Spotiz and the User agree that capitalized terms shall have priority over the definition given to them in this Privacy Policy or, failing that, in the General Terms and Conditions accessible on the app (hereinafter the “Terms and Conditions of Spotization”).

Last update: January 15, 2023

Thank you for sharing your personal information with us. At Spotiz, we care about the security of your data and are committed to providing you with clear and transparent information about how we collect, use and share your data when you browse our website at https://spotization.com (“Website”), use our mobile application (“App”) and when you interact with us in other ways. We process your data in accordance with the requirements set out in the General Data Protection Regulation (“GDPR”), as well as the Data Protection Act 2018 for the UK and other applicable data protection legislation.

This Privacy Policy tells you what personal data we collect from you, why, how, how we keep it secure, with whom we share it and your rights regarding it. We recommend that you read it in conjunction with our Terms and Conditions, which set forth the terms and conditions governing the services provided.

We update our Privacy Policy regularly, so we encourage you to review it regularly via the App or our Website. If we make changes to this Privacy Policy, the updated version will be available via our App and Website. If we make material changes to this Privacy Policy, we will provide a prominent notice and may also contact you directly by email or other means.

Our Services are not intended for children under the age of 18 or any other age limit applicable in your jurisdiction and we do not knowingly collect data relating to children. 

Who are we?

This Privacy Policy is issued on behalf of the Spotiz SA group, which consists of several different legal entities located throughout Europe. Although the different entities may, from time to time, act as Joint Controllers of your personal data, all Spotiz SA group companies have decided that Spotiz France, a société par actions simplifiée, with registered office at 320 rue saint Honoré 75001 Paris – France, registered under number 904 871 209 RCS Paris, is the main controller and the entity responsible for all processing of personal data described in this policy.

If you have any questions about this policy, including questions about your rights under the Data Protection Act, please contact our Delegate at the following address: [email protected]om. When we refer to “spotiz“, “we” or “our” in this Privacy Policy, we are referring to our entire group of companies.

What data do we collect about you?

 We may collect, use, store and transfer various types of personal data about you (i.e. any information that directly or indirectly identifies you) which we have grouped as follows:

• Identity and Contact Information: This includes your first name, last name, user name and password, date of birth and gender (if required by law), proof of identity such as an ID card, passport or driver’s license (if required by law), a real-time selfie (where required by the city), billing address, shipping address, email address, telephone numbers, personal license plate and other similar identifiers.
• Financial and Transactional Data: This includes certain crypto account information, bank account and payment card information as well as any information regarding payments you have made and any other information related to services you have purchased from us and other similar information. Please note that we do not store your complete payment card information. This information is stored by our approved third party payment processor Stripe Inc. via its Stripe Connect service. For more information, you can refer to our
• Technical and Usage Data: This includes information about how you use our Website, our Application, including your travel and location history, telemetry data (including speed, route selection, your IP (Internet Protocol) address, login data, type and version of browser used, time zone settings, types and versions of browser plug-ins, operating system and platform, and any other similar technological identifiers on the devices you use to access the Website and the Application
• Profile Data: this includes purchases you have made, your interests, marketing and communication preferences, your comments and responses to any surveys, and any other similar data you provide to us.
• User and potential user content includes information you submit when you contact our customer service department, or that we collect with your consent when you participate in our user research program or events we host. This may include comments, photographs, video or audio recordings.
• Social inclusion program data includes, for the UK, information about any of the following: valid HC2 certificate, DID card or disability railcard; your status as an NHS or emergency services worker or higher education student.

We also process Aggregate Data, such as statistical or demographic data, for any purpose. We may obtain Aggregate Data from your Personal Data, but it is not considered Aggregate Data under the law because it does not reveal your identity, either directly or indirectly. For example, we may aggregate your Technical and Usage Data to calculate the percentage of users using a particular feature of the Website or Application. Because such data is not regulated, its processing is not subject to this Privacy Policy.

If you do not provide us with your personal data

 In the event that we need to collect your personal data under our Terms and Conditions and you do not provide us with the requested data, we may not be able to perform the contract we have entered into or are attempting to enter into with you. In this case, we may not be able to allow you to use the Application, as this information is necessary for the use of our services.

How is your personal data collected?

Direct interactions. You may provide us with Identity and Contact Information and Financial and Transactional Data by filling out forms or by interacting with us. This includes Personal Data that you provide to us when you:

• browse our Website;
• use our Application;
• request marketing communications to be sent to you;
• enter a contest, take advantage of a promotion or complete a survey; or
• give us feedback or contact us.

Automated technologies or interactions. When you interact with our Website and the App, we automatically collect Technical and Usage Data about your browsing, device and route. We collect such Personal Data using telemetry sensors, cookies exclusively through Google Analytics, local storage and other technologies, whether proprietary or provided by third parties. 

How do we use your personal data?

Below you will find a description of all the ways in which we intend to use your personal data and the legal bases on which we will rely for these purposes. Where applicable, we have also indicated our legitimate interests.

Disclosure of your personal data

Our suppliers

We use various suppliers to provide, develop and promote our services. We may share some of your personal data with such vendors for the purposes set forth in the table above. We use these vendors to process payments, store data in the cloud, provide our services, perform data analysis, provide customer service, and perform advertising and marketing activities.

All of our suppliers warrant that they comply with the General Data Protection Regulation (EU) 2016/679 and have entered into data processing contracts with us. We require all third parties to respect the security of your personal data and to process it in accordance with applicable law. We do not allow our third-party service providers to use your personal data for their own purposes (unless it is necessary for the provision of their services, in which case you will be expressly informed) and only allow them to process your personal data for specific purposes and in accordance with our instructions.

