Through this Privacy Policy, 1C2F informs Data Subjects about how their Personal Data is processed on the City-Drop Application and Site and about the specific rights that can be exercised.
This Privacy Policy is an integral part of the GCR and the GCU. (available here https://www.city- drop.com/en/terms-of-use/), so the definitions used in the GCR and GCU are reused in this Privacy Policy.
2. Definitions
The following terms, whether used in the singular or plural in this Privacy Policy, shall have the meanings set forth in the GCU, the GCR or, if not set forth in the GCU, the GCR, or otherwise, shall have the following meanings:
Intermediate Storage: means the movement of Personal Data that have for 1C2F an administrative interest (such as in case of litigation and/or legal obligation) in a separate database, logically or physically separate and in any case with restricted access. This archive is an intermediate step before the deletion of the Personal Data concerned or their anonymization;
Recipients refers to all subcontractors, joint managers and recipients of Personal Data processed by 1C2F.
Affected Person means any lessee, driver, prospect, or any other person who can be identified, directly or indirectly, whose data are processed by 1C2F in the course of its activity.
Data controller Refers to the simplified joint stock company 1C2F, a company with a capital of 440,330 euros, whose registered office is located at 4 rue du Port aux Vins 92150 Suresnes, France, also known as the Renter.
Regulation on Personal Data : means the Law n°78-17 of January 6, 1978 relating to data processing, files and freedoms, relating to the protection of personal data, in application of the Community Regulation of April 27, 2016 published in the Official Journal of the European Union on May 4, 2016 relating to the protection of individuals with regard to the processing of personal data and to the free movement of such data (known as "RGPD" for General Data Protection Regulation). 3. Description and purposes of the Processing
The Personal Data of the Data Subjects are processed on the Application and on the Site to carry out the following treatments:
Personal data processed
Goals
Legal basis
Data identification data (last name, first name, e- mail address, telephone number, postal address, date and place of birth, account ID, profile (personal or professional);
If applicable, the identification data of of the additional driver(s): last name, first name, email address, telephone number, postal address,
Driver's license number and that of any additional driver(s);
Date driver's license obtained;
Driver's License Issuing Agency;
Copy of driver's license ;
Copy of a valid identity document (if necessary)
Account Activity Data;
Data Financial data (invoice) ;
If applicable, data on traffic violations;
IP address;
Data relating to navigation on the Website and the Application;
Data concerning satisfaction surveys or coming from the interactions of the Person Concerned on the dedicated pages and/or social networks;
Data voice, audiovisual and electronics: the recordings communications by e-mail, chat or telephone with our customer service department;
Connected vehicle data: vehicle status, damage or accident information, vehicle performance data operational and diagnostic data, mileage information, acceleration and braking rates, fuel consumption and levels, tire pressure, odometer readings, vehicle location, and odometer readings, vehicle location, and and other vehicle information;
Data to support consent and reading of documents
Vehicle rental
Execution of the contract between the Person concerned and 1C2F
Execution of the contract between the Person concerned and 1C2F
Legal obligations
Execution of the contract between the Person concerned and 1C2F
Management of the commercial relationship with the Person concerned
Infringement management
Management in case of disaster, breakdown, accident
Claims management
Execution of the contract between the Person concerned and 1C2F
Development of business statistics, analysis and marketing tools (including classification, scoring, etc.)
Legitimate interest
Management of the files of follow- up of the persons at risk having for consequence the refusal of rent to the concerned persons
Legitimate interest
Management exercise of specific rights
Legal obligations
Execution of the contract between the Person concerned and 1C2F
Management of unpaid bills and disputes
Fight against fraud and intrusions on the Application
Legitimate interest
Management of the rental process (delivery, collection, vehicle maintenance, invoicing, etc.)
Ensure compliance with the obligations set forth in the Rental Agreement (e.g., if the Vehicle is not returned at the end of the defined rental period, or if the Vehicle is used outside of the authorized geographical area).
Online notification management
Execution of the contract between the Person concerned and 1C2F
Vehicle Location Data
Ensure the point of departure and arrival of the rented Vehicle, check that the Vehicle has not left the Schengen area (fleet management).
Execution of the contract between the Person concerned and 1C2F
Recover vehicles in case of theft.
Legitimate interest
Assisting tenants (e.g., finding a garage, a parking space, in case of a breakdown/accident).
Execution of the contract between the Person concerned and 1C2F
The Company collects most of the Personal Data directly from the Data Subjects, but it may receive data from third parties, in particular from the authorities in charge of the management of fines related to traffic violations.
The Company also collects data related to cookies and other similar technologies, in accordance with à the policy in policy of cookies ://www.city-drop.com/en/data-protection>.
4. Data retention
The Personal Data processed in order to meet contractual obligations are kept for the duration of the commercial relationship in active storage and five (5) years after the end of it in intermediate storage, with the exception of telephone conversations recorded during a call made by the Person Concerned with the switchboard which are kept for a period of six (6) months.
