DriveNow carsharing

Privacy Policy

Preamble

 

We take the protection of personal data very seriously. With this document we would like to explain how we protect your data and what it means for you when you use our personalised services. Of course, we comply with all legal obligations regarding data protection to ensure maximum protection of your privacy. We comply with the provisions of the General Regulation on the Protection of Personal Data (Regulation (EU) 2016/679 so-called GDPR) and the national data protection legislation in force from time to time, also implementing Directive (EU) 2016/680 (on the protection of individuals with regard to the processing of personal data by competent authorities for the purpose of prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties).

 

This data protection policy applies to the processing of data carried out by DriveNow Italy S.r.l. within the scope of its services, including through the use of the website which can be accessed through the domain https://www.drive-now.com/it/it/, and the various subdomains (hereinafter referred to as the "Website"), as well as the special application for mobile devices "DriveNow" (the "App").

 

1. Name and address of the data controller

The service provider and data controller is DriveNow Italy S.r.l.,

Via Carlo Ottavio Cornaggia, n. 16, Milano, VAT number 09504560963 (hereinafter referred to as "DriveNow").

 

2. Name and address of the data protection officer

Our data protection officer is attorney-at-law Dr. Karsten Kinast, Kinast Rechtsanwaltsgesellschaft mbH, Hohenzollernring 54, 50672 Cologne. You can contact our data protection officer at any time in relation to any matter relating to data protection. The best way to contact us is to send an email to: datenschutz@drive-now.com or to write us at:: DriveNow Italy, via Carlo Ottavio Cornaggia, n. 16 – Milano (Italia).

 

3. General information on data processing

We only collect and use personal data from our users which is necessary to provide a functional service for our Website and for the content of our services.

 

3.1 Personal data

Personal data is information that can be associated with a user as an individual. Examples include the name, address, postal address, telephone number and email address. Non-personal data is information such as the number of users of a website or service.

You are free to disclose or not your personal information as requested by DriveNow from time to time, but failing to do so may entail the impossibility to provide required services. Consent for personal information data processing is not needed for all the processing however related and/or necessary to fulfil an obligation under the law, Community legislation or to fulfil obligations deriving from a contract you are party of, or to implement specific requests by you before the contract is concluded. If you choose not to consent to data processing operations for commercial and promotional purposes - whenever requested in particular sections of the Website - your refusal will bear no consequences.

 

3.2 Processing of personal data

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal data is collected via the Website and the App if you provide it to us on your own initiative and consent, e.g. by registering, filling out forms, sending emails or by booking a DriveNow vehicle.

 

Your personal information will be mainly processed with electronic or automated tools to guarantee maximum safety and confidentiality. However, there might be occasions when the data so collected is processed manually without using electronic means. The data collected will be processed in full compliance with the law, as well as with principles of lawfulness, fairness, transparency, protection of confidentiality of your rights, and without excess, for the sole purpose of fulfilling legal and contractual obligations arising from the contractual relationship and/or of correctly executing the related performances, and/or for the marketing purposes described in this privacy notice. The data might also be processed to assert or defend DriveNow's rights in a judicial process.

DriveNow does not collect nor process any sensitive data regarding its customers. Should it learn about sensitive data, they will be processed only and exclusively for the purposes connected with the provision of the service you have required and will not be communicated or used in any way not linked to the rental function.

Personal data will only be passed on to third parties if this is expressly provided for by law, or if it is necessary to comply with legal obligations or to perform an existing contract, or if you have consented to the transfer, or for marketing purposes in the specific cases described in this privacy policy.

3.3 Purposes of data processing

The purposes of our data processing are first of all the following, connected to the provision of services:

a) performing the obligations arising from the General Terms & Conditions, the Regulation and/or delivery of directly related and/or ancillary services. In such cases, in accordance with Article 24 of the Code, the consent procedure is not necessary when data processing is required to pursue obligations deriving from a contract, whereas, during the negotiation, your consent is not necessary when data processing is required to meet specific requests made by you prior to the conclusion of the contract;

b) providing the services required by the Applicant and/or Customer when registering on the Website and/or App e creating his own account and user profile, including the collection, storage, and processing of the data for establishing, and subsequently operating, technical, and administrative management of the relationship connected with provision of the services, and for exchanging messages in regard to management of the services;

Users have the opportunity to register on the Website by providing personal data. The data is entered in an input screen, transmitted to us and saved. The following personal data is collected during the registration process:

 

i) Name, address, date of birth, e-mail address, mobile phone number, payment information and a PIN chosen by you, answer to the security question and a password.

ii) a copy of the licence, a copy of the identity card and a photograph in selfie mode

iii) IP address and date and time of registration

 

DriveNow reserves the right to process your personal data in order to verify the authenticity of the driving licence data received during registration at the Motor Vehicle Authority.

Alternatively, you can use the tool offered on the Site to check your driving licence. For this purpose DriveNow uses the data indicated under (ii). Data processed for this purpose will be deleted within 3 months.

 

Your data under (i) will be kept for the entire duration of your membership in the service, but for a maximum of 4 or 5 years after the termination of the relationship, depending on the manner of termination of the contractual relationship as defined in art. 3.4. Upon expiry of these terms, all personal data will be irreparably deleted, unless longer retention periods are required by law. During the retention period, personal data required to comply with fiscal and legal obligations will be completely blocked and will no longer be accessible for further processing.

 

We always delete your IP address within 6 months.

