1.  INTRODUCTION

This Information Memorandum on personal data processing in connection with the use of the Citymove application operated by ŠKODA AUTO DigiLab s.r.o., with its registered office at Želetavská 1525/1, Michle, 140 00 Praha 4, IČO: 05976359, registered in the Commercial Register under File No. C 274001 (hereinafter the “Information Memorandum”), has been prepared for you to acquaint you with the procedure on how we collect, process, use and protect your personal data and thus help protect your privacy in connection with your use of the Citymove platform.

We handle all your personal data in accordance with applicable legislation, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR"), Act No. 110/2019 Coll., on the Processing of Personal Data, as amended, and Act No. 480/2004 Coll., On Certain Information Society Services, as amended.

Concurrently, through this Information Memorandum, we would like to clarify the most important concepts and processes that we use to protect your personal data and to answer questions you may have about the collection, processing, and storage of your personal data.

Version: 2022.07

‍

2.  OUR APPROACH

We consider the protection of personal data to be crucial and therefore we pay very close attention to it.

You can be certain that we treat your personal data with due care and diligence in accordance with applicable law and protect your personal data to the maximum extent possible, using technical and organizational measures of a high technical standard.

In order to fully understand how we protect your personal data, we recommend that you read this Information Memorandum carefully.

‍

3.  LEGAL TITLES FOR PROCESSING YOUR PERSONAL DATA

We collect and process your personal data only for the specific purpose and to the necessary extent. The transfer of your personal data is voluntary, in certain situation, however, it may be necessary for the conclusion of a contract and the provision of our services and, subject to certain conditions, you may request the deletion of the processed personal data (for details see chapter "10. Your rights").

In some cases, such as conclusion of a contract for the provision of our services, we need to obtain the necessary scope of personal information from you based on your binding order for such a service. Without this information, we would not be able to meet your requirements and conclude the contract with you, in particular with regard to the fulfillment of our legislative obligations, but also with regard to the protection of our legitimate interests.

The main titles for processing your personal data in connection with the use of the Citymove platform include: Contract performance – In this case, we need your personal data for the purpose of concluding a contractual relationship and the subsequent performance, or before concluding the contract. Legal obligations - We need your personal data in this case for the purpose of data processing to fulfill our legal obligations as an controller. Legitimate interest - The processing of your personal data would be necessary for the purposes of our legitimate interests, except where your interests or your fundamental rights and freedoms take precedence over those interests. Consent - you can give us consent for one or more specific purposes (for example, to send third-party commercial communications). To obtain a consent for the processing of your personal data, we follow these rules: (i) we will always collect the consent for the processing of your personal data separately, so the consent will not be part of the text of the contract or other contractual clauses, (ii) the text of the consent will always be comprehensible, (iii ) we will always ask for your active confirmation, so no pre-ticked boxes will be presented to you when asking for a consent.

‍

4.  PURPOSES OF PERSONAL DATA PROCESSING

As we mentioned in chapter “3. Legal titles for processing your personal data”, we shall base each processing of your personal data on a legal title and carry the processing out for a specific purpose.

Below are listed purposes for which we shall process your personal data and titles we shall use to do so:

• Registration of the user and administration of his account within the Citymove platform - the legal title shall be entering into a contract with you and fulfillment of the obligations arising from the contract.
• Provision of service through the Citymove platform - the legal title shall be entering into a contract with you and fulfillment of the obligations arising from the contract. This purpose also includes keeping services functional and safe, debugging, and updating features. Some features may require permissions to share data (e. g. location, movement activity).
• Billing of services provided by the Citymove platform to business partners and bookkeeping - the legal title shall be the fulfillment of legal obligations arising in particular from the Act on Accounting and Value Added Tax Act.
• Recording and archiving personal data of users of the Citymove platform - the legal title shall be our legitimate interest in ensuring our protection against any claims against us and the protection of our rights and claims.
• Sending commercial offers of our products and services and receiving updates of Citymove platform - the legal title shall be our legitimate interest in sending you offers of our products and services and informing you about Citymove news, events and other information.
• Sending personalized commercial offers of products and services of third parties - the legal title will be your freely given consent to the processing of personal data, especially service usage data and location data, for the purpose of personalized offers of products and services based on them.
• Improvement of provided services, application / web development, creation of analyses, reports and statistics - the legal title shall be our legitimate interest in ensuring the best possible user experience.
• Fulfillment of our legal obligations - the legal title is the fulfillment of our legal obligations, particularly in the areas of tax and accounting.
• Mediation of payments to business partners - the legal title shall be the performance of obligations arising from the contract with you.

