INFORMATION ON PERSONAL DATA PROTECTION
(Information memorandum on the processing of personal data of BikeKIA bike sharing service users)
ARRIVA Slovakia a.s., with its registered office at Štúrova 72, 949 01 Nitra, Slovak Republic, ID: 35 811 439, registered in the Commercial Register of the District Court Nitra, Section: Sa, Insert No.: 10493/N (hereinafter referred to as the “Provider” or the “Company”), processes your personal data for the purposes and on the legal bases as specified below in this information memorandum. In this information memorandum, you will also find more detailed information on the processing of your personal data as well as information about your rights as a data subject, as provided for under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or “GDPR”) and Act No. 18/2018 Coll. on the protection of personal data and on the amendment and supplementation of certain acts, as amended by subsequent regulations (hereinafter referred to as the “Personal Data Protection Act”).
Our Company is the Controller of your personal data, meaning that our Company determines the purposes and means of processing your personal data.
1. CONTACT DETAILS OF OUR COMPANY AND THE RESPONSIBLE PERSON
Company Name: ARRIVA Slovakia a.s. Address: Štúrova 72, 949 01 Nitra, Slovak Republic
Responsible Person: JUDr. Miriama Miskolczi Email: osobneudaje@arriva.sk Phone Contact: +421 915 733 733
2. WHAT PERSONAL DATA DO WE PROCESS
2.1. Regular Personal Data: As the Provider, our Company processes the following personal data that you provide to our Company, mainly through our website bikekia.sk or the BikeKIA mobile application or by other means, including but not limited to:
2.1.1. Identification Data: (such as name, surname, title, masked bank account number, cardholder’s name);
2.1.2. Contact Information: (such as permanent or temporary residential address, business address, email address, telephone number);
2.1.3. Location Data: (such as data related to rented bicycles, for example, bicycle location at the beginning and end of the rental period, other location-related data);
2.1.4. Transaction Data: (such as customer’s monthly turnover data).
2.2. Special Categories of Personal Data: As the Provider, our Company does not process special categories of personal data (sensitive data) for the purposes outlined in this information memorandum. Special categories of personal data include data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation. In the event that there is a requirement to process special categories of your personal data, we will either request your explicit consent or process such personal data on another relevant legal basis.
3. COOKIES AND OTHER ELECTRONIC DATA
3.1. Basic Cookie Files: These cookie files are strictly necessary to provide you with the services available through our websites and to use some of their features. Since these cookie files are strictly necessary for the basic functioning of the websites, you cannot refuse them without affecting how our websites function. You can block or delete them by changing your browser settings and blocking all cookies on this website.
Google Analytics Cookies: These cookie files collect information used either in aggregate form to help us understand how our website is being used or how effective our marketing campaigns are, or to help us customize our website and application for you in order to enhance your experience. If you do not want your visits to our site to be tracked, you can disable tracking in your browser.
Other External Services: We also use various external services such as Google Web Fonts, YouTube, Google Maps, OpenStreetMap to display precise locations of bike stations. Since these providers may collect personal data like your IP address, we allow you to block them on our website. Please be aware that this might heavily reduce the functionality and appearance of our site. Changes will take effect once the page is reloaded.
3.2. Server Data: When you visit our website bikekia.sk, your web browser provides data to our Company or our website manager, including the type of web browser you are using, the type of your operating system, data about the website you are visiting from, the websites you visit, the date and time of your access, and your IP address.
3.3. Social Network Plugins: We do not use social network plugins (modules) on our website bikekia.sk.
4. PURPOSES OF PROCESSING PERSONAL DATA (WHY WE HAVE YOUR PERSONAL DATA) AND LEGAL BASIS FOR PROCESSING (ON WHAT BASIS WE HAVE YOUR PERSONAL DATA)
4.1. Personal Data for Specific Purposes: When providing our services, we always process your personal data for a specific pre-determined purpose, with each purpose requiring only certain personal data from you. On the other hand, if you do not provide the necessary personal data for a specific purpose, our Company may not be able to provide the relevant service, or it may only be able to provide it to a very limited extent, which may not be desirable for you in the end.