 

The above processing activities are lawful as they are necessary for the performance of a contract or for the implementation of pre-contractual measures (Art. 6 para. 1 letter b) of the GDPR).

c) managing payments (with the relevant processing - as required by law - of the payment data, including the identifying details of the credit card or pre-paid card) for the required services and any accessory charges,  in accordance with the provisions of the General Terms & Conditions and/or other specific contractual conditions published on the Website or otherwise made available to the customers; the legal basis for the processing of such data, being necessary for the performance of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 letter b) of the GDPR.

d) fulfilling legal, accounting, fiscal and administrative obligations related to the provision of the required services; the legal basis for the processing of such data, being necessary for the performance of a legal obligation, is Art. 6 para. 1 letter c) of the GDPR.

e) managing relations with authorities and external public entities for purposes connected with specific requests, for the fulfilment of legal obligations or special procedures (e.g.: re-notification to the actual offender of the notice of assessment for traffic violations, collection of service data to evaluate their effectiveness and analyse urban mobility); the legal basis for the processing of such data, being necessary for the pursuit of DriveNow's legitimate interest in pursuing such requests or procedures, is Art. 6 para. 1 letter f) of the GDPR.

f) Establishing measures to protect against credit risk, including activities aimed at identifying the customer and his economic reliability/solvency, also during the contractual relationship; the legal basis for the processing of such data, being necessary for the pursuit of DriveNow's legitimate interest in safeguarding its business, is Art. 6 para. 1 letter f) of the GDPR.

g) setting up a geolocation system of the vehicles and any measures aimed at protecting the vehicle fleet against possible unlawful or fraudulent acts of the customers;

We also inform you that vehicles will be subject to geolocation, in order to properly provide the service. The data thus collected will be used with the sole purposes of properly execute the service and protect the vehicle fleet. In particular, DriveNow will be immediately notified when the vehicle is approaching the outer limits of the area of use prescribed in the General Terms & Conditions (geofencing). DriveNow reserves the right to collect, process and use data relating to the vehicle usage (including geolocation data) in order to detect and correct defects and malfunctions, identify and analyse any claim from third parties, or to further develop DriveNow services.

DriveNow will keep such data as far as possible separated from contractual data, so that during their processing it is not possible to link the vehicle usage data with the driver's personal information.

If there is evidence of an emergency or a violation of the main provisions of the framework agreement or of the individual rental contract (especially in the event of theft, accident, or serious damage to the vehicle), DriveNow may determine the concerned vehicle's geolocation in order examine the evidence and take the necessary precautionary measures. The legal basis for the processing of such data, being necessary for the pursuit of DriveNow's legitimate interest in safeguarding its assets, is Art. 6 para. 1 letter f) of the GDPR.

h) recording of video images referring to the space outside the vehicle, geolocation and dynamic parameters in correspondence with abnormal events for the purpose of kinematic reconstruction of any accidents and protection of the vehicle fleet against any acts taken by customers that are illegal or fraudulent;

Each of the vehicles provided by DriveNow for the renting service is equipped with a device for the recording of video images of the external space, of geolocation data and of the dynamic parameters in connection with abnormal events. Such data are processed by DriveNow for the purpose of possible crash kinematic reconstruction and to protect the vehicle fleet against possible unlawful or fraudulent acts of the customers. These images and data are saved on the device exclusively with regards to a short period before and after detecting an abnormal event (such as, for instance, a speed reduction beyond certain parameters, which might indicate a possible accident) or the manual activation by the driver, and the device overwrites its files with any trip, deleting the oldest data. In case of accident or damages to the vehicle, images and related data may be disclosed to insurance companies and their intermediaries and/or auxiliaries, submitted to Courts or disclosed to competent authorities for the above purposes, and shall be stored by DriveNow for a maximum period identical to the relevant limitation period, including, with regard to road traffic accident, the 2-year period indicated in Article 2947, paragraph 2, of the Civil Code. Lacking any accident o damages to the vehicle images and data will be erased after 6 months.

These processing activities are lawful, as they are necessary for the pursuit of DriveNow's legitimate interest in safeguarding its assets (Art. 6 para. 1 letter f) of the GDPR).

i) Each of the vehicles available from DriveNow for the rental service is equipped with a satellite device, able to detect the position and condition of the vehicle in real time and continuously and to monitor the driving activity of the driver, collecting data on driving styles and habits (hereinafter, the "Driving Behaviour"), such as sudden braking, sudden accelerations, curves, vehicle speed, data on engine revs, which are supplemented by contextual data (traffic, weather conditions, time of day).  

Driving behaviour data and vehicle geolocation data are processed as part of an activity to verify the use of the vehicle for the protection of DriveNow's assets, for the aggregate and statistical analysis of the use of Drive-Now's vehicles in order to improve the service and protection of DriveNow's assets, as well as to correctly reconstruct the dynamics of a possible accident. Such processing activities are lawful, as they are necessary for the pursuit of DriveNow's legitimate interest in protecting its corporate assets and improving the services offered (Art. 6 para. 1 letter f) of the GDPR).

 

With your consent, and as part of DriveNow's customer awareness policy for driving safety and prudence, your Driving Behaviour data and geolocation data are also processed in order to evaluate your Driving Behaviour and score you points. In order to encourage prudent Driving Behavior, DriveNow may also arrange rewarding pricing for customers who obtain a good score. Such processing activities are lawful as they are based on the user's consent (art. 6 para. 1 letter a) of the GDPR).