‍

5.  YOUR RIGHTS

The protection of your personal data would certainly be incomplete in case you would not have your own rights related to their protection. Below, you shall find a list of your privacy rights together with a practical explanation of their use:

• The right to withdraw consent allows you to withdraw any previously granted consent to the processing of personal data. In this case, we will not further process your personal data for this purpose. In some cases, you can revoke consent by changing the settings in an application or on a website. However, the withdrawal of consent does not affect the lawfulness of the processing of personal data until the moment of its withdrawal. 
• The right of access to personal data entitles you, upon your request, to obtain information whether we process your personal data and, if so, to what extent. You also have the right to request a copy of the processed personal data. If you submit a request, we are also obliged to inform you of the purpose of the processing, the recipient of the processed personal data or other related information.
• The right of correction, for example, shall allow you to ask us to change any of your personal data we process if there has been any change to it (e.g. change of surname, address change, etc.).
• The right of erasure is also referred to as the "right to be forgotten" and obliges us as a personal data controller to erase your personal information in the following cases:
  - the purpose of the processing no longer exists (e.g. termination of the contractual relationship),
  - you revoke your consent to the processing of personal data and there is no other reason for processing your personal data (e.g. withdrawing your marketing consent, provided that you do not have a contractual relationship with us),
  - you object to the processing of personal data (provided that the objection is justified and there is no legal reason for processing your personal data),
  - in accordance with applicable legislation, we are required to delete your data (e.g. the shredding obligation).

• The right to a restriction on the processing of personal data represents the possibility for the data subject to request a restriction on the processing of all or some of his personal data for a certain period of time in specific cases specified by the legislation in force. This is the case, for example, where the data subject denies the accuracy of his personal data and this issue needs to be examined.
• The right of objection is similar to the right of withdrawal of consent and applies when personal data is processed based on a legitimate interest (e.g. to protect our property). You can also object if your personal data will be processed for direct marketing purposes. In justified cases, the processing of your personal data will be stopped after the objection is accepted.
• The right to transfer personal data - when you ask us to transfer your personal data to another controller, it is our responsibility to provide and transfer this data in a structured, commonly used and machine-readable format. This right can only be exercised if the processing is based on consent or contract and at the same time it is automated processing.
• The right not to be subject to a decision based solely on the automated processing means that if the processing of your personal data carried out solely by automated means without any human intervention is to be the basis for a certain decision with legal or other significant impacts, you have the right to request that your personal data shall be assessed by a person.

‍

6.  RULES ON SHARING YOUR PERSONAL DATA WITH THIRD PARTIES

We divide the rules according to which we share your personal data with our processors into two basic categories.

The first category involves sharing personal data within the European Union and the European Economic Area, the second category involves sharing to third countries outside the European Union and the European Economic Area and sharing with international organizations.

In order to share your personal data with a processor within the European Union and the European Economic Area, we ensure that:

• personal information shall be shared for a specific purpose (such as fulfilling an order for services ordered through the Citymove platform)
• the transfer consists only of a clearly defined and necessary scope of personal data,
• the transfer shall be performed on the basis of a duly concluded contract for the processing of personal data or such contractual clause,
• sharing shall be done in an appropriate secure way (if technically possible encryption, pseudonymization, etc.).

Within the internal administrative functions, we cooperate with HoppyGo s.r.o., a Czech company, which, on the basis of our authorization and the contract on the processing of personal data, provides mainly customer support services.

In the case of sharing your personal data with countries outside the European Union and the European Economic Area and with international organizations, we shall do so solely with entities located in countries, which, as decided by the European Commission, ensure adequate protection of personal data or on the basis of standard contractual clauses, i.e. model contracts issued by the European Commission.

In the event that we undergo a change and transfer our business or other activities, in whole or in part, to another person (including assignment of contracts), then such transfer would include personal data relating to those activities. For these purposes, information (including personal data) relating to our business may be shared with other parties in order to evaluate and conclude the transaction. This would also be the case if we were required by law to make such changes.

Upon a lawful request, your personal data may be provided to public authorities, in particular courts, the Police of the Czech Republic and other law enforcement authorities to the extent necessary and within the limits of the law.