4.2. Purposes of Processing and Relevant Legal Basis: We process your personal data for the following purposes and based on the following legal grounds:
4.2.1. For the Purpose of Bike Rental (Based on Contract Performance and Pre-contractual Relations): This involves the processing of your identification, contact, location, and transaction data for the purpose of renting a bicycle (BikeKIA) and registering customers in the BikeKIA system (via the website, mobile application, telephone, terminal, or other means). The processing of your personal data is carried out based on the concluded rental agreement (BikeKIA) for the bicycle, as well as within the framework of pre-contractual relations preceding the conclusion of the rental agreement. By creating a BikeKIA account through our website, mobile application, or other means, you provide personal data to our Company as part of pre-contractual relations preceding the rental agreement.
4.2.2. Marketing Purpose (Based on Consent and Legitimate Interest): This primarily includes direct marketing, sending newsletters, customer satisfaction assessment, sending offers and advertisements for products and services offered by our Company, as well as products and services offered by companies in the Arriva group, including various competitions. We process your identification and contact personal data for this purpose based on:
4.2.2.1. **Your consent,** which you voluntarily provide to us, and you have the right to withdraw such consent at any time; or
4.2.2.2. **Legitimate interest.** Our Company's legitimate interest in processing your identification and contact personal data for marketing purposes (direct marketing) lies in promoting our Company's services and products to our current and former customers. This helps our Company grow and develop. Additionally, through communication with our former and current customers through feedback, our Company can identify how to improve its services and products and address any shortcomings. Our Company has a significant interest in providing the best possible services and products to its customers, so it is our legitimate interest to use the basic identification and contact information of our former and current customers for this purpose and to continuously receive their feedback. For the proper functioning and development of our Company, this is almost essential, as in today's modern world, every company operating in the market seeks to maintain regular contact with its customers.
We also refer to Section 62(3) of Act No. 351/2011 Coll. on Electronic Communications, as amended, which states that prior consent of the recipient of electronic mail is not required when it comes to direct marketing of own similar goods and services by a person who has obtained the contact information for sending electronic mail in connection with the sale of goods or services in accordance with this law or a special regulation.
In the case of processing personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below. If you object to the processing of your personal data for direct marketing purposes, our Company will not further process your personal data for that purpose.
4.2.3. Enforcement of Our Company’s Legal Claims (Based on Legitimate Interest): This involves processing mainly identification and contact personal data for the purpose of enforcing our Company’s legal claims against customers (debtors) in judicial, non-judicial, arbitration, administrative, enforcement, bankruptcy, and restructuring proceedings. Our Company necessarily requires the personal data concerned to effectively assert its legitimate claims and rights. Regarding the processing of personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below.
4.2.4. Complaints and Claims (Based on Legitimate Interest): This involves processing mainly identification and contact data of our customers and other individuals who submit complaints and claims related primarily to bicycle rentals. Since our Company has a significant interest in the satisfaction of our customers, our Company processes personal data for this purpose to be able to properly respond to these complaints and claims and provide remedies if certain complaints are justified. Additionally, our Company must be able to demonstrate the handling of complaints and claims, which is also overseen by the relevant supervisory authorities. Therefore, for the purpose of record keeping, we maintain these complaints and claims for a necessary period. Regarding the processing of personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below.
4.2.5. Identification and Contact Data (Based on Legitimate Interest): This involves processing identification and contact personal data of representatives of legal entities and other individuals that we obtain from publicly available sources designated for this purpose, directly from these individuals, or from other individuals (e.g., in person, via email, or through our forms and chats on our website bikekia.sk). Our Company requires this data to establish contact with other legal entities and individuals for the proper functioning of our Company and to provide you with information related to our Company, bicycle rentals, or other services and products of our Company and Arriva group companies, as requested. Regarding the processing of personal data based on legitimate interest, the data subject whose personal data is concerned has the right to object. More details on the right to object are provided in points 4.3 and 10.1.6 below.
4.3. General Information Regarding Processing Personal Data Based on Legitimate Interest: GDPR allows our Company as the Provider to process personal data even without obtaining your consent for such processing or without relying on other legal bases, such as contract performance or legal obligations under special laws.
