This Information Memorandum on personal data processing in connection with the use of the Citymove application operated by ŠKODA AUTO DigiLab s.r.o., with its registered office at Želetavská 1525/1, Michle, 140 00 Praha 4, IČO: 05976359, registered in the Commercial Register under File No. C 274001 (hereinafter the “Information Memorandum”), has been prepared for you to acquaint you with the procedure on how we collect, process, use and protect your personal data and thus help protect your privacy in connection with your use of the Citymove platform.
We handle all your personal data in accordance with applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR"), Act No. 110/2019 Coll., on the Processing of Personal Data, as amended, and Act No. 480/2004 Coll., On Certain Information Society Services, as amended.
Concurrently, through this Information Memorandum, we would like to clarify the most important concepts and processes that we use to protect your personal data and to answer questions you may have about the collection, processing, and storage of your personal data.
Version: 2022.07
We consider the protection of personal data to be crucial and therefore we pay very close attention to it.
You can be certain that we treat your personal data with due care and diligence in accordance with applicable law and protect your personal data to the maximum extent possible, using technical and organizational measures of a high technical standard.
In order to fully understand how we protect your personal data, we recommend that you read this Information Memorandum carefully.
We collect and process your personal data only for the specific purpose and to the necessary extent. The transfer of your personal data is voluntary, in certain situation, however, it may be necessary for the conclusion of a contract and the provision of our services and, subject to certain conditions, you may request the deletion of the processed personal data (for details see chapter "10. Your rights").
In some cases, such as conclusion of a contract for the provision of our services, we need to obtain the necessary scope of personal information from you based on your binding order for such a service. Without this information, we would not be able to meet your requirements and conclude the contract with you, in particular with regard to the fulfillment of our legislative obligations, but also with regard to the protection of our legitimate interests.
The main titles for processing your personal data in connection with the use of the Citymove platform include: Contract performance – In this case, we need your personal data for the purpose of concluding a contractual relationship and the subsequent performance, or before concluding the contract. Legal obligations - We need your personal data in this case for the purpose of data processing to fulfill our legal obligations as an controller. Legitimate interest - The processing of your personal data would be necessary for the purposes of our legitimate interests, except where your interests or your fundamental rights and freedoms take precedence over those interests. Consent - you can give us consent for one or more specific purposes (for example, to send third-party commercial communications). To obtain a consent for the processing of your personal data, we follow these rules: (i) we will always collect the consent for the processing of your personal data separately, so the consent will not be part of the text of the contract or other contractual clauses, (ii) the text of the consent will always be comprehensible, (iii ) we will always ask for your active confirmation, so no pre-ticked boxes will be presented to you when asking for a consent.
As we mentioned in chapter “3. Legal titles for processing your personal data”, we shall base each processing of your personal data on a legal title and carry the processing out for a specific purpose.
Below are listed purposes for which we shall process your personal data and titles we shall use to do so:
The protection of your personal data would certainly be incomplete in case you would not have your own rights related to their protection. Below, you shall find a list of your privacy rights together with a practical explanation of their use:
We divide the rules according to which we share your personal data with our processors into two basic categories.
The first category involves sharing personal data within the European Union and the European Economic Area, the second category involves sharing to third countries outside the European Union and the European Economic Area and sharing with international organizations.
In order to share your personal data with a processor within the European Union and the European Economic Area, we ensure that:
Within the internal administrative functions, we cooperate with HoppyGo s.r.o., a Czech company, which, on the basis of our authorization and the contract on the processing of personal data, provides mainly customer support services.
In the case of sharing your personal data with countries outside the European Union and the European Economic Area and with international organizations, we shall do so solely with entities located in countries, which, as decided by the European Commission, ensure adequate protection of personal data or on the basis of standard contractual clauses, i.e. model contracts issued by the European Commission.
In the event that we undergo a change and transfer our business or other activities, in whole or in part, to another person (including assignment of contracts), then such transfer would include personal data relating to those activities. For these purposes, information (including personal data) relating to our business may be shared with other parties in order to evaluate and conclude the transaction. This would also be the case if we were required by law to make such changes.
Upon a lawful request, your personal data may be provided to public authorities, in particular courts, the Police of the Czech Republic and other law enforcement authorities to the extent necessary and within the limits of the law.
Below you shall find the individual categories of personal data we process and the sorting of the specific data included.
In case of doubt in any part of this Information Memorandum or if you have any questions or concerns about the protection of your personal data, please do not hesitate to contact our Data Protection Officer of ŠKODA AUTO DigiLab: dpo@skodaautodigilab.com, http://www.skodaautodigilab.com/.
We take pride in complying with all established and binding rules and security measures when processing your personal data, and thus we hope that you will not be dissatisfied with our actions towards you.