‍

7.  PERSONAL DATA CATEGORIES

Below you shall find the individual categories of personal data we process and the sorting of the specific data included.

• Identification data: name, surname.
• Contact details: e-mail address, telephone number.
• Citymove account details: Your login, hash password, login time, behavior within platform after login.
• Evaluation and related communications: survey responses, complaints / suggestions / proposals / requests / questions and their handling, service requirements, evaluation records.
• Service usage data: order history, including contracts, invoices and other related information (subject, date, place of transaction, reminders), interactions with the application, search and listen features and other information depending on the setting of app permissions and individual functionalities of a device (e.g. accelerometer, gyroscope, barometer, Bluetooth, Wi-Fi networks, etc.).
• Internal control and investigation data: internal system logs.
• Communications, interactions and profiles derived from the following data: email communications, clicks, feedback / surveys / comments / suggestions / complaints to the controller, consent / disagreement with the type or form of communication.
• Recordings of customer support calls - recording of the call or its evaluation for some selected calls.
• Location data: location data based on GPS, location data derived from other operations.
• Web page identifiers: Browser / system information, Cookies or similar technology. More information is available on the website you visit.
• Information regarding the payment method: number, expiry date, holder's name and security code on the payment card.

‍

8.  CONTACT FOR YOUR QUESTIONS OR CONCERNS

In case of doubt in any part of this Information Memorandum or if you have any questions or concerns about the protection of your personal data, please do not hesitate to contact our Data Protection Officer of ŠKODA AUTO DigiLab: dpo@skodaautodigilab.com, http://www.skodaautodigilab.com/.

‍

9.  SUPERVISION

We take pride in complying with all established and binding rules and security measures when processing your personal data, and thus we hope that you will not be dissatisfied with our actions towards you.

Nevertheless, should you not agree with the way we process your personal data, we will be happy if you let us know. You may also contact:

Office for Personal Data Protection

address: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic

tel.: +420 234 665 111

web: http://www.uoou.cz/

Information on processing personal data within the Citymove platform

With this document, ŠKODA AUTO DigiLab s.r.o., with its registered office at Želetavská 1525/1, Michle, 140 00 Praha 4, IČO: 05976359, registered in the Commercial Register maintained by the Municipal Court in Prague under File No. C 274001 (hereinafter the “ŠKODA AUTO DigiLab”) as the personal data controller provides you information about the processing of personal data and your rights related to the processing.

Processing takes place within the following activities:

Platform

1. Purpose of processing:  

User registration and account management within the Citymove platform

Description of processing purpose:

We process your personal data so that we can register you as a platform user and continue to maintain your account.

Description of the legal basis for processing:

We must carry out the processing in order to conclude a contract with you, respectively to fulfill the contract you have entered into. The provision of your personal data is necessary for the conclusion of the contract and if you do not provide it, the contract will not be concluded with you or the already concluded contract will not be fulfilled.

Categories of personal data we process:

Identification data; contact information; platform account information; network identifiers; communications, interactions and profiles derived from this data; service usage data; transaction data; evaluation and related communication, including recorded customer support calls (insofar as they relate to registration and account management).

Processing and archiving time:

We process and archive personal data for the duration of the framework contract you have concluded for the provision of our services or for the performance of the obligations arising from the contract.

Categories of other processors or recipients to whom we may provide personal data:

Companies within the Volkswagen Group (ŠKODA AUTO a.s. etc.), IT infrastructure provider for customer support (Spinoco Czech Republic, a.s.), Payment servise provider (ComGate Payments, a.s.), infrastructure operator of the Citymove platform and IT tools and infrastructure providers. 

Origin of personal data:

Directly from you or from your use of the platform.

Automated decision-making:  

Not conducted.

2. Purpose of processing:  

Provision of services through the Citymove platform

Description of processing purpose:

Following your registration within the Citymove platform and ordering services that the platform allows you to order from third parties.

Description of the legal basis for processing:

We must carry out the processing in order to conclude a contract with you, respectively to fulfill the contract you have entered into. The provision of your personal data is necessary for the conclusion of the contract and if you do not provide it, the contract will not be concluded with you or the already concluded contract will not be fulfilled.

