1. INTRODUCTION
This Information Memorandum on personal data processing in connection with the use of the Citymove application operated by Škoda X s.r.o., with its registered office at Želetavská 1525/1, Michle, 140 00 Praha 4, IČO: 05976359, registered in the Commercial Register under File No. C 274001 (hereinafter the “Information Memorandum”), has been prepared for you to acquaint you with the procedure on how we collect, process, use and protect your personal data and thus help protect your privacy in connection with your use of the Citymove platform.
We handle all your personal data in accordance with applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR"), Act No. 110/2019 Coll., on the Processing of Personal Data, as amended, and Act No. 480/2004 Coll., On Certain Information Society Services, as amended.
Concurrently, through this Information Memorandum, we would like to clarify the most important concepts and processes that we use to protect your personal data and to answer questions you may have about the collection, processing, and storage of your personal data.
Version: 2024.04
Effective Date: April 1, 2024
2. OUR APPROACH
We consider the protection of personal data to be crucial and therefore we pay very close attention to it.
You can be certain that we treat your personal data with due care and diligence in accordance with applicable law and protect your personal data to the maximum extent possible, using technical and organizational measures of a high technical standard.
In order to fully understand how we protect your personal data, we recommend that you read this Information Memorandum carefully.
3. LEGAL TITLES FOR PROCESSING YOUR PERSONAL DATA
We collect and process your personal data only for the specific purpose and to the necessary extent. The transfer of your personal data is voluntary, in certain situation, however, it may be necessary for the conclusion of a contract and the provision of our services and subject to certain conditions, you may request the deletion of the processed personal data (for details see chapter "5. Your rights").
The main titles for processing your personal data in connection with the use of the Citymove platform include Contract performance – In this case, we need your personal data for the creation of your user account and contractual relationship and the subsequent performance, or before concluding the contract. Legal obligations - We need your personal data in this case to fulfill our legal obligations (e.g. tax or accounting). Legitimate interest - The processing necessary for the purposes of our legitimate interest’s protection (e.g. ensuring application security, enforcing legal claims, etc.), except where interests or your fundamental rights and freedoms take precedence over those interests. Consent - you can give us consent for one or more specific purposes (for example, to send third-party commercial communications). To obtain a consent for the processing of your personal data, we follow these rules: (i) we will always collect the consent for the processing of your personal data separately, so the consent will not be part of the text of the contract or other contractual clauses, (ii) the text of the consent will always be comprehensible, (iii ) we will always ask for your active confirmation, so no pre-ticked boxes will be presented to you when asking for a consent.
4. PURPOSES OF PERSONAL DATA PROCESSING
Each processing of your personal data is based on a legal title and carried out for a specific purpose.
Below are listed purposes for which we shall process your personal data and titles we shall use to do so:
- Registration of the user and administration of his account within the Citymove platform - the legal title shall be entering into a contract with you and fulfillment of the obligations arising from the contract.
- Provision of service through the Citymove platform - the legal title shall be entering into a contract with you and fulfillment of the obligations arising from the contract. This purpose also includes keeping services functional and safe, debugging, and updating features. Some features may require permissions to share data (e. g. location, movement activity).
- Billing of services provided by the Citymove platform to business partners and bookkeeping - the legal title shall be the conclusion of a contract with you and the performance of the obligations arising from the contract..
- Recording and archiving personal data of users of the Citymove platform - the legal title shall be our legitimate interest in ensuring our protection against any claims against us and the protection of our rights and claims.
- Sending commercial offers of our products and services and receiving updates of Citymove platform - the legal title shall be our legitimate interest in sending you offers of our products and services and informing you about Citymove news, events, and other information.
- Sending personalized commercial offers of products and services of third parties - the legal title will be your freely given consent to the processing of personal data, especially service usage data, for the purpose of personalized offers of products and services based on them.
- Improvement of provided services, application / web development, creation of analyses, reports and statistics - the legal title shall be our legitimate interest in ensuring the best possible user experience.
- Fulfillment of our legal obligations - the legal title is the fulfillment of our legal obligations, particularly in the areas of tax and accounting.
Detailed information on the processing of personal data within the Citymove platform can be found below under point 9 of this Memorandum.
5. YOUR RIGHTS
Below, you shall find a list of your privacy rights together with a practical explanation of their use:
· The right to withdraw consent allows you to withdraw any previously granted consent to the processing of personal data. In this case, we will not further process your personal data for this purpose. In some cases, you can revoke consent by changing the settings in an application or on a website. However, the withdrawal of consent does not affect the lawfulness of the processing of personal data until the moment of its withdrawal.