Nevertheless, should you not agree with the way we process your personal data, we will be happy if you let us know. You may also contact:
Office for Personal Data Protection
address: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic
tel.: +420 234 665 111
web: http://www.uoou.cz/
With this document, ŠKODA AUTO DigiLab s.r.o., with its registered office at Želetavská 1525/1, Michle, 140 00 Praha 4, IČO: 05976359, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 274001 (hereinafter the “ŠKODA AUTO DigiLab”) as the personal data controller provides you information about the processing of personal data and your rights related to the processing.
Processing takes place within the following activities:
Description of processing purpose:
We process your personal data so that we can register you as a platform user and continue to maintain your account.
Description of the legal basis for processing:
We must carry out the processing in order to conclude a contract with you, respectively to fulfill the contract you have entered into. The provision of your personal data is necessary for the conclusion of the contract and if you do not provide it, the contract will not be concluded with you or the already concluded contract will not be fulfilled.
Categories of personal data we process:
Identification data; contact information; platform account information; network identifiers; communications, interactions and profiles derived from this data; service usage data; transaction data; evaluation and related communication, including recorded customer support calls (insofar as they relate to registration and account management).
Processing and archiving time:
We process and archive personal data for the duration of the framework contract you have concluded for the provision of our services or for the performance of the obligations arising from the contract.
Categories of other processors or recipients to whom we may provide personal data:
Companies within the Volkswagen Group (ŠKODA AUTO a.s. etc.), IT infrastructure provider for customer support (Spinoco Czech Republic, a.s.), Payment servise provider (ComGate Payments, a.s.), infrastructure operator of the Citymove platform and IT tools and infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
Description of processing purpose:
Following your registration within the Citymove platform and ordering services that the platform allows you to order from third parties.
Description of the legal basis for processing:
We must carry out the processing in order to conclude a contract with you, respectively to fulfill the contract you have entered into. The provision of your personal data is necessary for the conclusion of the contract and if you do not provide it, the contract will not be concluded with you or the already concluded contract will not be fulfilled.
Categories of personal data we process:
Identification data; contact information; platform account information; Transaction information (including credit card information necessary to complete transactions) technology and equipment related data; communications, interactions and profiles derived from this data; location data, analytical reports and crash reports of the application with data about a device, operating system and an error. Further, data specific to the fulfillment of a contract concluded through the Citymove platform (e.g. car registration number for parking provided through the MPLA application). The scope of data may vary depending on the services currently offered, but it will be data necessary to use these services.
Processing and archiving time:
We process and archive personal data for the duration of the framework contract you have concluded for the provision of our services or for the performance of the obligations arising from the contract.
Categories of other processors or recipients to whom we may provide personal data:
Companies within the Volkswagen Group (ŠKODA AUTO a.s. etc.); Operators of applications linked to the Citymove platform (e.g. TSK, DPP, Rekola, Nextbike, Mr.Parkit, BeRider, HoppyGo), Citymove infrastructure operator and IT tools and infrastructure providers; Providers of internal administrative services, Service agencies; Marketing agencies; Analytical and statistical companies.
Origin of personal data:
Directly from you.
Automated decision-making:
Not conducted.
Description of processing purpose:
In the event that you wish to enter into a contract with us, after the contract is entered into and also after the termination of the contract for example by canceling your registration, we will continue to process your personal data to the extent necessary to achieve the purpose of our protection against any claims against us and the protection of our rights and claims, in particular in court, out-of-court or enforcement proceedings.
Description of the legal basis for processing:
We have a legitimate interest in carrying out this processing. This legitimate interest consists in defending any claims against us and protecting our rights and claims.
Categories of personal data we process:
Identification data; contact information; transaction information (including credit card information necessary to complete transactions) platform account information; network identifiers; communications, interactions and profiles derived from this data; service usage data; evaluation and related communication, including recorded customer support calls; location data.
Processing and archiving time:
We process and archive your personal data for the entire duration of your contractual relationship with us, and for a period of 10 years from the end of the contract.
Categories of other processors or recipients to whom we may provide personal data:
Citymove infrastructure operator and IT tools and infrastructure providers, customer support provider (Spinoco Czech Republic, a.s.).
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
Description of processing purpose:
We process your data in order to keep you informed of news in relation to the Citymove platform. If you are a user of the Citymove Platform, we may from time to time inform you about the Platform's news and updates without your prior consent, as we assume that you may be interested in this information as a platform user.
Description of the legal basis for processing:
We have a legitimate interest in carrying out this processing. This legitimate interest lies in our interest in providing you with up-to-date information and offering you our products and services that are relevant to you and may be of interest to you.
