I.What is the purpose of this privacy policy?
Citybee Eesti OÜ, legal entity code 14646800, registered office address Peetri 5, Tallinn, 10415 (hereinafter referred to as the Company or we), cares about your privacy and the protection of your personal data, therefore we process personal data in accordance with the General Data Protection Directive Regulation (EU) 2016/679 (hereinafter referred to as the Regulation) of the European Parliament and the Council as well as other legislation on the protection of personal data. Therefore, in order to ensure fair and transparent information about the processing of your personal data, we publish this Privacy Policy (hereinafter referred to as the Policy).
This Policy describes which personal data we collect and for what purposes we process it when you use our services on the website www.citybee.ee (hereinafter referred to as the Website). This Policy also provides important information about the protection of your personal data, your rights and how to exercise them. Therefore, be sure to take the time to review this Policy, and if you have any questions, please do not hesitate to contact us on the contacts listed. Please note that we reserve the right to change this Policy in the future. You will be additionally notified of any changes, but we encourage you to review this Policy periodically.
II.What is personal data and how is it processed?
Personal data is any information directly or indirectly related to you when your identity is known or can be established directly or indirectly using relevant data (such as name, surname, e-mail address, telephone number, etc.).
Processing of personal data means any operation on personal data (including the collection, recording, storage, editing, modification, granting of access, submission of requests, transmission, archiving, etc.).
When processing your personal data, the Company adheres to the following principles of personal data processing:
oYour personal data will only be processed to the extent necessary to achieve the relevant clearly defined and legitimate purposes, taking into account the protection of your privacy;
oYour personal data is processed accurately, fairly and lawfully and is only processed for purposes that correspond to the purposes stated before the collection of your personal data;
oYour personal data is processed in strict compliance with the clear and transparent requirements for the processing of personal data set out in the legislation;
oYour personal data will only be processed in such a form that your identity can be established for no longer than is necessary for the purposes for which the personal data are processed;
oThe processing of your personal data is subject to appropriate technical and organisational measures to ensure the security of your personal data, including protection against unauthorised processing and unintentional loss, destruction and damage.
III.For what purposes do we process your personal data?
Ordering Services on the Website (Possibility for Legal Entities to Conclude a Contract on the Website)
What personal data do we process?
In order to be able to conclude contracts with us on the Website and to administer these services and/or the accounting documents issued in accordance with them on the Website, in the section “Business Clients”, we ask you to provide the following data, including personal data:
•Company name;
•Company code;
•E-mail address of the person responsible for performance of the contract and administration of the staff;
•Telephone number of the person responsible for the performance of the contract and administration of the staff;
•Name and surname of the person responsible for the performance of the contract and administration of the staff.
How do we get your data?
•Directly from you when you provide them to us at the time of concluding the contract.
What is your personal data used for?
•All the abovementioned data is used to conclude and perform the contract concluded with you.
To whom can your personal data be provided?
•In order to ensure the proper functioning of the Website (where contracts are concluded and/or administered and/or services are ordered), we provide your personal data to the data processors (such as IT service providers, etc.);
•Data may also be transferred to the competent public authorities and/or law enforcement institutions (e.g. courts, the police or other supervisory authorities), providers of legal services and/or debt collectors, insurance companies and/or other. However, your data will only be provided if it is required by valid laws and only in accordance with the procedure set forth by law in order to ensure our rights, the security of our clients, staff and resources, to file, deliver and/or defend legal claims.
Please note that your personal data is only provided to those third persons which ensure the proper conditions necessary for the processing of personal data and security. Your personal data shall not be transferred to third countries (i.e. beyond the European Union or European Economic Area) or to any international organisations.
It is important that the responsible persons specified by the legal entity that enters into the service provision contract with us will have the right to see the list of employees who have access to CityBee, the details of their travel and the invoices issued to the legal entity.
Under what conditions of lawful processing do we process your personal data?
•By specifying your personal data in the relevant sections of the Website and ordering our services, a contract on the provision of specific services is concluded between you and the Company, therefore we, as a representative of a legal entity, process your personal data i.e. the processing of personal data is necessary in order to enter into and perform a contract with a legal entity in the legitimate interests of the Company;
•Personal data of employees of a legal entity who use leased vehicles on behalf of a legal entity shall be processed for the purpose of performance of the contract in accordance with Article 6 (1) (b) of the Regulation, i.e. processing is necessary for the performance of a contract to which the data subject is party;
•After performing the contract concluded with the Company for the provision of specific services, we must comply with the obligations imposed on us by law and keep this contract and/or evidence confirming it; therefore we protect your personal data in accordance with Article 6 (1) (c) of the Regulation, i.e. processing is necessary for compliance with a legal obligation to which the controller is subject (as defined in national law).