 

j) push notifications

DriveNow uses push messaging to communicate directly with App users. For this reason, DriveNow uses the personal data listed in section 3.3(b), together with the GPS data of the user's mobile terminal device (if the coverage for the DriveNow App has been activated).

 

Push messages can contain the following information:

  • the position of the nearest available DriveNow vehicle, if the radar function has been activated in the App
  • rental costs
  • classification of car cleanliness at the end of the rental period
  • information about changes to DriveNow's Terms and Conditions and/or privacy policy
  • promotional information about DriveNow services

 

Push messages are only sent if the user has given specific consent during the installation of the App. You can revoke this consent at any time, by selecting it in the App settings or in the settings of your mobile device. Such processing is lawful, as it is based on the user's consent (art. 6 para. 1 letter a) of the GDPR).

 

k) other purposes described in articles 4 through 8.

 

3.4 Deleting data and storage time

The start and end of the rental period (location, date, time, fuel, type of trip) are stored for 10 years, as are the data contained in the accounting documents relating to the rentals.

 

Driving Behaviour monitoring data are deleted or anonymised after 12 months.

 

The data of the device in which the App is installed are stored for 6 months.

 

For all other data, please refer to the paragraphs describing the respective use.

 

3.5 Security, TLS technology

 

3.5.1 Misure di sicurezza

We have taken technical and organisational measures to protect your personal data, in particular against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. These security measures are continually updated in line with technological developments. The transmission of personal data between your computer or mobile device and our server is always encrypted (TLS procedure, Transport Layer Security).

 

3.5.2 Login notification

In order to better protect you against misuse of your data, if you access your DriveNow customer account from a device unknown to us, you will automatically receive an email notification. For this purpose, each time you log in to your DriveNow customer profile on the Website or via the App, we save a specific device ID and process the data specified below, which we will communicate to you in the message addressed to you for identification purposes: device type, date and time, IP address and location based on IP. Of course, we only use this data for the purpose of increasing your security. The data will not be passed on to third parties other than those acting as data processors pursuant to Art. 28 GDPR. The processing of data is based on our legitimate interest in operating the systems and processing the data securely (Art. 6 para. 1 letter f of the GDPR).

 

3.5.3 Risk.Ident

On our website / application (app) we use the services of the it-security-provider Risk.Ident GmbH. Every communication between us and Risk.Ident only happens for the purpose of preventing fraud cases whilst using our website / app.

Data storage: Risk.Ident collects and processes specific data from our users, via cookies and tracking technology, about the features of the device used by the customer (“device related data”), raw data out of the TCP/IP connection and data about the usage of our website / app. Thereby Risk.Ident also collects and processes the IP-address of the user. However, this is encrypted within a few seconds at Risk.Ident. The information will be saved in a databank by Risk.Ident for risk prevention purposes.

Data retrieval: When the user signed a contract that entails risk related terms on our websites /apps e.g. by creating a user account for the purchase of certain items we retrieve a risk score from the databank of Risk.Ident. The risk score was deposited there for the device used by the customer.

The risk score is based inter alia on information
a) whether the user’s device has communicated or communicated, current or past, via a proxy connection,
b) whether the device recently has dialed in via various internet service providers,
c) whether the device has shown or showed a frequently changing geo reference, and
d) how many internet transactions have been executed via the device in the recent past (we cannot detect which kind of transaction it was),
e) how probable it is, that the device, deposited in the Risk.Ident-databank, actually is the device of the user. The outcome of this risk score supports us in the purpose of preventing fraud attempts.

Data transmission: Furthermore, we transmit data to Risk.Ident to the extent of our knowledge that a user committed or attempted to commit fraud to us. Risk.Ident receives the information about this fact as well as the specific device related data of the user.

Legal basis for these processes is our legitimate interest in accordance with Art.6 par.1 lit. f GDPR. Our legitimate interest is the already mentioned fraud prevention.

We only store the data required for a specific purpose, and only as long as it is needed, not exceeding one year. In case of fraud, data can be stored for a longer term. The data concerned shall be deleted when they are no longer necessary for the purposes for which they were stored, in so far legal storage obligations and periods do not contradict this. In this case we will apply technical measures to ensure that the data will not be used for further processes.

 

3.6 Categories of subject to whom the personal data can be disclosed

Your personal data may be disclosed to the following subjects or subject categories:

1. Police, armed forces, investigating authorities, judicial authority and other public authorities, including the Ministry of Infrastructure and Transport - Directorate-General for Motor Vehicles;

2. Companies, entities or associations, or parent companies, subsidiaries or affiliates within the meaning of Article 2359 of the Civil Code, or among them and companies subject to joint control, as well as between consortia, enterprise networks and clusters and temporary associations of enterprises and with their members, limited to disclosures made for administrative and/or accounting purposes;

3. insurance companies and their brokers and/or auxiliaries, or other subjects competent for the settlement of claims;

4. debt collection companies;

5.companies specialising in managing commercial or credit information, or in advertising;

6. public authorities having an agreement with DriveNow for the provision of car sharing services, in fulfilment of the commitments given to them;

7. service providers used by DriveNow for the provision of services (e.g. service to monitor the Driving Behaviour) or otherwise involved in the management of services and/or in the fulfilment of the consequent legal obligations (e.g. Exchange System of the Revenue Agency));

Data collected and saved in the DriveNow database will be processed by the employees and/or collaborators authorized by DriveNow (“Persons in charge of processing”); such information will not be disclosed to third parties, except as provided above and, in any case, within the limits indicated herein.