· The right of access to personal data entitles you, upon your request, to obtain information whether we process your personal data and, if so, to what extent. You also have the right to request a copy of the processed personal data. If you submit a request, we are also obliged to inform you of the purpose of the processing, the recipient of the processed personal data or other related information.
· The right of correction, for example, shall allow you to ask us to change any of your personal data we process if there has been any change to it (e.g. change of surname, address change, etc.).
· The right of erasure is also referred to as the "right to be forgotten" and obliges us as a personal data controller to erase your personal information in the following cases:
o the purpose of the processing no longer exists (e.g. termination of the contractual relationship) and we have no other legitimate purpose to process your data,
o you revoke your consent to the processing of personal data and there is no other reason for processing your personal data (e.g. withdrawing your marketing consent, provided that you do not have a contractual relationship with us),
o you object to the processing of personal data (provided that the objection is justified and there is no legal reason for processing your personal data),
o in accordance with applicable legislation, we are required to delete your data.
· The right to a restriction on the processing of personal data represents the possibility for the data subject to request a restriction on the processing of all or some of his personal data for a certain period in specific cases specified by the legislation in force. This is the case, for example, where the data subject denies the accuracy of his personal data and this issue needs to be examined.
· The right of objection applies when personal data is processed based on a legitimate interest (e.g. to protect our property). You can also object if your personal data will be processed for direct marketing purposes. In justified cases, the processing of your personal data will be stopped after the objection is accepted.
· The right to transfer personal data - when you ask us to transfer your personal data to another controller, it is our responsibility to provide and transfer this data in a structured, commonly used, and machine-readable format. This right can only be exercised if the processing is based on consent or contract and at the same time it is automated processing.
· The right not to be subject to a decision based solely on the automated processing means that if the processing of your personal data carried out solely by automated means without any human intervention is to be the basis for a certain decision with legal or other significant impacts, you have the right to request that your personal data shall be assessed by a person.
6. RULES ON SHARING YOUR PERSONAL DATA WITH THIRD PARTIES
We divide the rules according to which we share your personal data with our processors into two basic categories.
The first category involves sharing personal data within the European Union and the European Economic Area, the second category involves sharing to third countries outside the European Union and the European Economic Area and sharing with international organizations.
In order to share your personal data with a processor within the European Union and the European Economic Area, we ensure that:
· personal information shall be shared for a specific purpose (such as fulfilling an order for services ordered through the Citymove platform)
· the transfer consists only of a clearly defined and necessary scope of personal data,
· the transfer shall be performed based on a duly concluded contract for the processing of personal data or such contractual clause,
· sharing shall be done in an appropriate secure way (if technically possible encryption, pseudonymization, etc.).
Within the internal administrative functions, we cooperate with HoppyGo s.r.o., a Czech company, which, based on our authorization and the contract on the processing of personal data, provides mainly customer support services.
In the case of sharing your personal data with countries outside the European Union and the European Economic Area and with international organizations, we shall do so solely with entities located in countries, which, as decided by the European Commission, ensure adequate protection of personal data, conclude with us model agreement based on the standard contractual clauses issued by the European Commission, or fall under another data transfer scheme permitted by the regulations.
If we decide to change the payment gateway operator, we will ensure the secure transfer of your Information about the payment method to the new operator's system so that you can continue to use the Citymove platform features without having to re-enter your payment details. This applies similarly to other services necessary for our operations.
In the event that we undergo a change and transfer our business or other activities, in whole or in part, to another person (including assignment of contracts), then such transfer would include personal data relating to those activities. For these purposes, information (including personal data) relating to our business may be shared with other parties in order to evaluate and conclude the transaction. This would also be the case if we were required by law to make such changes.
Upon a lawful request, your personal data may be provided to public authorities, in particular courts, the Police of the Czech Republic and other law enforcement authorities to the extent necessary and within the limits of the law.
7. PERSONAL DATA CATEGORIES
Below you shall find the individual categories of personal data we process, and the sorting of the specific data included.
· Identification data: name, surname.
· Contact details: e-mail address, telephone number.
· Citymove account details: Your login, hashed password, login time, behavior within platform after login.
· Evaluation and related communications: survey responses, email communication, complaints / suggestions / proposals / requests / questions and their handling, service requirements, evaluation records of the Citymove app.
· Service usage data: order history, including contracts, invoices and other related information (subject, date, place of transaction, reminders), interactions with the application (analytical reports and “crash” reports), search and listen features and other information depending on the setting of app permissions and individual functionalities of a device (e.g. accelerometer, gyroscope, barometer, Bluetooth, Wi-Fi networks, etc.).
· Internal control and investigation data: logs of individual actions performed in the application, including their time traces..
