Privacy Statement - Dliwr Technologies

Dliwr believes that the protection of personal data is essential, so we treat your data with the greatest possible care. The purpose of this privacy statement is to inform you of how we deal with your personal data.

1. Who is responsible for processing your data?

In this privacy statement, Dliwr Technologies GmbH (hereafter: “Dliwr” or “we”) describes how, as the party responsible for processing, it deals with your personal data when you utilize our services, such as a subscription for the use of a bicycle, this website, or the Dliwr app.

2. What is personal data?

Information about an identified or identifiable natural person is considered to be ‘personal data’. The certification of specific information as personal data depends in part on whether Dliwr is in the possession of legal resources which can reasonably be assumed to be used by Dliwr to identify an individual.

3. The personal data we process

We process your personal data because you have provided the data to us yourself when entering into an agreement with us, or when you use this website or the Dliwr app.

A) Data generated through your use of our services, website, and Dliwr app. When you use the services offered by Dliwr, such as a subscription for the use of a bicycle, or have other contact with us, we will use the following personal data to provide services, depending on the specific manner in which you use the services:

• Data necessary to facilitate the rental of a bicycle, such as your contact details, name, address and date of birth;
• Data necessary for financial administration, such as your bank account number, name and address;
• Data necessary to provide access to and utilize the Dliwr app, such as password and username, cookies, beacons, metadata;
• Data necessary for the services related to the bicycle, such as location data for the Store Lock-Up and Pick-up service;
• Your communications preferences and settings;
• Surf history, based on our own observations or cookies (see Article 9 of this privacy statement);
• Data pertaining to your peripheral hardware, such as a MAC address, IP address or other number;
• Customer satisfaction data;
• Data regarding your use of our customer service.

B) Data processed via the GPS tracker in the Dliwr e-bikes

An e-bike issued by Dliwr may be equipped with a GPS tracker. When you take out a Dliwr e-bike subscription, we may process the bicycle’s location data. The processing of these data is necessary for the provision of our services. Dliwr has chosen to install the GPS tracker only in e-bikes, due to the high replacement cost for these bicycles. In doing so, Dliwr aims to offer the lowest possible rate for e-bike rental. The location data may be collected on a constant basis. The bicycle’s location is registered by storing the coordinates. These coordinates may only be used to calculate the location of the e-bike.

4. Processing: grounds and justified interests

Personal data is processed based on the following legal grounds:

1. Permission;

2. Implementation of an agreement with you;

3. Legal obligations;

4. Performing a task in the general interest;

5. Justified interest of Dliwr or a third party.

Justified interests include: security, (crime)prevention, IT management, research and analysis of one’s own products or services, operations, legal affairs and internal administration.

5. Purposes for processing personal data

We take great care when processing personal data. We only use those data necessary for the provision of our services. Dliwr processes your personal data for the purposes listed below. The number behind each purpose corresponds to the legal grounds listed in Article 4 of this Privacy Statement.

A) Purposes for the provision of our services

• Issuing, returning and exchanging bicycles [grounds 2];
• Dliwr administration for financial and fiscal obligations, including the (collective) invoicing for our services [grounds 2 or 3];
• Administering the lost and found process for lost or stolen bicycles, and via tracking in the event of non-payment [grounds 2];
• Communicating with and informing you, and providing services (for example, via the helpdesk and fleet dashboard) [grounds 2 or 5];
• Providing services, such as maintenance, repairs and/or replacement of the bicycle [grounds 2].

B) General purposes

• Building and maintaining the customer relationship [grounds: 2];
• Offering customer service, including services pertaining to the sale of services and the processing of complaints and requests [grounds: 2];
• Processing personal data to provide management information [grounds 2];
• Conducting market research, including measuring customer satisfaction, in order to improve our operations, brands, services and products [grounds: 5];
• The continued development and improvement of new and existing products and services [grounds: 5];
• Compliance with legal obligations, dispute resolution and enforcement of our rights and agreements [grounds: 2, 3 or 5];
• Analysing cookies for our website and the Dliwr app. We do this to ensure that our communications correspond as much as possible to your personal preferences [grounds: 1 or 5];

6. No processing of data of persons under the age of 16

We do not intend to collect data on persons under the age of 16. We recommend that parents be involved in their children’s (online) activities, in order to prevent Dliwr from unintentionally processing their personal data.