Personal Data processed for the purpose of managing infractions are kept for a period necessary to identify the driver, up to a limit of 45 days, and kept in Intermediate Storage for an additional period of one (1) year. Personal Data is also kept for an additional five (5) years for misdemeanors.
The Personal Data related to the management of unpaid invoices are kept in an active database until the unpaid invoice is settled and are deleted within forty-eight (48) hours following the settlement of the invoice by City-Drop or from the moment when the unpaid invoice is actually settled. In the event of non-recovery, the personal data will be kept for a maximum of five (5) years from the date of the outstanding payment.
Personal Data related to the location of Vehicles are kept for the following purposes:
to ensure the departure and arrival point of the rented Vehicle: City-Drop uses the geolocation of the Vehicle to ensure the parking location agreed with the Renter. If City- Drop is aware of the Renter's intention to return the Vehicle to another location than the one previously agreed, it will activate the geolocation system to manage this situation.
to find the Vehicle in case of theft: the location data are collected from the declaration of theft, then for the time of the investigation of the case by the competent legal authorities or until the end of a procedure of removal of doubt not leading to the confirmation of the theft of the vehicle. In case of theft, the geolocation data related to these procedures are kept in an intermediate archive by City-Drop in order to constitute a proof in case of litigation and within the limit of the applicable prescription period.
to assist the Renter (e.g. to find a garage, a parking place, in case of a breakdown/accident): location data are collected only when the Renter requests City- Drop's assistance.
The financial Personal Data meeting the accounting and tax obligations (invoices and amount of the transactions carried out as well as the date and time of these transactions) are kept for two (2) years in an active base as from the end of the contractual relationship and then for an additional period of eight (8) years in the Intermediary Archive.
The Personal Data collected in the context of the publication of online notices and the elaboration of commercial statistics are kept until the exercise of the data subject's right of objection.
The Personal Data processed in the context of files for monitoring persons at risk, for exercising specific rights and in the event of the fight against fraud are kept for a period of five (5) years.
5. Storage of Personal Data
The City-Drop Site is hosted by Amazon Web Services (Amazon.com Legal Department - 410 Terry Avenue North, Seattle, WA 98109-5210, USA).
Every precaution has been taken to store the Data Subject's Personal Information in a secure environment and to prevent it from being distorted, damaged or accessed by unauthorized parties. The information provided by the Data Subject will never be passed on to third parties for commercial purposes or sold or exchanged without his/her consent.
6. Recipients or categories of recipients if they exist
The Personal Data processed on City-Drop are accessible to certain employees in order to best meet the above-mentioned purposes, but also to authorized external Recipients for the provision of the service.
Name of Recipient
Country of establishment of the recipient of the data
Nature of the data transferred
Purpose of the proposed transfer
Categories of data recipients
Level of protection offered by the country or exception provided by the Personal Data Regulation
Amazon Web Services Europe
Europe
Personal Data collected from the Site (connection logs, personal data relating to the Account, online reviews, etc.)
Hosting of the City-Drop website
Subcontractor
Appropriate
Ariadnext SAS
France
Name, first name, sex, date and place of birth and driver's license number and that of any additional driver(s); Date driver's license obtained; Driver's license issuing agency; Copy of driver's license ;
Verification of the authenticity of the driver's license transmitted by the Renter; Vehicle rental; Management of infractions; Management of claims, breakdowns and accidents
Subcontractor
Appropriate
Stripe
Ireland
Identification data, payment information and bank data (payment card number, CVC code and expiration date) IP address; data of navigation
First Name, Last Name, Language Date of Birth Address electronic CustomerID, Date/time of travel GPS position Vehicle status Door status Battery status Kilometers driven Fuel level Number of satellites communicating with the Vehicle Account history Trip analysis data, Vehicle identification data / number Vehicle on- board system identification data (Vubox) Free vehicle geolocation analysis data
Tool to geolocate the Vehicle
Subcontractor
Appropriate
OVH
France
Personal Data collected from the Application (connection logs, parking of the Vehicle, etc.)
Use of the solution of electronic signature designated “Universign”
Data controller and Co-responsible
Appropriate
Message Bird
USA
Phone number
SMS sending solution
Subcontractor
Appropriate
Ringover
France / EU
Phone number, Recording of conversations
Telephone switchboard management tool
Subcontractor
Appropriate
Twilio/Sendgrid
USA
E-mail address
Mailing tool electronics
Subcontractor
Appropriate
7. Specific rights
1.Right of access
The Data Subject shall have the possibility to obtain from 1C2F the confirmation that Personal Data concerning him/her are or are not processed and, when they are, access to said Personal Data as well as the following information:
the purposes of the processing ;
categories of Personal Data;
the recipients or categories of recipients to whom the Personal Data have been or will be disclosed;
where possible, the period of time for which Personal Data is to be retained or, where this is not possible, the criteria used to determine this period;
the existence of the right to ask 1C2F for the rectification or deletion of Personal Data, or a limitation of the processing of its Personal Data, or the right to object to such processing;
the right to lodge a complaint with the CNIL;
where Personal Data is not collected from the Data Subject, any available information as to its source;
the existence of automated decision-making, including profiling, and, at least in such cases, relevant information about the underlying logic and the significance and intended consequences of such processing for the Data Subject.