Categories of personal data we process:

Identification data; contact information; platform account information; Transaction information (including credit card information necessary to complete transactions) technology and equipment related data; communications, interactions and profiles derived from this data; location data, analytical reports and crash reports of the application with data about a device, operating system and an error. Further, data specific to the fulfillment of a contract concluded through the Citymove platform (e.g. car registration number for parking provided through the MPLA application). The scope of data may vary depending on the services currently offered, but it will be data necessary to use these services.

Processing and archiving time:

We process and archive personal data for the duration of the framework contract you have concluded for the provision of our services or for the performance of the obligations arising from the contract.

Categories of other processors or recipients to whom we may provide personal data:

Companies within the Volkswagen Group (ŠKODA AUTO a.s. etc.); Operators of applications linked to the Citymove platform (e.g.  TSK, DPP, Rekola, Nextbike, Mr.Parkit, BeRider, HoppyGo), Citymove infrastructure operator and IT tools and infrastructure providers; Providers of internal administrative services, Service agencies; Marketing agencies; Analytical and statistical companies.

Origin of personal data:

Directly from you.

Automated decision-making:  

Not conducted.

3. Purpose of processing:  

Records and archiving of personal data of platform users

Description of processing purpose:

In the event that you wish to enter into a contract with us, after the contract is entered into and also after the termination of the contract for example by canceling your registration, we will continue to process your personal data to the extent necessary to achieve the purpose of our protection against any claims against us and the protection of our rights and claims, in particular in court, out-of-court or enforcement proceedings.

Description of the legal basis for processing:

We have a legitimate interest in carrying out this processing. This legitimate interest consists in defending any claims against us and protecting our rights and claims.

Categories of personal data we process:

Identification data; contact information; transaction information (including credit card information necessary to complete transactions) platform account information; network identifiers; communications, interactions and profiles derived from this data; service usage data; evaluation and related communication, including recorded customer support calls; location data.

Processing and archiving time:

We process and archive your personal data for the entire duration of your contractual relationship with us, and for a period of 10 years from the end of the contract.

Categories of other processors or recipients to whom we may provide personal data:

Citymove infrastructure operator and IT tools and infrastructure providers, customer support provider (Spinoco Czech Republic, a.s.).

Origin of personal data:

Directly from you or from your use of the platform.

Automated decision-making:  

Not conducted.

4. Purpose of processing:  

Sending commercial offers for our products and services and receive updates on the Citymove platform

Description of processing purpose:

We process your data in order to keep you informed of news in relation to the Citymove platform. If you are a user of the Citymove Platform, we may from time to time inform you about the Platform's news and updates without your prior consent, as we assume that you may be interested in this information as a platform user.

Description of the legal basis for processing:

We have a legitimate interest in carrying out this processing. This legitimate interest lies in our interest in providing you with up-to-date information and offering you our products and services that are relevant to you and may be of interest to you.

Categories of personal data we process:

Identification data; contact information; platform account information; communications, interactions and profiles derived from this data; service usage data; evaluation and related communication.

Processing and archiving time:

We process and archive your personal data for the entire duration of your contractual relationship with us and for a period of one year from the termination date of the contract.

Categories of other processors or recipients to whom we may provide personal data:

IT tools and infrastructure providers. 

Origin of personal data:

Directly from you or from your use of the platform.

Automated decision-making:  

Not conducted.

5. Purpose of processing:  

Personalized commercial offers of third-party products and services 

Description of processing purpose:

We process your data in order to inform you about third-party commercial offers in case you agree to receive them. The processing includes evaluation of your use of our services , including customization of the offer to your interests, in order to send only commercial offers that are relevant and interesting for you.

Description of the legal basis for processing:

We will perform this processing on the basis of your consent. 

Categories of personal data we process:

Location data,  details of the service used (e.g. information on the use of parking payments), reports containing a device identifier used to count users, displayed offers and campaigns and to analyze their results, and also crash reports with data about device and error.

Processing and archiving time:

We process your personal data as long as we have your consent. You can withdraw your consent at any time via the settings in your profile in the Citymove app and in the email messages sent to you, and further processing will be terminated.

Categories of other processors or recipients to whom we may provide personal data:

Your data is provided to third parties. We process analytical reports in cooperation with our contractual processor. In case you are interested in an offer, you may be redirected to our partner´s website or a different communication channel where processing may occur according to the conditions of this partner.

Origin of personal data:

Directly from you or from your use of the platform.

Automated decision-making:  

Not conducted. Offers are selected automatically according to relevance and predicted interests based on data related to the usage of Citymove services and type of the offer. Showing offers has no substantial impact on you, it is only an opportunity to benefit from the advantages we provide within our services.