7. Sharing data with third parties

Dliwr will share your personal data with third parties in certain cases for the reasons explained below. The number behind each purpose corresponds to the legal grounds listed in Article 4 of this Privacy Statement:

• if we are legally obligated or authorized to provide personal data to third parties [grounds: 3];
• if we suspect a violation of the rights of third parties, criminal acts or misuse, we may provide personal data to third parties who have a justified interest, or to bodies that serve the general interest. These may include enforcement authorities, such as the Public Prosecutor’s Office or supervisory bodies [grounds: 3, 4 or 5];
• Dliwr may also share your data with third parties in the context of implementing an agreement with you, or due to justified business interests such as maintaining a central administration or customer service unit, or analyzing our services provided to you [grounds: 5];
• with parties that assist Dliwr in providing its services and which are not data processors (such as accountants and (legal) consultants) [grounds: 5];
• for business purposes, such as the sale of business activities or shares or a reorganisation [grounds: 5];

Dliwr also uses the services of third parties that act as ‘processors’, such as hosting- and service providers and research bureaus that conduct market research or customer satisfaction surveys. If these third parties are indicated as ‘processors’ in accordance with applicable data protection law, then Dliwr will make written agreements with these parties. These service providers will only process personal data in accordance with the instructions and guidance provided by Dliwr.

Personal data sent to a recipient abroad will only be sent to a recipient in a country that the European Commission has determined offers a suitable level of protection for personal data. If personal data are sent to a recipient in a country that does not offer suitable protection for personal data, then Dliwr will ensure that the legally required guarantees are implemented. If you wish to receive further information about the transfer of your personal data to countries outside the European Economic Area, please contact the Dliwr employee responsible for data protection (see Article 12).

8. Storing your data

We will store your personal data for as long as necessary or permitted within the limitations of the purposes listed in this Privacy Statement and in accordance with applicable legislation. The criteria used to determine this storage period include:

• The duration of the period in which we have a current relationship with you and provide services to you (for example: as long as you have an account with us or continue to use our services);
• Whether we are subject to a legal obligation, such as special laws that require us to store our transactions for a specific period before deleting them; or
• Whether storage is desirable due to our legal position with regard to issues such as expiration terms, disputes or investigations by law enforcement bodies.

9. Studying visits to the website

When you visit our website(s) or utilize services or the Dliwr app, we may use cookies, web beacons and similar technologies to store information with the purpose of personalizing advertising messages and offering you better, faster, and safer customer experiences. You may indicate whether you would like to receive cookies or not. For more details on the use of cookies, please refer to our cookie statement. Our website may contain links to other websites. We bear no liability for how these websites deal with your personal data. Please consult the privacy statement for the relevant website for more information.

10. Your rights, including the right to object

You have the right to know which of your personal data we process and to whom we have provided your data. If you have granted permission for the processing of your personal data, you also have the right to revoke that permission.

If you would like to view, correct, edit, limit, delete any of your personal data processed by us, or object to the processing of your personal data or direct marketing activities, or if you would like to receive an electronic copy of your personal data to send it on to another company (inasmuch as the applicable legislation permits you to transfer such data), please feel free to contact by email (info@dliwr.com)  using the contact details listed under Article 12. Please describe which personal data your request concerns as clearly as possible. We will reply to your request as quickly as possible, and no later than the legally stipulated reply period. Finally, you also have the right to submit a complaint to the Personal Data Protection Authority.

You may only exercise your rights within the limits granted by law. In order to ensure that you have submitted the request yourself, we may ask that you include proof of your identification along with your request. We will only ask this if necessary to identify you, and we ask that you also make unreadable the passport photo, the machine readable zone (the row of numbers at the bottom of the passport), the passport number and your Citizen Service Number (CSN). We will destroy the copy of your proof of identification immediately after we have determined your identity.

11. Security and protecting data

Dliwr uses suitable security measures to prevent misuse, loss, unauthorized access, unintentional publication and unauthorized changes as much as possible. Dliwr has taken both technical and organizational measures to secure your personal data, such as the use of encryption techniques. These security measures are reviewed regularly in the light of new threats.

12. Contact

If you have any questions and/or comments regarding this Privacy Statement, please contact Dliwr via: info@dliwr.com

13. Amendment

We reserve the right to change the manner in which we process personal data and the composition or quantity of data we process. We therefore reserve the right to amend this Privacy Statement as needed. We will inform you of such changes if necessary.

This Privacy Statement was last revised on 23 September 2023.