DriveNow carsharing

Data Protection

Preamble

We take the protection of personal data, very seriously. We would like to explain here how we protect your data and what it means for you when you use our personalized services. Of course, we comply with all the legal requirements regarding data protection to ensure maximum protection of your privacy. We comply with the provisions of the General Data Protection Regulation (GDPR) and the New Federal Data Protection Act (BDSG-neu) due to the adaptation of data protection law in line with Regulation (EU) 2016/679 and we comply with the implementation of Directive (EU) 2016/680 (Data Protection Adaptation and Implementation Act EU - DSAnpUG-EU).

 

This data protection statement applies to DriveNow's website, which can be accessed under the domain https://www.drive-now.com/at/en/vienna and the various subdomains (hereinafter referred to as "our website").

 

1. Name and address of the person responsible

The responsible party and service provider is DriveNow Austria GmbH, Rinnböckstraße 3, 1030 Wien (hereinafter referred to as "DriveNow").

 

2. Name and address of the data protection officer

Our data protection officer is attorney-at-law Dr. Karsten Kinast, Kinast Rechtsanwaltsgesellschaft mbH, Hohenzollernring 54, 50672 Cologne. You can contact our data protection officer at any time in relation to any matter relating to data protection. The best way to contact us is to send an email to: datenschutz@drive-now.com or to write us at: DriveNow GmbH & Co KG, Seidlstrasse 26, 80335 Munich, Germany.

 

3. General information on data processing

We only collect and use personal data from our users which is necessary to provide a functional service for our website and for the content of our services.

 

3.1 Personal data

Personal data is information that can be associated with you as an individual. Examples include your name, address, postal address, telephone number and email address. Non-personal data is information such as the number of users of a website or service.

 

3.2 Processing of personal data

Processing means any operation or series of operations carried out with or without the aid of automated procedures in relation to personal data, such as the collection, collation, organisation, sorting, storage, adaptation or alteration, reading, retrieval, use, disclosure by transmission, dissemination or any other form of provision, comparison or linking, restriction, erasure or destruction.

 

Personal data is collected via this website if you provide it to us on your own initiative and consent, e.g. by registering, filling out forms, sending emails or by booking a DriveNow vehicle. We use this data for the purposes indicated in each case or resulting from the enquiry, thus for example the reservation enquiry for handling your reservation requests. Transmission to third parties will only take place if this is expressly permitted by law or if you have agreed to the transmission within the framework of your registration or during an active business relationship. Apart from this, you can principally use the general information on www.drive-now.com without disclosing your personal data.

 

3.3 Legal basis for the processing of personal data

The collection and use of the personal data of our users takes place regularly only with the user's consent. Insofar as we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 lit. a GDPR shall apply as the legal basis for the processing of personal data.

 

An exception applies in those cases in which prior consent cannot be obtained for actual reasons and the processing of the data is permitted by legal regulations. For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 lit. b GDPR is the legal basis. This also applies to processing operations that are necessary for carrying out pre-contractual measures.

 

Insofar as the processing of personal data is necessary to fulfil a legal obligation to which we are subject, Art. 6 para. 1 lit. c GDPR is the legal basis.

 

If processing is necessary to safeguard a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not outweigh this first interest, Art. 6 para. 1 lit. f GDPR is the legal basis for processing.

 

3.4 Data erasure and storage time

Your master data is kept for the duration of the contract. After you have initiated the termination of the business relationship, the data will be kept for a maximum of 4 years from your last transaction. If we initiate the termination of the business relationship for security reasons or due to bankruptcy, we will keep your data for a maximum of 5 years after your last transaction. 

3.5 Security

3.5.1 Security, TLS technology

We have taken technical and organisational measures to protect your personal data, in particular against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These security measures are continually updated in line with technological developments. The transmission of personal data between your computer or mobile device and our server is always encrypted (TLS procedure, Transport Layer Security).

3.5.2 Login notification security action

To enable us to protect you better from the abuse of your data, you will receive an automatic notification by email if somebody logs into your DriveNow customer account using a device which we do not recognise. For this purpose, we save a device-specific ID in your customer profile on the DriveNow website or app and process the following data which we send to you in the notification addressed to you for identification purposes: device type, time, IP address and location on the basis of the IP. These data are naturally only used by us to enhance your security. They are not disclosed to third parties. This data processing is supported by our justified interest as described in Art. 6 Abs.1 letter f of the GDPR.

