Privacy policy

PREAMBLE

As part of its business activities, DRIVECO operates a website accessible at DRIVECO.com (hereinafter the “Site”), which includes, in particular, a section dedicated to accessing and paying for the charging service provided by the charging stations that are part of the DRIVECO network (the “Charging Portal”), as well as several mobile applications available on the Android and iOS platforms (the “Mobile Apps”). We place the utmost importance on respecting the privacy and personal data of individuals who interact with us via the Site, the Mobile Apps, or by any other means.

Accordingly, we implement appropriate technical and organizational measures to ensure that your personal data is processed in accordance with applicable regulations (in particular, the General Data Protection Regulation No. 2016/679 of April 27, 2016 (hereinafter the “GDPR”) and the French Data Protection Act of January 6, 1978, as amended).

The terms “data” or “personal data” used in this policy have the same meaning as that given to the term “personal data” in the GDPR. Other terms common to this policy and the GDPR, including “processing,” “data controller,” “data processor,” and “recipient,” have the meanings given to them in the GDPR.

The purpose of this document is to provide you with clear and transparent information regarding:

• The manner in which we process your personal data and the rights you have in this regard;
• The use of cookies on our Site.
• The use of tracking tools in our communications

Recognizing the importance of clear and transparent information on this subject, we have included various tables to help you better understand our practices regarding the management of your personal data and to facilitate the exercise of your rights.

We apply the principles of data minimization, data protection by design, and data protection by default. Consequently, we collect only information that is relevant, adequate, and limited to what is necessary for the purposes for which the data is collected and processed.

1. WHO IS THE DATA CONTROLLER FOR YOUR PERSONAL DATA?

The data controller, as defined by the GDPR, is the person who determines the purposes and means of data processing—that is, for what purpose(s) and in what manner your personal data is processed.

The data controller for your data is DRIVECO, a simplified joint-stock company registered with the BastiaParis Trade and Companies Register under number 818 943 938.

We have appointed a Data Protection Officer (“DPO”) who will serve as your primary point of contact for all matters related to the protection of your personal data. You can contact the DPO by email at dibbdpo@dibb.fr

You may direct any questions, requests for information, or complaints to the DPO.

2. WHAT PERSONAL DATA DO WE COLLECT, AND HOW?

2.1 Data Collected

• Identification and contact information: We process the data necessary to contact you and handle your request. This data includes your email address, first and last name, and phone number.
• User identification, login, and payment data on the Mobile Apps: We process the data needed to create a user account on the Mobile Apps and to log you into your user account on the Mobile Apps. This data includes your login credentials (email address, password), the date of your last login, and the date you last accepted the legal terms (Terms of Use, Terms of Sale, Privacy Policy). You may also enter your credit card number in your user account to facilitate payment for the recharging service; this number is processed securely by our partner (INGENICO) and is not stored by DRIVECO. Finally, you may also link a badge number to your user account.
• User identification and payment information for the provision of the charging service via the Charging Portal: To allow you to access the charging service and pay for it through the Charging Portal, you must provide certain personal information, such as your email address and your credit card number when the charging service is subject to a fee; This number is processed securely by our partner (INGENICO) and is not stored by DRIVECO.
• Browsing data of Website users: When you browse the Website, certain data is collected regarding your device (computer, smartphone, tablet), your browser, , and the pages and content you view. This data may include directly or indirectly identifying information such as, for example, your IP address or a unique identifier linked to your device, operating system, software, or other factors.
• Data from our customers and prospects: We process the data necessary to make commercial contact in order to respond to their requests, present our service offerings, and manage our subsequent business relationships with our customers. This data includes, in particular, email addresses, your first and last names, and phone numbers.
• Data from business partners: We process the data necessary and relevant to managing our relationships with our service providers. This data includes, in particular, email addresses, your first and last names, and phone numbers.
• Candidate data: We process the personal data you provide to us when applying for our job and internship openings. This data may include your email address, first and last name, phone numbers, and your resume.
• User data: We process the data necessary for vehicle charging and any support services that Driveco may provide.

2.2 How We Collect Your Data

• Collection via the Website (forms): We process the data you voluntarily provide to us through the form fields provided for this purpose on the Website so that we can contact you. Required fields are marked with an asterisk. If you do not provide this information, you will not be able to send us your message.
• Collection via Mobile Apps: We process the data you provide to us through the form fields provided for this purpose on the Mobile Apps. Required fields are marked with an asterisk. If you do not provide this information, you will not be able to use the feature associated with the form.
• Data Collection via the Recharge Portal: We process the data you voluntarily provide to us through the form fields provided for this purpose on our Recharge Portal, which allows you to access the recharge service and, if applicable, make payment for it. Required fields are marked with an asterisk. If you do not provide this information, you will not be able to access the recharge service .
• Use of Cookies or Other Trackers on Our Site:

We use cookies or other types of “trackers” on our Site.

