Per October 20th 2021

Privacy Policy

PRIVACY POLICY

We are committed to protecting your privacy and any personal information you share with us. As part of this effort, we process personal information in accordance with the EU’s General Data Protection Regulation (GDPR) and other data protection regulations applicable to us. Accordingly, we have developed this privacy policy in order for you to understand how we collect, use, communicate, disclose and otherwise make use of personal information. We have outlined our privacy policy below. It is recommended that you read this privacy policy carefully.

WHO IS HELY AND HOW CAN YOU CONTACT US?

Hely wants to make shared mobility easier and more accessible. By offering various vehicles in one app, the user experiences more flexibility. This way sharing becomes smarter and more fun! 

The party responsible for the processing of your personal data is Mobility Solutions and Services B.V., acting under the name Hely, a company having its address at Stadsring 115, 3817 AX Amersfoort. Hely is registered with the Chamber of Commerce under number 71891463. 

All questions regarding the processing of personal data by Hely can be addressed to privacy@hely.com. If you have any questions about or wishes in connection to your personal data, you may also contact our data protection officer: privacy@hely.com.

TO WHOM DOES THIS PRIVACY POLICY APPLY?

This privacy policy applies to persons who visit and/or make use of the Hely website and/or app. This privacy policy also applies if your employer has generated an account for you in order for you to use the Hely services through your employer.

HOW DO WE USE YOUR PERSONAL DATA?

Below is an overview of the purposes for which Hely processes your personal data. In this overview, Hely indicates the personal data Hely uses for a specific purpose, what the legal basis is for processing these data, and how long Hely stores the data. To keep things organised, we have grouped everything by type or data stream.

PRE-REGISTRATION

You can make use of the Hely service when there is a Hely Hub in your neighbourhood. When you provide Hely your zip code, house number, email address and phone number, or when your employer provides this information on your behalf, Hely uses it to see whether there is a Hely Hub in your neighbourhood and to inform you about that. Some Hely Hubs are only available to specific zip codes or companies. When there is a Hely Hub in your neighbourhood, Hely uses your contact details to send you an invitation to complete your registration. Hely processes these personal data in order to take steps at your request prior to entering into a contract (Article 6.1(b) GDPR).

WAITING LIST

If there is no Hely Hub in your neighbourhood or your employer does not use our services, Hely will use your personal data to inform you about that and place you on the waiting list. As soon as there is a Hely Hub in your neighbourhood Hely will contact you. Hely will anonymize your personal data within 1 year after informing you thereof.

REGISTRATION

In order to complete your registration and to make use of the Hely service, you need to set up a personal account. You will provide Hely with additional information, including your name, date of birth, address, gender and, if you want to use Hely cars or scooters, your driving licence (or scooter driving licence) details. Hely processes these personal data in order to create your account and to allow you to use the Hely service. The processing of your personal data in this context is necessary for the performance of a contract in connection with the use of service to which you are a party (Article 6.1(b) GDPR). Hely stores your personal data for as long as you have an account and will anonymise your data 1 year after you deactivate your subscription for the purpose of financial processing. You are also able to reactivate your account within this term. Hely has a legal obligation to retain financial records for a period of 7 years.

ANONYMIZATION

At the end of the aforementioned period of 1 year, Hely will anonymize your data by replacing your name, address and other contact details with fictional data. What remains is information about which Hub you used, the use of our services and the number of contact moments (not its content). These data are used for statistical purposes. For example: in 2019, there were 100 contact moments regarding the topic ‘waiting list’. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR).

USE

If you rent a Hely vehicle, we may keep records on your use, i.e. the location and trip information, by means of a connectivity module (start and end of the rental period, the distance travelled in kilometres, the location of the vehicle and any defects it may have). Hely processes these data for administrative purposes and to invoice your use. This makes the processing of your personal data necessary for the performance of the contract to which you are a party (Article 6.1(b) GDPR). Hely also uses these data to analyse the use of Hely vehicles, which is necessary to safeguard Hely’s legitimate interests (Article 6(1)(f) GDPR).