 

4. Registration

In the following we describe the processing of data within the registration process.

 

4.1 Registration process

Our website offers users the option to register by entering personal data. As part of this process, the data is entered into an input screen, transmitted to us, and saved. We do not share data with third parties. The following personal data is collected as part of this registration process:

- Name, address, date of birth, e-mail address, mobile phone number, payment data as well as a PIN selected by you, answer to security question, and a password

 

In addition, the following personal data is collected:

- IP address

- Date and time of registration

 

Your data, with the exception of your IP address, will be stored for the entire period of the contract performance, not to exceed 4 or 5 years, depending on the manner in which the business relationship was terminated as set forth in Item 3.4. After the expiration of these periods, all data relating to your person will be permanently deleted, unless there are legally mandated retention periods. During the retention period, data relating to your person that is required to meet commercial and fiscal obligations will be completely blocked and will no longer be accessible for further data processing activities. We will delete your IP address after six months in all cases.

 

4.2 Legal basis

The legal basis for the processing of this data, which is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 lit. b GDPR.

 

5. Driver license verification

 

5.1 DLCS

As an alternative, you can also use the DLCS Tool offered on our website for driver license verification. To this end, we use the data you specified as part of your registration as well as a copy of your driver license (front and back) for review by our staff. After the verification, the data that was processed for this purpose will be deleted.

 

5.2 Legal basis

The legal basis for processing this data, which is required for contract performance or to carry out pre-contractual activities, is Art. 6 (1), lit. b, GDPR. 

 

6. Google Maps

In the following we describe data processing in the context of the use of Google Maps.

 

6.1 Google Maps application

This website, as well as the DriveNow application, use Google Maps API applications. This enables us to display interactive maps directly on the website or on our app and enables you to conveniently use the map function. This application is essential for the functionality and complete provision of our content and services. You can view Google's Terms of Use here: https://policies.google.com/terms?hl=en. The additional terms of use for Google Maps/Google Earth can be found here https://www.google.com/intl/en-US_US/help/terms_maps.html. You can find Google's privacy policy here: https://policies.google.com/privacy?hl=en. We use Google Maps to determine the current location of our vehicles and to show you the nearest available vehicle. In addition, we use Google Maps to translate geo-positions into addresses and to show you the estimated walking distance to the selected vehicle. After your approval, we will use Google Maps to show your planned arrival location and the remaining arrival time for handover to a subsequent customer on our app. We do not share this information with Google. This data will only be transmitted to Google anonymously. It cannot, therefore, be traced back to you.

 

6.2 Legal basis

The legal basis for the processing of this data, which is necessary for the fulfilment of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 lit. b GDPR.

 

7. Cookies

In the following, we describe processing procedures within the framework of using cookies in detail.

 

7.1 Use of cookies

Cookies are small text files that are stored on your hard drive by a web server. Cookies contain information that can later be read by a web server in the domain that issued the cookie to you. Cookies cannot run programs or deliver viruses to your computer. There is a distinction made between two different types of cookies. Session cookies are deleted as soon as you end the session. Temporary and permanent cookies are stored on the data carrier for a longer period or indefinitely.

 

7.2 Data in the context of the use of cookies

No personal data is stored in the cookies we use. The cookies we use are also not combined with personal data. In this respect, these cookies cannot be attributed to any particular person. When a cookie is activated, it only receives an identification number. Personal data such as name, IP address, etc. are not assigned to this identification number at any time. Using cookie technology, we only receive anonymous information, such as which pages of our website have been visited, etc.

 

7.3 Use of session cookies

Most of the cookies we use are so-called session cookies, which are necessary to keep your visit consistent, i.e. to ensure that, for example, no renewed login is required and that your preferences or other information already entered during the reservation request are retained during the session. In addition, we need session cookies to ensure that a specific offer that you have clicked on will be assigned to your request (e.g. for promotional offers). These session cookies are automatically deleted when the session ends. In addition, we use cookies when you visit the website subsequently to detect if you are particularly interested in certain offers, which allows us to display such targeted offers on the site. This assignment is only made using abstract criteria (e.g. "BMW") and not on a personal basis. These cookies have a lifetime of one year and are then automatically deleted.

