1. Data protection
We are pleased about your visit on our web pages and your interest in our offers. The protection of your personal data is an important concern for us. In these Privacy Statement we explain how we collect your personal data, what we do with it, for what purposes and on what legal basis this is done, and which rights and claims are associated with it for you.
Our Privacy Statement for the use of our websites does not apply to your activities on the websites of social networks or other providers that you can reach via the links on our websites. Please check the websites of these providers for their data protection regulations.
Controller for the processing of your personal data is:
car2go Iberia s.l., c/ San Bernardo 35, 28015 Madrid, Spain
If you have any questions on this Privacy Statement, please contact our data protection officer:
Data Protection Officer, HPC G462, 70771 Leinfelden-Echterdingen, Germany
3. Processing of your personal data
a. When you visit our website, we store certain information about the browser and operating system you use, the date and time of your visit, the access status (e.g. whether you were able to access a website or received an error message), the use of website functions, the search terms you may have entered, the frequency with which you access individual websites, the designation of files accessed, the amount of data transferred, the website from which you accessed our websites and the website which you visit from our websites, either by clicking on links on our websites or by entering a domain directly in the input field of the same tab (or the same window) of your browser in which you opened our websites.
b. We also store your IP address and the name of your Internet service provider for security reasons, in particular to prevent and detect attacks on our websites or attempts at fraud.
c. If you subscribed for a newsletter we offer on our website, the personal data stated in the newsletter subscription, i.e. name, surname, email address, will be processed for the distribution of the newsletter, unless you have consented to a further processing. You can unsubscribe the newsletter at any time by use of the unsubscribe possibility in the newsletter.
d. We only store other personal data if you provide this data, e.g. as part of a registration, a contact form, a survey, a price com-petition or for the execution of a contract, and even in these cases only insofar as this is permitted to us on the basis of a consent given by you or in accordance with the applicable legal provisions (further information on this can be found below in the section "Legal basis of processing").
You are not legally or contractually obliged to make available your personal data. However, it is possible that certain functions of our websites depend on the availability of personal data. If you do not make available personal data in these cases, this may result in functions not being available or only being available to a limited extent.
4. Purposes of processing and legal bases
a. We process the personal data collected when you visit our website (see Sec. 3 lit. a) in order to operate it in the most convenient manner for your use. The processing is based on our legitimate interests (Art. 6 (1) lit f GDPR). The continued improvement of our website is a legitimate interest. More information about the balance of interest test is available upon request.
b. Your IP address and the name of the internet service provider (see Sec. 3 lit. b) is processed to protect our IT systems from attacks and other illegal activities. The processing is based on our legitimate interests (Art. 6 (1) lit f GDPR). The continued improvement of our website is a legitimate interest. More information about the balance of interest test is available upon request.
c. The processing of your personal data for the distribution of the newsletter (see Sec. 3 lit. c) is based on our legitimate interests (Art. 6 (1) lit f GDPR). The continued improvement of our website is a legitimate interest. More information about the balance of interest test is available upon request. If you consented to the processing of your personal data for further purposes, your consent is the legal basis for the processing (Art. 6 (1) lit a GDPR).
d. If you provide us with further personal data, e.g. within the scope of a registration, a contact form, a survey, a price competition or for the execution of a contract (see Sec. 3 lit. d), we process this data for the purposes mentioned, for the purposes of customer administration and - if necessary - for the purposes of processing and accounting of any business transactions, in each case to the extent required for this. The processing is in this case necessary for the initiation or performance of a contract with you (Art. 6 (1) lit b GDPR).
e. If the processing is necessary for compliance with a legal obligation (e.g. retention obligation), the processing is based on Art. 6 (1) lit c GDPR.
5. Use of analysis tools
b. When using these analysis tools, (personal) data may be transferred to servers located in the USA and processed there. Please note the following: In the USA, the European Union considers that there is no "adequate level of protection" for the processing of personal data in accordance with EU standards. However, this level of protection can be replaced for individual companies by certification according to the so-called "EU-U.S. Privacy Shield".
c. If you do not want us to collect and analyze information about your visit to our website using the analysis tools mentioned above, you can object to this at any time with effect for the future ("opt-out").