DriveNow reserves the option of commissioning third parties to process personal data on its own behalf ("Data Processors ") and may accordingly share personal information with such third parties. However, DriveNow will require such third parties to observe the DriveNow privacy policy and principles during the data processing. Finally, your personal information will not be disseminated, except as required by law.

4. Google Maps

In the following we describe data processing in the context of the use of Google Maps.

 

4.1 Google Maps application

This Website, as well as the App, use Google Maps API applications. This enables us to display interactive maps directly on the Website or on our App and enables you to conveniently use the map function.

We use Google Maps to determine the current location of our vehicles and to show you the nearest available vehicle. In addition, we use Google Maps to translate geo-positions into addresses and to show you the estimated walking distance to the selected vehicle. After the selection of the vehicle, e will use Google Maps to show you in the App your planned arrival location and the remaining arrival time for reaching the Vehicle.

 

Within the framework of the performance of the individual rental agreements, data relating to the individual rentals are processed, such as the place where you start and end the rental, the time when the rental starts and ends and the duration of use of the vehicle, and the planned destination, also visible to the next user if you have activated the option to offer cars at the destination (“Handshake”).

The processing of such data, in particular to determine and display the current location, is essential for the full provision and proper functioning of all services of DriveNow

We do not share this information with Google. This data will only be transmitted to Google anonymously. It cannot, therefore, be traced back to you.

You can view Google's Terms of Use here: https://policies.google.com/terms?hl=it. The additional terms of use for Google Maps/Google Earth can be found here https://www.google.com/intl/it_IT/help/terms_maps.html. You can find Google's privacy policy here: https://policies.google.com/privacy/update?hl=it 

4.2 Legal basis

 

The legal basis for the processing of such data, being necessary for the performance of a contract or for the implementation of pre-contractual measures, is Art. 6 para. 1 letter b) of the GDPR.

5. Cookies

In the following, we describe processing procedures within the framework of using cookies in detail.

 

5.1 Use of cookies

Cookies are small text files that are stored on your hard drive by a web server. Cookies contain information that can later be read by a web server in the domain that issued the cookie to you. Cookies cannot run programs or deliver viruses to your computer. There is a distinction made between two different types of cookies. Session cookies are deleted as soon as you end the session. Temporary and permanent cookies are stored on the data carrier for a longer period or indefinitely.

 

 

5.2 Data in the context of the use of cookies

No personal data is stored in the cookies we use. The cookies we use are also not combined with personal data. In this respect, these cookies cannot be attributed to any particular person. When a cookie is activated, it only receives an identification number. Personal data such as name, IP address, etc. are not assigned to this identification number at any time. Using cookie technology, we only receive anonymous information, such as which pages of our Website have been visited, etc

 

 

5.3 Use of session cookies

Most of the cookies we use are so-called session cookies, which are necessary to keep your visit consistent, i.e. to ensure that, for example, no renewed login is required and that your preferences or other information already entered during the reservation request are retained during the session. In addition, we need session cookies to ensure that a specific offer that you have clicked on will be assigned to your request (e.g. for promotional offers). These session cookies are automatically deleted when the session ends. In addition, we use cookies when you visit the Website subsequently to detect if you are particularly interested in certain offers, which allows us to display such targeted offers on the site. This assignment is only made using abstract criteria (e.g. "BMW") and not on a personal basis. These cookies have a lifetime of one year and are then automatically deleted.

 

5.4 Onsite Targeting

Our Website uses cookie technology to collect data to simplify our Website. This tells us how the Website is used and enables us to constantly optimise our offering. The following data is processed:

  • Search terms used
  • Frequency of page views
  • Use of website functions

The collected data is data is used exclusively for anonymous evaluation of the use of the Website and is never merged with the personal data directly provided by the user. Using the information obtained through clickstream analysis, we make our Website as attractive as possible in order to best meet our customers' needs.

 

5.5 Remarketing/Retargeting

We use so-called re-marketing/re-targeting to make online offers more relevant for Internet users and to consistently improve our promotional offers and marketing measures. This technology allows us to reach out to Internet users who have already shown interest in our Website with DriveNow advertising via advertising banners or ads on the websites of our partners.

To this end, the users’ stored surfing behaviour is analysed with an analytical tool on the basis of an algorithm. The display of our advertising on the websites of our partners relies on cookies and the analysis of usage behaviour on the Website. The advertisement displays are completely anonymous. At no time are personal data saved or user profiles combined with personally identifiable data. For this purpose, we use cookies by the following third-party vendors:

5.5.1 Criteo

Criteo SA, 32 Rue Blanche, 75009 Paris, France: This product helps us to post our advertising in apps and e-mails to visitors who are interested in our products. We may share information such as technical identifiers from your registration information on our Website or from our CRM system with reliable advertising partners. This allows for linking your devices and/or environments in order to offer you a seamless user experience with the devices and environments you typically use. For further details about these linking capabilities, please refer to the privacy policy of Criteo at: http://www.criteo.com/de/privacy

 

5.5.2 Taboola

Taboola Inc., 28 West 23rd Street 5th floor, New York, NY 10010, USA: This product lets us determine which services you use and which of our pages you visit. This utility supports you with the discovery of content on third-party websites. The cookie enables us to generate pseudonymous user profiles by collecting device-related data and log data. Tracking (i.e. the collection of data associated with website use generated by the cookie) can be deactivated at any time. For this purpose, please follow the instructions in this document: https://www.taboola.com/privacy-policy.