DEVICE SETTINGS

For the Hely app to function properly, the following will be required: the camera on your phone to scan QR codes on our vehicles, Bluetooth, and a sound internet connection to operate the locks on our vehicles. You can also report damage in the app by snapping a picture with your phone camera. In the app, you can consent to the use of the camera, Bluetooth, and turning on location services to check whether you are near a Hely Hub. You can withdraw your consent at any time by changing your phone settings. The app and the Hely service will no longer function properly, however.

The app will send you push notifications with information about the Hely service and your use, such as the start and end times of your reservations. You can deactivate or reactivate the push notifications at any time in your phone’s settings menu. Receiving push notifications is optional. When deactivated, the app can still be used, but the quality of the service may suffer.

DRIVING LICENCE

You can only use a shared car or scooter if you provide us with a copy of your Dutch or foreign driving licence. This copy is provided to Hely’s partners that will validate your driving licence. Hely and those partners use this information and your other personal data to assess whether you are authorised to drive a certain vehicle and whether you pose a fraud risk. We also send the copy of your driving licence to our partner RentalCheck. For more information, please see the paragraph below on ‘automated decision-making’.

Disclosure of your personal data to our partners is necessary for the conclusion and performance of  a contract between you and the relevant vehicle-sharing service for the use of these services via the Hely platform. Hely will delete the copy of your driving licence within 2 weeks after you provide it. For more information about the use of your personal data by our partners, retention periods and your rights, please consult the relevant partner’s privacy policy. See Hely’s website for more information on Hely’s partners.

IDIN

If you do not have a driving licence and want to make use of services that do not require a driving licence, we use iDIN to verify the personal data provided by you during registration. iDIN lets you prove your identity using your bank’s log-in method. This is only possible if you have a Dutch bank account. Only the data needed by Hely to confirm your identity will be shared with iDIN. Hely will receive the following information: name, address and date of birth. You will be shown exactly which data you are about to share before you actually do so. For more information, you may also consult the privacy statement of your bank. Instead of using iDIN, you can also have us verify your personal data by sending a copy of your ID to our Customer Service department. We advise you to block out and/or redact all data except for your name, date of birth and the expiry date (https://www.rijksoverheid.nl/onderwerpen/identiteitsfraude/vraag-en-antwoord/veilige-kopie-identiteitsbewijs). [web page in Dutch]The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), to verify your account. Your personal data are stored for as long as you have an account and we will anonymize your data 1 year after you deactivate your subscription.

AUTOMATED DECISION-MAKING

Automated decision-making refers to a decision which is taken solely on the basis automated processing of your personal data. This means processing using, for making example, software code or an algorithm, which does not require human intervention. 

To prevent fraud and misuse, and to keep frauds, scammers and other (car) criminals away, Hely makes use of third-party services that analyse the personal data (including the document number or copy of your driving licence) you provided upon registration. These third parties provide us with information on your reliability, creditworthiness and payment behaviour by consulting different (public) sources. Hely provides CrimiMail B.V. (RentalCheck) with your contact details on the basis of which RentalCheck does a check in several registers, such as the Tenant Misconduct Reporting Point (Meldpunt Wangedrag Huurder). 

Hely also checks whether the name you provide upon registration matches the name connected to the bank account number you provided. Hely also checks the telephone number in order to verify whether this number is indeed yours and not false. 

Depending on the outcome of these checks, decisions shall be made by automated means when you register for a Hely account. This means Hely may automatically decide that you pose a fraud risk; your behaviour is consistent with that of known fraudsters; or you appear to have deliberately hidden your true identity. In that case, Hely may refuse or block (registration of) your account. Hely will also use automated decision-making to temporarily or permanently block your account if your payments are in arrears. Your account will be unblocked as soon as your payment has been received. It is also possible that you will not receive an invitation from Hely because you have displayed deviant behaviour.

Automated decision-making in the context of fraud and risk prevention is necessary for entering into, and performance of, a contract between you and Hely in relation to the use of the Hely platform. If, in these circumstances, you should object to the results of the credit check and the automated decision to deny you access to the service, or to temporarily or permanently block you, you can contact Hely to request human intervention. If you want to opt out of automatic decision-making, let us know, although it may mean you cannot make use of the Hely platform as automated decisions are necessary to provide the services in a safe manner. 