How long do we process (store) your personal data?
•We process the contracts and/or orders concluded with you, together with the supporting evidence (including the specified personal data), for the entire term of the contract and store: for 3 months if the service is refused; for 5 years after the expiry date of the contract. Data on customers who have not fulfilled their financial and/or property obligations or caused damage to the Company is stored for an additional 5 years.
Joining Self-Service (Purpose of Performance of the Contract)
What personal data do we process?
You can log in to your account on our Website by using your CityBee mobile application login details (e-mail address and password). You have the ability to order travel reports and invoices in your account. For the purpose of generating travel reports, we process the following personal data of yours:
•Name and surname;
•E-mail address;
•Rented vehicle;
•Address of the beginning and end of usage of the vehicle;
•Time of the beginning and end of usage of the vehicle;
•Distance travelled;
•Duration of use of the vehicle.
How do we get your data?
•This personal data is obtained directly from the vehicle you have rented from us.
What is your personal data used for?
•All the aforementioned data (except for the self-service login data) are used to fulfil the contract with you for the services you have ordered;
•Self-service login details, i.e. the login details (e-mail address and password) of the CityBee mobile application are used to create an account for you on the Website and to give you the opportunity to log in to it and submit your travel reports and accounting documents based on them.
To whom can your personal data be provided?
•In order to ensure the proper functioning of the Website, we provide your personal data to the data processors used (such as IT service providers, etc.);
•Data may also be transferred to the competent public authorities and/or law enforcement institutions (e.g. courts, the police or other supervisory authorities), providers of legal services and/or debt collectors, insurance companies and/or other. However, your data will only be provided if it is required by valid laws and only in accordance with the procedure set forth by law in order to ensure our rights, the security of our clients, staff and resources, to file, deliver and/or defend legal claims.
Please note that your personal data is only provided to those third persons which ensure the proper conditions necessary for the processing of personal data and security. Your personal data shall not be transferred to third countries (i.e. beyond the European Union or European Economic Area) or to any international organisations.
Under what conditions of lawful processing do we process your personal data?
•When you order a travel report, your personal data is processed for the purpose of performing the contract in accordance with Article 6 (1) (b) of the Regulation, i.e. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
•In the event that you do not pay for the services provided, your personal data will be processed and provided to legal and/or debt collection service providers in accordance with Article 6 (1) (f) of the Regulation, i.e. processing is necessary for the purposes of the legitimate interests pursued by the Company;
•Article 6 (1) (f) of the Regulation, i.e. processing is necessary for the purposes of the legitimate interests pursued by the Company;
•After performing the contract concluded with the Company for the provision of specific services, we must comply with the obligations imposed on us by law and keep this contract and/or evidence confirming it; therefore we protect your personal data in accordance with Article 6 (1) (c) of the Regulation, i.e. processing is necessary for compliance with a legal obligation to which the controller is subject (as defined in national law).
How long do we process (store) your personal data?
•We process the contracts and/or orders concluded with you, together with the supporting evidence (including the specified personal data), for the entire term of the contract and store: for 3 months if the service is refused; for 5 years after the expiry date of the contract. Data on customers who have not fulfilled their financial and/or property obligations or caused damage to the Company is stored for an additional 5 years.
Fulfilment of Tax Obligations (Issuance and Administration of Accounting Documents)
What personal data do we process?
In order to ensure the proper implementation of tax obligations (i.e. correct issuance and declaration of accounting documents to public authorities) and to issue and administer accounting documents (such as VAT invoices, VAT credit invoices) in cases when you use our services, we process the following personal data of yours:
•Name and surname;
•VAT identification number (when the person is registered as a VAT payer);
•Service details (type of service; price of the service/amount paid).
How do we get your data?
•Directly from you when you provide them to us by registering in the CityBee mobile application.
What is your personal data used for?
•All the abovementioned data is used in order to correctly draw up accounting documents and declare the services provided to you to the state authorities.
To whom can your personal data be provided?
•In order to ensure the proper functioning of the “Self-service” and/or “Accounts” sections of the Website (which contain the abovementioned accounting documents), we provide your personal data to the data processors used (such as IT service providers, etc.);
•Data can also be transferred to state authorities – tax authorities (such as the State Tax Inspectorate), consultants, auditors, etc.