 

5.5.3 Outbrain

Outbrain UK Limited 39 W 13th Street, New York, NY 10011 USA: This (content discovery recommendation system) supports you with the discovery of content on third-party websites. Outbrain uses cookies that help to collect and save information about you and other users of the service. Data is collected and saved in anonymous form. Outbrain as the controller has compiled information on the collection and processing of usage and other data in its privacy statement: http://www.outbrain.de/legal/privacy-713/. Tracking (i.e. the collection of data associated with website use generated by the cookie) can be deactivated at any time. For this purpose, please follow the instructions in this document: http://www.outbrain.de/legal/privacy-713.

 

5.5.4 Google Re-marketing

Our Website uses the re-marketing function of “Google AdWords”, a service provided by Google Inc.,1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This technology enables us to place automatically generated, target-group-specific advertisements on our website after your visit. The ads are based on the products and services that you clicked on during your last visit to our Website.

 

Google uses cookies to generate interest-based advertisements. Google generally saves information such as your web request, IP address, browser type, browser language, and the date and time of your request. This information is used only for allocating the web browser to a specific computer. It cannot be used to identify a person.

 

If you don’t wish to receive user-based advertising from Google, you can opt out of advertisements in the Google display settings.

 

Further information about Google’s use of cookies can be found in the Google privacy statement at the following link: https://www.google.de/intl/de/policies/privacy/.

 

5.5.5 Google AdWords & conversion tracking

We place Google AdWords advertisements to draw attention to our products. In the scope of this activity, we use “Google conversion tracking”, a service provided by Google, Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. These advertisements are displayed when users enter search queries on the websites of the Google advertising network. We have the option to combine our advertisements with certain search terms. We use cookies to place advertisements based on the prior visits of a user on our Website.

 

When a user clicks on an advertisement, Google saves a cookie in the user’s computer. Further information on the associated cookie technology can also be found in Google’s information on website statistics and privacy regulations.

 

With the help of this technology, Google and we as a customer are notified when a user clicks on an advertisement and is redirected to our webpages. The information obtained in this context is exclusively used for the statistical analysis of advertising optimisation. We do not receive any information that personally identifies visitors. The statistics provided to us by Google include the total number of users who clicked on one of our ads and, if applicable, whether they were redirected to a page of our Website that includes a conversion tag. These statistics enable us to understand which search terms led to the most frequent clicks on our ads and which advertisements resulted in a user filling out the contact form.

 

You can take steps to prevent the storage of the cookies required for these technologies, for example in your browser settings. In this case, your visit will not be reflected in user statistics.

 

You also have the option to select the types of Google ads in the display setting or to deactivate interest-based ads in the Google website. As an alternative, you can opt out of the use of cookies by third parties by visiting the Opt-Out help site of the Network Advertising Initiative. For more details, visit: http://www.networkadvertising.org/choices/ and http://www.youronlinechoices.com/

 

However, our company and Google will continue to receive statistical information about the number of users who visited this Website and when. If you do not wish to be included in these statistics, you can prevent inclusion with the help of additional browser programs (e.g. the Ghostery add-on).

 

5.5.6 Bing Ads

This Website uses Bing Ads, a program by Microsoft Corporation, Microsoft Way Redmond, WA 98052-7329, USA, which uses so-called Universal Event Tracking (UET) for re-marketing and conversion tracking. This service saves a cookie in the website visitor’s computer if our website was found through the Bing or Yahoo search engines. Data is collected and saved in anonymous form. Based on the use of the re-marketing function, custom-tailored offers will be displayed to the user during subsequent searches in one of the above-listed search engines. You can access the Microsoft privacy statement on the handling of collected data at the following link: https://privacy.microsoft.com/de-de/privacystatement/. You can opt out of Bing Ads at any time. The corresponding instructions can be found here: http://choice.microsoft.com/de-DE/opt-out.

 

5.5.7 Google Analytics

This Website uses Google Analytics, a web analysis service provided by Google Inc. ("Google"). Google Analytics uses "cookies", text files that are stored on your computer and which enable analysis of your use of the Website. The information on your use of this Website generated by the cookie (including your IP address) will be transferred to and stored on a Google server in the USA. However, if IP anonymization is enabled on this Website, your IP address will first be abbreviated by Google within the member states of the European Union or other parties to the agreement on the European Economic Area. Only in exceptional cases is the full IP address sent to a Google server in the US and shortened there.

 

Google will use this information for the purpose of evaluating your use of the Website, compiling reports about website activities for website operators and to provide other services related to website and internet use, in particular functions for Google Analytics reports on performance according to demographic characteristics and interests. Google Analytics Demographics and Interest Reporting allows us to use data from Google's interest-based advertising and/or data from third parties about our advertising audience (e.g. age, gender and interests) in conjunction with Google Analytics for targeted and optimised advertising activities, strategies and content of our Website.

Google may also transfer this information to third parties as required by law or if said third parties process this data on behalf of Google. In any event, Google will not associate your IP address with other data held by Google.

 

You can prevent these cookies being stored by selecting the appropriate settings in your browser; however, we wish to point out that doing so may mean you will not be able to enjoy the full functionality of this Website. You can also prevent the data generated by cookies about your use of the Website (incl. your IP address) being passed to Google and the processing of this data by Google, by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

 

This Website uses Google Analytics with the extension "anonymizeIp()". As a result, IP addresses are further processed in abbreviated form, so that a connection to a particular individual can be ruled out. If the data collected about you is personal in nature, it will be excluded immediately, and the personal data will be deleted immediately.

