PRIVACY POLICY

v1.0

With this Privacy Policy we, ("we" or "Bond Mobility AG""), wish to explain to you ("you" or the "User") how and why we collect and use your personal data when you use our BOND application and its related services (together the "Application"; more information on what these related services are, can be found in the Terms and Conditions).

Your privacy is very important to us, so we wish to be very clear on what we intend to do with your personal data. If you have questions regarding this Privacy Policy or anything explained herein, please do not hesitate to contact us.

We ask you to read this Privacy Policy as well as the terms and conditions of our Application (“Terms and Conditions”; you can consult them here) carefully, because they are both an integral part of our relationship with you.

Please note: this Privacy Policy only covers the collection and use of your personal data by Bond Mobility through the Application. It does not apply to:

your use of our public website, social media channels or your communications with us unrelated to your use of the Application;
the collection and use of your personal data through our other products and services which are not related to the Application;
whatever your bike provider or employer does with your personal data collected through our Application. You are kindly asked to contact your e-mobility device provider (e.g. manufacturer of your electric bike) or employer for more information on how they intend to use your personal data collected via our Application.

WHO IS RESPONSIBLE?

Short: We, Bond Mobility, are responsible for the collection and use of your personal data via the Application for the purposes explained below. In this section we provide you with our contact details in case you wish to contact us regarding our collection and use of your personal data.

The controller (i.e. the entity responsible) for the collection and use of your personal data through the Application is:

Bond Mobility AG
Freistrasse 17
8610 USTER
Switzerland
Enterprise no. (CHE-142.924.229)
E-mail: privacy@bond.info
Tel.: +41 44 544 05 30

WHAT SORT OF PERSONAL DATA DO WE PROCESS?

Short: In this section we list the different categories of personal data that are collected and used when you create a profile and subsequently use our Application.

When you use the Application, we collect and use the following categories of personal data:

personal identification data (e.g. your name, e-mail address, postal address, contact info, etc.);
your driver license. Note, however, that we may engage a third-party payment service provider who will collect your driver licence details (e.g. front and back image of your driver licence)
profile activity and information about your use of the Application;
technical information about your use of your e-mobility device collected by the e-mobility device, the connectivity device and the Application;
payment information for in-app payments. Note, however, that we do not collect your payment credentials itself nor any information which we can use to initiate or execute payments. We do not provide any payment services ourselves. We may engage a third-party payment service provider who will collect your payment credentials (e.g. your credit card number, expiration date and CVV/CVC code or other payment details);
electronic identification data (e.g. information about your phone’s Bluetooth radio, its MAC address and IMEI number of your phone, serial number of your e-mobility device, IP addresses etc.);
use of IT equipment (e.g. the operating system of your mobile device, time stamps, log files, browser type, ISP, etc.);
your location, movements and speed.

In principle we receive all of the personal data listed here directly from you. If you choose to register in our Application using your Facebook or Google account, we will receive your personal identification data from Facebook or Google. You are kindly referred to the privacy policies of Facebook and Google if you want to know more on how these social media providers process your personal data.

WHY DO WE PROCESS YOUR PERSONAL DATA?

Short: We collect and use your personal data for a number of different purposes, which we explain here. We are also obliged to indicate to you why our purposes are legitimate.

We collect and use your personal data for the following purposes:

A. to allow you to use the Application.

Such collection and use are allowed because of the necessity of such collection and use to perform the agreement we have with you through your acceptance of our Terms and Conditions.

We collect and use all of the personal data mentioned in section 2 for this purpose.
B. to verify your age and identity, in order to allow you to use the Bond Mobility Vehicles
Such collection and use are allowed because of the necessity of such collection and use to perform the agreement we have with you through your acceptance of our Terms and Conditions.

We collect and use all of the personal data mentioned in section 2 for this purpose.
C. to allow you to purchase and use third-party services via the Application.
Such collection and use are allowed because of the necessity of such collection and use to perform the agreement we have with you.

We collect and use all of the personal data mentioned in section 2 for this purpose.
D. to communicate with you about the Application (not for promotional purposes).
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of being able to communicate with our users about certain events concerning the Application, such as downtime, incidents, updates, etc.

We collect and use personal data of category 1 as described in section 2 for this purpose.
E. to provide our services to our customers (i.e. mobility service and equipment providers; employers; etc.).
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of providing our services to our customers. Note, however, that we only share your personal data with the customer with whom you also have a relationship (directly or for instance via your employer). Our customers are themselves responsible to inform you about the use they make of your personal data.

We collect and use personal data of categories 1, 3 and 8 as described in section 2 for this purpose.
F. for improving the Application, personalise and enhance your experience adding new features and developing new services.
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of continuously improving our products and services. Our customers are themselves responsible to inform you about the use they make of your personal data.

We collect and use all of the personal data mentioned in section 2 for this purpose.
G. for statistical reasons, so that we may understand how you and others use the Application.
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of assessing how the Application and its features are used. Our customers are themselves responsible to inform you about the use they make of your personal data.

We collect and use personal data of categories 3, 6 and 7 as described in section 2 for this purpose.
H. for security reasons and misuse detection, prevention and reporting.
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of keeping the Application, its underlying systems and infrastructure as well as our users safe and secure from fraudulent, malicious or harmful content or behaviour.

