3. COOKIES AND OTHER ELECTRONIC DATA

3.1. Basic Cookie Files: These cookie files are strictly necessary to provide you with the services available through our websites and to use some of their features. Since these cookie files are strictly necessary for the basic functioning of the websites, you cannot refuse them without affecting how our websites function. You can block or delete them by changing your browser settings and blocking all cookies on this website.

Google Analytics Cookies: These cookie files collect information used either in aggregate form to help us understand how our website is being used or how effective our marketing campaigns are, or to help us customize our website and application for you in order to enhance your experience. If you do not want your visits to our site to be tracked, you can disable tracking in your browser.

Other External Services: We also use various external services such as Google Web Fonts, YouTube, Google Maps, OpenStreetMap to display precise locations of bike stations. Since these providers may collect personal data like your IP address, we allow you to block them on our website. Please be aware that this might heavily reduce the functionality and appearance of our site. Changes will take effect once the page is reloaded.

3.2. Server Data: When you visit our website bikekia.sk, your web browser provides data to our Company or our website manager, including the type of web browser you are using, the type of your operating system, data about the website you are visiting from, the websites you visit, the date and time of your access, and your IP address.

3.3. Social Network Plugins: We do not use social network plugins (modules) on our website bikekia.sk.

4. PURPOSES OF PROCESSING PERSONAL DATA (WHY WE HAVE YOUR PERSONAL DATA) AND LEGAL BASIS FOR PROCESSING (ON WHAT BASIS WE HAVE YOUR PERSONAL DATA)

4.1. Personal Data for Specific Purposes: When providing our services, we always process your personal data for a specific pre-determined purpose, with each purpose requiring only certain personal data from you. On the other hand, if you do not provide the necessary personal data for a specific purpose, our Company may not be able to provide the relevant service, or it may only be able to provide it to a very limited extent, which may not be desirable for you in the end.

4.2. Purposes of Processing and Relevant Legal Basis: We process your personal data for the following purposes and based on the following legal grounds:

4.2.1. For the Purpose of Bike Rental (Based on Contract Performance and Pre-contractual Relations): This involves the processing of your identification, contact, location, and transaction data for the purpose of renting a bicycle (BikeKIA) and registering customers in the BikeKIA system (via the website, mobile application, telephone, terminal, or other means). The processing of your personal data is carried out based on the concluded rental agreement (BikeKIA) for the bicycle, as well as within the framework of pre-contractual relations preceding the conclusion of the rental agreement. By creating a BikeKIA account through our website, mobile application, or other means, you provide personal data to our Company as part of pre-contractual relations preceding the rental agreement.

4.2.2. Marketing Purpose (Based on Consent and Legitimate Interest): This primarily includes direct marketing, sending newsletters, customer satisfaction assessment, sending offers and advertisements for products and services offered by our Company, as well as products and services offered by companies in the Arriva group, including various competitions. We process your identification and contact personal data for this purpose based on:

4.2.3. Enforcement of Our Company’s Legal Claims (Based on Legitimate Interest): This involves processing mainly identification and contact personal data for the purpose of enforcing our Company’s legal claims against customers (debtors) in judicial, non-judicial, arbitration, administrative, enforcement, bankruptcy, and restructuring proceedings. Our Company necessarily requires the personal data concerned to effectively assert its legitimate claims and rights. Regarding the processing of personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below.

4.2.4. Complaints and Claims (Based on Legitimate Interest): This involves processing mainly identification and contact data of our customers and other individuals who submit complaints and claims related primarily to bicycle rentals. Since our Company has a significant interest in the satisfaction of our customers, our Company processes personal data for this purpose to be able to properly respond to these complaints and claims and provide remedies if certain complaints are justified. Additionally, our Company must be able to demonstrate the handling of complaints and claims, which is also overseen by the relevant supervisory authorities. Therefore, for the purpose of record keeping, we maintain these complaints and claims for a necessary period. Regarding the processing of personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below.

4.2.5. Identification and Contact Data (Based on Legitimate Interest): This involves processing identification and contact personal data of representatives of legal entities and other individuals that we obtain from publicly available sources designated for this purpose, directly from these individuals, or from other individuals (e.g., in person, via email, or through our forms and chats on our website bikekia.sk). Our Company requires this data to establish contact with other legal entities and individuals for the proper functioning of our Company and to provide you with information related to our Company, bicycle rentals, or other services and products of our Company and Arriva group companies, as requested. Regarding the processing of personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below.

4.3. General Information Regarding Processing Personal Data Based on Legitimate Interest: GDPR allows our Company as the Provider to process personal data even without obtaining your consent for such processing or without relying on other legal bases, such as contract performance or legal obligations under special laws.

Regarding such processing of personal data based on legitimate interest under Article 6(1)(f) of the GDPR, you have the right to object, with details of this right also provided in point 10.1.6 below. If you exercise the right to object to specific processing, our Company may not continue to process your personal data unless our Company demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless our Company demonstrates the establishment, exercise, or defense of legal claims. If you object to the processing of your personal data for direct marketing purposes, our Company will not further process your personal data for that purpose.

5. AUTOMATED DECISION-MAKING AND PROFILING

5.1. Within the BikeKIA service, our Company does not carry out automated decision-making or profiling in relation to your personal data.

