Information Notice on Personal Data Processing for the Provision of l’Velo Services

The personal data you provide to us are collected and processed by the personal data operator, Green Revolution Association, an association registered and operating under the Romanian law, with its registered office in 21-31 Avrig Street, U2 building, entrance 1, 10th floor, ap. 43, district 2, Bucharest, registered with the Register of Associations and Foundations attached to the Court of the 2nd District of Bucharest under no. 36 dated March 25th, 2009, legally represented by Corneliu Belciug (“AGR” or “We“). 

This information notice concerns all personal data collected by AGR in order to provide a broad variety of products and services made available or promoted by AGR within the I’Velo Project (collectively referred to as the “I’Velo Services“), by means of the Mobile App (“I’Velo App” or “App“) or in other alternative ways as indicated by AGR, in the General Terms and Conditions (“General Terms”).  

For the avoidance of doubt, the terms used in capital letters and not expressly defined in this document shall have the meaning attributed to them under the General Terms. 

For us at AGR, the security and confidentiality of your personal data are of significant importance. Consequently, we shall take all the necessary steps to ensure the security and confidentiality of all the processed personal data, as well as for the processing of personal data in accordance with the applicable legal provisions and exclusively for the purposes specified below. 

Personal data we process 

  • In order to be able to enjoy the l’Velo Services, you will have to be included in our database as a User; a status that is acquired according to the provisions of the l’Velo General Terms and Conditions. For this purpose, we shall collect from you the following personal data, both for your identification, and for the validation of your identity, if applicable: 
  • Identification data: full name, age, place and date of birth, personal number, identity card series and number; address, document issue, date of issue and date of expiry of the identity document;
  • Contact details: telephone number and e–mail address(es) or Facebook account address;
  • Copy of the identity card, in case you have not been a User of l’Velo Services in order to validate your identity, which will be deleted immediately after validation;
  • A photo of your face, in case you have not been a user of l’Velo Services in order to validate your identity, which will be deleted immediately after validation;
  • For AGR employees, videos from I’Velo Centres/I’Velo Stations, collected via the security cameras; 
  • Audio recordings of telephone calls, if you use the call center services.

 

  • As a User, you may at any time access your own unique nominal User account (“User Account“) from the App or from the [My Account] section on the I’Velo Website. Thus, we shall be able to collect, in addition to the above-mentioned personal data, the following information: 
  • A summary (hash) of the access password associated with your User Account;
  • Optional profile information: your job, to the extent that you choose to add it to your User Account, as well as any other type of content that AGR allows you to voluntarily upload to your User Account (e.g. audio-video materials, testimonials);
  • Where applicable, data associated with the User’s Facebook account, insofar as the Facebook account address was used when creating the User Account;
  • Provided geo-location data, collected through the App and history of routes performed using the bicycle or the electrical scooter rented through the l’Velo Service (including speed);
  • Bank card details (in order to make payments by card, if applicable) and other information regarding the transactions carried out; the data processed for this purpose are: (i) the last 4 digits of the card number, (ii) the type of card (Visa, Mastercard etc.), (iii) the expiry month and year.
  • Data regarding the accessed I’Velo bicycle or electrical scooter rental Services (“Rental Services“): information automatically generated upon purchase of a subscription or of a One Pass or Pay per Use permit by the User: the automated I’Velo station (“I’Velo Station” ) or the I’Velo Centre (“I’Velo Centre“) for pick up, the pick-up date and time of a rented bicycle or electrical scooter, the I’Velo Station or the I’Velo Center for returning it, the date and time of the delivery of a rented bicycle or electrical scooter, the duration of the rental (the time interval between the bicycle or electrical scooter pick-up and return), rental history, transaction history regarding the purchase of Rental Services (subscription payments, overdue payments);

Also, through the video surveillance system installed in l’Velo Centres and l’Velo Stations we shall collect video recordings of your person. 

How we collect personal data 

We collect only the personal data you voluntarily provide to us in order to obtain the status of User and, respectively, in order to access the l’Velo Services. Also, when you use the App for accessing the l’Velo Services, certain information from the aforementioned details will be automatically collected or generated by the App, depending on the options you choose or the l’Velo Services you access. 

We hereby inform you that there are no negative consequences for you, should you decide not to provide us with such personal data. However, your identification data and contact details are necessary for us to identify you and for you to be able to access the l’Velo Services, through the App or in any other way. Your other personal data, automatically collected when accessing the l’Velo Services, are strictly necessary for the provision of our services, as it is impossible for us to provide our services without collecting the additional categories of personal data indicated above.  

