Privacy Policy Pave Commute App

The app “Pave Commute” (“App“) is operated by Carployee GmbH, FN 487221b, Peter-Behrens-Platz 10, 4020 Linz (“we” or “us”). Since the protection of your personal data (“data“) is of particular concern to us, we process your data exclusively on the basis of the applicable legal provisions. In this statement, we inform you in accordance with Art 13 and 14 of the General Data Protection Regulation (“DSGVO“) about how we, as the data controller, process your data in connection with the app. 

This Privacy Policy is directed to (i) our enterprise customers, including, without limitation, employers / universities / recreational institutions, together with their representatives (“Organization” or “Enterprise Customer”) and (ii) consumers who use the App (“Users”; collectively, “you“, “your“).

We would like to point out that in connection with the app, we only act in the role of data controller (Art 4 Z 7 DSGVO) with regard to the data processing described in this privacy policy. In the context of sending invitation links from organizations (employers) and the shift schedule connection, on the other hand, we act as the processor of the respective organization (Art 4 Z 8 DSGVO). For further information on these data processing activities, we therefore refer users to the privacy policy of the respective organization.

1. What categories of data are processed?

A. If you are an organization, we process your data that falls under the following categories:

• Name/Company
• Contact information (e-mail address, phone number)
• Address
• Invoice data
• Bank data
• Technical data (date, time and duration of use of the app, IP address, system data on the device and operating system used)
• Any other data provided when contacting us

B. If you are a user, we process your data that falls under the following categories:

• First and last name
• Contact information (e-mail address, phone number)
• Address
• Technical data (date, time and duration of use of the app, IP address, system data on the device and operating system used)
• Location data and data from activity sensors
• Any other data provided when contacting us
• Data on mobility behavior

2. How do we process your data?

A. If you are an organization, we process your data for the following purposes and on the basis of the following legal grounds:

a) Business relationship and processing

We process data of the organization (in particular contact data, billing data, other relevant data for offering benefits) for the fulfillment of our obligations arising from the contractual relationship with the organization (pursuant to Art 6 para 1 lit b DSGVO), for the fulfillment of legal obligations (Art 6 para 1 lit c DSGVO) and/or for the protection of legitimate interests, unless the interests of the organization in the confidentiality of its data prevail (Art 6 para 1 lit f DSGVO).

b) Contact

When organizations contact us via email or through the contact options otherwise offered, the data provided by the organization will be processed in order to handle and respond to the respective request, in particular: Name, email or phone number, any data provided in the text or conversation. 

We process data for the purpose of contacting us in the context of (pre-)contractual relationships pursuant to Art 6 para 1 lit b DSGVO.

B. If you are a user, we process your data for the following purposes and on the basis of the following legal grounds:

a) Registration and account management

The app can be downloaded to a mobile device via Google Play Store or Apple App Store (“App Store“). In the course of registering a user in the app, the user can either create a user account via email or use an existing user account from Google or Apple (Single Sign On, “SSO“). 

If a user decides to register via SSO and clicks on the respective login button, he or she will automatically be redirected to the pages of Google or Apple. There, the user can log in to his user account. This links the respective Google or Apple user account with our app. This link gives us access to a user’s data stored at Google or Apple. These are in particular name and email address. This data is used exclusively to set up, provide and personalize the app user account. We do not use the login to access personal data such as friend lists or contacts or to store them for our own purposes. 

This processing of data in the context of the registration of a user and his account management is carried out for the fulfillment of (pre-)contractual obligations from our contractual relationship with the user pursuant to Art 6 para 1 lit b DSGVO. Processing in the context of linking with SSO services is based on the user’s consent pursuant to Art 6 para 1 lit a DSGVO. Users can undo the link at any time via their Google or Apple user account.

b) Cookies and tracking in the context of app use

In the course of using our app, we collect the following data from users, in particular for the purposes of quality assurance and further development of the app: date, time and duration of use of the app, IP address, system data on the device used and operating system. We collect this data automatically with cookies and analysis tools provided by third-party providers on the basis of the user’s consent pursuant to Art 6 (1) lit a DSGVO (or in connection with § 165 (3) TKG in the case of so-called “persistent” cookies, which are stored on the user’s terminal device).