Regarding such processing of personal data based on legitimate interest under Article 6(1)(f) of the GDPR, you have the right to object, with details of this right also provided in point 10.1.6 below. If you exercise the right to object to specific processing, our Company may not continue to process your personal data unless our Company demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless our Company demonstrates the establishment, exercise, or defense of legal claims. If you object to the processing of your personal data for direct marketing purposes, our Company will not further process your personal data for that purpose.
5. AUTOMATED DECISION-MAKING AND PROFILING
5.1. Within the BikeKIA service, our Company does not carry out automated decision-making or profiling in relation to your personal data.
6. RECIPIENTS OR CATEGORIES OF PERSONAL DATA RECIPIENTS
6.1. List of recipients of personal data: Your personal data may be provided to the following recipients:
6.1.1. Auditors who conduct an audit in our Company, especially to verify our Company’s financial statements;
6.1.2. Orange Slovensko, a.s., Metodova 8, 821 08 Bratislava, ID: 35 697 270, which, as an intermediary, provides central customer support line services for our Company, Arriva;
6.1.3. TIER Mobility SE, c/o WeWork, Eichhornstraße 3, 10785 Berlin, which provides software and backend for the BikeKIA system;
6.1.4. Banks and other companies that provide financial and business transaction services for our Company and provide financial services;
6.1.5. Legal representatives and law firms that provide comprehensive legal advice to our Company, represent our Company in courts and before other state authorities, as well as against debtors and other entities;
6.1.6. IT service providers as intermediaries who provide some IT security and infrastructure for our Company, including the website;
6.1.7. Companies that provide accounting and tax advice for us;
6.1.8. Shareholders/partners of the Company.
6.2. Intermediaries are anyone who processes personal data on behalf of our Company as the Data Controller.
6.3. State authorities and other entities: Your personal data may also be provided to other entities if our Company believes that such provision of personal data is:
6.3.1. In accordance with a binding legal regulation, the Articles of Association or the GDPR; or
6.3.2. Necessary for the purposes of asserting, establishing, or defending our Company’s legal right/claim; or
6.3.3. Necessary to protect the vital interests of our Company or the vital interests of any other person,
And may involve the provision of personal data to some of the following entities:
6.3.4. Any competent authority in criminal proceedings, the prosecutor’s office, or the court;
6.3.5. Banks;
6.3.6. Legal representatives;
6.3.7. Regulator;
6.3.8. Notary as a judicial commissioner;
6.3.9. Tax office;
6.3.10. Supervisory and control authorities;
6.3.11. Government agency;
6.3.12. Executor;
6.3.13. Administrator or preliminary administrator in bankruptcy proceedings or restructuring proceedings, settlement proceedings, or debt relief proceedings, or a supervisory administrator conducting supervisory activities;
6.3.14. Municipality, city, higher territorial unit;
6.3.15. Ministry;
6.3.16. National Control Office of the Slovak Republic;
6.3.17. National Security Authority of the Slovak Republic;
6.3.18. Slovak Trade Inspection;
6.3.19. Judicial Treasury;
6.3.20. Office for Personal Data Protection of the Slovak Republic;
6.3.21. Financial Directorate of the Slovak Republic;
6.3.22. Or another entity.
6.4. Providing personal data at the request of the data subject: We may also provide your personal data to other recipients if you give your consent to our Company or instruct our Company to provide your personal data for such purposes.
7. RETENTION PERIOD OF PERSONAL DATA
7.1. We will retain your personal data for as long as necessary for the purposes for which our Company processes your personal data, unless a binding legal regulation allows or requires us to retain the relevant personal data for a longer period.
7.2. We retain individual personal data for the following periods:
Purpose: Retention Period: Bike Rental For the duration of the contract and for an additional ten years following the year in which the contract terminated/fulfilled (in accordance with Act No. 431/2002 Coll. on Accounting as amended, Act No. 566/2001 Coll. on Securities and Investment Services, and Act No. 186/2009 Coll. on Financial Mediation and Financial Consulting). In case of legal proceedings against you as a debtor, our Company will process your personal data for the necessary duration during which the legal proceedings are ongoing. Marketing Purposes For the duration of consent or until the consent is revoked.