 

We use Google Analytics to analyse and regularly improve the use of our Website. We can improve our offering and make it more interesting for you as a user with the statistics gained. For the exceptional cases in which personal data is transferred to the USA, Google has submitted itself to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

 

Third party information: Google Dublin, Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, , Fax: +353 (1) 436 1001. Usage conditions: https://www.google.com/analytics/terms/gb.html, Overview of data protection: https://support.google.com/analytics/answer/6004245?hl=en, as well as the privacy policy: https://policies.google.com/privacy?hl=en.

 

This Website also uses Google Analytics for a device-independent analysis of visitor flows, which is carried out via a user ID. You can disable cross-device analysis of your usage in your Google Account under "My information", "Personal information"

 

5.5.8 Google Tag Manager

This Website uses “Google Tag Manager”, which is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Tag Manager is used to manage website tags. Google Tag Manager is a cookie-free domain; it does not collect personal data. However, the application initiates other tags, which may collect personal data, although Google Tag Manager does not access this data. Any opt-out established at the domain or cookie level will apply to all tracking tags that were implemented with Google Tag Manager. Further information on Google Tag Manager can be found at http://www.google.de/tagmanager/use-policy.html.

 

5.5.9 adjust.io

This Website also uses the “adjust.io” analytical technology of adeven GmbH, Saarbrücker Str. 37a, 10405 Berlin, (“adeven”). adeven uses IP and Mac addresses of users for its analysis, which are exclusively used anonymously. No conclusions about individuals can be drawn. The information collected through this tool is exclusively used to analyse the function and usage of the Website by generating anonymous evaluations and charts on the number of visits, number of pages accessed by each user etc. The analyses are exclusively used for the purposes of our own market research and the optimisation and user-friendly design of our Website. By using this Website for analytical purposes, you consent to the processing of anonymous data in the manner and for the purposes set out above. You can opt out of the collection and storage of data at any time with future effect by sending an e-mail to optout@adjust.io.

 

5.5.10 DoubleClick

Our Website uses DoubleClick by Google Inc. via Trakken Web Services GmbH, Zirkusweg 1, 20359 Hamburg, Germany to present you with relevant advertisements. When you open a website and see a display of an advertisement placed via websites of the Google advertising network or click on it, a DoubleClick cookie may be stored in your browser. The DoubleClick cookie identifier allocated to your browser is the same cookie that is used when you visit websites, in which advertising programs by DoubleClick are applied. This cookie allocated to your browser contains a pseudonymous identification number (ID) and can check which ads were displayed in your browser and how many ads have been viewed. These cookies do not contain any personal information. In connection with our re-marketing measures, we may show you advertisements tailored to your preferences on the basis of this information. Re-marketing collects and saves information about your surfing habits in anonymous form for marketing purposes.

 

DoubleClick only allows Google and its partners to place advertisements on the basis of prior visits to our Website or other websites. Google transmits the information generated by cookies to a server in the United States for analytical purposes and saves it there.

 

Google observes the data protection provisions of the U.S. Privacy Shield Agreement and is registered with the U.S. Department of Commerce Privacy Shield Program> For further information, see:

https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI

 

The transmission complies with legal requirements or occurs within the scope of order processing. Under no circumstances will Google combine your data with other data collected by Google. By using this Website, you consent to the processing of data collected about you by Google in the manner of data processing and for the purposes set out above. You can prevent the storage of cookies by selecting the corresponding settings in your browser; however, you may not be able to fully use some of the features of our Website in this case.

 

Information about data protection at DoubleClick can be found at:

http://www.google.de/policies/technologies/ads/

 

In addition, you can opt out of the transmission of data generated by cookies, which refer to your use of websites to Google as well as the processing of this data by Google by downloading and installing the browser plug-in available at:

 

5.5.11 Visual Website Optimizer (VWO)

Wingify Software Private Limited, Antriksh Apartments, Sector-14, Rohini, Delhi-110085, India: With this software we can analyze users' behaviour on the Website and interaction with them, we can create variants of certain pages and test them by sending them to randomly selected users or through certain target groups. For these purposes, VWO is also able to record anonymously the movement of the users' mouse and their interaction with the fields on the Website. The anonymity of the users is guaranteed by the fact that during this operation no personal data such as IP addresses, names or data entered via the keyboard are recorded at all. VWO uses cookies to test and analyse user behaviour. For more information on the use of cookies by VWO, please visit the following website https://vwo.com/knowledge/what-are-the-cookies-stored-by-vwo/.

 

Information on the general operation of VWO can be found at https://vwo.com/privacy-policy/.

 

If you wish to be excluded from WKO's testing and analysis methods, you can exercise this option at https://vwo.com/opt-out/.

 

5.6 Opting out of cookie storage

You have the option to accept or reject cookies. Most web browsers automatically accept cookies, but browser settings usually allow for rejecting cookies. If cookies are rejected, some features of the Website may no longer be usable. If cookies are accepted, the accepted cookies may be deleted at a later point. When you delete cookies, all settings that are controlled by these cookies, including advertising preferences, will be deleted and may not be restored. Furthermore, please refer to the above-mentioned special opt-outs.

 

Detailed additional information on this topic can be found at the following websites: youronlinechoices, Network Advertising Initiative and/or Digital Advertising Alliance. These websites also contain details about deleting cookies from your device.