A cookie is an electronic file stored on your device (computer, tablet, smartphone, etc.) and associated with the Site. This file is automatically sent back during subsequent visits to the Site.

When you browse this Site, cookies from us and/or third-party companies may be stored on your device.

The first time you visit this Site, an explanatory banner regarding the use of cookies will appear, allowing you to configure your preferences.

We use various types of cookies, generally set in response to actions you have taken that constitute a request for services, such as setting your privacy preferences, logging in, or filling out forms. They allow us to store information across multiple visits to the Site on the same device.

These cookies are necessary for the Site to function and do not require your consent. They are therefore automatically placed on your device. Refusing these cookies may affect the Site’s functionality and the quality of your browsing experience.

• “Statistical” or audience measurement cookies:

These cookies allow us to analyze your activity on the Site in order to assess visitor frequency and volume and to improve the Site’s functionality and user experience. These cookies may be “first-party” (i.e., set by us) or “third-party” (when set by third parties).

Your consent is requested prior to the placement of these cookies—that is, when you first log in—via a checkbox on our cookie banner (except when the cookie is strictly necessary for the Site’s operation and routine administrative tasks).

• Use of Tracking Pixels in Our Communications:

To better tailor our communications and interactions with you, our emails include tracking pixels that allow us to detect when our messages are opened.

This information allows us to ensure that our emails are delivered to your inbox, adjust the frequency of our mailings, and provide you with more relevant communications.

You may opt out of this use at any time, without affecting your receipt of our emails. To exercise this right, a link is provided in every email, or you can access it through your user account.

• Collection of publicly available data (information about our potential customers) via professional social networks (LinkedIn, etc.) or other public sources of information.
• Direct collection: We process the data you send us directly by any means (email, mail).

3. WHAT ARE THE PURPOSES AND LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA THAT WE CARRY OUT?

Type of data	Purpose of processing	Legal basis
Identification and Contact Information	Initial contact / prospecting.	Legitimate interest GDPR, Article 6.1.f
	Sending newsletters.	Consent GDPR, Article 6(1)(a)
	Sending marketing communications (promotional offers, coupons, contests, etc.).	Consent GDPR, Article 6.1.a
User identification, login, and payment data on the Mobile Apps	Access to the features offered by the Mobile Apps, including the ability to create a user account. Statistics and audience measurement. Provision and management of the charging service.	Performance of the contract GDPR, Article 6(1)(b)
User identification and payment data for the provision of the charging service (Charging Portal)	Provision and management of the charging service.	Performance of the contract GDPR, Article 6.1.b
Browsing data of website users	Provision of a functional, secure website that is compatible with the various types of devices and browsers available on the market.	Legitimate interest GDPR, Article 6(1)(f)
	Statistics and audience measurement.	Consent GDPR, Article 6(1)(a)]
Prospect Data	Marketing: identifying new potential customers and presenting our service offerings Data collected from public sources.	Legitimate interest GDPR, Article 6.1.f
	Managing communications about our offers, promotions, and services (via email, text message)	Consent GDPR, Article 6(1)(a)]
Customer data	Management of our relationships in connection with the provision of services.	Performance of the contract GDPR, Article 6.1.b
	Managing communications regarding our offers, promotions, and services (via email or text message)	Consent GDPR, Article 6(1)(a)]
Data from business partners	Performance of the service agreement.	Performance of the contract GDPR, Article 6(1)(b)
Candidate data	Management of job applications and storage of applications in a database.	Consent GDPR, Article 6(1)(a)
User Data	Management of our relationships in connection with the provision of services.	Legitimate interest GDPR, Article 6.1.f

4. WHAT SECURITY MEASURES DO WE IMPLEMENT TO PROTECT YOUR PERSONAL DATA?

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, or unauthorized access to such data.

We also monitor how our service providers process your personal data to ensure that they provide sufficient guarantees regarding the implementation of appropriate data security measures.

5. HOW LONG DO WE RETAIN YOUR DATA?

Personal data is retained for as long as necessary to fulfill the purposes for which it was collected, as described in Article 3, plus the duration required by law.

The main retention periods are as follows:

• Data regarding users of the charging service: duration of the contractual relationship, plus 5 years. Invoices are retained for 10 years following the year they were issued;
• Data regarding individuals contacting customer support: In the event of a call, telephone recordings are retained for 6 months.
• Data regarding prospects: 3 years from the last contact (provided the prospect did not object at the time of initial contact).
• Customer data: the duration of the contractual relationship, plus 5 years, including 3 years for marketing purposes;
• Data related to tracking pixels: Until consent is withdrawn or 3 years from the last contact;
• Data relating to business partners: the duration of the contractual relationship, plus 5 years
• Data relating to job applicants: the time necessary to process active applications and, in the event of a negative outcome, 2 years from the last contact with the applicant;
• Documents and accounting records: 10 years;
• Data necessary for dispute resolution: 5 years (the applicable statutory limitation period).

6. WHAT ARE YOUR RIGHTS?

You have certain rights regarding your data, which you may exercise under the conditions set forth in the GDPR. A summary of these rights is provided below.

Your rights	Purpose
Right of access GDPR, Article 15	To obtain a legible and understandable copy of the data we hold about you, as well as a copy of this privacy policy on a durable medium.
Right to Rectification GDPR, Article 16	To have your personal data rectified, updated, or completed.
Right to Withdraw Consent GDPR, Article 7, paragraph 3.	To have the processing of data for which you have given consent ceased in the future.
Right to object GDPR, Article 21	To have the processing of your data ceased in the future when such processing is based on our legitimate interest or that of a third party (subject, in particular, to legitimate and compelling reasons) or when your data is used for direct marketing purposes.
Right to erasure (right to be forgotten) GDPR, Article 17	To have all or part of your data deleted, or to have it completely and irreversibly anonymized, under certain conditions (in particular if you believe the data is no longer necessary, if you have withdrawn your consent, or if you believe your data is being processed unlawfully). In such cases, we may nevertheless be required to retain certain data to comply with our legal obligations or to assert our rights in court.
Right to Restriction of Processing GDPR, Article 18	Request that your data be retained without further use (for example, if you believe the data is no longer necessary or is being processed unlawfully). In this case, your data will be temporarily set aside and will no longer be used (subject to our legal obligations or the exercise of our rights in court).
Right to data portability GDPR, Article 20	To obtain a copy of the data you have provided to us in a reusable electronic format so that you can transfer it to another data controller.
Right to Provide Post-Mortem Instructions	Tell us how you would like us to handle your data in the event of your death.

You may exercise these rights at any time and free of charge, except in cases of manifestly unfounded or excessive requests (particularly due to their repetitive nature). In such exceptional cases, we reserve the right, in accordance with the provisions of the GDPR (Article 12(5)), to charge a reasonable fee or to refuse your request.

You may exercise your rights by contacting our Data Protection Officer via email at: dibbdpo@dibb.fr

If you believe that we have not responded satisfactorily to your request, you may contact:

For French users: the Commission Nationale de l’Informatique et des Libertés (CNIL), Ms. Marie-Laure Denis – President of the CNIL – via its website www.cnil.frwww.cnil.fr or by mail atpost to the following address: CNIL – 3, Place de Fontenoy – TSA 80715 – 75334 PARIS CEDEX 07 – Tel: +33 1 53 73 22 22

For Belgian users: Data Protection Authority – Gegevensbeschermingautoriteit (APD-GBA) – Mr. David Stevens – President of APD-GBA – Rue de la Presse 35 / Drukpersstraat 35 – 1000 BruxellesBrussels / 1000 Brussel – Tel: +32 2 274 48 00 – commission@privacycommission.behttps://www.autoriteprotectiondonnees.be/citoyen

For Italian users: Garante per la protezione dei dati personali, Prof. Pasquale Stanzione – President of Garante per la protezione dei dati personali – Piazza del Monte Citorio, 121 – 00186 Rome – Tel: +39 06 696771 – segreteria.stanzione@gpdp.ithttps://www.garanteprivacy.it/home

For Spanish users: Spanish Data Protection AgencyAgencia Española de Protección de Datos (AEPD), Ms. María del Mar España Martí – Director of the Spanish Data Protection Agency) – C/ Jorge Juan, 6 – 28001 Madrid – Tel: +34 91 266 3517 – internacional@agpd.eshttps://www.aepd.es/

7. WHO HAS ACCESS TO YOUR DATA?

Some of your data may be accessed, or at the very least stored, by the following individuals:

• Our authorized staff;
• Our technical service providers who perform services necessary for the operation of the Site and/or the fulfillment of the purposes described in Section 3 above;
• Our legal service providers (legal professionals, attorneys), certified public accountants, or other consultants
• Our payment service providers and banking institutions;
• The owners or operators of charging stations (data of users of the relevant charging service);
• Our business partners.

Your personal data will not be transferred to recipients located outside the EU or the European Economic Area (hereinafter “EEA”). In the event that we need to process your data outside the EU and the EEA, we commit to implementing the necessary measures to ensure the protection of your data, in particular through the use of the European Union’s standard contractual clauses approved by the European Commission.

8. CHANGES

This document is subject to updates. We encourage you to check this page regularly for updates.