Categories of personal data we process:
Identification data; contact information; platform account information; communications, interactions and profiles derived from this data; service usage data; evaluation and related communication.
Processing and archiving time:
We process and archive your personal data for the entire duration of your contractual relationship with us and for a period of one year from the termination date of the contract.
Categories of other processors or recipients to whom we may provide personal data:
IT tools and infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
Description of processing purpose:
We process your data in order to inform you about third-party commercial offers in case you agree to receive them. The processing includes evaluation of your use of our services , including customization of the offer to your interests, in order to send only commercial offers that are relevant and interesting for you.
Description of the legal basis for processing:
We will perform this processing on the basis of your consent.
Categories of personal data we process:
Location data, details of the service used (e.g. information on the use of parking payments), reports containing a device identifier used to count users, displayed offers and campaigns and to analyze their results, and also crash reports with data about device and error.
Processing and archiving time:
We process your personal data as long as we have your consent. You can withdraw your consent at any time via the settings in your profile in the Citymove app and in the email messages sent to you, and further processing will be terminated.
Categories of other processors or recipients to whom we may provide personal data:
Your data is provided to third parties. We process analytical reports in cooperation with our contractual processor. In case you are interested in an offer, you may be redirected to our partner´s website or a different communication channel where processing may occur according to the conditions of this partner.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted. Offers are selected automatically according to relevance and predicted interests based on data related to the usage of Citymove services and type of the offer. Showing offers has no substantial impact on you, it is only an opportunity to benefit from the advantages we provide within our services.
Description of processing purpose:
We have obligations arising out of certain legislation which we need to fulfill and which consist of processing your personal data. Therefore, we shall process your personal data, but only to the extent necessary and only for the period defined below.
Description of the legal basis for processing:
We process your personal data based on the legal title of the fulfillment of legal obligations, especially in the field of tax and accounting.
Categories of personal data we process:
Identification data; contact information; transaction data; platform account information; service usage data.
Processing and archiving time:
We process and archive your personal data for as long as we are required to do so by applicable law.
Categories of other processors or recipients to whom we may provide personal data:
External tax, accounting, and legal advisors, IT tools, payment service and infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
Description of processing purpose:
We strive to ensure that our services are as good as possible and that our users are always satisfied. We use cookies to determine how our users behave on the web. We also endeavor to offer users services and products tailored to their preferences and usage. If the user gives us consent, we can also collect data from the social networks of the user. Detailed information about the use of cookies can be found on our websites.
Description of the legal basis for processing:
We process your personal data based on the legal title of the legitimate interest of the controller.
Categories of personal data we process:
Identification data; contact information; service usage data(including e.g. home address), device and operating system for troubleshooting; recordings of customer support calls, IP address, IP device, social media login credentials (including photo).
Processing and archiving time:
We process your personal data for the entire duration of your contractual relationship with us.
Categories of other processors or recipients to whom we may provide personal data:
IT tools, analytics and infrastructure providers
Origin of personal data:
Directly from you or from your use of the platform or the use of Facebook and Google.
Automated decision-making:
There is no automated decision-making with legal or other similar implications. The processing includes analysis of the use of services and products and marketing activities.
Description of processing purpose:
We have obligations under selected legal provisions that we must comply with, which consist of processing your personal data. We will therefore process your personal data, but only to the extent necessary and only for the period of time defined below.
Description of the legal basis for processing:
We process your personal data on the basis of the legal basis of compliance with legal obligations, in particular in the field of tax and accounting.
Categories of personal data we process:
Identification data; contact data; platform account data; service usage data.
Processing and archiving time:
We process and archive your personal data for as long as we are required to process it by the applicable legislation.
Categories of other processors or recipients to whom we may provide personal data:
External tax, accounting and legal advisors; IT infrastructure providers.
Origin of personal data:
Directly from you or from your use of the platform.
Automated decision-making:
Not conducted.
You have the following rights when processing personal data:
You can use the following contacts to communicate with ŠKODA AUTO DigiLab concerning personal data protection:
· Electronically at dpo@skodaautodigilab.com
· In writing at ŠKODA AUTO DigiLab s.r.o., Želetavská 1525/1, Michle, 140 00 Praha 4
In connection with the exercise of your rights, ŠKODA AUTO DigiLab may claim reasonable compensation not exceeding the costs necessary to process the request if such requests are clearly unreasonable or disproportionate.
If you have questions about protection of personal data, you can contact the Data Protection Officer of ŠKODA AUTO DigiLab.
If you do not agree with the procedure of how we process your personal data, you can file a complaint with the Data Protection Officer of ŠKODA AUTO DigiLab or file a complaint with the supervisory authority to protect your rights.
Office for Personal Data Protection
Pplk. Sochora 27, 170 00 Prague 7
+420 234 665 111