 

7.4 Onsite targeting

Our website uses cookie technology to collect data to simplify our website. This tells us how the website is used and enables us to constantly optimise our offering. The following data is processed:

- Search terms used

- Frequency of page views

- Use of website functions

 

This data is used exclusively for anonymous evaluation of the use of the website and is never merged with the personal data stored by us. Using the information obtained through clickstream analysis, we make our website as attractive as possible in order to best meet our customers' needs.

 

7.5 Re-marketing/re-targeting and web analysis

We use so-called re-marketing/re-targeting to make online offers more relevant for Internet users and to consistently improve our promotional offers and marketing measures. This technology allows us to reach out to Internet users who have already shown interest in our website with DriveNow advertising via advertising banners or ads on the websites of our partners. To this end, the users’ stored surfing behaviour is analysed with an analytical tool on the basis of an algorithm. The display of our advertising on the websites of our partners relies on cookies and the analysis of usage behaviour on the website. The advertisement displays are completely anonymous. At no time are personal data saved or user profiles combined with personally identifiable data. For this purpose, we use cookies by the following third-party vendors:

 

7.5.1 Criteo

Criteo SA, 32 Rue Blanche, 75009 Paris, France: This product helps us, beyond the scope described above, to post our advertising in apps and e-mails to visitors who are interested in our products. We may share information such as technical identifiers from your registration information on our website or from our CRM system with reliable advertising partners. This allows for linking your devices and/or environments in order to offer you a seamless user experience with the devices and environments you typically use. For further details about these linking capabilities, please refer to the privacy policy of Criteo at: http://www.criteo.com/de/privacy

 

7.5.2 Taboola

Taboola Inc., 28 West 23rd Street 5th floor, New York, NY 10010, USA: This product lets us determine which services you use and which of our pages you visit. This utility supports you with the discovery of content on third-party websites. The cookie enables us to generate pseudonymous user profiles by collecting device-related data and log data. Tracking (i.e. the collection of data associated with website use generated by the cookie) can be deactivated at any time. For this purpose, please follow the instructions in this document: https://www.taboola.com/privacy-policy.

 

7.5.3 Outbrain

Outbrain UK Limited 39 W 13th Street, New York, NY 10011 USA: This (content discovery recommendation system) supports you with the discovery of content on third-party websites. Outbrain uses cookies that help to collect and save information about you and other users of the service. Data is collected and saved in anonymous form. Outbrain as the controller has compiled information on the collection and processing of usage and other data in its privacy statement: http://www.outbrain.de/legal/privacy-713/. Tracking (i.e. the collection of data associated with website use generated by the cookie) can be deactivated at any time. For this purpose, please follow the instructions in this document: http://www.outbrain.de/legal/privacy-713.

 

7.5.4 Google Re-marketing

Our website uses the re-marketing function of Google AdWords, a service provided by Google Inc.,1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This technology enables us to place automatically generated, target-group-specific advertisements on our website after your visit. The ads are based on the products and services that you clicked on during your last visit to our website.

 

Google uses cookies to generate interest-based advertisements. Google generally saves information such as your web request, IP address, browser type, browser language, and the date and time of your request. This information is used only for allocating the web browser to a specific computer. It cannot be used to identify a person.

 

If you don’t wish to receive user-based advertising from Google, you can opt out of advertisements in the Google display settings.

 

Further information about Google’s use of cookies can be found in the Google privacy statement at the following link: https://www.google.de/intl/de/policies/privacy/.

 

7.5.5 Google AdWords & conversion tracking

We place Google AdWords advertisements to draw attention to our products. In the scope of this activity, we use Google conversion tracking, a service provided by Google, Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. These advertisements are displayed when users enter search queries on the websites of the Google advertising network. We have the option to combine our advertisements with certain search terms. We use cookies to place advertisements based on the prior visits of a user on our website.

 

When a user clicks on an advertisement, Google saves a cookie in the user’s computer. Further information on the associated cookie technology can also be found in Google’s information on website statistics and privacy regulations.

 

With the help of this technology, Google and we as a customer are notified when a user clicks on an advertisement and is redirected to our webpages. The information obtained in this context is exclusively used for the statistical analysis of advertising optimisation. We do not receive any information that personally identifies visitors. The statistics provided to us by Google include the total number of users who clicked on one of our ads and, if applicable, whether they were redirected to a page of our website that includes a conversion tag. These statistics enable us to understand which search terms led to the most frequent clicks on our ads and which advertisements resulted in a user filling out the contact form.