6. RECIPIENTS OR CATEGORIES OF PERSONAL DATA RECIPIENTS

6.1. List of recipients of personal data: Your personal data may be provided to the following recipients:

6.1.1. Auditors who conduct an audit in our Company, especially to verify our Company’s financial statements;

6.1.2. Orange Slovensko, a.s., Metodova 8, 821 08 Bratislava, ID: 35 697 270, which, as an intermediary, provides central customer support line services for our Company, Arriva;

6.1.3. TIER Mobility SE, c/o WeWork, Eichhornstraße 3, 10785 Berlin, which provides software and backend for the BikeKIA system;

6.1.4. Banks and other companies that provide financial and business transaction services for our Company and provide financial services;

6.1.5. Legal representatives and law firms that provide comprehensive legal advice to our Company, represent our Company in courts and before other state authorities, as well as against debtors and other entities;

6.1.6. IT service providers as intermediaries who provide some IT security and infrastructure for our Company, including the website;

6.1.7. Companies that provide accounting and tax advice for us;

6.1.8. Shareholders/partners of the Company.

6.2. Intermediaries are anyone who processes personal data on behalf of our Company as the Data Controller.

6.3. State authorities and other entities: Your personal data may also be provided to other entities if our Company believes that such provision of personal data is:

6.3.1. In accordance with a binding legal regulation, the Articles of Association or the GDPR; or

6.3.2. Necessary for the purposes of asserting, establishing, or defending our Company’s legal right/claim; or

6.3.3. Necessary to protect the vital interests of our Company or the vital interests of any other person,

And may involve the provision of personal data to some of the following entities:

6.3.4. Any competent authority in criminal proceedings, the prosecutor’s office, or the court;

6.3.5. Banks;

6.3.6. Legal representatives;

6.3.7. Regulator;

6.3.8. Notary as a judicial commissioner;

6.3.9. Tax office;

6.3.10. Supervisory and control authorities;

6.3.11. Government agency;

6.3.12. Executor;

6.3.13. Administrator or preliminary administrator in bankruptcy proceedings or restructuring proceedings, settlement proceedings, or debt relief proceedings, or a supervisory administrator conducting supervisory activities;

6.3.14. Municipality, city, higher territorial unit;

6.3.15. Ministry;

6.3.16. National Control Office of the Slovak Republic;

6.3.17. National Security Authority of the Slovak Republic;

6.3.18. Slovak Trade Inspection;

6.3.19. Judicial Treasury;

6.3.20. Office for Personal Data Protection of the Slovak Republic;

6.3.21. Financial Directorate of the Slovak Republic;

6.3.22. Or another entity.

6.4. Providing personal data at the request of the data subject: We may also provide your personal data to other recipients if you give your consent to our Company or instruct our Company to provide your personal data for such purposes.

7. RETENTION PERIOD OF PERSONAL DATA

7.1. We will retain your personal data for as long as necessary for the purposes for which our Company processes your personal data, unless a binding legal regulation allows or requires us to retain the relevant personal data for a longer period.

7.2. We retain individual personal data for the following periods:

Purpose: Retention Period: Bike Rental For the duration of the contract and for an additional ten years following the year in which the contract terminated/fulfilled (in accordance with Act No. 431/2002 Coll. on Accounting as amended, Act No. 566/2001 Coll. on Securities and Investment Services, and Act No. 186/2009 Coll. on Financial Mediation and Financial Consulting). In case of legal proceedings against you as a debtor, our Company will process your personal data for the necessary duration during which the legal proceedings are ongoing. Marketing Purposes For the duration of consent or until the consent is revoked.

For processing personal data based on legitimate interest, for the necessary duration to fulfill the processing purpose, up to a maximum of ten (10) years from the date of acquisition. Enforcement of Legal Claims For the duration necessary to enforce the rights and claims of our Company, at least for the duration of the statutory limitation period according to the Civil Code or Commercial Code, but no more than ten (10) years after the termination/fulfillment of contractual obligations. In case of initiating judicial or administrative proceedings, our Company will process your personal data for the necessary duration during which the legal or administrative proceedings are ongoing. Complaints and Claims For the duration necessary to fully process complaints and claims, up to a maximum of ten (10) years for the purposes of record-keeping and potential oversight by supervisory authorities, as well as for any legal disputes or other enforcement of the rights and claims of our Company during the statutory limitation period according to the Civil Code and Commercial Code. Identification and Contact Information For the duration necessary to establish contact with the individuals concerned or to provide information/assistance as requested by these individuals, but no more than five (5) years from the date of acquisition.

8. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

8.1. Our Company does not carry out and does not intend to carry out the transfer of your personal data to third countries that do not provide an adequate level of personal data protection, except in cases where such transfer is expressly required by a binding legal regulation or a decision of a state authority. Third countries are all countries other than the European Union Member States and countries that are parties to the Agreement on the European Economic Area.

8.2. In the event that the nature of the service requires the transfer of personal data to third countries, we will comply with all conditions set out in Articles 44 to 49 of the GDPR, as well as other GDPR conditions, to ensure that such transfer meets all security standards and does not violate your rights and freedoms.

9. SECURITY OF PERSONAL DATA

9.1. On the security of personal data: Our Company implements appropriate administrative, technical, and organizational security measures to protect your personal data under the control of our Company from unauthorized access, collection, use, disclosure, copying, modification, or deletion. All personal data you provide to us is stored on secure servers. We are part of the Arriva plc group, which trains its employees in connection with our principles and procedures for the protection of personal data, and access to personal data is granted exclusively to employees for whom the relevant processing of personal data arises from their job position. We also take steps to ensure that any service provider processing personal data on our behalf adopts appropriate technical and organizational measures to protect such personal data.