· Device details: device type, operating system type and version.
· Location data: location data based on GPS, location data derived from other operations.
· Internet identifiers: IP addresses, browser / system information, cookies or similar technology, information regarding log in through third party account (Google, Apple, Facebook, Škoda ID). More information is available on the website you visit.
· Transaction information: payment identifiers for individual payments made through the Citymove platform.
· Information regarding the payment method: masked number (last four digits), expiry date, holder's name and security code on the payment card.
· Information about the CCS card: masked number and expiry date.
8. CONTACT FOR YOUR QUESTIONS
In case of doubt in any part of this Information Memorandum or if you have any questions or concerns about the protection of your personal data, please do not hesitate to contact our Data Protection Officer of Škoda X: dpo@skoda-x.cz, http://www.skoda-x.cz.
9. DETAILED INFORMATION ON PROCESSING PERSONAL DATA WITHIN THE CITYMOVE PLATFORM
Processing takes place within the following activities:
I. User registration and account management within the Citymove platform
Description of processing purpose:
We process your personal data so that we can register you as a platform user and continue to maintain your account.
Description of the legal basis for processing:
We must carry out the processing in order to conclude a contract with you, respectively to fulfill the contract you have entered into. The provision of your personal data is necessary for the conclusion of the contract and if you do not provide it, the contract will not be concluded with you or the already concluded contract will not be fulfilled.
Categories of personal data we process:
Identification data; contact information; platform account information; network identifiers; communications; service usage data; transaction data; evaluation and related communication, including recorded customer support calls (insofar as they relate to registration and account management).
Processing and archiving time:
We process and archive personal data for the duration of the framework contract for the provision of our services or for the performance of the obligations arising from the contract.
Categories of other processors or recipients to whom we may provide personal data:
Companies within the Volkswagen Group (Espetially Škoda Auto a.s.), IT infrastructure provider for customer support (Spinoco Czech Republic, a.s.), Payment servise provider (Stripe Payments Europe, Ltd.), issuer of CCS cards (CCS Česká společnost pro platební karty s.r.o.) infrastructure operator of the Citymove platform and IT tools and infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
II. Provision of services through the Citymove platform
Description of processing purpose:
Ensuring the functions of the Citymove platform - searching for public transport, parking and other places, buying tickets, renting vehicles and bicycles, etc. within the scope of the current offer of the application.
Description of the legal basis for processing:
We must carry out the processing in order to conclude a contract with you, respectively to fulfill the contract you have entered into. The provision of your personal data is necessary for the conclusion of the contract and if you do not provide it, the contract will not be concluded with you or the already concluded contract will not be fulfilled.
Categories of personal data we process:
Identification data; contact information; platform account information; Transaction information (including credit card information necessary to complete transactions, or CCS card) device details; evaluation and related communications; location data, analytical reports and crash reports of the application with data about a device, operating system and an error. Further, data specific to the fulfillment of a contract concluded through the Citymove platform (e.g. car registration number for parking provided through the MPLA application). The scope of data may vary depending on the services currently offered, but it will be data necessary to use these services.
Processing and archiving time:
We process and archive personal data for the duration of the framework contract you have concluded for the provision of our services or for the performance of the obligations arising from the contract.
Categories of other processors or recipients to whom we may provide personal data:
Companies within the Volkswagen Group (espetially Škoda Auto a.s.); Operators of applications linked to the Citymove platform (e.g. TSK, DPP, Rekola, Nextbike, Mr.Parkit, BeRider, HoppyGo), Citymove infrastructure operator and IT tools and infrastructure providers; Providers of internal administrative services, Service agencies; Marketing agencies; Analytical and statistical companies.
Origin of personal data:
Directly from you.
Automated decision-making:
Not conducted.
III. Records and archiving of personal data of platform users
Description of processing purpose:
In the event that you wish to enter into a contract with us, after the contract is entered into and also after the termination of the contract for example by canceling your registration, we will continue to process your personal data to the extent necessary to achieve the purpose of our protection against any claims against us and the protection of our rights and claims, in particular in court, out-of-court or enforcement proceedings.
Description of the legal basis for processing:
We have a legitimate interest in carrying out this processing. This legitimate interest consists in defending any claims against us and protecting our rights and claims.
Categories of personal data we process:
Identification data; contact information; transaction information (including credit card or CCS card information necessary to complete transactions) platform account information; network identifiers; evaluation and related communications; service usage data; evaluation and related communication; location data.
Processing and archiving time:
We process and archive your personal data for the entire duration of your contractual relationship with us, and for as long as there is an interest in defending our rights (until any claims are time-barred).