Purposes and legal grounds for data processing 

The personal data collected from you is processed exclusively for the purposes specified in this Information Notice and only under the legal grounds for processing, as specified by the applicable legal provisions on personal data protection: 

  1.  Acquiring the User status 

 

In order to be able to provide you with Rental Services, we must identify you and include you in our user database. 

For this purpose, your identification data, contact details (including, but not limited to, your e-mail address and phone number), as well as your bank card details shall be processed under the legal grounds of a concluded contract (the l’Velo Contract), all the processed data being necessary for the conclusion and performance of such contract. 

 

If you do not have and never had the status of User, we will also process a copy of your identity card and a facial image of you, in order to validate your identity. The validation is done by an AGR representative, and the copy of your identity card and your facial image will be deleted as soon as your identity has been confirmed. 

When you use the App to access the l’Velo Services, we may also process other personal data belonging to you in order to create your App account, as well as to ensure its use under optimal conditions. The data will also be processed based on the contract concluded between you and AGR (the l’Velo Contract). For this purpose, we shall be able to process your personal data in the following ways: 

  • Validation of your User account, monitoring and improving the security and accuracy of the App operation, including the detection of any unauthorized access to your User account;
  • Granting you access, as a User, to the interactive facilities available in the App interface, respectively for you to be contacted by AGR, depending on the options selected in connection with the installation and use of the App and/or for the purpose of sending specific notifications in the App from the User or to the User, including notifications with regard to the purchased I’Velo Services (e.g. the expiry date of the allowed rental period);
  • Support services provided by AGR, on your request.

When you contact us through the call center, we shall also process audio recordings of our conversation with you, with your consent, expressed prior to the recording, in order to improve our services. You may withdraw your consent at any time, which will lead to the cessation of such processing and the deletion of audio recordings, unless their storage is mandatory under certain legal provisions. 

  1. Accessing the Rental Services 

 

When you access the Rental Services, we will process your identification data, contact details, personal number, bank card details for the purpose of providing the Rental Services (i.e. the conclusion and performance of the I’Velo Contract as detailed in the I’Velo General Terms and Conditions), so that we can provide you with the bicycle or electrical scooter and be able to recover the provided bicycle or electrical scooter, if you do not return it voluntarily, as well as for the payment of any related costs. The processing of your personal data is done under a contract, all the processed data being indispensable for the conclusion and performance of the l’Velo Contract. 

We shall process the automatically generated rental information in order to calculate, process and confirm the payment of the Rental Services you have benefited from, as well as for to manage any future Rental Services (e.g. granting access to the Rental Services subject to confirmation of a subscription payment, maintaining the access to Rental Services during the subscription, which is conditional upon the confirmation of payment of any possible additional costs). 

By creating a User Account, acquiring the User Status and accessing the Rental Services, Users express their consent for the use by AGR of the contact details provided (such as, but not limited to, calling the Users on the provided telephone number, contacting the Users at the provided e-mail address, etc.) for the proper performance of the I’Velo Contract. 

 

  1. Ensuring the security of rented goods 

 

In order to access the Rental Service through the App, it is necessary to enable the location of your device and allow the App to access its location. For this purpose, we will process the geo-location data collected through the App, strictly during the rental period, based on our legitimate interest, in order to: (i) ensure the security and compliant use of the rented goods, in order to prevent or recover them in the case of non-return or theft, (ii) in order to identify your exact location, if you request on-site Support Services from the team designated by AGR (e.g.  interventions to remedy a malfunction on a rented bicycle or electrical scooter), or that of other users, or (iii) receive and send warnings regarding potential obstacles, theft or other incidents encountered or reported by the User on the routes covered with the bicycle or electrical scooter or, depending on the custom settings made by you through the App. 

 

 

3.1 GPS monitoring 

 

The information collected by AGR through GPS is stored on the server managed by the actual providers of the GPS service with which AGR collaborates and/or on AGR’s server. 

 

The information collected by the GPS system includes: date, time, place, history of routes covered with the rented bicycles or electrical scooters through the l’Velo Services (including speed and distance). 

 

The information collected by AGR through the GPS system is permanently accessible, from a technical point of view, with strict and continuous monitoring during the rental time. 

 

Personal data collected through the use of the GPS monitoring system may be disclosed to the authorities, or to the persons designated by AGR, in case of theft. 

 

Access to such data is allowed only to persons authorized by AGR, who will sign a confidentiality agreement concerning the data and the information of which they become aware. 

