Privacy Statement

Cargoroo B.V.

Latest update: 24 November 2021

Version 2.0

Who are we and what do we do?

We are Cargoroo B.V. (Cargoroo). Cargoroo offers smart electric shared cargo bikes in your neighbourhood. You can easily book, pay for and use our cargo bikes via our App (our Services). On our Website www.cargoroo.eu you can find more information about Cargoroo and our Services.

Through this Privacy Statement, we explain what personal data we process through our App, Website and Services. We also explain the purposes for which we use your data, how we secure it and how we store it.

What personal data do we collect and how do we use it?

We collect various types of personal data from Users of our App, Website and Services. Below we have broken down the personal data we collect in these cases.

Data that we process from our Users:

Personal data	Purposes	Legal basis
Contact Details Users: First and last name, date of birth, address details, e-mail address and telephone number. To sign up to our service we ask for proof of identity where we ask for your photo and the BSN number to be taped.	We use this data to: to contact you; to address you by your name; verify your identity and your date of birth; Create your account (e.g. by sending a verification email and text message); Send updates, newsletters and offers (only if you are already a paying User with us or if you have given us permission to do so).	We process this personal data to perform the contract between you and Cargoroo, to be sure with whom we are entering into a contract, and to be sure that you meet our minimum age requirement. If you haven’t opted out of receiving communications from us, we may send updates, newsletters and offers to paying Users because we have a legitimate interest in keeping them informed of this information. We will only send newsletters and offers to parties other than paying Users based on consent. You can always unsubscribe from our newsletter by using the unsubscribe link at the bottom of each newsletter.
Account details: Contact details supplemented with your usage history.	We use this data to: contact you; enable you to use the Services; take stock of the Services you have previously purchased from us; bill you for the Services you have used Improve and optimize our Services.	We process this personal data because it is necessary in order to carry out our agreement with you. In addition, we may process this personal data based on a legitimate interest to improve and optimize our Services.
Usage data: Location data (when unlocking and locking) of the cargo bike and during use of the cargo bike	We use this data to: show you which share cargo bikes are in your neighbourhood to make sure the share cargo bike doesn't unlock until you're nearby; To be able to track our shared cargo bikes and to recognize and prevent any abuse.	We process this personal data because it is necessary to carry out the agreement between you and Cargoroo. In addition, we may process this personal data based on a legitimate interest to protect our property.
Bank details of our Users: Bank account number Authorizations Payment details	Wij gebruiken deze gegevens om: collect payments due for the use of the Services from your bank check and administer your payments for our Services.	We process this data as necessary to carry out the agreement between you and Cargoroo. Moreover, we are legally obliged to keep financial records for the benefit of the tax authorities.
Technische Information: Information about the device you use to access our Services, the IP address by which, the times when, and the location from which you use our Services, and information about the browser you use.	We use this data to: Customize our App and Website for your device; recognize and prevent abuse of our Services.	We process this personal data because we have a legitimate interest in providing you with a well-functioning website. In addition, we have a legitimate interest in logging your activity to prevent misuse of our Services.
Contact details by email, phone or social media: Information that you disclose to us when you send us a message through the Website or through our social media or when you call us, for example, your first and last name, email address/Username and any personal data included in the message.	We use this data to: to contact you based on your message; Process your feedback/input to improve our Services.	We process this personal data because we have a legitimate interest in helping you with your question or comment and because you voluntarily disclose this data. On the following pages you can see how these companies handle your personal data: Instagram: Privacyinstellingen en informatie Facebook: Data Policy Twitter: Privacy Policy LinkedIn: Privacy Policy
Posts or references on our social media: Information that you disclose to us by posting on our social media, for example, your first and last name, email address/username, and any personal information included in the message.	We use this data to: Give our (potential) Users the possibility to inform each other on our social media; To promote our services, for example if you leave a review on one of our Social Media.	We process this personal data because we have a legitimate interest in helping you with your question or comment and to use your reference and because you voluntarily disclose this data. On the following pages you can see how these companies handle your personal data: Instagram: Privacyinstellingen en informatie Facebook: Data Policy Twitter: Privacy Policy LinkedIn: Privacy Policy
Personal data	Purposes	Legal basis

Personal data

Purposes

Legal basis

Contact Details Users:

First and last name, date of birth, address details, e-mail address and telephone number.

To sign up to our service we ask for proof of identity where we ask for your photo and the BSN number to be taped.

We use this data to:

to contact you;
to address you by your name;
verify your identity and your date of birth;
Create your account (e.g. by sending a verification email and text message);
Send updates, newsletters and offers (only if you are already a paying User with us or if you have given us permission to do so).