We implement your objection by setting an opt-out cookie in your browser. This cookie is only used to associate your objection. Please note that for technical reasons, an opt-out cookie only works in the browser in which it was set. If you delete the cookies or use a different browser or device, please opt-out again.
d. Below you will find information on Adobe Analytics and Google Analytics:
i. Adobe Systems Inc. (“Adobe“)
The IP address collected from your browser by Adobe will not be combined with other data Adobe has. You can prevent the storage of the cookie by adjusting the browser software. Please note that this may result in the website functions not being available to you in full extent.
The storage duration of the cookie is 2 years. The information collected by the cookie will be only shared with the processors.
The processing of these data is based on the so-called balancing of interests clause in Art. 6(1) lit. f GDPR. The continued improvement of the website as well as our services is a legitimate interest. More information about the balance of interest test is available upon request.
Adobe is certified according to the EU-U.S. Privacy Shield.
To object to the analysis through the product Adobe Analytics, you can follow this link:
Install the opt-out cookie (Adobe Omniture)
ii. Google Analytics
This website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. This website uses Google Analytics with the extension “anonymizeIP()”. The IP address is truncated. Your IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases the whole IP address will be first transferred to a Google server in the USA and truncated there.
Google will use this information on behalf of the operator of this website for the purpose of profiling by evaluating your use of the website, compiling reports on website activity for the website operator and providing the website operator with other services relating to website activity and internet usage, in particular functions for Google Analytics reports for the service of demographic characteristics and interests. By the use of Google Analytics Demographics and Interest Reporting we can process data resulting from the interest-based advertising pursued by Google and/or data from third parties relating to our advertising audience (e.g. age, gender and interests) in connection with Google Analytics for targeted and optimized advertisement activities, strategies and contents of our website.
Click here to opt out from Google Analytics.
The IP-address, that your browser conveys within the scope of Google Analytics, will not be associated with any other data held by Google.
The processing of the data is based on balancing of interests pursuant to Art. 6(1) lit. f GDPR. The continued improvement of the website as well as our services is a legitimate interest. More information about the balance of interest test is available upon request.
For the exceptional cases, in which personal data is transferred to the U.S., Google is certified under the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.
6. Usage-based information (targeting and retargeting)
In order to be able to tailor our online marketing (e.g. banner advertising) on the websites of our retargeting partners (Google Dynamic Re-marketing and Google Ads) more specifically to your needs and interests, we use so-called retargeting technologies. Your interest in our products and services is stored in cookies. These cookies are read and used when visiting other websites that work together with our re-targeting partners in order to be able to inform you as focused on your interests as possible. This is done anonymously, i.e. you cannot be identified by retargeting.
Within our web presence, we use the Website-Custom-Audience-Pixel of Facebook Inc. 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). Facebook is certified according to the EU-U.S. Privacy Shield https://www.privacyshield.gov/EU-US-Framework.
This allows us to follow the Internet behavior of our users once they have viewed or clicked on a Facebook ad. Through this, we are able to evaluate the effectiveness of the Facebook ads for statistical and market research purposes and can thus optimize our advertising measures. When you visit our website, this information is passed on to Facebook.
The data collected by us is anonymous and gives us no indication of the identity of the user. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook are able to use the data for its own advertising purposes in accordance with Facebook’s data use policy. You can allow Facebook and its partners to display ads on and off Facebook. Additionally, a cookie can be stored on your hard drive for this purpose.
Facebook’s data use policy provides information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy and can be found here: https://www.facebook.com/policy.php. And information on the settings for the display of personalized ads can be viewed here: https://www.facebook.com/ads/about/.
Deactivate the Website-Custom-Audience-Pixel
If you do not want us and our retargeting partners to collect, store and analyze information about your visit and to tailor banner advertising to your interests, you can object to this at any time with effect for the future (opt-out).
An opt-out cookie is placed in your browser to technically implement your objection. This cookie is used exclusively for the association of your objection. Please note that for technical reasons, an opt-out cookie can only be used for the browser from which it was set. If you delete the cookies or use another browser or another terminal device, please opt-out again.
The processing of the data is based on balancing of interests pursuant to Art. 6 (1) lit. f GDPR. The continued improvement of the website as well as our services is a legitimate interest. More information about the balance of interest test is available upon request.
