PRIVACY STATEMENT

1. Who is responsible for processing your data?
In this privacy statement NEXT Urban Mobility B.V. (hereafter: “NEXT” or “we”) outlines how it, as the controller, handles your personal data which is processed via the HUB App (“App”).

2. What is personal data?
Information about an identified or identifiable natural person is personal data. Whether certain information should qualify as personal data also depends on whether NEXT has legal means that it might reasonably be assumed to use to identify a data subject.

3. Personal data processed by us
We process personal data about you because you provide data to us or make it available to us when entering into an agreement for using the App, but also when you use the App and so provide us with data, or authorise us to record data about your interests and preferences.

Information provided or made available to us. When you enter into an agreement with NEXT for using the App, we need the following personal information from you which you provide or make available to us:

• Name and contact details (telephone numbers, email addresses);
• payment details and financial information such as IBAN number and payment method;
• account details (password and pin code, chosen by the user);
• driving licence number (only when using our shared cars), to verify the validity of the driving licence and to prevent identity fraud;
• other data relevant to the specific agreement;

Data about your use of the vehicles, the App and other services. If you use the App or otherwise have contact with NEXT, we process the following data as part of providing the service; depending on the exact use you make of it, it (may) be considered as personal data:

• customer number(s);
• data on the use of the bicycle or scooter: location and journey data via a connectivity module (start and end of the hire period, the distance travelled in kilometers, the location of the bicycle at the start and end of the hire period – for business administration and billing purposes );
• data about the use of the car: location and journey data via a connectivity module (start and end of the hire period, the distance traveled in kilometers, the location of the vehicle at the start and end of the rental period, any breakdowns in the vehicle concerned, fuel consumption – for business administration and billing purposes);
• the frequency NEXT services are used;
• and recordings of telephone conversations with you.

4. Processing: lawful basis and legitimate interests
Personal data is processed on the basis of the following principles from Article 6 of the General Data Protection Regulation:

1. consent;
2. performance of a contract with you;
3. legal obligation;
4. performance of a task in the public interest;
5. legitimate interest of NEXT or a third party;6. necessary for the protection of vital interests. Our legitimate interests include: marketing, advertising, security, (crime) prevention, IT management, (market) research into and analysis of our own products or services, business management, legal matters and internal management.

Onze gerechtvaardigde belangen zijn onder andere: marketing, reclame, beveiliging, (misdaad)preventie, IT-beheer, (markt)onderzoek naar en analyse van eigen producten of diensten, bedrijfshuishouding, juridische zaken en intern beheer.

5. Purpose of processing personal data
NEXT processes your personal data for the purposes given below. The reference after each purpose corresponds to the lawful basis given in clause 4 of this privacy statement:

• to be able to offer the App and to be able to provide the services from the App [basis: 1, 2];
• to detect and remedy errors and faults during the hire period and in general [basis: 2, 5] • to inform you about NEXT products and services and to interview you, so that we can match our services even better to the needs of our customers [basis: 1, 5] • to send you promotional emails, such as offers or announcements, and to keep you informed of promotions, newsletters, events, surveys and other products or services that might be offered by NEXT [basis: 1, 5];
• to analyse use of the App and its functionalities and to introduce improvements based on this [basis: 5];
• to reveal trends and (whether or not based on that) to develop new products (product development) [basis: 5];
• to send you notifications when charging, servicing and maintaining the vehicle [basis: 1, 2];
• to take measures in the event of a serious breach of the Terms of Use [basis: 5];
• and recording telephone conversations to improve our service or for training purposes [basis: 5].

6. Analytical, statistical and scientific processing
We may process your data for market research, historical analysis purposes to reveal trends and correlations in data, or to contribute to research for social or scientific purposes, or to improve the quality of life in cities. We may provide your details to third parties for this. This data may include vehicle data, journey data and location data, so we take appropriate measures (such as hashing, aggregation and encryption) to protect your privacy so that personal data will no longer be directly traceable to you as a natural person by us or any third parties involved. (pseudonymised). We process your data on the basis of legitimate interests. You have the option to end processing of personal data for the purposes described in this clause at any time, via the settings menu in the App.

7. Sharing with third parties
In addition to the foregoing, NEXT may share your personal data with third parties, including in the following cases. The reference following each purpose corresponds to the lawful basis given in clause 4 of this privacy statement:
• where you find a fault or have a question about the NEXT App or services, or where this is necessary for the proper functioning of NEXT services, qualified employees of NEXT or suppliers commissioned by NEXT may have access to your personal data in order to help you [basis: 5];
• to comply with legal obligations, such as, for instance, traffic fines [basis: 2, 3];
• to be able to offer assistance in the event of a breakdown or an emergency [basis: 2, 6];
• if your employer arranges using NEXT, certain data relating to the use of the vehicles in question, such as journey data, may be provided to your employer [basis: 2, 5]. NEXT will not give third parties access to the above personal data or this personal data to third parties, unless this is necessary:
• for the provision of a service for the above purposes, for example, hosting, analysis and (market) research service providers (these are “NEXT processors”);
• as part of maintenance and auxiliary work;
• as part of evaluating NEXT services with an employer;
• as part of a transaction, for example when NEXT decides to sell or transfer all or part of its business. NEXT may transfer information that has been collected and stored, including personal information, to the party or parties involved in the transaction as part of that transaction; or • in connection with a legal regulation or an order from a competent authority.