Please note that your personal data is only provided to those third persons which ensure the proper conditions necessary for the processing of personal data and security. Your personal data shall not be transferred to third countries (i.e. beyond the European Union or European Economic Area) or to any international organisations.
Under what conditions of lawful processing do we process your personal data?
•After providing you with services and/or receiving payment for the provided services, we must comply with the obligations imposed on us by law to properly keep the Company’s records and keep accounting documents, therefore we process your personal data in accordance with Article 6 (1) (c) of the Regulation, i.e. processing is necessary for compliance with a legal obligation to which the controller is subject (as defined in national law).
How long do we process (store) your personal data?
•We store the accounting documents issued to you and other relevant personal data for up to 10 years in accordance with national legislation.
Improving the Quality of Customer Service and Information (Recording of Telephone Conversations)
What personal data do we process?
In order to ensure the proper service and information of you by telephone calls, we process (record and store) the following personal data of yours:
•Conversation recording;
•Telephone number;
•Technical details of the conversation (date, duration, etc.).
How do we get your data?
•Directly from you when you call us on the telephone numbers provided to order services, to report any problems or to request the information you need. We only record incoming calls, where callers are provided with additional information about the recordings of their call before the call begins.
What is your personal data used for?
•We use the telephone number and technical data of the call to make it easier to find the call record and identify the caller if necessary;
•We use the recording of the interview to assess the quality of telephone service and/or as evidence of a complaint or other matter.
To whom can your personal data be provided?
•In order to evaluate and continuously improve our telephone service, we may provide access to your personal data to our staff and used data processors (such as a call centre, IT service provider, consultants, etc.);
•Data may also be transferred to the competent public authorities and/or law enforcement institutions (e.g. courts, the police or other supervisory authorities), providers of legal services and/or debt collectors, insurance companies and/or other. However, your data will only be provided if it is required by valid laws and only in accordance with the procedure set forth by law in order to ensure our rights, security of our clients, staff and resources, to file, deliver and/or defend legal claims.
Please note that your personal data is only provided to those third persons which ensure the proper conditions necessary for the processing of personal data and security. Your personal data shall not be transferred to third countries (i.e. beyond the European Union or European Economic Area) or to any international organisations.
Under what conditions of lawful processing do we process your personal data?
•If you contact us by telephone and hear information that the conversation will be recorded and continue the conversation, you consent to such processing of personal data, and we will process your personal data in accordance with Article 6 (1) (a) of the Regulation, i.e. the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
How long do we process (store) your personal data?
•We keep records of your conversation and other relevant personal data for 6 months from the date of the end of the conversation. Conversation records that record the circumstances of a particular event (such as the conclusion/termination of a contract, the submission/examination of a complaint, etc.) will be included in other processing purposes set forth in this Policy and will be retained as evidence for an appropriate period of time.
Administration of Requests, Complaints, Claims (Examination of Inquiries)
What personal data do we process?
In order to evaluate and resolve your requests, complaints, claims or other inquiries you make to us and to make sure that they are reasonable and provide you with an answer and/or to make, enforce or defend legal claims, we process the following personal data of yours:
•Name;
•Surname;
•Contact details (such as address, e-mail address, telephone number);
•Description of the circumstances of the complaint or other inquiry;
•Documents supporting the complaint.
How do we get your data?
•Directly from you and/or your representative when you send us your requests, complaints, claims or other inquiries using the contacts provided by us (such as address, e-mail address, telephone, in public space, including social network communication, etc.).
What is your personal data used for?
•We use the description of the circumstances of your complaint or other inquiry and the supporting documents in order to assess the circumstances of your inquiry and make sure that they are justified;
•We use your name, surname and contact details in order to identify you (i.e. identify the applicant) and provide you with an answer to your inquiry.
To whom can your personal data be provided?
•In order to assess the circumstances of your complaint or other inquiry and to make sure that it is valid, we may transfer your personal data to persons providing legal services (lawyers, bailiffs, consultants, etc.).
•We may also transfer this data to the competent public authorities and/or law enforcement institutions (e.g. courts, the police or other supervisory authorities), providers of legal services and/or debt collectors, insurance companies and/or other. However, your data will only be provided if it is required by valid laws and only in accordance with the procedure set forth by law in order to ensure our rights, security of our clients, staff and resources, to file, deliver and/or defend legal claims.
Please note that your personal data is only provided to those third persons which ensure the proper conditions necessary for the processing of personal data and security. Your personal data shall not be transferred to third countries (i.e. beyond the European Union or European Economic Area) or to any international organisations.
