesitate to contact our data protection officer as follows:
Address: Leipziger Straße 26, 10117 Berlin, Germany
Email address: dpo@wind.de
IV. General References
1. Origin and use
(1) The personal data that We process have been provided, directly or indirectly, by You.
(2) We collect, process, and use Your personal data in accordance with the content of this Privacy Policy and the GDPR and only as far as this is necessary to provide our services, ensure a functional Website and Application as well as improve Your experience with us.
2. Data Security
We protect our Website and Application and other systems by technical and organizational measures against loss, destruction, access, modification, or dissemination of Your data by unauthorized persons. These measures include but are not limited to access control, input control and order control.
3. Purposes
(1) Your personal data will be processed in order to allow access to the services provided by WIND and to have access to information hosted on our Website and the Application and provide the information and the services requested by You in the Application and in the Website.
(2) We also process Your personal data to comply with the legal obligations that We are subject to.
(3) We may also process data to administer our Website and the Application, to secure their proper functioning and to analyse their use.
(4) Sometimes We process Your personal data in order to respond to Your enquiries, complaints and/or recommendations.
(5) Additionally, we may process Your personal data for sending commercial communications in the case that You have authorized us to do so.
4. Legal Basis for the Processing of Your Data
(1) We process personal data that We require to fulfil or conclude a contract with You or to carry out pre-contractual measures on the basis of Art. 6 para. 1 lit. b GDPR.
(2) In addition, it may be necessary to process personal data in order to fulfil a legal obligation that We are subject to (Art. 6 para. 1 lit. c GDPR) or to protect Your vital interests (Art. 6 para. 1 lit. d GDPR).
(3) Other personal data We process according to Art. 6 para. 1 lit. f. GDPR for the protection of our legitimate interests, e.g. for the technically error-free and optimized provision of our services.
(4) Some personal data may only be processed with Your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw this consent at any time for the future. "For the future" means that Your withdrawal has no effect on the processing of data that We have made between the granting of Your consent and Your withdrawal. You do not have to justify Your withdrawal. An informal message via e-mail to dpo@wind.co is sufficient.
5. Duration of Storage
Your personal data will be kept as long as it is necessary for the purposes established in this policy. However, it may happen that the European or national legislator requires a longer storage period. In these cases, the data is not deleted or locked until the corresponding retention period has expired. After this period, the data will be definitively deleted.
6. No Disclosure
We will not disclose Your personal data to third parties, except if You have consented to the data transfer or if We are authorized or obliged to transfer data due to legal provisions and/or official or court directions. This may refer to cases including but not limited to the provision of information for the purposes of law enforcement, danger prevention or the enforcement of intellectual property rights.
7. Recipients
(1) Without prejudice to the above, Your personal data may be transferred to public administrations, including courts, when it is required in accordance with the current legislation in force.
(2) Additionally, companies that provide services to us and are contracted by WIND, such as payment providers, IT service providers (e,g, Google LLC) and etc. can have access to Your personal data. To the extent WIND uses such contractors, a description of their services can be found below.
(3) Unless noted otherwise below, these external companies process data for WIND as data processors, i.e. based on WIND’s instructions.
8. Transfer of personal data
(1) Personal data transfer may only occur if there is good reason to do so and all the relevant requirements of the GDPR regarding the data transfer are complied with.
(2) For instance, information processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, U.S. and Amazon Web Services Inc., 410 Terry Avenue North, Seattle WA 98109, US, can be transferred to their servers in the United States. For more information please refer to “Using the Application“ and “Website management” sections below.
(3) Additionally, payment data may be transferred to the payment service provider Stripe, Inc. 185 Berry Street, Suite 550 San Francisco, CA 94107, USA depending on the Your choice of a preferred payment method. For more information please refer to “Rentals and payments“ section below.
(4) Some information can be transferred to CRM (Customer relationship management) provider Salesforce.com, inc. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States.
(5) Google LLC, Stripe Inc., Amazon Web Services, Inc., Salesforce Inc. apply the EU Model Standard Contractual Clauses to their transfers of personal data. This ensures an adequate level of protection for Your data.
9. Data Protection and Third-Party Websites
(1) This Website may contain hyperlinks to or from third-party websites. If You follow a hyperlink to one of these websites, please note that We cannot assume any responsibility or guarantee for external contents or data protection conditions. Please verify the respective applicable data protection provisions before You transfer personal data to these websites.
(2) Data communication via the internet cannot be guaranteed to be error-free and/or available at all times according to the current state of technology. In this respect, We are not liable for the constant and uninterrupted availability of our system.
V. Operations. Purposes and legal grounds for processing
The type and volume of the personal data we use are determined by the purposes and operations in relation to which We collect and use them.