We process this personal data to perform the contract between you and Cargoroo, to be sure with whom we are entering into a contract, and to be sure that you meet our minimum age requirement.

If you haven’t opted out of receiving communications from us, we may send updates, newsletters and offers to paying Users because we have a legitimate interest in keeping them informed of this information. We will only send newsletters and offers to parties other than paying Users based on consent.

You can always unsubscribe from our newsletter by using the unsubscribe link at the bottom of each newsletter.

Account details:

Contact details supplemented with your usage history.

We use this data to:

contact you;
enable you to use the Services;
take stock of the Services you have previously purchased from us;
bill you for the Services you have used
Improve and optimize our Services.

We process this personal data because it is necessary in order to carry out our agreement with you.

In addition, we may process this personal data based on a legitimate interest to improve and optimize our Services.

Usage data:

Location data (when unlocking and locking) of the cargo bike and during use of the cargo bike

We use this data to:

show you which share cargo bikes are in your neighbourhood
to make sure the share cargo bike doesn't unlock until you're nearby;
To be able to track our shared cargo bikes and to recognize and prevent any abuse.

We process this personal data because it is necessary to carry out the agreement between you and Cargoroo.

In addition, we may process this personal data based on a legitimate interest to protect our property.

Bank details of our Users:

Bank account number
Authorizations
Payment details

Wij gebruiken deze gegevens om:

collect payments due for the use of the Services from your bank
check and administer your payments for our Services.

We process this data as necessary to carry out the agreement between you and Cargoroo.

Moreover, we are legally obliged to keep financial records for the benefit of the tax authorities.

Technische Information:

Information about the device you use to access our Services, the IP address by which, the times when, and the location from which you use our Services, and information about the browser you use.

We use this data to:

Customize our App and Website for your device;
recognize and prevent abuse of our Services.

We process this personal data because we have a legitimate interest in providing you with a well-functioning website.

In addition, we have a legitimate interest in logging your activity to prevent misuse of our Services.

Contact details by email, phone or social media:

Information that you disclose to us when you send us a message through the Website or through our social media or when you call us, for example, your first and last name, email address/Username and any personal data included in the message.

We use this data to:

to contact you based on your message;
Process your feedback/input to improve our Services.

We process this personal data because we have a legitimate interest in helping you with your question or comment and because you voluntarily disclose this data.

On the following pages you can see how these companies handle your personal data:

Instagram: Privacyinstellingen en informatie

Facebook: Data Policy

Twitter: Privacy Policy

LinkedIn: Privacy Policy

Posts or references on our social media:

Information that you disclose to us by posting on our social media, for example, your first and last name, email address/username, and any personal information included in the message.

We use this data to:

Give our (potential) Users the possibility to inform each other on our social media;
To promote our services, for example if you leave a review on one of our Social Media.

We process this personal data because we have a legitimate interest in helping you with your question or comment and to use your reference and because you voluntarily disclose this data.

On the following pages you can see how these companies handle your personal data:

Instagram: Privacyinstellingen en informatie

Facebook: Data Policy

Twitter: Privacy Policy

LinkedIn: Privacy Policy

Personal data

Purposes

Legal basis

How long do we keep your personal data?

We will retain your personal data for as long as we need it for the purposes outlined above and as further described below.

We will retain your personal data for as long as you regularly use our Services. Copies of IDs will only be used for registration purposes and will be deleted as soon as possible and in any event after a maximum of 30 days. If you have not logged into your account or the App for two years, we will send you two reminders within six months that you have an account with us. If you do not take action as a result of these reminders, we will delete your account and the personal data associated with it within 60 days after the second reminder. If you delete your account yourself, we will keep your personal data for another 6 months in case you change your mind. After this period your personal data will be permanently deleted.

As an exception to the above principles, we may also need to retain some personal data for a period of time after deleting your account for other purposes, including legal obligations. For example, we are required by law to retain certain information (such as purchases made) for 7 years based on tax laws.

Below are a number of retention periods for personal data that we process as part of our Services, or because we are legally obliged to do so:

LoLocation data: We keep this data for 6 months, unless the data is needed longer for the purposes mentioned above. Thereafter, this data will be deleted, with the exception of the data we have included in the invoices;
Personal data in our administration for the tax authorities: we keep this data for 7 years, unless we are legally obliged to keep the data longer;
Copies of identity documents for registration purposes: We delete these data as soon as possible, and in any event within 30 days, unless we are legally obliged to retain the data for a longer period (e.g. on the instructions of investigating authorities or a court order);

Sharing your personal data with others

We use third party service providers to manage and/or host our Website (ie. Amazon Web Services, Microsoft Azure, Google Cloud and Digital Ocean), to verify the identity and date of birth of our users (ie. Onfido), to keep track of the location and unlock and lock our bicycles (ie. Conneqtech), for sending verification messages, emails, text messages and newsletters (ie. Messagebird and Mailchimp), for verifying payment details and making payments and possible collections (ie. Mollie), and for keeping our administration (ie. Lotus and Exact).