For more information about your rights in relation to the processing of your personal data, please see below. If you are in arrears of more than 3 months or have committed fraud, Hely will submit your personal data to CrimiMail’s database. Just as Hely does, third parties, such as rental companies, may also consult this database before they conclude an agreement with you. Registration as a dubious tenant at CrimiMail has several consequences. Affiliated rental companies can:

• refuse to rent a vehicle to you;

• ask for a higher security deposit;

• require exceptional payment terms; or

• require cash payment in advance.

Hely processes your personal data to protect its interest in cases of criminal offences committed against Hely or which, on the basis of facts and circumstances, can be expected to be committed against Hely and to warn third parties of structural non-payment, which also constitute legitimate interests of Hely and those third parties. For more information on the processing of your personal data by CrimiMail, please consult CrimiMail’s website and privacy policy.

NEWSLETTERS

Hely wishes to inform you on the developments of its services, if you have signed up for Hely’s newsletters. If, at any moment, you do not wish to receive newsletters of Hely anymore, you can unsubscribe by using the opt-out option that is provided in every newsletter that Hely sends you. To subscribe you have to provide us with your zip code, house number, telephone number and email address. The processing thereof is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely direct marketing. Hely retains your email address for as long as you are subscribed to the newsletter and not longer than 3 months after you unsubscribe.

EMAIL TRACKING

Hely included email tracking and link tracking features in its newsletters and emails by embedding a small transparent image pixel in the outgoing email. If the email is opened, Hely has access to certain information, such as the name and surnames of the recipient; the recipient’s email address; subject of the email; date and time in which the email was sent; confirmation that the recipient received the email; confirmation that the recipient has opened the email after it has been received; timestamp of each email opening; the history of the times (number, date and time) the recipient has opened the received email; IP from which the email was opened; browser and operating system used by the recipient who opened the email; number of links included in the email; text and URL of such links; number of clicks made on each of them by the recipient; timestamp of each click on the link; IP from which the link was clicked on and browser and operating system used by the person who has clicked on the link. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely to analyse the reach and effectiveness of the emails sent by Hely. The information is retained for 3 months.

SERVICE

To provide customer service Hely may collect and process your personal data to be of service to you and to respond to any questions you submit through email or the contact form on the website, including helping you with any issues which may arise regarding our website and/or services. If you use the online chat function on our website, app or via Facebook, the data processed by Hely for this purpose are browser data and data that you enter in the contact form to or a chat conversation with Hely. If you contact Hely by telephone, the call will be recorded for training purposes. Hely may use your email address to send you service emails, e.g. if you have forgotten your password. These emails are necessary for using the service and for that reason it is not possible to unsubscribe from them.

The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), namely being able to serve you efficiently and to optimise Hely´s customer service. If you have a Hely account, your personal data are stored for as long as you have an account and will anonymize your data within 1 year after you deactivate your account. In other cases, Hely will delete your personal data within 9 months after responding to your message or resolving your complaint.

REMARKETING

Hely uses remarketing services to advertise on third party websites to you after you visited our website/app. We, and our third-party vendors, use cookies to inform, optimize and serve ads based on your past visits to our website/app. Hely will only do this if you have consented to cookies (Article 6(a) GDPR). Please read the Cookie Policy to find out more. The personal data are stored until you delete the cookies in your browser(s).

CAREERS

If you apply for a position at Hely, you will provide your personal data such as your first and last name, full address, email address, phone number and your CV and other attachments to your application. Hely uses this information to review your application and respond to your application. The processing of these personal data is necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR), for recruitment. Hely retains your personal data for 4 weeks after rejection or, with your consent (Article 6(a) GDPR), for a period of 1 year.

ANALYTICS

Hely uses third-party analytics tools to help measure traffic and usage trends for the website and app. These tools collect information sent by your device or our website/app, including the web pages you visit, add-ons, and other information that assists us in improving the website and app. The tools use cookies. We collect and use this analytics information with analytics information from other users so that it cannot reasonably be used to identify any particular individual user. Hely requires this information in order for the website to work as optimally as possible (for example, to display content correctly and to keep the website secure), the processing of these personal data is therefore necessary for the purposes of the legitimate interests pursued by Hely (Article 6.1(f) GDPR). For more information, please read our Cookie policy.