1. Download / Installation of the Application
(1) The Services WIND offers are provided exclusively via our Application. When You download / install our Application, We will ask for permission to use interfaces to access functions and contents of Your device in order to collect certain data including:
a. Your location: to display all available Electric Scooters in Your area and guide you there. We also track Your location when locking and unlocking a Scooter. Location tracking only takes place to ensure a proper lending and return process or to assist You in the event You report a service case;
b. Your camera: to scan the QR code of a chosen Electric Scooter and place a rental request;
c. Mobile data and Bluetooth connection: to unlock and lock the Electric Scooter.
(2) We need access to the above interfaces and data in order to provide You with the functions and services of our Application as well as to enable the booking of an Electric Scooter.
(3) We process that information according to Art. 6 para. 1 lit. b GDPR, namely to fulfil our obligations under our Contract with You.
(4) Access is possible from the moment the Application is installed on Your mobile device. Depending on Your settings, this access is permanent or only for the duration of the actual use of the Application. For the highest possible level of data protection, We recommend that You only allow access during the actual use of the Application. The data retrieved in each case are generally stored only for the duration of the actual use of the Application, after which they are deleted. We store Your location retrieved in the event You report a service case for a maximum duration of one year at the time of reporting. We store the location data that We collect in connection with locking and unlocking our Electric Scooters for a maximum duration of 3 years. The data will then be made anonymous or will be blocked and deleted according to the rules stated in clause 7 of this Policy regarding “Duration of the Storage”.
2. Registration
(1) In order to use our Services and all features of our Application, You have to register. You can register by entering Your telephone number in the input screen provided for this purpose.
(2) The processing of Your data during registration is carried out on the basis of Art. 6 para. 1 lit. b GDPR for the conclusion and fulfilment of a contract.
(3) These data are processed solely in order to provide You with the functionality of our Application. Without registration as a User, there is no way to rent and use an Electric Scooter through the Application.
(4) As soon as You uninstall the Application and the legal retention periods have expired, the data entered during registration will be deleted.
3. Using the Application
(1) In addition to the required information under s.1 and s.2, every time You open our Application, We collect so-called server log files. These log files register all requests and accesses made by Users to the Application and record all error messages from an Application. This recorded information includes:
a. the IP address of Your mobile device,
b. Your device,
c. the name of Your telephone, if You have named it using Your own name,
d. the time of the request,
e. the status of the request,
f. the quantity of the transferred data with respect to that request.
(2) We have a legitimate interest in the processing of that data in order to detect and eliminate errors of our Application, to ensure its stability and security, and carry out analyses to improve our Application.
(3) The legal basis for that processing is Art. 6 para. 1 lit. f GDPR.
(4) The data will be deleted as soon as You close our Application.
(5) We use Google Firebase authentication by Google LLC. for Our Application to make Your authentication easier and more convenient. You can view the Google Firebase Terms of Use here: https://firebase.google.com/terms/ as well as Google Firebase's privacy policy here: https://firebase.google.com/support/privacy.
(6) Our Application also uses Google Maps API applications by Google LLC. This enables Us to display interactive maps directly in the Application and enables You, by using Your IP address, device information and/or geolocations, to use the map functions such as indication of location of the nearest Electric Scooter, expected running distance and running time and etc. You can view the Google Terms of Use here: https://policies.google.com/terms?hl=en. The additional terms of use for Google Maps/Google Earth can be found here: https://www.google.com/help/terms_maps.html You can find Google's privacy policy here: https://www.google.com/intl/de/policies/privacy/.
(7) We use the Amazon Web Services as our Application infrastructure, i.e. without it We may not be able to provide you with the functionalities of Our Application thus grant you access to Our Services. In this context, information is transmitted exclusively to servers in the Frankfurt am Main region and stored there. Amazon may not use the data for other purposes. In addition, Amazon is obliged to treat the information in accordance with this data protection declaration and the relevant data protection laws. More information can be found in Amazon's privacy policy: https://aws.amazon.com/de/compliance/data-privacy-faq/.
(8) We also use Customer relationship management (CRM) provided by Salesforce. Inc in order to manage Our relationships and interactions with You. Salesforce may not use the data for other purposes. You can find Salesforce’ privacy policy here: https://www.salesforce.com/company/privacy/.
4. Rentals and payments
(1) In addition, for the purpose of administering rentals and processing of payments, for each User We also store information related to:
a. Rental: date, duration of rental, distance, cost;
b. Payment details: may differ in accordance to the preferred payment method.
(2) The data are processed exclusively for the purpose of providing You with the functions and services of our Application.
(3) The legal basis for that processing is Art. 6 para. 1 lit. b GDPR for the conclusion and performance of a contract.