We only provide personal information to third party service providers that is necessary for them to perform the services they provide to us. We have contractual agreements with service providers to protect your personal data and regulate, among other things, what these parties are allowed to do with your personal data, how they must secure it and when it must be deleted.

We will also share your personal data with courts, law enforcement authorities, regulators, government officials or attorneys or other parties where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim, or for the purposes of a confidential alternative dispute resolution process.

If we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets to whom we assign or novate any of our rights and obligations

We will only share your data with third parties if this is necessary or if we are legally obliged to do so.

Transfer of personal data

Your personal data may be transferred to countries outside the European Economic Area (EEA) or the UK; in particular, to the US, where some of our service providers are based. When such information is transferred outside the EEA or the UK and that country does not have an adequacy decision from the European Commission (or in the case of the UK, the UK government) (see here), data is appropriately protected through the use of the European Commission or the UK Information Commissioner approved standard contractual clauses (see here), or a service provider's binding corporate rules (BCRs, see here). If you would like to know more about how we transfer and protect your data outside the EEA or the UK, please contact us using the contact details in this statement.

Use of anonymous data

We may strip your personal data of any direct or indirect identifying information. This means that the data will be completely and irreversibly anonymized and merged: they can no longer be considered as personal data because they can no longer be identified. We may share this anonymized data with (local and regional) authorities for analysis purposes, to build up demographic profiles and to improve our services.

How do we protect your data?

We protect your personal data against unauthorised and unlawful access, modification, disclosure, use and destruction. We take, among other things, the following technical and organizational measures to protect your personal data:

Personal data is stored on servers which comply with ISO27001 and PCI-DSS.
Only authorized employees have access to personal data
All passwords, payment information, and credit card numbers are stored encrypted
Access to our systems is secured via Secure Socket Layer (SSL) or Transport Layer Security (TLS) and similar technologies.

Third party websites

You may find links and other references on our Services to the websites and services of partners, suppliers, advertisers or other third parties. We have no control over the content behind these links and we are not responsible for the practices of such websites and services. These services usually have their own terms of use, policies and privacy statements and we encourage you to read them carefully.

Cookies

Our services make use of cookies. A cookie is a simple, small text file that can be placed on your computer when you visit the Website or make use of our App (hereinafter for the sake of convenience referred to as the Website). This text file identifies your browser and/or computer. When you visit our Website again, the cookie allows our Website to recognize your browser or computer.

We use the following types of cookies:

Functional Cookies: Functional cookies are essential for the operation of our Website. They enable you to navigate around our Website and use the features it contains. Cargoroo uses these cookies to optimise the functionality of certain pages of the Website.
Analytical or statistical cookies: Analytical cookies are used to examine the quality and effectiveness of the Website. For example, we can see how many users visit the Website and which pages are visited. We use this information to improve our Website and Services. Cargoroo uses these cookies to process the surfing behavior of large numbers of visitors - anonymously - into graphs and patterns that help us improve and optimize our Websites.
Tracking Cookies: Tracking cookies track the click and browsing behaviour of our visitors. These cookies allow us to see if and when you view your profile and if you click through to our Website. We may use these cookies to serve you with advertisements based on your interests. Cargoroo uses these cookies to personalize communications from Cargoroo on its own site and on its partner sites to better meet the needs of individual users.

Changes to this privacy statement

We are constantly seeking to improve our Website and Services. We may therefore update this privacy statement from time to time. If we change our privacy statement in any significant way, we will post this on our Website and App along with the updated privacy statement.

Your rights

You have the right to ask us for a copy of your personal data; to correct, delete or limit the processing of your personal data; and to obtain certain personal data in a structured, machine-readable format and ask us to transfer it to another party. In some cases you can also object to the processing of your personal data. To the extent we have relied on consent for the processing of your personal data, you have the right to withdraw such consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

These rights may be limited, for example, if complying with your request would reveal personal information about another person, if it would violate the rights of a third party (including our rights), or if you ask us to delete information that we are legally required to retain or where we have compelling legitimate interests to retain it.

To exercise these rights, or to obtain other information, please contact us using the details set out below. If you have any unresolved issues, you have the right to lodge a complaint with a relevant regulator.

Onze contactgegevens

Address:	Cargoroo B.V. Govert Flinckstraat 309 H 1074 CA Amsterdam Netherlands
E-mail:	support@cargoroo.nl
Support:	+31 85 016 14 44