Where Personal Data is transferred to a third country or to an international organization, the Data Subject has the right to be informed of the appropriate safeguards with respect to such transfer.
1C2F provides a copy of the Personal Data being processed.
1C2F may charge a reasonable fee based on administrative costs for any additional copies requested by the Data Subject.
Where the Data Subject submits a request electronically, the information shall be provided in a commonly used electronic format, unless the Data Subject requests otherwise.
The Data Subject's right to obtain a copy of his or her Personal Data shall not infringe upon the rights and freedoms of others.
2. Right of rectification
The Data Subject has the right to obtain from the Data Controller, as soon as possible, the rectification of Personal Data concerning him/her that are inaccurate. He/she also has the right to have incomplete Personal Data completed, including by providing an additional declaration.
3. Right to erasure
The Data Subject shall have the right to obtain from 1C2F the erasure, as soon as possible, of Personal Data concerning him or her where any of the following grounds apply:
Personal Data are no longer necessary for the purposes for which they were collected or otherwise processed by 1C2F ;
The Data Subject has withdrawn his or her consent to the processing of such Personal Data and there is no other legal basis for the processing;
The Data Subject exercises his/her right to object in the conditions recalled below and there is no compelling legitimate reason for the processing;
The Personal Data has been processed unlawfully;
Personal Data must be deleted to comply with a legal obligation;
The Personal Data was collected from a child.
4. Right to limitation
The Data Subject has the possibility to obtain from 1C2F the limitation of the processing of his/her Personal Data when one of the following reasons applies:
1C2F verifies the accuracy of the Personal Data following the challenge by the Data Subject of the accuracy of the Personal Data;
The processing is unlawful and the Data Subject objects to the erasure of the Personal Data and demands instead the limitation of its use;
1C2F no longer needs the Personal Data for the purposes of the processing, but it is still necessary for the Data Subject for the establishment, exercise or defense of legal claims;
The Data Subject has objected to the processing under the conditions recalled below and 1C2F verifies whether the legitimate reasons pursued prevail over the alleged reasons.
5. Right to Data Portability
The Data Subject has the possibility to receive from 1C2F the Personal Data concerning him/her, in a structured, commonly used and machine-readable format when the processing of the Personal Data is based on consent, or on a contract and the processing is carried out using automated processes. The Data Subject exercises his right to portability, he has the right to obtain that the Personal Data be transmitted directly by 1C2F to another Processor that he will designate when technically possible. The right to portability of the Personal Data of the Data Subject shall not infringe the rights and freedoms of others.
6. Right to object
The Data Subject may object at any time, on grounds relating to his or her particular situation, to the processing of Personal Data concerning him or her based on the legitimate interests of 1C2F. The latter will then no longer process the Personal Data, unless it can demonstrate compelling legitimate grounds for the processing that override the interests and rights and freedoms of the Data Subject, or may retain them for the establishment, exercise or defense of legal claims.
7. Post-Mortem Instructions
The Data Subject has the possibility to communicate to 1C2F directives concerning the conservation, deletion and sharing of his/her Personal Data after his/her death, which directives may also be registered with a "certified digital trustworthy third party". These directives, or a sort of "digital will", may designate a person in charge of their execution; failing that, the heirs of the Person concerned will be designated.
In the absence of a directive, the heirs of the Person concerned may contact 1C2F in order to :
to access the processing of Personal Data for the "organization and settlement of the estate of the deceased";
receive communication of "digital assets" or "data similar to family memories, which can be transmitted to heirs";
to close the account of the Person concerned on the Application and to oppose the continuation of the processing of his/her Personal Data.
In any case, the Person concerned has the possibility to indicate to 1C2F at any time that he/she does not wish, in case of death, that his/her Personal Data be communicated to a third party.
8. Exercise of the specificities of the persons concerned
The Rights can be exercised, at any time, with 1C2F :
By e-mail to t h e following address: [email protected]specifying the subject of the request;
By post, specifying the subject of the request at the following address City- Drop, 4 rue du Port aux Vins, 92150 Suresnes, France.
In order to assert its rights under the conditions mentioned above and in the event that 1C2F has doubts about the author of the request, 1C2F may ask the latter to prove his identity by mentioning his name, first name, e-mail address and to accompany his request with a copy of a valid identity document.
A reply will be sent to the Person Concerned within a maximum of one (1) month following the date of receipt of the request.
If necessary, this period may be extended by two (2) months by 1C2F, which will inform the Person Concerned, taking into account the complexity and/or the number of requests.
In the event that the Data Subject requests the deletion of his or her Personal Data and/or exercises his or her right to request the deletion of his or her Personal Data, 1C2F may, however, retain the Personal Data in the form of an Intermediate Archive for the period necessary to meet its legal obligations, or for evidentiary purposes during the applicable statute of limitations.
The Person Concerned may also lodge a complaint with the competent control authority (the CNIL).