Users can reject the storage of individual cookies or the use of analysis tools (by means of configuration in the cookie banner) or revoke the storage or use of analysis tools in the app settings at a later time. When cookies are set or analysis tools are used on the basis of voluntary consent, user data is sometimes transmitted to recipients in third countries outside the EEA, in particular to the USA. The USA has not been certified by the European Court of Justice as having an adequate level of data protection; in particular, there is a risk that data may be viewed by US authorities for control and monitoring purposes. By giving their consent, users agree that cookies and analysis tools from third-party providers in the USA or from other insecure third countries may be used and accept a possible lower level of data protection (Art 49 para 1 lit a DSGVO).

Cookies that are absolutely necessary for the structure or functioning of the app (technically necessary cookies) cannot be deactivated. In these cases, the data processing is based on our legitimate interest pursuant to Art 6 (1) f DSGVO to be able to provide the app in a correspondingly functional manner. 

c) Onboarding, route recommendations, matching, and points accumulation as part of app usage.

Based on the user’s addresses, the app calculates route recommendations to workplaces or other regularly visited locations for each day (“onboarding“). When using the app, users then receive suggestions regarding optimal travel routes and means of transport (“route recommendations“). In addition, users can also search for carpooling opportunities or exchange information with like-minded users about the route or their choice of means of transport in chat groups. Chat groups are created for users who have a similar or identical journey (“matching“). In the course of matching, only the first name, the respective distance to each other, and an approximate location are visible to other users. Users are free to communicate further via chat and to share their exact route, address or location with other users. By using the app for (daily) travel, the user can collect points for mobility behavior on travelled routes (“collecting points“), which can be redeemed via the app for benefits of various kinds (“Benefits“; see point f) for more details).

This processing of data in the context of onboarding, route recommendations, matching or the creation of chat groups as well as the collection of points is carried out in order to fulfill our contractual obligations from our contractual relationship with the respective user pursuant to Art 6 para 1 lit b DSGVO as well as due to our legitimate interest pursuant to Art 6 para 1 lit f DSGVO to be able to offer the best possible service in the context of the app for users. 

d) GPS tracking and activity sensors

In order to make full use of the app’s functionalities, in particular to receive optimal suggestions regarding the choice of means of transport and routes or carpooling to the organization or to check whether users are also implementing these suggestions correctly, the app accesses the user’s location and activity sensors of the user’s end device. This is done exclusively on the basis of explicit consent pursuant to Art 6 para 1 lit a DSGVO, which users can edit or revoke at any time in the app settings.

e) Establishing employer linkages and data sharing.

If users want to connect to their employer via the app and provide the employer with information about their work-related mobility behavior, we process data for the purpose of establishing the link (first name, last name and email address) as well as the transmission and display of data about the user’s mobility behavior (points collected and means of transport selected) on the basis of express consent pursuant to Art 6 para 1 lit a DSGVO, which users can edit or revoke at any time in the app settings. The display of data on driving behavior transmitted in the context of the link takes place in the form of aggregated statistics and does not provide any information about specifically selected routes of individual users, as well as locations, distances traveled, CO2 emissions or times of individual trips. The establishment of a personal reference by the employer is only possible in exceptional cases (depending on the number of linked users). 

f) Redemption of benefits

In case of redemption of a benefit by a user, we process data (in particular name, email address, address (optional) as well as statistical data on the mobility behavior of the user) for the purpose of fulfilling our contractual obligations arising from the contractual relationship with the user, including the transmission of information required for the redemption of benefits to third party recipients (organizations), pursuant to Art 6 para 1 lit b DSGVO. 