 

5.7 Legal basis

The processing activities described in this article 5 are lawful as they are necessary for the pursuit of our legitimate interest in improving our services and our commercial offers. The legal basis for this is Art. 6 para. 1 letter f) of the GDPR.

 

6. Custom Audience / Customised marketing

6.1 Marketing on partner sites (Facebook, LinkedIn, Twitter and Google)

We use the Custom Audience process on our Website. This process transfers our customers’ data to our partners Facebook, LinkedIn, Twitter and Google. Our partners compare these data with the data in existing user profiles and, if they match, can inform you specifically about our products and services tailored to your needs. The following categories of personal data are transferred: email address, mobile phone number. The hashing method is used to transfer the data. This method allows your data to be transferred in pseudonymised form.

The aim of processing your personal data is to improve our marketing activities and to tailor them to your needs.

It is possible that your data will be processed in the USA by our partners. Facebook, LinkedIn, Twitter and Google are party to the EU-US Privacy Shield, an agreement which is sure is a reasonable level of data protection.

Your data will be stored and sent to our partners until you object.

You can object to your personal data being processed by Custom Audience. To do this, please send an email to the following email address:

unsubscribe@drive-now.com

If you object to your data being processed by Custom Audience, your data will no longer be sent to our partners.

 

6.2 Facebook Custom Audience

Within our Internet presence we use the "Facebook pixel" from Facebook Inc. 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). This allows users' behaviour to be tracked after they have seen or clicked on a Facebook ad. This process is used to evaluate the effectiveness of Facebook advertisements for statistical and market research purposes and can help to optimise advertising measures.

 

The data collected is anonymous to us, so it does not give us any indication of the identity of the users. However, Facebook stores and processes the data so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes in accordance with the Facebook data usage guidelines You can enable Facebook as well as its partners to connect advertising ads to Facebook and including on external websites. A cookie can also be stored on your computer for these purposes. In order to reject the use of cookies on your computer in general, you can set your internet browser so that cookies can no longer be stored on your computer in the future or cookies that have already been stored will be deleted. However, disabling all cookies can result in some functions on our internet pages no longer being executed.

 

You can disable the use of cookies by Facebook through a program we have developed specifically for this case (web-based opt-out procedure). For this you only need click on the following link[SG1] 

 

6.3 Legal basis

The treatments described in this art. 6 are lawful as they are necessary for the pursuit of our legitimate interest in improving our services and our commercial offers. The legal basis for this is Art. 6 para. 1 letter f) of the GDPR.

 

7. Advertising

The section below explains our data processing for the purpose of product information and advertising.

 

7.1 Product recommendation e-mails

 

We want to provide our customers with regular product recommendation e-mails. For this purpose, we use the e-mail address you specified as part of registration, your name and your date of birth. Our product recommendation e-mails are intended to inform you about products we offer, in which you may be interested on the basis of your most recent lease. In addition, we want to send you our confirmation notification regarding your registration and helpful product use instructions.

 

Furthermore, we will use your data for the following purposes: measures for the further development of services and products, reporting on the success of the utilised measures in the course of time, testing and optimisation of procedures for requirement analysis, benchmarking, and enrichment of our data, e.g. from publicly available sources or internal market research. Your data may only be communicated to suppliers who assist us in sending such commercial communications.

 

Your data will be stored as long as we maintain a business relationship with you and you have not objected to this data processing. You have the right to object to this data processing at any time, either as a whole or for specific measures. In this case, we will no longer process your data.

 

You may send your objection via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Italy S.r.l., via Carlo Ottavio Cornaggia, n. 16 - Milano, Italia. There is also an unsubscribe link in all notifications, which will be considered an objection if activated. 

 

The processing activities described in this art. 7.1 are lawful, as they are necessary for the pursuit of DriveNow's legitimate interest in performing direct marketing activities (Art. 6 para. 1 letter f) of the GDPR).

 

 

7.2 Personalised advertising and/or offer e-mails

 

We want to regularly send interest-based customised advertisements and/special offers for DriveNow to our customers via e-mail. Special offers also include our DriveNow packages with special cooperation partners.

 

Our goal is to continually improve our DriveNow customer experience and to make it more user-friendly. For the purpose of sending you such advertisements, we will use the e-mail address you specified as part of registration, your name and your date of birth. In order to send you interest-based advertising, we will use automatically generated information transmitted by your computer such as delivery and read receipts for messages, information on your device, your browser, your activities in our Website, including the length of your visit on our Website and your lease transactions. We will process this information in pseudonymised form. This ensures that our customers exclusively receive e-mail messages that match their interests relating to the advertising and/or special offers of DriveNow.

 

Your data may only be communicated to suppliers who assist us in sending such commercial communications.

 

Your data will be stored as long as we maintain a business relationship with you and you have not objected to this data processing. You have the right to object to this data processing, at any time, either as a whole or for specific measures. In this case, we will no longer process your personal data.

 

You may send your objection via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Italy S.r.l., via Carlo Ottavio Cornaggia, n. 16 - Milano, Italia. There is also an unsubscribe link in all notifications, which will be considered an objection if activated.

 

The processing activities described in this art. 7.2 are lawful, as they are necessary for the pursuit of DriveNow's legitimate interest in performing direct marketing activities (Art. 6 para. 1 letter f) of the GDPR).

 

 

7.3 Advertising of third-party products and services dedicated to DriveNow customers

 

We want to regularly inform by e-mail our customers who have agreed about the opportunities to use DriveNow's services in the city, and to take advantage of special offers of products or services of DriveNow's business partners, dedicated to our customers.