 

You can take steps to prevent the storage of the cookies required for these technologies, for example in your browser settings. In this case, your visit will not be reflected in user statistics.

 

You also have the option to select the types of Google ads in the display setting or to deactivate interest-based ads in the Google website. As an alternative, you can opt out of the use of cookies by third parties by visiting the Opt-Out help site of the Network Advertising Initiative. For more details, visit: http://www.networkadvertising.org/choices/ and http://www.youronlinechoices.com/

 

However, our company and Google will continue to receive statistical information about the number of users who visited this website and when. If you do not wish to be included in these statistics, you can prevent inclusion with the help of additional browser programs (e.g. the Ghostery add-on).

 

7.5.6 Bing Ads

This website uses Bing Ads, a program by Microsoft Corporation, Microsoft Way Redmond, WA 98052-7329, USA, which uses so-called universal event tracking (UET) for re-marketing and conversion tracking. This service saves a cookie in the website visitor’s computer if our website was found through the Bing or Yahoo search engines. Data is collected and saved in anonymous form. Based on the use of the re-marketing function, custom-tailored offers will be displayed to the user during subsequent searches in one of the above-listed search engines. You can access the Microsoft privacy statement on the handling of collected data at the following link: https://privacy.microsoft.com/de-de/privacystatement/. You can opt out of Bing Ads at any time. The corresponding instructions can be found here: http://choice.microsoft.com/de-DE/opt-out.

 

7.5.7 Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies", text files that are stored on your computer and which enable analysis of your use of the website. The information on your use of this website generated by the cookie (including your IP address) will be transferred to and stored on a Google server in the USA. However, if IP anonymisation is enabled on this website, your IP address will first be abbreviated by Google within the member states of the European Union or other parties to the agreement on the European Economic Area. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there.

 

Google will use this information for the purpose of evaluating your use of the website, compiling reports about website activities for website operators and to provide other services related to website and internet use, in particular functions for Google Analytics reports on performance according to demographic characteristics and interests. Google Analytics Demographics and Interest Reporting allows us to use data from Google's interest-based advertising and/or data from third parties about our advertising audience (e.g. age, gender and interests) in conjunction with Google Analytics for targeted and optimised advertising activities, strategies and content of our website.

Google may also transfer this information to third parties as required by law or if said third parties process this data on behalf of Google. In any event, Google will not associate your IP address with other data held by Google.

 

You can prevent these cookies being stored by selecting the appropriate settings in your browser; however, we wish to point out that doing so may mean you will not be able to enjoy the full functionality of this website. You can also prevent the data generated by cookies about your use of the website (incl. your IP address) being passed to Google and the processing of this data by Google, by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

 

This website uses Google Analytics with the extension "anonymizeIp()". As a result, IP addresses are further processed in abbreviated form, so that a connection to a particular individual can be ruled out. If the data collected about you is personal in nature, it will be excluded immediately, and the personal data will be deleted immediately.

 

We use Google Analytics to analyse and regularly improve the use of our website. We can improve our offering and make it more interesting for you as a user with the statistics gained. For the exceptional cases in which personal data is transferred to the USA, Google has submitted itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

 

Third party information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Usage conditions: https://www.google.com/analytics/terms/gb.html, Overview of data protection: https://support.google.com/analytics/answer/6004245?hl=en, as well as the privacy policy: https://policies.google.com/privacy?hl=en.

 

This website also uses Google Analytics for a device-independent analysis of visitor flows, which is carried out via a user ID. You can disable cross-device analysis of your usage in your Google Account under "My information", "Personal information"

 

7.5.8 Google Tag Manager

This website uses Google Tag Manager, which is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Tag Manager is used to manage website tags. Google Tag Manager is a cookie-free domain; it does not collect personal data. However, the application initiates other tags, which may collect personal data, although Google Tag Manager does not access this data. Any opt-out established at the domain or cookie level will apply to all tracking tags that were implemented with Google Tag Manager. Further information on Google Tag Manager can be found at http://www.google.de/tagmanager/use-policy.html.