6. Purpose of processing:  

Billing services provided by Citymove to business partners and bookkeeping

Description of processing purpose:

We have obligations arising out of certain legislation which we need to fulfill and which consist of processing your personal data. Therefore, we shall process your personal data, but only to the extent necessary and only for the period defined below.

Description of the legal basis for processing:

We process your personal data based on the legal title of the fulfillment of legal obligations, especially in the field of tax and accounting.

Categories of personal data we process:

Identification data; contact information; transaction data; platform account information; service usage data.

Processing and archiving time:

We process and archive your personal data for as long as we are required to do so by applicable law.

Categories of other processors or recipients to whom we may provide personal data:

External tax, accounting, and legal advisors, IT tools, payment service and infrastructure providers.

Origin of personal data:

Directly from you or from your use of the platform.

Automated decision-making:  

Not conducted.

7. Purpose of processing:  

Improvement of provided services, application / web development, creation of analyses, reports and statistics

Description of processing purpose:

We strive to ensure that our services are as good as possible and that our users are always satisfied. We use cookies to determine how our users behave on the web. We also endeavor to offer users services and products tailored to their preferences and usage. If the user gives us consent, we can also collect data from the social networks of the user. Detailed information about the use of cookies can be found on our websites.

Description of the legal basis for processing:

We process your personal data based on the legal title of the legitimate interest of the controller.

Categories of personal data we process:

Identification data; contact information; service usage data(including e.g. home address), device and operating system for troubleshooting; recordings of customer support calls, IP address, IP device, social media login credentials (including photo).

Processing and archiving time:

We process your personal data for the entire duration of your contractual relationship with us.

Categories of other processors or recipients to whom we may provide personal data:

 IT tools, analytics and infrastructure providers

Origin of personal data:

Directly from you or from your use of the platform or the use of Facebook and Google.

Automated decision-making:  

There is no automated decision-making with legal or other similar implications. The processing includes analysis of the use of services and products and marketing activities.

8. Purpose of processing:  

To comply with our legal obligations

Description of processing purpose:

We have obligations under selected legal provisions that we must comply with, which consist of processing your personal data. We will therefore process your personal data, but only to the extent necessary and only for the period of time defined below.

Description of the legal basis for processing:

We process your personal data on the basis of the legal basis of compliance with legal obligations, in particular in the field of tax and accounting.

Categories of personal data we process:

Identification data; contact data; platform account data; service usage data.

Processing and archiving time:

We process and archive your personal data for as long as we are required to process it by the applicable legislation.

Categories of other processors or recipients to whom we may provide personal data:

External tax, accounting and legal advisors; IT infrastructure providers.

Origin of personal data:

Directly from you or from your use of the platform.

Automated decision-making:  

Not conducted. 

What are your rights?

You have the following rights when processing personal data:                            

• Access to processed personal data.
• Correction of inaccurate or incorrect data or completion of incomplete data.
• Deletion of personal data in case of non-existence of purpose or unauthorized processing.
• Restriction or blocking of personal data processing.
• Listing of personal data in a structured and machine-readable format for yourself or another controller.
• Objection to the processing of personal data if you believe that processing is not justified.
• Not to be subject to automated decision making.

How can you exercise you rights?

You can use the following contacts to communicate with ŠKODA AUTO DigiLab concerning personal data protection:

·       Electronically at dpo@skodaautodigilab.com  

·      In writing at ŠKODA AUTO DigiLab s.r.o., Želetavská 1525/1, Michle, 140 00 Praha 4 

In connection with the exercise of your rights, ŠKODA AUTO DigiLab may claim reasonable compensation not exceeding the costs necessary to process the request if such requests are clearly unreasonable or disproportionate.

Data Protection Officer

If you have questions about protection of personal data, you can contact the Data Protection Officer of ŠKODA AUTO DigiLab.

www.skodaautodigilab.com

dpo@skodaautodigilab.com 

Possibility to file a complaint

If you do not agree with the procedure of how we process your personal data, you can file a complaint with the Data Protection Officer of ŠKODA AUTO DigiLab or file a complaint with the supervisory authority to protect your rights.

Office for Personal Data Protection

Pplk. Sochora 27, 170 00 Prague 7         

+420 234 665 111

http://www.uoou.cz/

‍