We collect and use all of the personal data mentioned in section 2 for this purpose.
I. to defend ourselves in legal proceedings.
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of being able to build our case, compile evidence and defend ourselves in courts or other judicial proceedings.

We collect and use all of the personal data mentioned in section 2 for this purpose.
J. to inform any third party in the context of a possible merger with, acquisition from/by or demerger by that third party, even if that third party is located outside the EU.
Such collection and use are allowed because of the necessity of such collection and use to pursue our legitimate interest of being able to conclude corporate transactions.

We collect and use all of the personal data mentioned in section 2 for this purpose.
K. to send you promotional communications, newsletters or marketing materials.
For such collection and use we will ask for your consent before we make any personal data available to other users.

We collect and use personal data of category 1 as described in section 2 for this purpose.
L. to build user communities.
As a social network we share your information with other my.bike members and the public in accordance with your privacy settings. For such collection and use we will ask for your consent before we make any personal data available to other users.

We collect and use personal data of categories 1, 3 and 8 as described in section 2 for this purpose.
M. to comply with our legal obligations as well as with any valid request from law enforcement, judicial or governmental authorities.
Such collection and use are allowed because of the necessity to comply with our legal obligations.

We collect and use all of the personal data mentioned in section 2 for this purpose.

RECIPIENTS AND TRANSFERS

Short: Your personal data are shared with a limited number of parties, such as our own service providers and our customers. We can also share your personal data with other users if you have consented to this. In this section we explain to whom we send your personal data and how we ensure that your personal data are kept safe when sent abroad.

Your personal data may be sent to the following categories of recipients:

yourself;
other users (if you have consented to this)
your contacts or business relations (e.g. your employer);
our customers (if you have a direct or indirect relationship with a customer) and service providers (e.g. for maintenance and repair requests) ;
social media providers if you choose to use their services to register in our Application;
our shareholders, potential acquirers, subsidiaries and affiliates;
governmental, judicial and other competent bodies.

Your personal data are processed in the European Union. If we were to transfer your personal data outside the European Economic Area (“EEA”) at some point in the future, we will ensure that these data are adequately protected through:

the recipient country having legislation in place which may be considered equivalent to the protection offered within the EEA, or
a contractual arrangement between us and that third party.

HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

Short: We only retain your personal data as long as required to achieve the purposes listed in section 3 and in any case for the duration of you having an account in the Application and until ten years after such account has been closed.

Your personal data are only processed for as long as needed to achieve the purposes listed in section 3 above. Where our collection and use of your personal data relies on your consent, we will stop using your personal data for such purpose when you withdraw your consent.

However, please bear in mind that your personal data will at the earliest be de-identified after ten (10) years starting from the moment where you close your account with us.

Moreover, de-dentification will only be possible when none of the following overriding circumstances arises:

an overriding interest of Bond Mobility or any other third party in keeping your personal data identifiable;
a legal or regulatory obligation or a judicial or administrative order that prevents us from de-identifying.

WHAT RIGHTS DO YOU HAVE?

Short: You have a right to access, correct or erase your personal data or limit or oppose the processing of your personal data. You also have a right to data portability and the right to withdraw earlier given consent.. In this section we explain how and under which conditions you may exercise these rights.

You have the right to request access to all personal data processed by us insofar it pertains to you. You can exercise this right first and foremost via the Application itself. We reserve the right to refuse multiple requests for access that are clearly submitted for causing nuisance or harm to us or others or we may choose to charge you an administrative fee.
You have the right to ask that any personal data pertaining to you which are inaccurate, are corrected free of charge. Some personal data you can correct yourself via the Application. If a request for correction is submitted, such request must be accompanied of proof of the flawed nature of the data for which correction is asked.
You have the right to request that personal data pertaining to you will be deleted if they are no longer required in light of the purposes outlined above. However, you need to keep in mind that a request for deletion will be evaluated by us against:
1. our own or a third party’s overriding interests;
2. legal or regulatory obligations or administrative or judicial orders which may contradict such deletion.
Instead of deletion you can also ask that we limit the processing of your personal data if and when (a) you contest the accuracy of that data or you object to our processing of it and you want us to limit the processing of your personal data for the time during which we are assessing the validity of you claim, (b) the processing is illegitimate or (c) the data are no longer needed for the purposes which are outlined above, but you need them to defend yourself in judicial proceedings.
You have the right to oppose the processing of personal data for the purposes C through I in section 3, but you are required to explain your particular circumstances on which your request for opposition is based.
For the purposes A, B, J and K in section 3, you have the right to receive from us in a structured, commonly used and machine-readable format all personal data you have provided to us.
For the purposes J and K in section 3 you have the right to withdraw your earlier given consent. You can do this via the Application or by following the process as described below.
Each request addressed to us can be send via e-mail to privacy@bond.info

An e-mail requesting to exercise a right will not be construed as consent with the processing of your personal data beyond what is required for handling your request. Such request should clearly state and specify which right you wish to exercise and the reasons for it, if such is required. It should also be dated and signed, and accompanied by a digitally scanned copy of your valid identity card proving your identity.

We will promptly inform you of having received this request. If the request proves valid, we will notify you as soon as reasonably possible and at the latest thirty (30) days after having received the request.

If you have any complaint regarding the processing of your personal data by Bond Mobility, you may always contact us via the e-mail address mentioned above. If you remain unsatisfied with our response, you may file a complaint with the competent data protection authority, i.e. the data protection authority.