 

7.5.9 adjust.io

This website also uses the “adjust.io” analytical technology of adeven GmbH, Saarbrücker Str. 37a, 10405 Berlin, (“adeven”). adeven uses IP and Mac addresses of users for its analysis, which are exclusively used anonymously. No conclusions about individuals can be drawn. The information collected through this tool is exclusively used to analyse the function and usage of the website by generating anonymous evaluations and charts on the number of visits, number of pages accessed by each user etc. The analyses are exclusively used for the purposes of our own market research and the optimisation and user-friendly design of our website. By using this website for analytical purposes, you consent to the processing of anonymous data in the manner and for the purposes set out above. You can opt out of the collection and storage of data at any time with future effect by sending an e-mail to optout@adjust.io.

7.5.9.1

App performance tracking: Our mobile apps use the app performance and analysis technology “adjust”, a service provided by adjust GmbH ("Adjust").

When you launch the DriveNow app, “adjust” collects install and event data our iOS and Android mobile apps in order to help us understand how our users are interacting with our apps and to optimize and analyze mobile ad campaigns. For such analysis, “adjust” uses your IDFA or Google Play Services ID, and your anonymized (hashed) IP- and MAC address. The hashes used are one-way hashes and it is not possible to identify you or your mobile device individually. The legal basis for the processing is based on Art. 6 para. 1 f) GDPR. The legitimate interest lies in the analysis and improvement of our mobile advertising campaigns. Your data will (not) be transferred transnationally.

You can opt out of the collection and storage of data at any time with future effect by sending an e-mail to optout@adjust.io.

 

7.5.10 DoubleClick

Our website uses DoubleClick by Google Inc. via Trakken Web Services GmbH, Zirkusweg 1, 20359 Hamburg, Germany to present you with relevant advertisements. When you open a website and see a display of an advertisement placed via websites of the Google advertising network or click on it, a DoubleClick cookie may be stored in your browser. The DoubleClick cookie identifier allocated to your browser is the same cookie that is used when you visit websites, in which advertising programs by DoubleClick are applied. This cookie allocated to your browser contains a pseudonymous identification number (ID) and can check which ads were displayed in your browser and how many ads have been viewed. These cookies do not contain any personal information. In connection with our re-marketing measures, we may show you advertisements tailored to your preferences on the basis of this information. Re-marketing collects and saves information about your surfing habits in anonymous form for marketing purposes.

 

DoubleClick only allows Google and its partners to place advertisements on the basis of prior visits to our website or other websites. Google transmits the information generated by cookies to a server in the United States for analytical purposes and saves it there.

 

Google observes the data protection provisions of the U.S. Privacy Shield Agreement and is registered with the U.S. Department of Commerce Privacy Shield Program> For further information, see:

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI

 

The transmission complies with legal requirements or occurs within the scope of order processing. Under no circumstances will Google combine your data with other data collected by Google. By using this website, you consent to the processing of data collected about you by Google in the manner of data processing and for the purposes set out above. You can prevent the storage of cookies by selecting the corresponding settings in your browser; however, you may not be able to fully use some of the features of our website in this case.

 

Information about data protection at DoubleClick can be found at:

http://www.google.de/policies/technologies/ads/

 

In addition, you can opt out of the transmission of data generated by cookies, which refer to your use of websites to Google as well as the processing of this data by Google by downloading and installing the browser plug-in available at:
 

7.5.11 Visual website optimizer (VWO)

Wingify Software Private Limited, Antriksh Apartments, Sector-14, Rohini, Delhi-110085, India: This enables us to analyse the behaviour of users on our website and the interaction with them, create versions of certain pages and test them by making them available to users selected at random or determined by target groups. For this purpose, VWO is capable, among other things, of recording the mouse movement of users and their interaction with boxes on our website in anonymised form. The anonymity of the users is guaranteed by the fact that no personal data, such as IP addresses, names or entries using the keyboard are recorded. VWO uses cookies to conduct tests and reproduce user behaviour. Further information about the use of cookies by VWO is available at https://vwo.com/knowledge/what-are-the-cookies-stored-by-vwo/.

Information about the general function of VWO is available at https://vwo.com/privacy-policy/.

If you wish to be excluded from VWO's analysis and test methods, you can arrange this at https://vwo.com/opt-out/.
 