If these third parties are designated as processors in accordance with applicable data protection legislation, NEXT will make written agreements with these third parties. Processors commissioned by NEXT act on the instructions and under the responsibility of NEXT.

Personal data collected by NEXT is stored on a server belonging to (a supplier of) NEXT in the European Economic Area (EEA). If personal data is sent to a recipient abroad, this is usually only to a recipient in a country which, according to the European Commission, offers a level of protection that is suitable for personal data. If personal data is sent to a recipient in a country which does not offer an adequate level of protection, NEXT will ensure that the legally required safeguards are put in place, such as the conclusion of an EU model contract or requiring the recipient’s Privacy Shield certification. If you wish to see further information about the transfer of your personal data to countries outside the EEA, you can contact the Data Protection Officer at Pon (see clause 13 of this privacy statement).

8. How long we store your data
We store personal data in accordance with our internal retention policy or as long as:
• you are a NEXT customer or continue to show an interest in NEXT services;
• we are required by law to store data;
• we believe we may be allowed to store data to the extent necessary based on necessity .

9. Your rights, including the right to object
You have the right to know which personal data we have stored about you and with whom we have shared your personal data. In addition to the right to access, you also have the following rights with regard to us processing your personal data:

• the right to withdraw your consent, where processing your personal data is based on it;
• the right to submit a complaint to the Dutch Data Protection Authority;
• the right to rectification of your personal data;
• the right to erasure of your personal data;
• the right to restrict processing;
• the right to data portability;
• the absolute right to object to direct marketing;
• the right to object to processing based on the legitimate interests of NEXT or a third party (depending on your personal circumstances).

To submit your request to exercise one of the above rights, you can contact us via customer services (see clause 13). You can only exercise your rights to the extent that the law grants you these rights. NEXT will make every effort to respond to your submitted request within the legal timeframes. We may disregard excessive requests. To be sure that a request has been made by you, we can ask you to send a copy of your proof of identity with this request. We only ask this if we consider it necessary to identify you, and we also request that this copy has the passport photo, MRZ (machine readable zone – the strip with numbers at the bottom of the passport), passport number and citizen service number (BSN) blanked out. We will destroy the copy of your proof of identity immediately once we have identified you.

10. Withdrawing consent
You have the option to stop NEXT collecting and processing your personal data at any time. This can be done by contacting Next using the contact details given under “Contact” (see clause 13). You may then no longer use the App.

You may receive messages, including commercial communications and service messages, from NEXT, as part of using NEXT services. If you no longer wish to receive these messages, you can use the unsubscribe options under “Data usage” in the App’s settings menu or at the bottom of any message you receive.

11. Analytics
NEXT uses Instabug and Google Analytics for its App. Google Analytics is a web analysis service provided by Google Inc. Google Analytics uses cookies to analyse the way in which the App is used and to prepare reports for NEXT on the use of the App, using this information. The information generated by the cookies about your use of the App is transferred to and stored by Google on servers in the United States. Google may only provide the information generated by the cookies to third parties if Google is legally obliged to do so or if such third parties process the information on Google’s behalf. Google will not combine your IP address with other data that Google has. Instabug is a feedback tool for mobile apps which is integrated into the App. You can activate Instabug yourself in the App by shaking your phone. This generates an information report for NEXT including information about the network and the smartphone type.

The use of Google Analytics and Instabug is necessary for analysing and improving the functioning of the App.

12. Security
NEXT has put appropriate technical and organisational security measures in place (using, among other things, secure servers, firewalls and electronic security and encryption of data connections and associated processing) to ensure that your personal data is protected against unlawful or unauthorised processing as well as loss, destruction, damage, modification or disclosure, and that the transfer of your personal data from the vehicle and the App to the servers is done in a secure manner. These security measures are reviewed periodically based on perceived threats.

13. Contact
For queries or comments regarding this privacy statement please contact:
NEXT Urban Mobility B.V.
Burgemeester de Widtstraat 14
3811 LV Amersfoort
info@next-mobility.nl

We have a Data Protection Officer who is registered with the Dutch Data Protection Authority. This is someone within our organisation who oversees the application of and compliance with privacy legislation such as the General Data Protection Regulation (GDPR). Our Data Protection Officer can be reached by email at privacy@pon.com and by post at the above address (for the “Privacy Office”).

14. Variations to this privacy statement
The way we process personal data and the composition or amount of data we process may change. This is why we reserve the right to vary this privacy statement. You will be notified of any change if necessary.

Where changes to the privacy statement lead to substantial changes with regard to the services to be provided by NEXT under the user agreement for using the App, you will first be given the opportunity to terminate the user agreement.

This statement was last revised on 17 September 2018.