(4) Without depositing a method to pay the rental price of an Electric Scooter (both for single trips and for subscriptions or to top up Your credit in the Application), there is no way to rent and use an Electric Scooter through the Application.
4.1. Credit Card via Stripe Inc.
(1) For payment by credit card We use the payment service provider Stripe, Inc. 185 Berry Street, Suite 550 San Francisco, CA 94107, USA. If You decide to pay via Stripe, the data You enter will be transmitted to Stripe for payment during sign-up. Stripe stores Your payment data itself.
(2) We may gain access and store:
a. Payment ID from Stripe;
b. Last 4 numbers of Your card;
c. Your names or any other details (if You have provided such to Stripe).
(3) Special features for single trips: Single trips are always charged depending on the duration of use. Therefore, We need to know Your Stripe-ID at the start and at the end of a single trip. Therefore, We store Your Stripe ID in Your customer account until You delete Your Stripe ID. If You do not have a current subscription, You can delete Your Stripe ID after each individual trip and only save it again when You use the Application. Alternatively, You can use Stripe to load credit to Your WIND account and then delete Your Stripe ID again.
(4) Stripe may not use Your data for other purposes. Stripe is required to use the information in accordance with the relevant data protection laws. Stripe's privacy policy can be found here:https://stripe.com/de/privacy.
4.2. PayPal
(1) In addition, We use the payment service provider PayPal of PayPal (Europe) S.à r.l et Cie, S.C.A., so You can also pay via Your PayPal account. If You choose to pay via PayPal, the information You provide will be sent to PayPal for payment at sign-up. The data is stored by PayPal itself. PayPal pre-authorizes Your PayPal account on behalf of WIND by debiting Your User account with EUR 1, but this amount will be refunded immediately.
(2) We may gain access and store:
a. Payment ID from Stripe;
b. Last 4 numbers of Your card;
c. Your names or any other details (if You have provided such to Stripe).
(3) Special features for single trips: Single trips are always charged depending on the duration of use. Therefore, We need to know Your PayPal ID at the start and at the end of a single trip. Therefore, We store Your PayPal ID in Your customer account until You delete Your PayPal ID. If You do not have a current subscription, You can delete Your PayPal ID after each individual trip and only save it again when You use the Application. Alternatively, You can use PayPal to load credit to Your WIND account and then delete Your PayPal ID again.
(4) PayPal may not use Your data for other purposes. PayPal is required to use the information in accordance with the relevant data protection laws. PayPal's privacy policy can be found here:https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=en_EN
5. Invoicing
(1) You have the right to receive, free of charges, the corresponding invoices, if You request so.
(2) In order to issue and provide an invoice, We need to process the following information:
a. Your names: an invoice requirement;
b. Address: an invoice requirement;
c. Email address: where You will receive invoice.
6. Feedback
(1) We may also process personal data of Yours in order to respond to Your enquiries, complaints and requests.
(2) Specifically, We may process Your:
a. Names;
b. Email address;
c. The information contained in Your message/ query content
d. Any additional data that We may need in order to process Your request/enquiry.
(3) If Your query or request concerns our Services and Contract related issues, the data processing will be performed for the fulfilment of a contract with You as Our existing client or in order to take steps at the Your request as a potential client prior to entering into a Contract with us (Art. 6 para. 1 lit. b GDPR).
(4) Otherwise, We will process Your data for the protection of our legitimate interests, specifically for the purpose of provision of clarifications, additional information and response to questions regarding the Our Services and supplement, where necessary, the information available on our Website and Application (Art. 6 para. 1 lit. f. GDPR).
7. Newsletter subscription
(1) We may also process Your email if You decide to subscribe to Our Newsletter.
(2) We will use Your email for the purposes of direct marketing to send You relevant information and offers regarding Our Services.
(3) We process this information based on Your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw this consent at any time for the future. "For the future" means that Your withdrawal has no effect on the processing of data that We have made between the granting of Your consent and Your withdrawal. You do not have to justify Your withdrawal. An informal message via e-mail todpo@wind.cois sufficient.
8. In-app marketing communication
(1) We may display marketing notifications and pop-up communication directly in the Application, if You decide to enable this option.
(2) We will for the purposes of direct marketing to send You relevant information and offers regarding Our Services.
(3) We will conduct this based on Your consent. You can withdraw this consent at any time. for the future by deactivation this option in the Application. "For the future" means that Your withdrawal has no effect on the processing of data that We have made between the granting of Your consent and Your withdrawal.
9. Website management
(1) We employ cookies and tools to manage our Website, analyze its functioning and use and tailor its content according to Your preferences.