7.6 Opting out of cookie storage

You have the option to accept or reject cookies. Most web browsers automatically accept cookies, but browser settings usually allow for rejecting cookies. If cookies are rejected, some features of the website may no longer be usable. If cookies are accepted, the accepted cookies may be deleted at a later point. When you delete cookies, all settings that are controlled by these cookies, including advertising preferences, will be deleted and may not be restored. Furthermore, please refer to the above-mentioned special opt-outs.

 

Detailed additional information on this topic can be found at the following websites: youronlinechoices, Network Advertising Initiative and/or Digital Advertising Alliance. These websites also contain details about deleting cookies from your device.

 

7.7 Legal basis

The above-mentioned data processing activities and the associated purposes are our legitimate interest, on the legal basis of Art. 6 (1), lit. f, GDPR.

 

8. Custom Audience / Customised marketing

8.1 Marketing on partner sites (Facebook, LinkedIn, Twitter and Google)

We use the Custom Audience process on our website. This process transfers our customers’ data to our partners Facebook, LinkedIn, Twitter and Google. Our partners compare these data with the data in existing user profiles and, if they match, can inform you specifically about our products and services tailored to your needs. The following categories of personal data are transferred: email address, mobile phone number. The hashing method is used to transfer the data. This method allows your data to be transferred in pseudonymised form.

 

The aim of processing your personal data is to improve our marketing activities and to tailor them to your needs.

It is possible that your data will be processed in the USA by our partners. Facebook, LinkedIn, Twitter and Google are party to the EU-US Privacy Shield, an agreement which is sure is a reasonable level of data protection.

Your data will be stored and sent to our partners until you object.

You can object to your personal data being processed by Custom Audience. To do this, please send an email to the following email address:

unsubscribe@drive-now.com

If you object to your data being processed by Custom Audience, your data will no longer be sent to our partners.

8.2 Facebook Custom Audience

Within our Internet presence we use the "Facebook pixel" from Facebook Inc. 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). This allows users' behaviour to be tracked after they have seen or clicked on a Facebook ad. This process is used to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and can help to optimise advertising measures.

The data collected is anonymous to us, so it does not give us any indication of the identity of the users. However, Facebook stores and processes the data so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data usage guidelines. You can enable Facebook as well as its partners to connect advertising ads to Facebook and including on external websites. A cookie can also be stored on your computer for these purposes. In order to reject the use of cookies on your computer in general, you can set your internet browser so that cookies can no longer be stored on your computer in the future or cookies that have already been stored will be deleted. However, disabling all cookies can result in some functions on our internet pages no longer being executed.

You can disable the use of cookies by Facebook through a program we have developed specifically for this case (web-based opt-out procedure). For this you only need click on the following link .

8.3 Legal basis

Our legitimate interest lies in the aforementioned data processing processes and the purposes pursued with them. For this purpose, Art. 6 para. 1 lit. f GDPR provides the legal basis.

9. Product and advertising e-mails

The section below explains our data processing for the purpose of product information and advertising.

 

9.1 Product recommendation e-mails

We want to provide our customers with regular product recommendation e-mails. For this purpose, we use the e-mail address you specified as part of registration, your name and your date of birth. Our product recommendation e-mails are intended to inform you about products we offer, in which you may be interested on the basis of your most recent lease. In addition, we want to send you our confirmation notification regarding your registration and helpful product use instructions. You will receive these e-mails regardless of your subscription to our newsletter. Furthermore, we will use your data for the following purposes: Measures for the further development of services and products, reporting on the success of the utilised measures in the course of time, testing and optimisation of procedures for requirement analysis, benchmarking, and enrichment of our data, e.g. from publicly available sources or internal market research. We do not share data with third parties. Your data will be stored as long as we maintain a business relationship with you and you have not objected to this data processing. You have the right to object to this data processing, which is based on Art. 6 (1), lit. f, GDPR, at any time, either as a whole or for specific measures. In this case, we will no longer process your data. You may send your objection via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Austria GmbH, Rinnböckstraße 3, 1030 Wien. There is also an unsubscribe link in all notifications, which will be considered an objection if activated. 

 

9.2 Legal basis

The legal basis for the processing of data after registration for the newsletter by the user is, with the user's consent, Art. 6 para. 1 lit. a GDPR.

 

9.3 Personalised advertising and/or offer e-mails

We want to regularly send interest-based customised advertisements and/special offers for DriveNow to our customers via e-mail. Special offers also include our DriveNow packages with special cooperation partners, which you can view at: https://www.drive-now.com/de/de/now/partners.

