Privacy Policy

1 Introduction

This privacy policy aims to inform users of the IDEFLEET platform about the collection and processing of their personal data.

This document is drafted in accordance with EU Regulation No. 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, known as the "GDPR".

Personal data is considered to be any information that allows the identification of a user directly or indirectly. This may include: their first and last names, email, or location (non-exhaustive list).

1.1 Vehicle Owners

The owners of vehicles made available for rental and users of the IDEFLEET platform as fleet managers are referred to in this privacy policy as "our partners" or "the partner."

1.2 Data Controller

In the sense of the GDPR, the Data Controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

The data controller resulting from the use of the IDEFLEET platform is the partner.

The partner has determined the IDEFLEET solution as the means of collecting and processing personal data on their behalf.

The company IDEMOOV, SAS with a capital of €1,150,500.00, registered under Strasbourg B 830 613 808, as the publisher and host of the IDEFLEET solution, acts as the data processor for personal data on behalf of the partner.

For any questions regarding the processing of personal data resulting from the use of the IDEFLEET solution, the user is invited to consult this Privacy Policy or contact the Partner with whom they are contractually bound.

The personal data processor IDEMOOV can also be contacted as follows at the postal address: IDEMOOV SAS, 1C Rue Pégase 67960 Entzheim France, or via [email protected] or at 03.67.22.02.79.

1.3 Data Protection Officer

The Data Protection Officer of the processor IDEMOOV is OLOWOLAGBA Man Su, who can be reached at the postal address: MD6 CONSULTING SAS, 1C Rue Pégase 67960 Entzheim France, or via [email protected] or at 03.88.55.00.28.

If you believe, after contacting us, that your data protection rights are not being respected, you can file a complaint with the CNIL, 3 Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 7, phone: 01.53.73.22.22, or cnil.fr.

2 Collection and Processing of Data During the Use of Our Platform

In accordance with Article 5 of the European Regulation 2016/679, personal data shall be:

• Processed lawfully, fairly, and transparently in relation to the data subject;
• Collected for specified, explicit, and legitimate purposes presented in this privacy policy and not further processed in a manner incompatible with those purposes;
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

Processing is lawful only if, and to the extent that, at least one of the following applies:

• The data subject has given consent to the processing of their personal data for one or more specific purposes;
• Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
• Processing is necessary for compliance with a legal obligation to which the controller is subject;
• Processing is necessary to protect the vital interests of the data subject or another natural person;
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

We process data in the context of rental for the following purposes:

• Management of the rental contract to establish and manage the contract, including identity verification and the authorization to drive a vehicle.
• Management of the rental service, including making the vehicle available, managing reservations, and rental durations.
• To determine if a vehicle is in a respective operational zone defined by our partner or if the rental end will take place outside the operational zone, as this would be contrary to these general conditions. In such cases, vehicles may trigger an audible alert ("geofencing").
• In case of abnormally long usage duration (especially if the vehicle is not moved), we may terminate the rental.
• For requests addressed to our customer service (e.g., a reservation cannot be made, a vehicle cannot be located, assistance service in case of an accident).
• As evidence in case of an accident or damage.
• For billing purposes. We record in your booking history the starting and ending points of your trips as well as parking locations, if applicable.
• To improve our services by analyzing aggregated statistics of where users make reservations and end their journeys, as well as frequent routes, so our partners can optimize vehicle distribution.
• Fraud prevention and security against abuse and crime.
• Management of damages and accidents during the rental period.

2.1 Registration

To access our services, creating an account is mandatory and requires the following personal data: name(s), first name(s), and email address. These data will be linked to your identity.

2.2 Collection and Processing of Data During the Use of the Application

2.2.1 Application Permissions

To use our services, it is necessary to access certain features of your device, commonly referred to as "permissions". Depending on your operating system, you must explicitly grant these permissions, and you also have the option to revoke them individually at any time. The data accessible through these permissions will be used exclusively for purposes specified in this privacy policy. Camera: Access to the camera function is required to scan the QR code on the vehicle before any rental. Camera access is also required when reporting a claim if you wish to attach one or more photos. Location: We need information about your location to show you the proximity of vehicles. Additionally, we process these location data when you use the application or rent a vehicle, to improve our services and personalize them according to your needs. However, location is not collected continuously, only when necessary, specifically at the time of vehicle pickup, at the time of return, in case of roadside assistance, or in case of theft or suspected theft.

The legal basis is Article 6, paragraph 1, letter b of the GDPR, as the data processing serves to provide the functionalities of the application and our services.

2.2.2 Google Maps

The IDEFLEET platform uses the Google Maps API applications, a service provided by Google Ireland Ltd., Google Building Gordon House, Barrow Street, Dublin 4, Ireland. It allows the use of interactive maps on our application, for example. This application is essential for the functionality and full provision of our content and services. You can view Google’s terms of use at: https://www.google.com/intl/de/policies/terms/.