Transactions within the company

We will share your personal data with other companies in our group.

We may also share your personal data with third parties to whom we may sell or transfer part of our business or assets, or with whom we may decide to merge. In addition, we may seek to acquire or merge with other companies. If such a change in our business occurs, the new owners may use your personal information.

Professional counselors and law enforcement

We may disclose your personal information to law enforcement or regulatory agencies in connection with any proceeding or investigation where we are required to do so. We may disclose your personal information to our professional advisors, who are usually licensed by a competent authority (legal representatives, accountants, etc.), if necessary. We may also disclose your personal information to our insurance providers when necessary to process any insurance claim related to your use of our Application.

Local authorities

Local authorities require us to share certain information about our Users as a condition of operating in the cities they govern. This exchange is automatic and complies with the Open Mobility Foundation‘s data exchange protocols. All local authorities have guaranteed that they comply with the General Data Protection Regulation (EU) 2016/679 and have signed data sharing agreements with us.

Cookies

Most often, cookies are used by third parties and this usually involves the disclosure of Technical and Usage Data, which is often anonymized. Please use our cookie banner to accept or decline all non-essential cookies. To learn more about the cookies we use, please refer to the Website at: https://spotiz.com/cookies/.

International transfers

Many of the third parties with whom we do business are located outside the European Economic Area (EEA) and therefore their processing of your personal data involves a transfer of data outside the EEA. Where we transfer your personal data outside the EEA, we ensure that a similar level of protection is provided by ensuring that we have in place at least one of the following measures:

• We may transfer your personal data to countries that provide an adequate level of personal data protection according to the European Commission. To learn more, please refer to the European Commission’s website: Adequacy of personal data protection in countries outside the EU; or
• We may enter into specific contracts, approved by the European Commission, that ensure a similar level of protection for personal data as in Europe. To learn more, please refer to the European Commission’s website: Model contracts for the transfer of personal data to third countries.

Please contact us if you would like to learn more about the specific mechanism we use when transferring your personal data outside the EEA. 

Data security

We have appropriate security measures in place to protect your personal information from accidental loss, unauthorized use or access, alteration or disclosure. In addition, we restrict access to your personal data to our employees, agents, contractors and other third parties who need to know your personal data in order to perform their duties. They will only process your personal data on our instructions and are subject to an obligation of confidentiality.

We have procedures in place to deal with any suspected breach of personal data, and we will notify you and any relevant regulatory body of any breach if we are legally required to do so.

Data retention

How long do we use your personal data?

We retain your personal data only for as long as is reasonably necessary to fulfill the purposes for which we collected it, including for the purposes of complying with any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period of time in the event of a claim or if we reasonably believe that litigation is likely to arise in connection with our relationship with you. In determining the appropriate retention period for personal data, we take into account the amount, nature and sensitivity of the data in question, the risks of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, whether we can fulfill those purposes by other means, and applicable legal, regulatory, tax, accounting and other requirements.

In certain situations, we will irreversibly anonymize your personal data (so that it is no longer personally identifiable) for research and statistical purposes, in which case this policy will cease to apply, and we may use such data indefinitely, without further notice.

Please note that we are legally required to retain basic information about our customers for seven years after they cease to be customers for tax purposes.

Automated decision making

We use automated decision making, including the use of profiling, when performing age verification. Age verifications are only requested when required by cities, and if so, you will be prompted to perform them on your screen. Our system will check the information on your ID (this can also be a passport or driver’s license) to verify your date of birth and its validity, while comparing the photo on your ID with the actual photo you submit. Together, they will determine if it is the same person in the photo as on the ID.

We also use automated decision making for fraud detection. Our systems will identify any transaction or profile that is deemed suspicious based on the data we have and, based on that information, take a specific approach, such as authorizing a payment, requesting verification of certain data, or blocking a payment or account.

If you wish to object to this automatic decision making, please contact [email protected]om. 

Blacklisting
Spotiz may blacklist an account or payment method when it determines that fraudulent activity is associated with it. Accounts and payment methods that have been blacklisted are kept on file to prevent future fraudulent transactions. This list is not shared with third parties and is for internal use only. The purpose of this activity is to prevent fraudulent transactions and protect our users. If you would like to know more about this, please contact [email protected]om.

Your legal rights

Spotiz is committed to respecting the legal rights of its customers with respect to data protection. If you send us a request concerning your rights under data protection law, we will respond within one month from the date of receipt and will try to comply with the request within the same period. If necessary, this period may be extended by up to two months if the request is complex. Please contact [email protected]om to exercise the following rights in relation to the personal information that spotiz processes about you:

If you send us a request concerning one of these rights, we will respond within one month from the day of receipt and, as far as possible, we will do our best to deal with your request within this period. If necessary, this period may be extended by a further two months in complex cases (we will inform you if this is the case).

For full information on your mandatory rights, please consult the webpage of the data protection authority in your country of residence:

• For users in Switzerland, here.
• For users from the European Economic Area, you can find your PAD here.
• For users in the UK, you can contact the Information Commissioner’s Office here.
• For India, you can contact the Ministry of Electronics & Information Technology here
• For other countries, please contact the data protection authority in your country of residence

If you have any concerns, we would like to have the opportunity to respond before you contact the appropriate local authorities. Therefore, please contact us first by sending an e-mail to [email protected]om.