 

Subject to your consent, your data may only be communicated to suppliers who assist us in sending such commercial communications.

 

Your data will be stored as long as we maintain a business relationship with you and you have not objected to this data processing. You have the right to object to this data processing, at any time, either as a whole or for specific measures. In this case, we will no longer process your personal data.

 

You may send your objection via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Italy S.r.l., via Carlo Ottavio Cornaggia, n. 16 - Milano, Italia. There is also an unsubscribe link in all notifications, which will be considered an objection if activated.

 

The processing activities described in this art. 7.3 are lawful as they are based on the user's consent (art. 6 para. 1 letter a) of the GDPR).

 

 

7.4 Advertising of products and services supplied by third parties involved in DriveNow services

 

We want our customers who have given their consent to receive from us or our suppliers involved in DriveNow's services, such as BMW, commercial information about their products or services.

 

Subject to your consent, we therefore may:

 

(a) send you such commercial communications about the products and services of our suppliers (e.g. BMW), and to this end your data may be communicated to the suppliers who assist us in sending them.

 

Your data will them be stored as long as we maintain a business relationship with you and you have not revoked your consent to any such use. You have the right to withdraw your consent at any time, either as a whole or for specific processing activities. In this case, your data will no longer be processed.

 

You may send your consent revocation via e-mail to service@drive-now.com or via regular mail by writing to DriveNow Italy S.r.l., via Carlo Ottavio Cornaggia, n. 16 - Milano, Italia. There is also an unsubscribe link in all notifications, which will be considered a consent revocation if activated.

 

(b) transmit your data to the above mentioned suppliers (e.g. BMW), who will act as independent data controllers when sending promotional e-mails to you.

 

The processing activities described in this art. 7.4 are lawful as they are based on the user's consent (art. 6 para. 1 letter a) of the GDPR).

 

 

8. Market and survey research

In the following we describe data processing procedures in the context of market and survey research.

 

We process your personal data for market research and polling purposes. Your data will be made anonymous, only used by us for statistical purposes and cannot be traced back to you at any time.

Such processing activity is lawful as it is necessary for the pursuit of DriveNow's legitimate interest in obtaining a more effective organisation of advertising, regarding our offers and services (Art. 6 para. 1 letter f) of the GDPR).

 

9. Use of service providers for the processing of personal data / processing of data in countries outside the European Economic Area

 

We use service providers to provide services and to process your data relating to our services and products. The service providers process the data exclusively in accordance with our instructions and have been obliged to comply with the applicable data protection regulations. All contractors have been carefully selected and will only have access to your data to the extent and for the time required to provide the services or to the extent to which you have consented to the processing and use of your data.

 

Service providers in countries such as the USA or in the countries of the European Economic Area are subject to data protection that does not generally protect personal data to the same extent as is the case in the Member States of the European Union. If your data is processed in a country that does not have a recognised high level of data protection such as the European Union, we use contractual regulations or other recognised instruments to ensure that your personal data is adequately protected.

 

10. Your rights as an affected person

 

10.1 Right to information

You have the right to request at any time which data concerning you we process, the purpose of the processing, the categories of data concerned, the recipients or categories of recipients to whom such data are transmitted, the retention period or the criteria used to determine that period and their origin if the data are not collected from you.

 

10.2 Right to revoke consent

If you have given your consent to the use of data, you can revoke this at any time without giving reasons with effect for the future.

 

10.3 Right of correction

If your data stored with us is incorrect, you can correct it at any time in your customer account or have it corrected by us through our service centre.

 

10.4 Right of deletion and blocking

You have the right to request that your personal data in our possession be deleted, in the cases provided for in Art. 17 GDPR. As a rule, your personal data will be deleted within 2 working days of exercising this right. If the processing of data is necessary to comply with a legal obligation to which we are subject or if it is necessary to ascertain, exercise or defend a legal claim, your data may be blocked but not deleted. Once they have been deleted, it is no longer possible to provide information on the data.

 

10.5 Right to data transmission

Should you request the personal data provided to us, we will release or transmit the data to you or another person responsible, if you so desire, in a structured, current and machine-readable format. The latter, however, shall only be the case if this is technically possible.

 

 

10.6 Right to restriction of processing

You may request that the processing of data be restricted, in the cases provided for in Art. 18 GDPR, for example when you dispute the accuracy of personal data, for the period necessary for us to verify the accuracy of such data.

 

10.7 Right of objection

You have the right to object at any time and without giving reasons for data processing for the purpose of direct marketing. In addition, it is pointed out that the execution of the framework contract as well as the handling of individual contracts may be restricted or no longer possible due to opposition to all data processing operations.

 

10.8 Extended rights in relation to data processing for personalised data evaluation

With regard to the data processing of personalised data evaluation, in addition to the aforementioned rights, you also have the right of participation granted to a natural person in the decision-making process, a right of appeal and a right to disclosure of our position.

 

10.9 Contact for assertion of the rights of the persons affected

For asserting your rights you are entitled to the means mentioned in Section 2 of the privacy policy.

 

10.10 Right of appeal to the supervisory authority

You have the right to file a complaint with the competent supervisory authority against the processing of your personal data if you feel that your rights under the GDPR have been violated.

 

11. General Terms and Conditions

Please read the information included in article 21 of our General Terms and Conditions, accessible here: https://www.drive-now.com/en/it/gtc