 

Personal data collected through the use of such monitoring system, shall be stored for a maximum period of 1 (one) year, after the expiry of this term being automatically deleted or anonymised. In the event that the User chooses to record/keep a history of the routes, the personal data collected through the use of this monitoring system will continue to be stored for the period of time specified by the User. 

 

Users have the right to access at any time the personal data concerning their person, collected by AGR through the GPS monitoring system. 

 

We specify that you can at any time opt to access the Rental Service through the l’Velo Urban Card, in which case we will not process your location. 

 

3.2 Monitoring by video means 

The legitimate interest of AGR is to manage (and preserve) its assets and to ensure the safety at the work for its employees and assets. 

AGR processes data regarding the users, AGR’s staff and other subjects who are in the immediate vicinity of I’Velo Centres or Stations, persons who are interested in using the services provided in I’Velo Centres or Stations, in order to monitor the real time flow of persons/users, in order to prevent theft situations and to ensure the protection of AGR’s premises and staff. 

The information collected by AGR through CCTV (closed circuit television) is stored in the memory of the security cameras and the memory is automatically rewritten when the maximum storage capacity is reached. 

The information collected through CCTV includes: date, time, location and images captured with video cameras. 

The information collected by AGR through the CCTV system is accessible at all times, from a technical point of view, with continuous monitoring. AGR can transfer the data collected in the event that the information collected through the CCTV helps either the criminal investigators, in case of a possible crime or AGR, in case of destruction, deterioration of assets, as well as in the case of fire, earthquake, flood or other similar situations, if the collected data is required by a criminal prosecutor or by AGR (including in relation to third parties). 

Access to such information is only allowed to persons authorized by AGR, who will sign a confidentiality agreement for the data and information they process. At the same time, the job description of the authorized persons will include specific confidentiality obligations. 

The personal data collected through the use of this monitoring system shall be stored for a maximum period of 1 (one) month. 

The users have the right to access, at any time, the personal data concerning their person, collected by AGR through the CCTV monitoring system. 

The l’Velo Centres and Stations, where this type of monitoring is carried out, are marked by a specific icon. 

  1. Marketing and bonuses

If you express your consent, we shall be able to process your personal data for direct marketing purposes, in order to send you promotional offers regarding our or our partners’ products and services, as well as to send you information and/or newsletters regarding various events, campaigns and initiatives aligned with the purposes of AGR. You can withdraw, at any time, your consent regarding such processing either by e-mail to ivelo@greenrevolution.ro, directly from your User Account or via the App, and AGR shall cease any processing of your personal data for direct marketing purposes. We shall also be able to process your personal data based on our legitimate interest, in order to grant you certain bonuses or benefits, at AGR’s discretion and based on the criteria established by the latter. 

 

  1. Providing custom services

We shall process the geo-location data based on your consent given in the App settings for the purpose of identifying and recommending locations/routes of general interest. The geo-location data shall be anonymized.  

Also, after returning the bicycle or the electrical scooter to one of the l’Velo Stations, you can choose to save the route in your User Account. Otherwise, the data concerning the route shall be anonymised and processed exclusively for statistical purposes. 

Also, we shall process your optional data based on your implicit and unequivocal consent, manifested by voluntarily entering such data into the App and/or granting the relevant permissions to the App, in order to improve the security and accuracy of the I’Velo Services offered by the App and of its operation as well as in order to customize the services offered by the App according to the preferential settings selected by you. 

You may, at any time, withdraw your consent to such processing and request deletion of all data by submitting a request to ivelo@greenrevolution.ro. Consequently, AGR shall cease any processing of your personal data for this purpose. 

 

  1. Processing of statistical data

The geo-location data (collected according to item 3 or item 5 of this section), the rental details and the data regarding the device on which the App is used, shall be sent to AGR and shall be used exclusively for statistical purposes, to improve the technical performance of the App and the services offered by AGR. 

The data processed for statistical purposes shall be anonymized and processed in a way that does not allow your identification in any form. 

Since you are entitled to know the purpose for which we process your personal data, we will inform you before processing your personal data for any purpose other than those for which you have entrusted us with your personal data, unless this subsequent purpose is incompatible with the initial purpose, in which case we will ask for your consent for any subsequent processing activities. 

Moreover, we adequately protect your interests, rights and freedoms. The personal data is stored in a secure location and protected during transit. Data that is no longer needed to reach a certain goal is deleted. 

 

Minimization of personal data 

Collecting your personal data is limited to what is strictly necessary to achieve the purposes mentioned above. 

 

Storage duration 

Your identification and contact details shall be stored for the entire duration of the l’Velo Contract, that is, for the entire period during which you will retain your User status. 