For processing personal data based on legitimate interest, for the necessary duration to fulfill the processing purpose, up to a maximum of ten (10) years from the date of acquisition. Enforcement of Legal Claims For the duration necessary to enforce the rights and claims of our Company, at least for the duration of the statutory limitation period according to the Civil Code or Commercial Code, but no more than ten (10) years after the termination/fulfillment of contractual obligations. In case of initiating judicial or administrative proceedings, our Company will process your personal data for the necessary duration during which the legal or administrative proceedings are ongoing. Complaints and Claims For the duration necessary to fully process complaints and claims, up to a maximum of ten (10) years for the purposes of record-keeping and potential oversight by supervisory authorities, as well as for any legal disputes or other enforcement of the rights and claims of our Company during the statutory limitation period according to the Civil Code and Commercial Code. Identification and Contact Information For the duration necessary to establish contact with the individuals concerned or to provide information/assistance as requested by these individuals, but no more than five (5) years from the date of acquisition.
8. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
8.1. Our Company does not carry out and does not intend to carry out the transfer of your personal data to third countries that do not provide an adequate level of personal data protection, except in cases where such transfer is expressly required by a binding legal regulation or a decision of a state authority. Third countries are all countries other than the European Union Member States and countries that are parties to the Agreement on the European Economic Area.
8.2. In the event that the nature of the service requires the transfer of personal data to third countries, we will comply with all conditions set out in Articles 44 to 49 of the GDPR, as well as other GDPR conditions, to ensure that such transfer meets all security standards and does not violate your rights and freedoms.
9. SECURITY OF PERSONAL DATA
9.1. On the security of personal data: Our Company implements appropriate administrative, technical, and organizational security measures to protect your personal data under the control of our Company from unauthorized access, collection, use, disclosure, copying, modification, or deletion. All personal data you provide to us is stored on secure servers. We are part of the Arriva plc group, which trains its employees in connection with our principles and procedures for the protection of personal data, and access to personal data is granted exclusively to employees for whom the relevant processing of personal data arises from their job position. We also take steps to ensure that any service provider processing personal data on our behalf adopts appropriate technical and organizational measures to protect such personal data.
10. YOUR RIGHTS AS A DATA SUBJECT IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA
10.1. Individual rights of data subjects: Just as our Company has its rights and obligations regarding the protection of personal data, you also have rights concerning the protection of your personal data (personal data concerning you). These rights include:
10.1.1. Right of access: You have the right to obtain confirmation from our Company as to whether or not your personal data is being processed by our Company, what personal data is being processed, for what purposes it is processed, how long it is stored, where our Company obtains it, to whom it provides it, who else, apart from our Company, processes your personal data, whether and how automated decision-making, including profiling, occurs in the processing of your personal data, and what other rights you have in connection with the processing of your personal data. All this information is provided in this information memorandum; however, if you have the impression that you do not know whether and what personal data our Company processes and how it processes them, you have the right to access this personal data. Within the framework of the right of access, you can request our Company to provide you with a copy of your processed personal data, with the first copy being provided to you free of charge, and further provision of copies being subject to a fee.
10.1.2. Right to rectification: If you find that our Company processes your personal data that are inaccurate, incorrect, or incomplete, you have the right for our Company to rectify or complete these personal data.
10.1.3. Right to erasure (right to be forgotten): In the following cases, you have the right for your personal data processed by our Company to be erased without undue delay:
10.1.3.1. Your personal data are no longer necessary for the purposes for which our Company obtained or otherwise processed them; or
10.1.3.2. You have withdrawn your consent to the processing of your personal data, and processing of these personal data required your consent, and our Company does not have another legal basis for processing them (e.g., for enforcing the rights and claims of our Company); or
10.1.3.3. You have exercised your right to object to the processing of your personal data (further details on this right are provided in section 10.1.6 below), which our Company processes based on legitimate interests, and our Company finds that it has no other legitimate interests justifying further processing of these personal data; or
10.1.3.4. Our Company has processed your personal data unlawfully; or
10.1.3.5. To fulfill a legal obligation of our Company laid down in a generally binding legal regulation applicable to our Company; or
10.1.3.6. Personal data were obtained in connection with the offer of information society services directly to a child.
It is important to note that even if one of the above-mentioned cases applies, our Company is not obliged to erase your personal data (personal data concerning you) if processing of them is necessary:
