PROCESSING ACTIVITY

PURPOSE

DATA PROCESSED

LEGAL BASIS

RETENTION

RECIPIENTS

Preliminary enquiry, booking and quotation

Receiving rental requests, prior consultation, preparing quotations, recording and confirming bookings.

Name* (identification);
e-mail address and/or telephone number* (contact); planned rental date/time and location*; requested Bicycle, number of Accessories and Users (preparation of quotation/booking); date/time of enquiry or booking* (record keeping); individual request or comment (service preparation).

Art. 6(1)(b) GDPR – steps taken at the Renter’s request prior to entering into a Rental Agreement.

If a contract is concluded: according to the retention period applicable to the Rental Agreement; if no contract is concluded: 1 year from closure of the quotation/booking.

Processors under Section VII, in particular hosting provider and document-storage provider.

Conclusion and performance of the Rental Agreement

Conclusion and performance of the electric bicycle rental agreement; identification of the Parties; contact; fulfilment of rights and obligations arising from the Rental Agreement.

Name*, birth name, place and date of birth*, mother’s name*, address*, telephone number*, e-mail address*; identifiers of Bicycle and Accessories*; rental period and locations*; fact that a photo ID was presented*; rental fee, deposit, delivery/return fee, payment method*; Renter’s signature*; in case of assistance/technical rescue, GPS coordinates.

Art. 6(1)(b) GDPR – performance of the Rental Agreement.

5 years from termination of the Rental Agreement; for data appearing on accounting documents, until expiry of the right to assess tax. For rescue/assistance, GPS data are retained for the period applicable to GPS processing.

Processors under Section VII, in particular hosting and document-storage providers.

Documentation of handover and return

Recording the condition of the Bicycle and Accessories, evidencing performance of the rental and supporting settlement of the deposit.

Date of Rental Agreement*, Renter’s name*, Users’ names and ages (identification of actual user and verification of age conditions), rental period*, Bicycle and Accessory identifiers*, date/time, place and condition data at handover/return, deposit settlement data, signatures of Renter and Lessor*.

Art. 6(1)(b) GDPR – performance of the Rental Agreement. For User data: Art. 6(1)(f) GDPR – legitimate interest of the Controller: identifying persons authorised to use the Bicycle and enforcing the rules of use.

5 years from termination of the Rental Agreement.

Processors under Section VII, in particular hosting and document-storage providers.

GPS tracking

Protection of the Bicycle as an asset, management of late return, and assisting in locating a lost or stolen Bicycle.

Bicycle identifier*, GPS-device identifier, current or last known geographical position, time of positioning, Bicycle speed data, alert-event data.

Art. 6(1)(f) GDPR – legitimate interest of the Controller: protection of the high-value Bicycle, locating it in the event of theft, loss or failure to return, and protection of the Controller’s financial interests.

72 hours after closure of the rental; 30 days in backups for system-recovery purposes; in the event of damage, delay or legal dispute, for as long as necessary to enforce claims, but no longer than 5 years.

Processors under Section VII, in particular hosting and VPS providers. Other recipients: competent authority, police.

Payment, fees and deposit management

Recording rental fees, deposits and other charges, settlement of the deposit and financial accounting.

Renter’s name*; amount and legal title of charges*; payment method*; fact, date/time and amount of payment; transaction or bank identifier; confirmation of payment success; data on payment, deduction and refund of deposit; reason for deduction.

Art. 6(1)(b) GDPR – performance of the Rental Agreement.

5 years from termination of the Rental Agreement; for data on accounting documents, until expiry of the right to assess tax.

Processors under Section VII, especially online invoicing and document-storage providers. Other recipient: Worldline Financial Services (Europe) S.A.; its Hungarian intermediary and processor BizWorks Kft. (BizPay), for card-terminal payments.

Invoicing

Issuing invoices and retaining accounting documents.

Billing name*, billing address*, tax number; invoice items and amount, date of performance, payment method; billing e-mail address if the invoice is sent electronically.

Art. 6(1)(c) GDPR – legal obligation (Section 179 of the VAT Act and Sections 77–78 of the Taxation Act).

Until expiry of the right to assess tax, pursuant to Sections 78(3) and 202 of the Taxation Act.

Processors under Section VII: hosting, document-storage and online invoicing providers. Other recipients: Hungarian National Tax and Customs Administration (NAV), accountant [Fehér Anita, 8900 Zalaegerszeg, Vörösmarty Mihály u. 22., feheranita0831@t-online.hu].

Handling damage, malfunction, accident and theft

Documenting incidents, preliminary and final assessment of loss, settlement of deposit, enforcement of legal claims.

Date of Rental Agreement*, Renter’s name*, name and signature of affected adult User, rental period*, date/time of damage report*, Bicycle and affected Accessory identifiers*, date/time, place and nature of incident, description of damage/missing item/fault, Renter/User statement, related evidence and reports, service/quotation data, damage assessment, cost and deposit settlement data.

Art. 6(1)(f) GDPR – legitimate interest: documenting damage, settling deposit and damage claims, asserting, enforcing and defending legal claims. For any health data arising: Art. 9(2)(f) GDPR – establishment, exercise or defence of legal claims.

5 years from closure of the incident or due date of the claim; in authority or court proceedings, until the end of the limitation period following final closure.

Processors under Section VII: hosting and document-storage providers. Other recipients: insurer, repair service, expert, competent authorities.

Enforcement of legal claims

Establishment, exercise or defence of legal claims and participation in authority, court, notarial, enforcement and other legal proceedings.

Identification, address and contact data; contractual, financial, complaint, damage and other case data relating to the matter; statements, evidence and procedural documents.

Art. 6(1)(f) GDPR – legitimate interest: establishment, exercise or defence of the Controller’s legal claims and evidencing its position in proceedings.

5 years from closure of the case/proceedings; if proceedings are pending, until the end of the limitation period following final closure.

Other recipients: lawyer, legal adviser, competent authorities, conciliation body, notary, court, bailiff, expert and persons participating in the dispute/proceedings.

Complaint handling

Investigating, answering and recording consumer complaints.

Name*; contact details*; content of complaint*; attachments; dates of submission and response*; minutes/record data*.

Art. 6(1)(c) GDPR – legal obligation (Section 17/A of the Consumer Protection Act).

Copy of the record and response: 3 years (Section 17/A(7) of the Consumer Protection Act).

Processors under Section VII, especially hosting and document-storage providers. Other recipient: consumer-protection authority.

Partner commission settlement and tracking rentals

Identifying rentals generated through a Partner recommendation; calculating, settling and paying Partner commission.

Name or identifier of referred/forwarded Renter, rental date and performance data, basic bicycle-rental fee, commission base, commission rate and amount, payment, invoice/document and transfer data.

Art. 6(1)(f) GDPR – legitimate interests of the Controller and third party (Partner): performance of the cooperation agreement with the Partner and proof of the legal basis and amount of commission.

Commission-settlement and contractual data: 5 years from termination of the business relationship; invoice data: until expiry of the right to assess tax.

Processors under Section VII, especially hosting and document-storage providers. Other recipient: Partner as independent controller.

Handling data-subject rights

Receiving, identifying, fulfilling and evidencing requests under the GDPR.

Identification data, contact details, content of request, attachments, time/place/method of submission.

Art. 6(1)(c) GDPR – legal obligation under Chapter III GDPR.

Until expiry of the limitation period relating to the request; generally no longer than 5 years.

Processors under Section VII, especially hosting and document-storage providers.