The personal data provided by you voluntarily in the App, as well as the personal data automatically generated by the App, shall be stored for the entire duration of your use of the App, but not more than 2 (two) years from the last use of the Rental Services. In any case, you will be notified 5 (five) days before the expiry date regarding the deletion of your personal data, and unless you log in to your User Account prior to the expiration of this period, they will be automatically deleted. You can delete the optional data provided, as well as the data concerning the routes travelled, at any time from the relevant App interface. 

The bank card details can be kept for the duration you selected at the time of making the first payment and registering your bank card to the App, should you choose to save the card data in the App, being automatically deleted at the end of the relevant period. Also, the video and audio recordings of our calls with you shall be stored for a maximum of 30 days from the moment of the recording and automatically deleted at the end of such period. 

Your personal data will be processed for direct marketing purposes and for the purpose of providing customized services, for a period of at most 2 (two) years from the moment you gave your consent for this purpose, being automatically deleted upon expiration of such period. If you withdraw your consent for the processing of personal data for direct marketing purposes or for the provision of customized services, at any time, we will cease any processing activity for this purpose and we will proceed to delete the personal data processed, as soon as possible, but not later than 30 (thirty) days, except for the personal data whose processing is necessary for the use of the App or the performance of the contract concluded with AGR.  

For the same purpose, if the storage of other personal data is required under express legal provisions, we may continue to store your personal data for the duration provided by those legal provisions. 

 

Recipients of personal data 

Your card details will be sent to our payment processor, for the purpose of processing payments by card for purchasing the l Velo Services. Also, the personal data collected through the App may be transferred abroad, in the European Union, for technical reasons related to the functioning of the App. AGR has concluded with the authorized persons a contract containing mandatory clauses regarding the security, integrity and confidentiality of your personal data. 

To the extent you grant us your consent, your contact details will be forwarded to Raiffeisen Bank S.A., for marketing purposes, so that they may send you offers and other promotional messages regarding products and services. 

We shall not disclose or transfer your personal data to other persons, except where their disclosure or transfer is mandatory under imperative legal obligations, in which case we will inform you as soon as possible about such transfer. 

 

Security of personal data 

For us at AGR, the security and confidentiality of your personal data are very important. Consequently, we will take all necessary steps to ensure the security and confidentiality of the processed personal data. The security measures implemented are in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and with Law no. 190/2018 on the rules of implementation of the General Data Protection Regulation. Should we discover an incident regarding the security of personal data that presents a risk to your rights and freedoms, we shall notify the National Supervisory Authority for Personal Data Processing (ANSPDCP) within 72 hours from the date on which AGR became aware of such situation. You will also be personally informed of any security incident, if it is likely to present a high risk to your rights and freedoms. 

 

Know your rights 

You have the following rights regarding the processing of personal data concerning your person: (1) the right of access to personal data; (2) the right to rectification or deletion of personal data; (3) the right to restriction of personal data processing; (4) the right to personal data portability; (5) the right to object when processing personal data. 

 

Exercise your rights 

The data protection officer within AGR is Mr. Corneliu Belciug, having the following contact details: 

  • postal address: 2 Intrarea Valului Str., district 1, Bucharest
  • phone number: 021 327 57 78
  • e–mail address: office@greenrevolution.ro

 

Should you have any questions regarding the processing of your data, or if you would like to send us a request, as well as to exercise any of your rights regarding the processing of personal data, please contact us at: ivelo@greenrevolution.ro, via telephone at 021 327 57 78 or at our location situated at 2 Intrarea Valului Str., district 1, Bucharest. 

We will review each request as soon as possible, but not later than one month. If we need more information from you or we have difficulty in resolving your request, we will inform you without delay that we need additional time to properly analyse your request. 

If you feel that we have not solved all your requests or you are dissatisfied with our responses, you can submit a complaint against us to ANSPDCP. You can also refer the matter directly to the competent courts. 

Thank you for entrusting us with your personal data and for taking the time to read the information on how we process such data. Please feel free to contact us if you have any questions. 

 

o I hereby declare that I am aware of the provisions of this Information Notice on the processing of my personal data. 

o I hereby agree with the processing of my geo-location data for the purpose of providing customized services and I am aware of the provisions of this Information Notice on the processing of my personal data for this purpose. 

 

o I hereby agree with the processing of my contact data for direct marketing purposes and I am aware of the provisions of this Information Notice on the processing of my personal data for direct marketing purposes. 

 

o I hereby agree that my contact details be transferred to Raiffeisen Bank S.A. for direct marketing purposes, in order to receive offers and other promotional materials regarding the services and products offered by them.