10.1.3.7. To exercise the right to freedom of expression and information; or
10.1.3.8. To fulfill a legal obligation of our Company laid down in a generally binding legal regulation; or
10.1.3.9. For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes; or
10.1.3.10. For the establishment, exercise, or defense of legal claims of our Company.
10.1.4. Right to restriction of processing: In certain cases, in addition to the right to erasure, you have the right to request our Company to restrict the processing of your personal data, by which you can request that your personal data be marked and that these personal data not be subject to any further processing for a specific period. Our Company is obliged to restrict the processing of your personal data if:
10.1.4.1. You contest the accuracy of personal data, for a period enabling our Company to verify the accuracy of these personal data; or
10.1.4.2. The processing of your personal data is unlawful, and you oppose the erasure of these personal data and request the restriction of their use instead; or
10.1.4.3. Our Company no longer needs your personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims; or
10.1.4.4. You have exercised your right to object to the processing of your personal data (further details on this right are provided in section 10.1.6 below), pending verification whether the legitimate grounds of our Company override your grounds.
If the processing of your personal data has been restricted pursuant to this right to restriction of processing, such personal data, with the exception of storage, may be processed by our Company only with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
10.1.5. Right to data portability: You have the right to receive your personal data which you have provided to our Company, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller, where the processing is based on consent or on a contract and is carried out by automated means (electronically). Our Company will provide you with your personal data in such a format, and you have the right to have those personal data transmitted directly from our Company to another controller, where technically feasible.
10.1.6. Right to object: You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on public interest or legitimate interest, including profiling. Our Company will no longer process your personal data unless our Company demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
If our Company processes your personal data for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, our Company will no longer process your personal data for such purposes.
10.1.7. Manner of exercising rights: You can exercise the above-mentioned rights by contacting our Company using the contact details provided in section 1 above.
10.1.8. Right to lodge a complaint with the supervisory authority: In the event of suspicion of unauthorized processing of your personal data, in addition to exercising the rights mentioned above, you may file a complaint with the supervisory authority, especially in the Member State of your habitual residence, place of work, or place of the alleged infringement. The supervisory authority in the Slovak Republic is the Office for Personal Data Protection of the Slovak Republic. The registered office of the Office for Personal Data Protection of the Slovak Republic is at Hraničná 12, 820 07 Bratislava, Slovak Republic, and its contact details are as follows: tel. no. +421 2 3231 3214; email: statny.dozor@pdp.gov.sk; website: https://dataprotection.gov.sk/
In the case of filing a complaint/proposal electronically, it is necessary that it complies with the requirements of Section 19 (1) of Act No. 71/1967 Coll. on Administrative Proceedings (Administrative Code) as amended.
10.1.9. Notification of a personal data breach: In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, our Company is obliged to notify you of the data breach without undue delay.
11. RIGHT TO WITHDRAW CONSENT TO THE PROCESSING OF PERSONAL DATA AT ANY TIME
11.1. If you have given our Company consent to the processing of certain of your personal data (the legal basis for the processing of certain personal data by our Company is consent or explicit consent), you can withdraw such consent at any time by contacting our Company using the contact details provided in section 1 above. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
12. CHANGES TO THIS INFORMATION MEMORANDUM
12.1. This information memorandum on personal data protection may be updated as needed in response to changes in legal, technical, or business developments. When updating this information memorandum on personal data protection, we will take appropriate measures to inform you depending on the significance of the changes we make.
TERMS AND CONDITIONS FOR THE USE OF SHARED BICYCLES IN THE CITY OF ŽILINA AS PART OF THE BIKEKIA SERVICE:
FORM FOR WITHDRAWAL
SAMPLE FORM FOR WITHDRAWAL FROM THE CONTRACT (fill in and send this form only if you wish to withdraw from the contract)
To ARRIVA Slovakia a.s., with registered office: Štúrova 72, 949 44 Nitra, Slovak Republic, ID No.: 35811439, registered in the Commercial Register of the District Court Nitra, section: Sa, insert number: 10493/N: I/we* hereby give notice that I/we* withdraw from my/our* contract of sale of the following goods*/from my/our* contract for the provision of the following service*:
In the form above, indicate whether you are withdrawing from the Framework Agreement or from a specific Partial Agreement.
Subscribe to our newsletter
News, events and competitions direct to your email.
2023 BikeKIA. All rights reserved.