Under what conditions of lawful processing do we process your personal data?
•If you make a complaint, claim or other inquiry regarding your possible rights and/or interests protected by law, we have a legal obligation to examine your inquiry and provide you with an answer, therefore we process your personal data in accordance with Article 6 (1) (c) of the Regulation, i.e. processing is necessary for compliance with a legal obligation to which the controller is subject (as defined in national law);
•By submitting a request, comments, responses or other inquiry to us that does not involve a possible violation of your rights and/or interests protected by law, you consent to us that you allow us to get acquainted with your inquiry and respond to your inquiry, therefore, we process your personal data in accordance with Article 6 (1) (a) of the Regulation, i.e. the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
How long do we process (store) your personal data?
•We process complaints, requests, comments, responses, claims or other inquiries submitted by you during the entire period of examination of the inquiry and store it for 3 months from the date of its examination (except for communication in the public space). Personal data may be stored for a longer period if the complaint or request, remark, claim, response or other inquiry is not examined or is still pending during that period, and if personal data will be necessary to protect our or third parties’ legitimate interests, e.g. in the event of a statutory limitation period or a legal dispute. If the complaint has been resolved by signing the settlement agreement, your personal data will be stored for 10 years.
Data collection of important messages sent to you
In cases when we send you important messages, i.e. information related to the service contract (e.g. change of contract conditions, supplement; change of service pricing, etc.) and/or notifications related to the handling of complaints/claims/requests or similar inquiries (e.g. replies to your claims, complaints, requests; correspondence in resolving a dispute, etc.), we have a legitimate interest in making sure that you have been informed of the latest changes to the Contract and/or Service Rules and to gather evidence that this type of notice has been provided to you and read (opened). Therefore, when we send you this type of message, we additionally monitor this message, i.e. we collect statistical information about the messages sent to you (e.g. the name of the message, the fact and date of delivery of the message, the fact and date of opening (reading) the message, the fact and date of opening the link in the message, etc.).
The collection of the data of the said person (statistical information on the notification) is carried out for the purpose of evidence of proper performance of the contract and/or handling of complaints and in accordance with Article 6 (1) (f) of the Regulation, i.e. processing is necessary for the purposes of the legitimate interests pursued by the Company. These data are stored in the Client’s account for the entire period of performance of the contract and/or complaint/inquiry/claim processing and for 5 years from the date of sending the notice.
Raising Representation and Awareness in Public Space (Communication in Social Networks)
In order to properly represent the Company and increase our awareness in the public space, the Company administers the following accounts for social purposes:
@CityBeeEstonia, at the address: https://www.facebook.com/CityBeeEstonia;
@citybeeEstonia, at the address: https://www.instagram.com/citybeeEstonia/.
What personal data do we process?
In order to communicate with you on social networks, we process the following personal data of yours:
•Name, surname (title);
•Information about the communication in your account (“like”, “follow”, “comment”, “share”, etc.);
•Photos (profile and/or in which the Company is marked);
•Sent messages;
•Information about the message (time of receipt of the message, content of the message, attachments to the message, correspondence history, etc.);
•Information on participation in events and/or games organised by the Company (participation, non-participation, interest, compliance with the rules of the game, etc.);
•Information about the Company’s evaluation (evaluation score, feedback, etc.).
How do we get your data?
•Directly from you (on your social network account) when you communicate with us (using social networking tools such as Messenger or the Live Help section of the Website) and/or when you visit our managed social network accounts and/or Website.
What is your personal data used for?
•All the abovementioned personal data of you are used for mutual communication in the public space, i.e. on social networks.
To whom can your personal data be provided?
•In order to ensure a proper representation of the Company in the public space and to constantly communicate with you, we may transfer your data to data processors used (such as advertising agencies, consultants, etc.);
•Data may also be transferred to the competent public authorities and/or law enforcement institutions (e.g. courts, the police or other supervisory authorities), providers of legal services and/or debt collectors, insurance companies and/or other. However, your data will only be provided if it is required by valid laws and only in accordance with the procedure set forth by law in order to ensure our rights, security of our clients, staff and resources, to file, deliver and/or defend legal claims;
•Please note that your personal data is only provided to those third persons which ensure the proper conditions necessary for the processing of personal data and security. Your personal data shall not be transferred to third countries (i.e. beyond the European Union or European Economic Area) or to any international organisations.