 

Our goal is to continually improve our DriveNow customer experience and to make it more user-friendly. For the purpose of sending you such advertisements, we will use the e-mail address you specified as part of registration, your name and your date of birth. In order to send you interest-based advertising, we will use automatically generated information transmitted by your computer such as delivery and read receipts for messages, information on your device, your browser, your activities in our website, including the length of your visit on our website and your lease transactions. We will process this information in pseudonymised form. This ensures that our customers exclusively receive e-mail messages that match their interests relating to the advertising and/or special offers of DriveNow. You will receive these notifications regardless of your subscription to our newsletter. We do not share data with third parties. Your data will be stored as long as we maintain a business relationship with you and you have not objected to this data processing. You have the right to object to this data processing, which is based on Art. 6 (1), lit. f, GDPR, at any time, either as a whole or for specific measures. In this case, we will no longer process your personal data. You may send your objection via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Austria GmbH, Rinnböckstraße 3, 1030 Wien There is also an unsubscribe link in all notifications, which will be considered an objection if activated.

 

9.4 Legal basis

The above-mentioned data processing and the associated purposes are part of our legitimate interest on the legal basis of Art. 6 (1), lit. f, GDPR.

 

9.5 Newsletter

We would like to regularly provide interested parties and our customers with advertisements about our products and services about the following products and product categories of our contract partners via e-mail, text message and push. For this purpose, we will use the e-mail address you specified as part of registration, your mobile phone number and your name.  Your data will be exclusively used for distributing our newsletter. The identification of your e-mail address and your mobile phone number takes place in a double-opt in process. That means you will receive a separate confirmation e-mail and a 4-digit code via text message after processing your data. You will only start to receive promotional e-mails after clicking on the link included in the e-mail and entering the code contained in the text message. In addition, we will store your IP address and time of registration and confirmation in each case. The purpose of this procedure is to prove your registration and to investigate any possible misuse of your personal data. We do not share data with third parties. Your data will be stored until you withdraw your consent. You have the right to withdraw your consent to this data processing, which is based on Art. 6 (1), lit. a, GDPR, at any time without citing any reasons. In this case, we will no longer process your personal data. You may send your notice to withdraw consent via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Austria GmbH, Rinnböckstraße 3, 1030 Wien. There is also an unsubscribe link in all e-mails, which will be considered withdrawal of consent if confirmed.

 

9.6 Legal basis

The legal basis for above-described data processing and the associated purposes is Art. 6 (1), lit. a, GDPR.

 

9.7 Advertising by BMW

On our website it is possible to obtain information about current products and services available from the BMW Group, Bayerische Motoren Werke Aktiengesellschaft (BMW), Petuelring 130, 80788 Munich (BMW). This is done on the basis of your consent. When you log in to the shipment section for customer care and to selected publicity communications and for market research, the data from the entry mask is sent to us and we then forward this information to BMW.

 

BMW AG is also authorised to share this data with certain subsidiaries (BMW M GmbH, Daimlerstr. 19, 85748 Garching-Hochbrück) as well as individual contract dealers and workshops (preferred partners, companies where you bought vehicles or used service or consulting offers, or your regional partners), who may use your data for the above-listed purposes and are authorised to contact you in this regard. Updates may be shared among the above-listed companies.

 

For this purpose, we collect your e-mail address and your mobile phone number. The identification of your e-mail address and your mobile phone number takes place in a double-opt in process. That means you will receive a separate confirmation e-mail and a 4-digit code via text message after processing your data. You will only start to receive promotional e-mails after clicking on the link included in the e-mail and entering the code contained in the text message. You will begin to receive advertising e-mails once you click on the link included in the message. In addition, we will store your corresponding IP addresses and times of registration and confirmation in each case. The purpose of this procedure is to prove your registration and to investigate any possible misuse of your personal data.

 

To unsubscribe, you can either send an e-mail to service@drive-now.com at any time without citing any reasons or unsubscribe via the link at the bottom of any newsletter. You can also cancel your subscription by contacting the BMW Customer Service by phone at: +49 89 1250-16000 or by e-mail at: kundenbetreuung@bmw.de

 

9.8 Legal basis

The legal basis for processing data after a user’s subscription to the newsletter, in the presence of the user’s consent, is Art. 6 (1), lit. a, GDPR.