Install the opt-out cookie
7. Automated decision-making
No automated decision-making takes place, which is solely based on automated processing, including profiling, and resulting in a legal consequence or impairing you in a similar manner.
8. Recipients of personal data
Only such persons are given access to your personal data within our organization, which require the data to fulfil contractual or legal obligations and to maintain our legitimate interests.
Based on these requirements, the following are recipients of your personal data:
a. Public bodies and institutions with its head office in the EU where access is based on a legal or official obligation.
To fulfill our obligations, we work with third parties, so-called processors. These include:
Talon.One: To individually adapt certain conditions and features of the website, personal data is transferred to our service provider Talon.One GmbH, Wiener Straße 10, 10999 Berlin.
Google and Adobe are processors regarding the analysis tools.
The personal data is only transferred to the service provider in this relationship to enable the processing of the personal data by the service provider on behalf of us and on the basis of our instructions (so-called “processing on behalf”), to the extent this is required to fulfill our services and maintain our legitimate interests. The processor will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard the personal data and to process the personal data only as instructed.
c. International transfers of personal data
The personal data that we process about you may be transferred to and processed by recipients which are located inside or outside the European Economic Area ("EEA") and which do not provide for an adequate level of data protection. The countries that are recognized to provide for an adequate level of data protection from an EU law perspective (Art. 45 GDPR) are Andorra, Argentina, Canada, Switzerland, Faeroe Islands, Guernsey, the State of Israel, Isle of Man, Jersey, New Zealand, the Eastern Republic of Uruguay and Japan. Recipients in the US may partially be certified under the EU-U.S. Privacy Shield and thereby deemed to provide for an adequate level of data protection from an EU law perspective (Art. 45 GDPR). To the extent your personal data are transferred to countries that do not provide for an adequate level of data protection from an EU law perspective, we will base the respective transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission (Art. 46 (2) GDPR). You can ask for a copy of such appropriate safeguards by contacting us.
9. Retention and deletion of your personal data
Your personal data will be retained as long as necessary to provide you with the services requested. When we no longer need to use your personal data to comply with contractual or statutory obligations, we will block it during the statute of limitations and/or take steps to properly anonymize it so that you can no longer be identified from it in order to comply with legal or regulatory obligations to which we are subject, e.g. statutory retention periods which can result from e.g. Commercial Code, Tax Code and usually contain retention periods from 6 to 10 years.
10. Rights of the data subject
If you have consented to the processing of your personal data by us, you have the right to withdraw your consent at any time. The legality of processing your personal data before withdrawal remains unaffected.
Pursuant to applicable law, as a data subject, you may have the right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (“right to be forgotten”) (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR) and/or the right to object to the processing of your personal data (Art. 21 GDPR).
a. You may have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access. The right of access is limited pursuant to Section 13 of the Organic Law 3/2018 on Personal Data Protection and Digital Rights. For the purposes set out in Section 12.5 GDPR, the exercise of the right of access may be considered repetitive on more than one occasion during the six-month period, unless there is legitimate reason to do so. If you choose a means other than the one offered, which entails a disproportionate cost, the request will be considered excessive, and you will have to assume the additional costs that his choice entails
You may have the right to obtain a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
b. You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
c. Under certain circumstances, you may have the right to obtain from us the erasure of personal data concerning you and, after the relevant blocking of the personal data, we will erase such personal data.
d. Under certain circumstances, you may have the right to obtain from us restriction of processing your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes.
e. Under certain circumstances, you may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us.
Right to object
Under certain circumstances, you have the right to object at any time to the processing of your personal data pursuant to Art. 6 (1) lit. e GDPR (data processing in the public interest) or Art. 6 (1) lit f GDPR (data processing on the basis of a balance of interests) on grounds relating to your particular situation. If you object, we can be obligated to no longer process your personal data.
Moreover, if your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. In this case your personal data will no longer be processed for such purposes by us.
d. We ask you to address your rights to the contact details set out under Sec. 2.
e. If you believe that the processing of your personal data violates legal requirements, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
The competent data protection supervisory authority is Spanish Data Protection Authority with address in C/Jorge Juan 6, 28001. Telephone: 912663517.
Status: November 2019