Please note that personal data provided on social networks is processed jointly with the social network controller (i.e. on Facebook and/or Instagram platform), therefore we offer to read the social network controller’s privacy policies for more information on personal data processing on social networks.
Under what conditions of lawful processing do we process your personal data?
•By communicating with us and/or visiting accounts managed by us and our Website, you consent to us being able to access and respond to your communications, and we therefore process your personal data in accordance with Article 6 (1) (a) of the Regulation, i.e. the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
How long do we process (store) your personal data?
•We process the personal data provided by you until the moment of revocation of your consent (i.e. deletion of the provided personal data from the account), but not longer than until the deletion of the Company’s account. We note that personal data will only be processed on the platform of the social network controller, therefore the exact terms and conditions of processing are determined by the platform controller.
•In the event of unauthorised communication (such as slander, defamation of the Company, etc.), we may retain this communication as evidence for an appropriate period of time to protect our violated rights or legitimate interests (i.e. the entire period of out-of-court dispute resolution, pre-trial dispute resolution or litigation).
Please note that more information about the processing of your personal data in the CityBee mobile application can be found in the CityBee mobile application Privacy Policy.
More information about the cookies we use can be found in the Cookie Policy at: https://www.citybee.ee/en/cookie-policy-en
IV.What rights do you have and how can you exercise them?
Data subjects whose personal data we process have the right to:
•request, access and obtain a copy of your personal data;
•request the correction or restriction of inaccurate or incomplete personal data;
•request the removal or restriction of excess or unlawful processing of personal data;
•not consent to the processing of his or her personal data;
•request the transfer of your personal data in a systematic, computer readable format;
•has the right to withdraw consent at any time where the processing is based on the data subject’s consent (pursuant to Article 6 (1) (a)). Revocation of the consent of the data subject shall not affect the lawfulness of the processing prior to revocation;
•submit a complaint to the Data State Inspectorate
The Company does not conduct profiling of your personal data on the basis of which automatic decisions are made and which may have legal consequences for you or may have a significant impact on you.
The data subject may exercise his or her rights by submitting a written request to the Company in person (to an employee of the Company), by post, through a representative or by electronic means – by e-mail: info@citybee.ee, in writing – at the address: Peetri 5, Tallinn, 10415, Eesti.
Upon request, the data subject must prove his or her identity in one of the following ways:
•by submitting a request to an employee of the Company, together with a valid identity document;
•by submitting a request by post or courier, together with a copy of a valid identity document certified in accordance with the procedure established by legal acts;
•by submitting the application electronically, confirming it by electronic means of communication that allow proper identification of the person (e.g. mobile signature, qualified electronic signature, etc.).
Upon the receipt of your request for the exercise of data subjects’ rights, we will provide you with an answer immediately, but no later than within 1 month from the date of the request. This period may be extended by one month, if necessary, depending on the complexity and number of applications. You will be additionally notified of such an extension within one month. The information you request will be provided free of charge. However, if we see that your requests are manifestly unfounded or disproportionate, in particular due to their repetitive content, we reserve the right to charge a reasonable fee (i.e. to claim administrative costs) or to refuse to act on such a request from the data subject.
The reply will be provided in the manner chosen in your request. If you do not specify in the request the way in which you wish to receive a reply, the reply will be sent to you in the same way as the request.
V.What are your duties and responsibilities?
You are responsible for the accuracy, correctness and completeness of the personal information you provide. Therefore, in the event of a change in your personal data (which is necessary to achieve the abovementioned objectives), you have an obligation to immediately notify the Company of the change in your personal data.
By submitting your personal data, you assume full liability for the lawfulness of the submission of your personal data and are liable for any losses that we and/or third parties may incur as a result of the unlawful processing of such personal data.
VI.How do we take care of the security of your personal data?
When processing your personal data, we apply appropriate organisational and technical security measures to protect your personal data from accidental or unlawful disclosure, destruction, alteration or other unlawful acts. The abovementioned measures are chosen taking into account the risks to your rights and freedoms as a data subject.
In this case, we ensure strict access control to the processed personal data, therefore we only grant access to them to those employees who need your personal data to perform work functions and monitor the use of the provided access. Access to personal data is ensured by using the appropriate level of passwords and concluding confidentiality agreements with the persons who access your personal data.
We note that all employees of the Company who have access to your personal data are acquainted with the requirements of personal data protection and must ensure the confidentiality of the processed personal data.
VII.Who may be contacted in the case of additional questions?
You can contact us with any questions by e-mail at: info@citybee.ee or by calling +372 600 0160