Categories of other processors or recipients to whom we may provide personal data:
IT tools and infrastructure providers andcustomer support provider (Spinoco Czech Republic, a.s.).
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
IV. Sending commercial offers for our products and services and receive updates on the Citymove platform
Description of processing purpose:
We process your data in order to keep you informed about offers and news in relation to the Citymove platform.
Description of the legal basis for processing:
We have a legitimate interest in carrying out this processing. This legitimate interest lies in our interest in providing you with up-to-date information and offering you our products and services that are relevant to you and may be of interest to you.
Categories of personal data we process:
Identification data; contact information; platform account information; service usage data.
Processing and archiving time:
We process and store your personal data for the duration of your contractual relationship with us, or until you let us know that you no longer wish us to process your data for this purpose.
Categories of other processors or recipients to whom we may provide personal data:
IT tools and infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
V. Commercial offers of third-party products and services
Description of processing purpose:
We process your data in order to inform you about third-party commercial offers in case you agree to receive them. The processing includes evaluation of your use of our services , including customization of the offer to your interests, in order to send only commercial offers that are relevant and interesting for you.
Description of the legal basis for processing:
We will perform this processing on the basis of your consent.
Categories of personal data we process:
Location data, device details, details of the service used (e.g. information on the use of parking payments), reports used to count users, displayed offers and campaigns and to analyze their results, and also “crash” reports.
Processing and archiving time:
We process your personal data as long as we have your consent. You can withdraw your consent at any time via the settings in your profile in the Citymove app and in the email messages sent to you, and further processing will be terminated.
Categories of other processors or recipients to whom we may provide personal data:
Your data is provided to third parties. We process analytical reports in cooperation with our contractual processor. In case you are interested in an offer, you may be redirected to our partner´s website or a different communication channel where processing may occur according to the conditions of this partner.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted. Offers are selected automatically according to relevance and predicted interests based on data related to the usage of Citymove services and type of the offer. Showing offers has no substantial impact on you, it is only an opportunity to benefit from the advantages we provide within our services.
VI. Billing services provided by Citymove to business partners and bookkeeping
Description of processing purpose:
Your use of the services of our business partners through the Citymove platform imposes obligations on us, which include the processing of your personal data. We will therefore process your personal data, but only to the extent necessary and only for the period defined below.
Description of the legal basis for processing:
We process your personal data based on the legal title of contracts with you if you use the services of our business partners through the Citymove platform..
Categories of personal data we process:
Identification data; contact information; transaction data; platform account information; service usage data.
Processing and archiving time:
We process and archive personal data for the duration of the contract concluded with you for the provision of our services or for the performance of obligations arising from the contract.
Categories of other processors or recipients to whom we may provide personal data:
External tax, accounting, and legal advisors, IT tools, payment service and infrastructure providers, Payment servise provider (Stripe Payments Europe, Ltd.), issuer of CCS cards (CCS Česká společnost pro platební karty s.r.o.).
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
VII. Improvement of provided services, application / web development, creation of analyses, reports and statistics
Description of processing purpose:
In order to properly ensure the functioning of the services we provide and to improve them, we need to process information about their use for the creation of analyses, reports and statistics. If the contract with you is terminated, for example by cancelling your registration, we will continue to process your personal data, but only to the minimum extent necessary for the production of reports and statistics.
Description of the legal basis for processing:
We process your personal data based on the legal title of the legitimate interest of the controller.
Categories of personal data we process:
Identification data; contact information; service usage data (including e.g. address in the case of user testing), transaction information, device details, IP address, information regarding log in through third party account (Google, Apple, Facebook, Škoda ID).
Processing and archiving time:
We process your personal data for the entire duration of your contractual relationship with us.
Categories of other processors or recipients to whom we may provide personal data:
IT tools, analytics and infrastructure providers
Origin of personal data:
Directly from you or from your use of the platform or the use of Facebook and Google.
Automated decision-making:
There is no automated decision-making with legal or other similar implications. The processing includes analysis of the use of services and products and marketing activities.
VIII. To comply with our legal obligations
Description of processing purpose:
We have obligations under selected legal provisions that we must comply with, which consist of processing your personal data. We will therefore process your personal data, but only to the extent necessary and only for the period of time defined below.
Description of the legal basis for processing:
We process your personal data on the basis of the legal basis of compliance with legal obligations, in particular in the field of tax and accounting.
Categories of personal data we process:
Identification data; contact data; platform account data; service usage data.
Processing and archiving time:
We process and archive your personal data for as long as we are required to process it by the applicable legislation.
Categories of other processors or recipients to whom we may provide personal data:
External tax, accounting and legal advisors; IT infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
