You can find the data protection statement for the use of the website and app here.
Data protection notice for customers of City Bike Linz Rental Service GmbH in the context of registration
In the following, we would like to inform you about the processing of your data in connection with the use of our services and the rights to which you are entitled under the data protection laws.
1. Contact details of the responsible party
City Bike Linz Rental Service GmbH, Wischerstraße 2, 4040 Linz, Email: firstname.lastname@example.org
2. Personal data
Personal data is any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to identifying information such as name, an identification number, location data, an online identification or one or more factors specific to that person.
3. Purposes and legal bases of data processing
We process personal data within the framework of the data protection requirements of the General Data Protection Regulation (EU) 2016/679 and the Data Protection Act for the purposes listed below.
3.1. Contract performance/execution of pre-contractual measures (Art. 6 para. 1 sentence 1 b) GDPR)
Users' personal data is used for our bicycle rental services, in particular for registering via the app, website and for services related to this. If you contact us, your information is stored for the purpose of processing your enquiry and to respond to any follow-up questions.
As part of the registration process or rental transaction, we process personal data that is required for registering the rental, its content, for amendment or termination of the registration or the respective contractual relationship, e.g.: Name, title, address, date of birth, telephone number, bank details or credit card information, monthly totals of invoices, the bicycles you use in our system, and enquiries directed to us regarding your contract. Personal data is processed in order to conclude a contract with you or to fulfil or terminate a contract that has already been concluded. This also includes, for example, data processing carried out in connection with our customer service. City bike Linz uses personal data, including bicycle usage data (such as the location of the rental bicycle at the start of the rental, at the end of the rental, and during parking), insofar as this is necessary for the purpose of fulfilling the contractual relationship with the customer. This also includes use of data to identify and eliminate errors and malfunctions in the rental transaction and in the overall service. Data on rental transactions carried out by the customer is collected and stored with the starting point and destination, and the start time and destination time. This data can be viewed at any time in the customer account and is included in the invoice. Movement record of the rider is not documented.
3.2. Protection of legitimate interests (Art. 6 para. 1 sentence 1 f) GDPR)
We process your personal data if this is necessary to protect our interests or the interests of third parties and your interests are not overriding. We process personal data to protect the following legitimate interests:
- for internal purposes like managing and improving our business processes, business analysis, reviewing our company’s activities, for developing services and products
- for direct advertising, to offer you similar products made by us that are suitable for your individual needs, if you allow us to contact you.
- for securing legal claims
- for ensuring the security and availability of our IT systems, for preventing damage
- for performing contracts with parties involved in the provision of our services
3.3. Fulfilling a legal obligation (Art. 6 para. 1 sentence 1 c) GDPR)
We are subject to various legal requirements from which an obligation to process personal data may arise: under commercial, company, competition and tax laws, data protection laws and other general legal obligations.
3.4. Processing on the basis of consent (Art. 6 para. 1 sentence 1 a) GDPR)
We process your personal data if you have given us consent to do so (when you give your consent, you will receive further information, e.g. on the purposes and your options to revoke the consent).
4. Recipients of personal data
Employees of our company have access to your personal data to the extent necessary to fulfil the aforementioned purposes. We engage service providers who support us in data processing within the framework of commissioned data processing (service providers for the following services: IT and network operation, call centre, customer service, file/data medium destruction, printing, archiving, sales partners, market research, advertising and marketing, operation of online offers, websites and apps). These service providers are subject to strict contractual agreements, including confidentiality. On a contractual basis, recipients outside our company, who do not work for us under commissioned data processing agreements, also process your personal data to the extent necessary:
- Telecommunications service providers, e.g. to make calls, send SMS, etc.
- Sales partners and other companies that support us in sales of our products
- Banks, e.g. for carrying out direct debit procedures; providers of payment services
- Tax advisors/auditors, to carry out and review bookkeeping in line with the legal requirements (e.g. tax law requirements).
- Lawyers, to represent and enforce our legal interests
In individual cases, we are legally obliged to send personal data to authorities (e.g. requests for information from investigating authorities) or natural/legal persons (e.g. to assert claims).#
5. Data processing in third countries
We generally process your personal data in Austria and in the European Union. Service providers who process personal data on our behalf outside the European Union (so-called third countries) are only deployed if an "Adequacy decision" of the European Commission (Art. 45 GDPR) exists for that third country, "appropriate guarantees" (Art. 46 GDPR) are available with the recipient or "internal data protection rules" (Art. 47 GDPR) are followed by the recipient. Furthermore, your personal data will be processed in third countries insofar as it is necessary for the fulfilment of the contract (e.g. rental transactions in third countries), if you have given your consent to do so or if there is a legal obligation.
6. Deletion of personal data
We generally delete personal data when it is no longer required (see purposes above).
We delete your customer data at the latest six months after the end of the calendar year following your deregistration, unless we are obliged to retain it for a longer period due to legal requirements (e.g. commercial law or tax law requirements); in these cases, we delete the data upon expiry of these legal periods (usually after 7 years).
If you have given your consent to the processing of personal data, we will delete your personal data as soon as you revoke your consent and insofar as there is no other legal basis for the processing.
7. Source of personal data
We process other personal data apart from the personal data that we receive directly from you. We receive some personal data from third parties in cases where we offer our services jointly with partner companies and you give your express consent for this.
8. Options and configuration
When you register with us, or at any time while your registration is ongoing or rental transactions are being made, we give you options to decide and configure the collection and use of your data in certain areas. You can exercise your options through your user account. As a business client, you can also contact your contact persons for this.
9. Your rights
As a data subject within the meaning of the GDPR, you have the following rights in principle:
- You have the right to obtain information about your processed data (Art. 15 GDPR). To do so, please contact our customer service in writing.
- If you wish to correct incorrect personal data or have incomplete data completed, you can correct this in your user account or contact our customer service (Art. 16 GDPR).
- You have a right to delete your personal data under certain legal conditions (Art. 17 GDPR). You can delete your data in your user account or contact our customer service.
- You have a right to restrict processing under certain legal conditions (Art. 18 GDPR). You can arrange this by contacting our customer service.
- You have a right to receive or transfer the personal data concerning you under certain legal conditions (Art. 20 GDPR). You can arrange this by contacting our customer service.
- You have the right to complain to a supervisory authority (Art. 77 GDPR). You can contact the data protection supervisory authority for this purpose, for example.
- Right to revoke your consent: You have the right to revoke your consent to the processing of your personal data at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected by the revocation. We will inform you about how you can revoke your consent once we receive your consent. In any case, you can contact our customer service to declare your revocation.
- You have a right of objection under certain legal conditions. We will inform you about this when you conclude the contract and at the end of this notice.
10. Changes to the data protection notice
Given that changes in the law or changes in our internal processes may make it necessary to amend this data protection notice, which we reserve the right to do accordingly, we request you to check the data protection notice periodically on https://www.citybikelinz.at.
11. Your right to object (Art. 21 of the GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is carried out on the basis of Art. 6 para. 1 sentence 1 e) of the GDPR or Art. 6 Para. 1 sentence 1 f) of the GDPR. We will then no longer process this personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. If personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of the relevant personal data for the purpose of such marketing. You can declare your objection to our customer service.