Additional terms of use for Google Maps can be viewed here: https://www.google.com/help/terms_maps.html.

Google’s privacy policy is available at: https://www.google.com/intl/de/policies/privacy/.

The legal basis is Article 6, paragraph 1, letter b of the GDPR, as the data processing serves to provide the functionalities of the application and our services.

2.3 Collection and Processing of Data During Vehicle Rental

When you rent a vehicle, we collect and process additional data via our application and the connected objects of the vehicles. The legitimacy of this collection is based on Article 6, paragraph 1, letter b of the GDPR, as the data processing is necessary for the performance of the rental contract. In other cases, this collection is based on Article 6, paragraph 1, letter f of the GDPR, based on our legitimate interest to ensure continued functionality and security, as well as for the constant development of the application and our services.

2.3.1 Data Collection in Our Application

When you rent a vehicle, we record the location of your device at the beginning and end of the rental. Given the conclusion of a rental contract for each transaction, we also save the usage period and the details of the rented vehicle. These data are primarily used for billing purposes related to the rental.

2.3.2 Data Collection by Our Vehicles

Our partners' vehicles are equipped with what are called "IoT connected objects" that send data (including personal data) to us via GSM networks. We collect these data during vehicle operation. More specifically, we collect the following information during the rental:

• Location (GPS coordinates)
• Diagnostic data (e.g., battery level, vehicle distance traveled, rental start and end times, and vehicle usage behavior data)
• We may collect photos, such as those taken after an incident or before a rental period for damage documentation.
• In addition, during the rental period, we process your data from the identity document you provided during registration to verify your identity.

These data are primarily used for:

• Managing the rental contract and vehicle availability
• Supporting customers in case of incidents or requests
• Improving service through data analysis
• Ensuring the safety and security of the service by monitoring vehicle location
• Managing billing and preventing fraud
• Resolving disputes in case of damage to the vehicle

3 Data Transfer

We only transfer your data to third parties within the scope allowed by data protection law or with your explicit consent. We do not transfer your data to third parties for advertising purposes.

We use the following categories of recipients for data processing:

• Partners providing hosting services for our servers and databases
• Providers of analysis tools for evaluating user behavior in our application
• Service providers for sending emails and notifications
• Providers of payment services to process your payments

Your data will be processed only within the European Union or the European Economic Area.

4 Data Security

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

These measures include:

• Regular updates and audits of our security policies and procedures
• Encryption of sensitive data
• Access control systems to restrict access to data
• Security measures for our servers and networks
• Training and awareness programs for our employees

5 Your Rights

You have the following rights regarding your personal data:

• Right of access: You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, if so, to access the personal data and information about their processing.
• Right to rectification: You have the right to request the correction of inaccurate personal data and to have incomplete personal data completed.
• Right to erasure: You have the right to request the deletion of your personal data under certain conditions.
• Right to restriction of processing: You have the right to request the restriction of processing of your personal data under certain conditions.
• Right to data portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller without hindrance.
• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, including profiling.
• Right to withdraw consent: You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, please contact our Data Protection Officer or the partner you are contractually bound to. You also have the right to lodge a complaint with a supervisory authority, such as the CNIL.

6 User Rights

Any user concerned by the processing of their personal data may exercise the following rights, in accordance with European Regulation 2016/679 and the French Data Protection Act (Law 78-17 of 6 January 1978):

• Right of access, rectification, and erasure of data (Articles 15, 16, and 17 of the GDPR);
• Right to data portability (Article 20 of the GDPR);
• Right to restriction (Article 18 of the GDPR) and objection to data processing (Article 21 of the GDPR);
• Right not to be subject to a decision based solely on automated processing;
• Right to determine the fate of data after death;
• Right to contact the competent supervisory authority (Article 77 of the GDPR).

The aforementioned rights may be limited in certain circumstances:

The right to erasure may be limited if the processing is necessary for compliance with a legal obligation, for reasons of public interest, or for the defense of legal claims.

The right to object may be limited in case of legitimate and compelling reasons of the data controller, or for the establishment, exercise, or defense of legal claims.

The right to data portability applies only to automated processing, and to data that you have declared or that have been collected by your use of the service and based on your consent or the existence of a contract. This right is always subject to practical and technical considerations that may limit portability.

To exercise your rights, please send your request to our partner, the data controller providing you the service, who will forward the request to IDEMOOV SAS for assistance in the process.

In order for the data controller to process the request, the user may be required to provide certain information such as their full name, email address, and proof of identity.

Visit cnil.fr for more information about your rights.

7 Changes to the Privacy Policy

The editor of the IDEFLEET platform reserves the right to modify this policy at any time to ensure that users of the site comply with current legislation. Any changes will not affect purchases previously made on the site, which remain subject to the policy in effect at the time of purchase and as accepted by the user when validating the purchase.

Users are invited to review this policy each time they use our services, without the need for formal notification.

This policy, published on 22/04/2024, was updated on 03/06/2024.