For data processing subsequent to this transfer carried out by Carployee with the purpose of providing redeemed benefits, the respective organization is (independently) the data controller (Art. 4 Z 7 DSGVO). For the provision of benefits that are offered and made available directly by Carployee (“Pave Commute Benefits“), please see point g). 

g) Provision of Pave Commute Benefits

In the context of providing Pave Commute Benefits, we process data (in particular name, email address, address if applicable) for the purpose of fulfilling our contractual obligations arising from the contractual relationship with the User pursuant to Art 6 para 1 lit b DSGVO.

h) Contact by user

If users contact us via email or via the otherwise offered contact options, the data provided by the user will be processed in order to process and respond to the respective request, in particular: Name, email or telephone number, any data provided in the text or conversation. 

We process data for the purpose of contacting us in the context of (pre-)contractual relationships pursuant to Art 6 para 1 lit b DSGVO.

i) Contacting users regarding new app features / changes

In order to keep users up to date with new features of the app, they will receive e-mails about any technical innovations at regular intervals as part of their app use. 

We base this data processing on our legitimate interest pursuant to Art 6 para 1 lit f DSGVO to improve the use of the app and to inform users about innovations and changes regarding the use of the app. 

3. Storage duration

A. If you are an organization, we store your data as follows:

We store data within the scope of a business relationship with the organization for the duration of the active contractual relationship as well as beyond that in accordance with the statutory retention and documentation obligations (e.g. in accordance with UGB and BAO).

B. If you are a user, we store your data as follows:

We generally store user data for the duration of their active app user account. If the processing of user data is based on consent, we store the data until the respective user revokes it. 

4. Who will your data be shared with?

Your data will be communicated to the following recipients in the course of processing for the above purposes:

• IT service providers used by us
• Banks, tax consultants, auditors
• Organizations/users who use the app (when offering/redeeming benefits).
• In case of occasion to legal representatives, notaries, courts and administrative authorities

In our role as a processor of our enterprise customers, we also transmit user data to organizations when using optional features (especially employer linking, shift schedule connection). Users can find more detailed information in the privacy policy of the respective organization. A link with organizations can be removed by users in the app settings at any time.

5. Transfer to third countries

If the above-mentioned recipients of your data are located outside the EEA and the country in question has not been determined by decision of the EU Commission to have an adequate level of data protection, we will ensure that the transfer is made on the basis of standard contractual clauses or otherwise in accordance with Art 46, 47 or 49 of the GDPR.

6. What rights do you have?

Right to information

If we process data from you, you have the right to information about the processing purposes, the categories of data processed, the recipients of this data, storage period, the rights you are entitled to, the origin of the data and the existence of automated decision-making.

Correction and deletion

You are entitled to request the correction of incorrect or incomplete data concerning you. You are entitled to request the deletion of data concerning you, provided that the processing of the data is not lawful and there are no legal obligations on our part against the deletion. 

Restriction of processing

You are entitled to request the restriction of the processing of your data in certain cases.

Data portability

You have the right to request the transfer of your data that you have provided to us in a structured, common and machine-readable format. You have the right to have the data transferred by us directly to a responsible party, insofar as this is technically feasible.

Opposition

You are entitled to object to the processing of data relating to you at any time on grounds relating to your particular situation. If you object, we will no longer process data relating to you unless we can demonstrate that our reasons for processing outweigh your interests.

Revocation

You have the right to revoke processing of your data based on your consent at any time. This does not affect the lawfulness of the data processing carried out up to this point.

Complaint

If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can complain to the supervisory authority. In Austria, this is the Data Protection Authority, Barichgasse 40, 1030 Vienna (www.dsb.gv.at). 

Our contact details:

For questions or personal concerns, please contact:

Carployee GmbH 

A-4020 Linz, Peter-Behrens-Platz 10

Tel: +436802381701

Email: support@pavecommute.app