 

10. Market and survey research

In the following we describe data processing procedures in the context of market and survey research.

 

10.1 Statistical purposes

We process your personal data for market research and polling purposes. Your data will be made anonymous, only used by us for statistical purposes and cannot be traced back to you at any time. You can object to this data processing at any time and without giving reasons with effect for the future. For this purpose, you can use the functions described under Section 2 in the privacy policy.

 

10.2 Legal basis

This data processing is based on Art. 6 para. 1 lit. f. and serves the improvement of our purposes mentioned here in the privacy policy, in particular a more effective organisation of advertising, regarding our offers and services. We comply with the protection of our customers by conducting market research with anonymised data.

 

11. Use of service providers for the processing of personal data / processing of data in countries outside the European Economic Area

 

We use service providers to provide services and to process your data relating to our services and products. The service providers process the data exclusively in accordance with our instructions and have been obliged to comply with the applicable data protection regulations. All contractors have been carefully selected and will only have access to your data to the extent and for the time required to provide the services or to the extent to which you have consented to the processing and use of your data.

 

Service providers in countries such as the USA or in the countries of the European Economic Area are subject to data protection that does not generally protect personal data to the same extent as is the case in the Member States of the European Union. If your data is processed in a country that does not have a recognised high level of data protection such as the European Union, we use contractual regulations or other recognised instruments to ensure that your personal data is adequately protected.

 

12. Your rights as an affected person

 

12.1 Right to information

 You have the right to ask us at any time about the data stored concerning you, as well as its origin, recipients or categories of recipients to whom this data is transmitted and the purpose of storage.

 

12.2 Right of revocation

If you have given your consent to the use of data, you can revoke this at any time without giving reasons with effect for the future.

 

12.3 Right of correction

If your data stored with us is incorrect, you can correct it at any time in your customer account or have it corrected by us through our service centre.

 

12.4 Right of deletion and blocking

You have the right to block and delete your personal data stored by us. As a rule, your personal data will be deleted within a maximum of 2 working days after assertion of this right. Should the deletion contradict legal, contractual, fiscal or commercial-law storage obligations or other reasons based in law, your data can only be blocked, not deleted. Once your data has been deleted, it is no longer possible to provide information.

 

12.5 Right to data transmission

Should you request the personal data provided to us, we will release or transmit the data to you or another person responsible, if you so desire, in a structured, current and machine-readable format. The latter, however, shall only be the case if this is technically possible.

 

12.6 Right of objection

You have the right to object at any time and without giving reasons for data processing for the purpose of direct marketing. In addition, it is pointed out that the execution of the framework contract as well as the handling of individual contracts may be restricted or no longer possible due to opposition to all data processing operations.

 

12.7 Extended rights in relation to data processing for personalised data evaluation

With regard to the data processing of personalised data evaluation, in addition to the aforementioned rights, you also have the right of participation granted to a natural person in the decision-making process, a right of appeal and a right to disclosure of our position.

 

12.8 Contact for assertion of the rights of the persons affected

For asserting your rights you are entitled to the means mentioned in Section 2 of the privacy policy.

 

12.9 Right of appeal to the supervisory authority

You have the right to file a complaint with the competent supervisory authority against the processing of your personal data if you feel that your rights under the GDPR have been violated.

 

13. Data protection notice in the General Terms and Conditions.

Please see the data protection information included in Item 165 of our General Terms and Conditions, which you can access at https://www.drive-now.com/at/en/gtc  This section discusses how we process your personal data, which we need to implement individual lease contracts. In addition, we explain which personal data we must process, if applicable, in case of claims for recourse. Due to our legal liability as vehicle owners and to determine non-contractual and/or non-compliant use, we may also process your personal data. When you drive one of our vehicles, we use the so-called geo-fencing system, which involves the identification of your GPS location to provide you with valuable information. This does not involve creating a route profile. We process your personal data to send you additional push notifications for targeted communication. Finally, the section contains information about processing your personal data for identity verification and credit checks.

 

14. Changes to the privacy policy

This privacy policy may be subject to change over time. We encourage you to regularly review the privacy policy for any changes. However, we will provide you with a corresponding notification in case of significant changes. This may involve e-mail notification if necessary. This privacy policy was last updated on September 28, 2018.