(2) Whenever You access our Website, We may process Internet identifiers which alone do not contain data that could be associated with an individual visitor to the website. Nonetheless, We collect the following information about Your computer via cookies and/or other tools:
a. the IP-address of Your computer,
b. the operating system of Your computer,
c. the type of browser You are using (Firefox, Google Chrome, etc.) and its version,
d. the request of Your browser,
e. the time of this request,
f. the status of the request,
g. the amount of data transferred in the context of this request,
h. Date and time of access,
i. the URL of the Website from which You accessed our Website (so-called referrer URL),
j. the URL of the Website You are visiting from our Website.
(3) Some of the cookies we use are necessary for the proper functioning of Our Website.
(4) When the processing of that data is not essential for Our Website We may store and track cookies after having obtained Your consent (Art. 6 para. 1 lit. a GDPR) for each specific category of cookies and the purpose of their use on Your first visit to the Website through the integrated cookie managing tool. More information about the tools and cookies used, their providers, and how to change their settings can be found here.
VI. Your Rights
(1) Right to information acc. Art. 13 GDPR: to be informed about the collection and use of Your personal data what the purpose of this Privacy Policy is.
(2) Right to withdraw Your consent acc. Art. 7 para. 3 GDPR: In cases where the processing of Your personal data is only possible with Your consent, You can revoke this consent at any time in the future. "For the Future" means that Your revocation has no effect on the processing of data that We have made between the granting of Your consent and Your revocation. You do not have to justify Your withdrawal. An informal message via e-mail to dpo@wind.co is sufficient.
(3) Right of access in acc. Art. 15 GDPR: You may request confirmation from us at any time whether We process personal information concerning You. In this case, You have the right to request information about:
a. the purposes for which We process Your personal information
b. the categories of personal data We process,
c. the recipients or categories of recipients to whom We have disclosed or will disclose the data,
d. the storage duration (as far as possible),
e. the right of rectification, erasure or restriction of our processing, as well as the right of opposition to such processing,
f. the existence of a right of appeal to a supervisory authority,
g. the origin of Your data, as far as they were not collected by us,
h. the existence of automated decision-making including profiling and, where appropriate, detailed information on the logic, scope and impact of such processing.
(4) Right to rectification acc. Art. 16 GDPR: You can request correction and supplementation of Your personal data at any time free of charge.
(5) Right to erasure acc. Art. 17 GDPR: You can view Your personal data at any time free of charge and request cancellation if:
a. these are no longer needed for the purpose for which they were processed,
b. You have revoked Your consent and there is no other legal basis for the processing,
c. You have filed an objection against the processing of Your data acc. Art. 21 GDPR,
d. We have processed Your data unlawfully,
e. the deletion is required to fulfil a legal obligation under EU or national law.
(6) Right to restriction of processing acc. Art. 18 GDPR: You can view Your personal data at any time free of charge and, if necessary, request their blocking if:
a. You deny their accuracy,
b. the processing is illegal, but You reject the deletion of the data,
c. We no longer need the data, but You need it for the assertion, exercise or defense of legal claims,
d. You have filed an objection against the processing of Your data acc. Art. 21 GDPR, but it is not yet certain whether our interests in processing outweigh Your interests.
(7) Right to data portability acc. Art. 20 GDPR: At our request, We are required to provide You with data that We process automatically based on Your consent or in fulfilment of a contract in a portable and secure format. The direct transfer of data to another controlller is also possible at Your request. However, it only takes place if technically feasible.
(8) Right to object acc. Art. 21 GDPR: on grounds relating to Your particular situation, You can object to the processing of personal data carried out on the basis of Our legitimate interest or performed for direct marketing purposes.
(9) Right to object to automatic decision-making, including profiling acc. Art. 22 GDPR: to object to a decision-making that is based solely on automated processing, including profiling, which produces legal effects concerning You or in any other similar way significantly affects You.
(10) Right to lodge a complaint with a supervisory authority acc. Art. 77 GPDPR: If You think that We have violated data protection regulations, You can contact a regulatory authority for data protection in the non-public area, in particular the supervisory authority of your habitual residence, your work place or the location of such violation, as well as the Berlin Data Protection Commissioner:
Berliner Beauftragte für den Datenschutz und die Informationsfreiheit (BlnBDI)
Address: Friedrichstr. 219, 10969 Berlin, Germany
Visitor’s entrance: Puttkamer Straße 16 - 18 (5th Floor)
Phone: +49 30/138 89-0
Fax: +49 30/215 50 50
E-mail: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de
VII. Your Data Requests
(1) For more information or to exercise any of Your rights, please contact us via dpo@wind.co.
(2) If You have any questions, comments or inquiries regarding the processing of Your personal data, please also contact us at the contact details provided above.
(3) We may contact and/or request additional information from You, if necessary, to verify Your identity.
Wind Tel-Aviv (By-Byke) Ltd.
May 2022