DOES HELY SHARE YOUR PERSONAL DATA?

Hely cooperates with third parties that provide mobility services in order to provide you with various types of transport from different providers. Hely’s current partners are stated on the website. These parties may also process your personal data. For more information about the processing of your personal data by partners, please consult the privacy policy of these third parties. When you make a transaction, your transactional data are sent to our payment service provider in order to process your payment. For instance, if you pay by means of SEPA direct debit, your name, address, place of residence and invoice number will be disclosed to Mollie BV in order to process your payment. Please read Mollie’s privacy statement for more information on the processing of your personal data.

If your employer facilitates Hely’s services, certain data regarding the use of vehicles, such as trip data, may be disclosed to your employer. Given that this pertains to business trips, your employer is obliged to keep records of these data for the Dutch Tax and Customs Administration, as they would otherwise not be deductible.

To provide some services, Hely shares your personal data with service providers. These service providers process your personal data on behalf of Hely. The processing by service providers is governed by a so-called data processing agreement in which Hely has ensured that the service provider shall only process the personal data on instructions of Hely. Third parties are:

• external hosting providers, including cloud providers for the storage and management of data;

• third parties that provide tools for analytical purposes (as described above);

• other specific tasks that have been outsourced include IT support, email marketing (such as MailChimp), customer service (such as the chat function).

In addition, Hely will provide your personal data to external parties, such as police and government institutions, e.g. to pay traffic fines, if Hely is obliged to do so on the basis applicable laws and / or regulations or by means of a court order or a legal verdict, or has obtained consent from you for the provision to third parties.

DOES HELY TRANSFER YOUR PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA?

Some of our service providers are also located outside the European Economic Area (EEA), in this case the United States. To comply with EU data protection laws around international data transfer, Hely only allows service providers outside the EEA to process your personal data if they apply the European Commission’s Standard Contractual Clauses (Article 46.2(c) GDPR). For more information on where and how the relevant document may be accessed or obtained, please contact us at privacy@hely.com.

WHAT ARE YOUR RIGHTS?

Under the GDPR, you have a number of rights with regard to your personal data and the processing thereof:

RIGHT TO ACCESSYou have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to your personal data and additional information about the processing of your personal data.

RIGHT TO RECTIFICATIONYou have the right to request the rectification of inaccurate personal data concerning you.

RIGHT TO BE FORGOTTENYou have the right to ask us to erase your personal data (right to be forgotten) for example if the personal data are no longer necessary in relation to the purposes for which they were collected; you withdraws consent on which the processing is based, and where there is no other legal ground for the processing; or the personal data have been unlawfully processed.

RIGHT TO RESTRICTIONYou have the right to obtain restriction of processing of your personal data, for example when you have contested the accuracy of your personal data.

DATA PORTABILITYYou have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where the processing is based on your consent or on a contract.

RIGHT TO OBJECTYou have the right to object to processing of personal data which is based on our legitimate interests. We shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. 

Where personal data are processed for direct marketing purposes, you always have the right to object to processing of personal data for such marketing. In that case, we shall no longer process your personal data for such purposes.

WITHDRAW CONSENTWhere the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You may send your request to privacy@hely.com. Hely shall respond to your request without undue delay and in any event within 1 month of receipt of the request. That period may be extended by 2 further months where necessary, taking into account the complexity and number of the requests. Hely shall inform you of any such extension within 1 month of receipt of the request, together with the reasons for the delay. If Hely does not take action on your request, Hely shall inform you without delay and at the latest within 1 month of receipt of the request of the reasons for not taking action. In that case, you also have the right to lodge a complaint with the supervisory authority and to seek a judicial remedy.

WHAT ARE COOKIES AND HOW DOES HELY USE THEM?

When using the website or app, various cookies are saved on your computer, mobile device and/or tablet, which can then be accessed. Cookies are small pieces of information (in the form of text) that a server sends to the browser (such as Internet Explorer or Firefox) with the intention that the browser sends this information back to the server the next time a user makes use of the website. Cookies cannot damage your devices or the files saved on them. Please consult the Hely Cookie policy for more information about how Hely uses cookies.

COMPLAINTS?

In case you suspect a breach of data protection legislation and the matter is not solved amicably between us in negotiations, you also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens.