At guppy®, we care about privacy and transparency in the handling of your personal data. We collect the data that you provide when you register in our application and we access them to be able to use them throughout the provision of the different services that we offer, thus achieving proper functioning of both the app and our platform. In turn, said data is shared, in accordance with the provisions of our Privacy Policy, with the companies with which we have signed contracts for the provision of services, as well as Personal Data Processing Commission, to carry out the tasks typical of the service that guppy has entrusted to them.

WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?

GUPPY MOVILIDAD SOSTENIBLE, S.L. is the Controller of your personal data, which assigns them to the franchise corresponding to your geographical area, to act as Processors of the Treatment:

Astur Sercomar, S.L.U. (hereinafter, “Astur Sercomar”) as it is the guppy franchise in Asturias and the owner of the vehicles used in Asturias to provide the service.

• C/ Gregorio Marañón Nº 1 Bajo II, CP 33.203 Gijón (Asturias, España)
• asturias@guppy.es; hola@guppy.es
• +34 649 210 756

Cantabria Movilidad Sostenible, S.L. (hereinafter, “Cantabria Movilidad Sostenible”) as it is the guppy franchise in Cantabria and the owner of the vehicles used in Cantabria to provide the service.

• C/ Antonio López Nº 42, CP 39.009 Santander (Cantabria, España)
• cantabria@guppy.es; hola@guppy.es
• +34 649 210 756

ARE YOUR DATA SHARED WITH THIRD PARTIES?

Yes. Your data may be shared with third parties, to carry out the treatments exposed here. It is necessary that access to your personal data be granted to the companies of the G. Junquera Marítima business group (understood as those included within the concept of article 42 of the Commercial Code) and to third parties that provide us with fundamental support linked to the Services.

Specifically, we have signed other commissioned contracts for the processing of personal data with:

• Junquera Marítima, S.L.: CIF B33600834, C/ Gregorio Marañón Nº 1 Bajo II, CP 33.203 Gijón (Asturias, Spain). guppy has signed a contract with G. Junquera that includes the commission to process guppy user’s data, in terms of their identifying data.
• Beard Systems Solutions, S.L.: B52571635, C/ Zaragoza 18, Puerta D, Planta 4, CP 33.212 Gijón (Asturias, Spain), for the implementation of improvements in the app and on the guppy® website
• Eteria Marketing y Comunicación, S.L.: B33897513, Av. Del Jardín Botánico, Grupo Intermark building, 1345, CP 33.203 Gijón (Asturias, Spain), for the guppy® marketing plan
• Alice Biometrics, S.L.: B27872217, C/ Fonte Dasabelleiras s/n, CP 36.310 Vigo, Pontevedra (Galicia, Spain), for the evaluation of users’ biometric data
• Ecoeficiencia e Ingeniería, S.L.: B33998824, C/ Gregorio Marañón Nº 3, Bajo, CP 33.203 Gijón (Asturias, Spain), for the management of guppy users, incidents and claims, as well as development and maintenance of the application and the guppy® website

In turn, your data may be provided to third parties that provide fundamental support to guppy, linked to the services we provide, such as:

• Technology service providers
• Providers and collaborators of services related to advertising and marketing
• Tax Agency and other Public Administrations for compliance with tax obligations
• Public Administrations competent in traffic matters
• Other Public Administrations or integral parts of the same, in case the legislation requires it and thus it is necessary
• Insurance companies: management of claims or accidents
• Credit institutions: POS’s for the management of collections and payments
• Google, regarding the collection of cookies through the website. To find out how Google uses information from websites or applications that use its services, you can find out here: https://policies.google.com/technologies/partner-sites

WHAT ATE THE RIGHTS THAT ARE RECOGNIZED AFTER GIVING YOUR DATA TO GUPPY?

First of all, we guarantee the confidentiality of your data, through the application of techniques and processes adapted to the current technological reality. Likewise, we guarantee the exercise of the rights granted by current and applicable legislation regarding the protection of personal data. You can exercise them, at no cost, by direct communication to the following email address: legal@guppy.es For this, you will be provided with a series of official forms from the Spanish Agency for Data Protection, one for each right to exercise , in such a way that you send them to us filled in with your data and a copy of a document proving your identity.

You have the right to:

• Access the data we have about you.
• Request any rectification related to the data we have. When providing your data, you must take into account that you guarantee (i) that you are of legal age, (ii) that you agree to notify us of any change or modification thereof, (iii) and that the data provided is true, exact and complete, being responsible for any damage or harm, direct or indirect, that could be caused as a consequence of the breach of said obligation. Also, keep in mind that, as a general rule, you should only provide your own personal data. In the event that the data provided belonged to a third party, as a user, you guarantee that you have informed said third party of the aspects contained in this document and obtained their authorization to provide us with their data, in relation to the purposes indicated.
• Request the deletion of your data, provided they are not necessary for the purpose for which they are intended or we do not have legitimacy to carry it out.
• Require the limitation of the treatment of your data, which may lead to a temporary suspension of the treatment of the same, and of the service to which they feed.
• Likewise, you will have the right to the portability of your data, to transmit it to another controller, whenever technically possible and acceptable, receiving it in a structured, commonly used and machine-readable format, in order to provide it to another entity.
• You will have the right to oppose, at any time, the processing of your data, including profiling, if the processing is based on the legitimate interest of the Responsible.
• And, finally, you will have the right not to be subject to a decision based solely on automated processing, including profiling.

Whenever you consider it appropriate, you can file a claim with the Spanish Agency for Data Protection, through the following link: https://www.aepd.es/es/la-agencia/en-que-podemos-ayudarte and in https://sedeagpd.gob.es/sede-electronica-web/vistas/formNuevaReclamacion/nuevaReclamacion.jsf?QID=Q251&ce=0 especially when the Company has not acted diligently in the active exercise of your rights.

HOW AND FOR WHAT PURPOSE ARE YOUR PERSONAL DATA COLLECTED?

Your personal data will be collected through the App, the Website or within the framework of the provision of the Services. This Privacy Policy is part of the Terms and Conditions, in its entirety. If you decide not to expressly, freely and voluntarily consent to your personal data, we will not be able to provide you with the service described above.

Next, we proceed to expose the data obtained from guppy users, as well as the purposes for which they will be used and with whom said data will be shared:

DATA CATEGORY: LOCATION

TYPE OF DATA

APROXIMATE LOCATION:

This is the physical location of the user or device in an area that is 3 square kilometres or larger, such as the city the user is in or the location provided by the ACCESS_COARSE_LOCATION Android permission.

PRECISE LOCATION:

This is the physical location of the user or device in an area less than 3 square kilometres, such as the location provided by the ACCESS_FINE_LOCATION Android permission.

PURPOSES FOR WHICH IT IS USED

APPLICATION FUNCTIONALITY:

They are used to offer functions that are available in the application. For example, to show the guppies that are nearby or, with the radar function, to warn when one is available in the surroundings.

ANALYSIS:

They are used to analyse the performance of the application or how users use it. For example, to analyse in which areas it is more common for users to use guppy, where it is necessary to add more vehicles and from which areas they can be removed.

DEVELOPER COMMUNICATIONS:

They are used to send news or notifications about the application or about the developer. For example, there are situations where communications are only sent to users who found themselves in a certain place due to an incident and not to the rest.

ADVERTISING OR MARKETING:

They are used to display or target ads or marketing communications, or to measure ad performance. For example, if a promotion is offered to users in a specific province.

FRAUD PREVENTION, SECURITY AND COMPLIANCE:

They are used to prevent fraud, to protect security or to comply with the law. For example, when there has been an incident, the location of the vehicle and the user is analysed to see what could have happened, as well as the speed of movement, in the event that it is necessary to respond to an identification of the driver by the Police.

HOW THE DATA IS COLLECTED?

Location data is collected via GPS:

The user must have the location of their device activated, in order to find vehicles around them in the app [therefore, the location is accessed through the phone’s own GPS].

The vehicles have the GPS activated to be able to verify the route that each user follows, in order to be able to analyse it in the event of an incident or police or judicial request.

This information is transmitted to the app and analysed by guppy.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on a server, called RM, created specifically for guppy. Said server collects the location data of the vehicle and is recorded in it, in order to have access if necessary due to an incident.

The data is shared with:

• Junquera Marítima, S.L., (GJ) have signed a management contract with guppy, as well as a personal data processing contract. At GJ there is customer service, the legal department and the financial department; these departments must have access to the route traced by the vehicle at the end of the rental, in order to carry out the daily management of the app.
• Ecoeficiencia e Ingeniería, S.L., (E+) have signed a maintenance contract for computer systems, as well as a custom contract for the processing of personal data. In E+, there is the technical department, responsible for the proper functioning and development of the application, as well as its computer systems. Also, the person in charge of managing the fleet of vehicles and the maintenance staff of the guppies. For this reason, E+ and its staff have access to all the data provided by the client, including the location of the client.
• Authorities, such as the Local Police or the Court, sometimes require us this type of information in order to solve a possible incident and to be able to find out where the vehicle travelled. The information is transmitted either through the competent electronic headquarters or in paper format, physically in the resulting location.

DATA CATEGORY: LOCATION

TYPE OF DATA

NAME:

The way in which the user refers to himself, such as his first name, his last name or his nickname. It is obtained through the DNI and the driver’s license of the user.

E-MAIL ADDRESS:

The user’s email address, in order to receive communications from guppy.

PHONE NUMBER:

The mobile phone number of the user, to be able to contact him if necessary.

OTHER INFORMATION:

Any other personal information, in this case, the person’s biometric data is collected to be able to unequivocally identify it.

PURPOSES FOR WHICH THEY ARE USED

APPLICATION FUNCTIONALITY:

They are used to offer functions that are available in the application. For example, to be able to differentiate one user from another.

ANALYSIS:

They are used to analyse the performance of the application or how users use it. For example, to analyse if it is more common for men or women to use guppy.

DEVELOPER COMMUNICATIONS:

They are used to send news or notifications about the application or about the developer. For example, in the event that an incident has occurred and a communication must be sent stating the consequences of their actions.

FRAUD PREVENTION, SECURITY AND COMPLIANCE:

They are used to prevent fraud, to protect security or to comply with the law. For example, when there has been an incident, this data is analysed to distinguish one user from another, whether they have a driver’s license or not, whether they are of legal age or not and, in the event that they have to be penalized or sanctioned, do so. with the right person and not with a third party; Verify that identity theft does not occur between users.

ACCOUNT MANAGEMENT:

It is used to set up or manage a user account with the developer. For example, to distinguish the movements and rentals of one user from those of the other, as well as the activity status of their account.

HOW THE DATA IS COLLECTED?

The data is collected at the time the user registers in the app, providing their identification data, as well as their telephone number and email, with the biometric data that identifies and distinguishes them from other people, in order to verify that it is the same person with the ID and driver’s license as the one who registered in the app.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on a server, called RM, created specifically for guppy. Said server collects the identification data of the user and they are registered in it, in order to have access if necessary due to an incident, to identify a driver or in the event that it is necessary to make a claim or communicate with the user.

The data is shared with:

• Junquera Marítima, S.L., (GJ) have signed a management contract with guppy, as well as a personal data processing contract. GJ has the customer service, the legal department and the financial department; These departments must have access to the user’s identification data, in order to carry out the daily management of the app, attend to doubts and claims.
• Ecoeficiencia e Ingeniería, S.L., (E+) have signed a maintenance contract for computer systems, as well as a custom contract for the processing of personal data. E+ has the technical department, responsible for the proper functioning and development of the application, as well as its computer systems. Also, the person in charge of managing the fleet of vehicles and the maintenance staff of the guppies. For this reason, E+ and its staff have access to all the data provided by the client, including identification data.
• Authorities, such as the Local Police or the Court, sometimes require us this type of information in order to solve a possible incident and to be able to find out who the user who used the vehicle is and who suffered a mishap. The information is transmitted either through the competent electronic headquarters or in paper format, physically in the resulting location.

DATA CATEGORY: FINANCIAL INFORMATION

TYPE OF DATA

USER PAYMENT INFORMATION:

Information about the user’s financial accounts, such as the credit card number (we only have the last numbers of it).

SHOPPING HISTORY:

Information about purchases or transactions made by the user.

OTHER FINANCIAL INFORMATION:

Any other financial information of the user, such as the type of card he uses or the name of his Bank.

PURPOSES FOR WHICH THEY ARE USED

APP FUNCTIONALITY:

They are used to offer functions that are available in the app. For example, for the user to buy bonus.

FRAUD PREVENTION, SECURITY AND COMPLIANCE:

They are used to prevent fraud, to protect security or to comply with the law. For example, when there has been an incident, in the event that charges must be made to the user’s account, when the user makes a transfer to us or if he claims a refund of a charge.

ACCOUNT MANAGEMENT:

It is used to set up or manage a user account with the developer. For example, to distinguish the bonus that a user buys from those of another, as well as the possible debt that a user maintains with guppy.

HOW THE DATA IS COLLECTED?

The data is collected at the time the user registers in the application, providing their debit or credit card number, it is not necessary to provide their account number.

Guppy only has access to the last digits of the card and who the card belongs to, that is, the name of its holder.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on a server, called RM, created specifically for guppy. Said server collects the financial data of the user and they are registered in it, to be able to access it if necessary due to an incident or to make collections or refunds of balance.

The data is shared with:

• Junquera Marítima, S.L., (GJ) have signed a management contract with guppy, as well as a personal data processing contract. At GJ there is customer service, the legal department and the financial department; These departments must have access to the user’s financial data (only the data we know, not all of it), in order to carry out the daily management of the app, making payments, refunds and dealing with claims.
• Ecoeficiencia e Ingeniería, S.L. (E+) by having signed a maintenance contract for computer systems, as well as a custom contract for the processing of personal data. In E+, there is the technical department, responsible for the proper functioning and development of the application, as well as its computer systems. Also, the person in charge of managing the fleet of vehicles and the maintenance staff of the guppies. Therefore, E+ and its staff have access to all data provided by the client, including financial data.
• Financial entities, with the purpose of issuing the corresponding receipts and collections

DATA CATEGORY: PHOTOS AND VIDEOS

TYPE OF DATA

PHOTOS:

The user’s photos, which he/she himself/herself shares in the app at the start or end of the rental.

VIDEOS:

The videos of the user when registering in the app.

PURPOSES FOR WHICH THEY ARE USED

APP FUNCTIONALITY:

They are used to offer functions that are available in the application. For example, users provide photos of the vehicles before and after a rental to verify their condition.

FRAUD PREVENTION, SECURITY AND COMPLIANCE:

They are used to prevent fraud, to protect security or to comply with the law. For example, when there has been an incident, to physically identify a user and verify that they match the person who appears on the DNI and on the driving license that was provided to us.

ACCOUNT MANAGEMENT:

It is used to set up or manage a user account with the developer. For example, to distinguish one user from another based on verification of their photos/videos and with their ID and driver’s license.

HOW THE DATA IS COLLECTED?

Users, when registering in the app, must take a selfie or video selfie to identify the user through their biometric data. In addition, when a user takes photos before and after the rental and uploads them to the app, guppy has access to them to verify the status of the vehicle in the event of an incident.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on a server, called RM, created specifically for guppy. Said server collects the data of the photos provided by the user, in order to have access if necessary due to an incident.

The data is shared with:

• Junquera Marítima, S.L., (GJ) having signed a management contract with guppy, as well as a personal data processing contract. At GJ there is customer service, the legal department and the financial department; These departments must have access to the photographs provided by the client for the daily management of rentals and possible incidents.
• Ecoeficiencia e Ingeniería, S.L., (E+) by having signed a maintenance contract for computer systems, as well as a custom contract for the processing of personal data. In E+, there is the technical department, responsible for the proper functioning and development of the application, as well as its computer systems. Also, the person in charge of managing the fleet of vehicles and the maintenance staff of the guppies. For this reason, E+ and its staff have access to all the data provided by the client, including the photos and videos that the user shares in the app.
• Alice Biometrics, S.L., (Alice) for being the company that collects biometric data from users and to which only this company has access. GJ and E+ do not have access to this type of data, they only access the result of the report issued by Alice on said data.

DATA CATEGORY: FILES AND DOCUMENTS

TYPE OF DATA

FILES AND DOCUMENTS:

The user’s files or documents, or information about their files or documents, such as file names. In this category, can be included the digital file of his/her ID and his/her driver’s license.

PURPOSES FOR WHICH THEY ARE USED

APP FUNCTIONALITY:

They are used to offer functions that are available in the application. For example, it is necessary to collect both his/her ID and his/her driver’s license and other information, such as responsible statements of use, so that the user can make a rental.

FRAUD PREVENTION, SECURITY AND COMPLIANCE:

They are used to prevent fraud, to protect security or to comply with the law. For example, to verify that the driver’s license belongs to the same person who took the selfie and who registered in the application, that they are 18 years old and that they have not falsified their data.

HOW THE DATA IS COLLECTED?

Users, when registering in the app, must provide a copy of their ID, as well as their driver’s license, to identify the user and verify that they are of legal driving age, as well as a valid driver’s license. In case it has expired, the user is required to update the document if they want to continue using guppy.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on a server, called RM, created specifically for guppy. Said server collects the data of the user’s DNI and driver’s license, in order to have access if necessary due to an incident and assess whether the user is authorized to drive.

The data is shared with:

• Junquera Marítima, S.L., (GJ) having signed a management contract with guppy, as well as a personal data processing contract. At GJ there is customer service, the legal department and the financial department; These departments must have access to the documents (ID card and driver’s license) provided by the client for the daily management of rentals and possible incidents.
• Ecoeficiencia e Ingeniería, S.L., (E+) by having signed a maintenance contract for computer systems, as well as a custom contract for the processing of personal data. In E+, there is the technical department, responsible for the proper functioning and development of the application, as well as its computer systems. Also, the person in charge of managing the fleet of vehicles and the maintenance staff of the guppies. For this reason, E+ and its staff have access to all the data provided by the client, including the documents that the user shares in the app.
• Alice Biometrics, S.L., (Alice) for being the company that collects IDs and driving licenses and compares them with the selfie or video selfie that the user has made, as well as with the biometric data, to make the corresponding report on the user validity.

DATA CATEGORY: APP ACTIVITY

TYPE OF DATA

APP INTERACTIONS:

Information about how the user interacts with the application. For example, the number of times he/she enters in the app or the number of times he/she interacts with the guppy radar.

SEARCH HISTORY IN THE APP:

Information about what the user has searched for in the application, from vehicles to radar.

OTHER USER GENERATED CONTENT:

Any other type of content generated by users that does not appear in the other sections. For example, if you leave a message at the start or end of the rental, or the score you give to the trip.

PURPOSES FOR WHICH THEY ARE USED

ANALYSIS:

They are used to analyse the performance of the application or how users use it. For example, to see which users are using a certain function, to know the status of the vehicles, to receive feedback from users on how their rental went or to receive complaints or improve performance.

DEVELOPER COMMUNICATIONS:

They are used to send news or notifications about the application or about the developer. For example, if a user reports a problem with the rental by interacting with the corresponding button in the app, guppy will contact them to find out exactly what has happened.

HOW THE DATA IS COLLECTED?

All the data collected comes from the activity that the user carries out in the activity and that implies an active communication between the user and guppy, either leaving a valuation of the vehicle, consulting previous rentals or problems that the user has identified.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on a server, called RM, created specifically for guppy. Said server collects the data of the user’s interactions with the app, solely for its analysis and study in the face of possible incidents.

The data is shared with:

• Junquera Marítima, S.L., (GJ) have signed a management contract with guppy, as well as a personal data processing contract. At GJ there is customer service, the legal department and the financial department; These departments must have access to the user’s comments and interactions with the app, provided by the client for the daily management of rentals and possible incidents.
• Ecoeficiencia e Ingeniería, S.L., (E+) by having signed a maintenance contract for computer systems, as well as a custom contract for the processing of personal data. In E+, there is the technical department, responsible for the proper functioning and development of the application, as well as its computer systems. Also, the person in charge of managing the fleet of vehicles and the maintenance staff of the guppies. For this reason, E+ and its staff have access to all the data provided by the client, including the comments that the user shares in the app.

DATA CATEGORY: DEVICE ID OR OTHER TYPES OF DATA

TYPE OF DATA

DEVICE ID OR OTHERS:

Identifiers related to a specific device, browser, or application, such as the IMEI number, device type, or device operating system.

PURPOSES FOR WHICH THEY ARE USED

APP FUNCTIONALITY:

They are used to offer functions that are available in the application. For example, depending on the type of device, to enable application features or authenticate users.

ANALYSIS:

They are used to analyse the performance of the application or how users use it. For example, when updating the application on some devices before others and assessing its evolution and performance.

HOW THE DATA IS COLLECTED?

The identification data of the device ID is obtained when the user downloads the application, since it must be downloaded from the Apple Store or the Play Store depending on the operating system of the device.

HOW AND WITH WHOM IS THE DATA SHARED?

The data is collected on the server and only Ecoeficiencia e Ingeniería, S.L. has access to it, as it is where the technical department is located, responsible for the proper functioning and development of the application, as well as its computer systems.

Treatment of Personal Data of the Users

GUPPY MOVILIDAD SOSTENIBLE, S.L.U. collects and transmits data in order to provide its service, verify the correct operation of both the vehicles and the app, verify compliance with the requirements by users and provide their service without incidents.

Below, we indicate, in detail, the processing of personal data that we carry out, as well as all the information related to them:

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by our users in order to provide the requested services, as well as to send them commercial communications. Specifically:

The provision, optimization, monitoring, customization and provision of user assistance. Identification of users and verification of the documentation necessary to perfect the contracts related to the services provided. Management of collections, payments, defaults, billing, claims, accidents and administrative infractions, as well as for the control and prevention of fraud. Attention to requests, complaints, incidents, claims or suggestions. In the event that you do not provide your personal data, we will not be able to fulfil the purposes described.

Automated decisions will not be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

Your data will be kept as long as the interested party does not request its deletion and, where appropriate, during the years necessary to comply with legal obligations.

WHAT IS THE LAWFULNESS FOR THE PROCESSING OF YOUR DATA?

First of all, the performance of a contract, the one signed by both parties for the provision of the service offered by guppy (carsharing) à GDPR, article 6.1.b)

Secondly, the legitimate interest of the Controller, which involves sending commercial communications, even electronically à GDPR, considering 47 and Spanish Law of Information Society Services and Electronic Commerce, article 21.2).

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Ecoeficiencia e Ingeniería, S.L., due to its role as a technological developer and data analyst for the optimization of the service
• Junquera Marítima, S.L., in order to carry out the management of the invoices issued, or if it is necessary to make surcharges. In turn, G. Junquera’s legal team is part of the guppy Legal Department, so they will be the ones that will attend to the data related to convictions or criminal offenses. They are also in charge of providing Customer Service by telephone or e-mail.
• Financial entities, in order to issue the corresponding receipts (contractual requirement)

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not foreseen.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy®, we treat the information provided by interested persons in order to carry out the administrative, accounting and fiscal management of the contracted services, as well as of the contact persons. In the event that you do not provide your personal data, we will not be able to fulfil the purposes described.

Likewise, we will use the personal data provided by users to send them guppy’s commercial communications and inform them about collaborations that guppy carries out with other companies, which may have an impact on guppy’s activity and services provided.

No automated decisions will be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

Your data will be kept as long as the interested party does not request its deletion and, where appropriate, for the years necessary to comply with legal obligations.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

First of all, the performance of a contract, to carry out the administrative, accounting and fiscal management of the contracted services à GDPR, article 6.1.b)

Secondly, the legitimate interests pursued by the Controller, which involves the management of professional contact data à GDPR, article 6.1.f) and LOPDGDD, article 19

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of mediating negotiations with suppliers
• Financial entities, in order to make the corresponding payments (contractual requirement)
• Tax Administration, in order to comply with legal obligations (legal requirement)

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by interested persons in order to carry out personnel management, training, occupational risk prevention and health surveillance, payroll preparation, social insurance and contributions, records of working hours, accidents at work (in case). In the event that you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

As long as the employment relationship with the entity is maintained and for the years necessary to comply with legal obligations.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

First of all, the performance of a contract, to carry out the management of personnel, training and qualification à GDPR, article 6.1.b)

Secondly, compliance with a legal obligation: prevention of occupational risks and health surveillance, preparation of payroll, social insurance and contributions, registration of working hours, management of occupational accidents (if applicable). à Law 31/1995, November 8, on the Prevention of Occupational Risks; Royal Legislative Decree 2/2015, October, which approves the Consolidated Text of the Workers’ Statute Law; Royal Legislative Decree 8/2015, October 30, which approves the Consolidated Text of the General Law of Social Security; Royal Decree-Law 8/2019, March 8, of Urgent Measures of Social Protection and Fight against Labour Precariousness in the Work Day; GDPR, articles 6.1.c) and 9.2.b)

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of the group’s human resources
• Financial entities, in order to make payroll payments (contractual requirement)
• Tax, Social Security and Mutual Administration, in order to comply with legal obligations (legal requirement)
• State Foundation for Employment Training (FUNDAE), in order to carry out the management of subsidized courses (legal requirement)
• Ecoeficiencia e Ingeniería, S.L., due to its role as technological developer and data analyst for the optimization of the service

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by interested persons in order to manage and attend to the requests of the claimants, in the exercise of the rights established in the data protection regulations. In the event that you do not provide your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

They will be kept for the time necessary to resolve the claims.

WHAT IS THE LAWFULNESS FOR THE TRATMENT OF YOUR DATA?

Compliance with a legal obligation: manage and attend to the requests of the claimants in the exercise of the rights established in the data protection regulations à GDPR, article 6.1.c)

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and the Legal Department being in charge of dealing with these claims
• Control authorities, Public Administration Bodies and Ombudsman, where appropriate, in order to manage possible responsibilities (legal requirement)

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by interested persons in order to collect, disseminate and transfer professional data and images and/or videos of persons for promotional purposes, for publication on the internet (social networks, video platforms and websites), in the entity’s publications and other media. In the event that you do not provide us with your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

In the event that it is a minor who, as an ambassador of the brand, transfers his image for promotional purposes, the consent of his parents or legal guardians will be required, prior to the manifestation of the necessary information regarding protection. of data, complying with the obligation and the duty to inform that is included in the General Regulation of Data Protection.

HOW LONG WILL WE KEEP YOUR DATA?

The data will be kept as long as the interested party does not express their wish that they be deleted.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

The consent of the interested party: collection, dissemination and transfer of professional data and image and/or video of people for promotional purposes, for publication on the internet (social networks, video platforms and websites), in the entity’s publications and others media à GDPR, article 6.1.a).

In the case of minors, the informed consent of their parents or their legal guardian is required, even if they are minors but over fourteen years of age, since, from guppy, we consider that it implies greater protection and safeguarding of the interests of said minors.

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of publishing said photographs
• Internet, social networks, video platforms, websites, the entity’s website and other means of communication, in order to disseminate the activities carried out (contractual requirement)

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by interested persons in order to manage the personal, economic and professional data provided by the candidate to participate in the selection processes for the guppy® franchise application, interviews and other procedures necessary to the award of the guppy® franchise. In the event that you do not provide us with your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

Two years, since the last interaction.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

The performance of a contract: management of the personal, economic and professional data provided by the candidate, to carry out the selection processes of candidates for the award of the guppy® franchise.

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

No data will be transferred to third parties, except legal obligation.

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by interested persons in order to manage the Curriculum Vitae received, and carry out the personnel selection processes, interviews and other procedures necessary to search for the best possible candidate for a given job position. In the event that you do not provide us with your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

Two years, since the last interaction.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

The performance of a contract: management of the Curriculum Vitae delivered by the candidate, to carry out the personnel selection processes for the search for the best possible candidate for a given job position à GDPR, article 6.1.b)

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of the human resources of said company

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

At guppy® we treat the information provided by interested persons in order to manage the queries, suggestions, complaints and claims made by the users of the application through the Customer Service number and fleet. In the event that you do not provide us with your personal data, we will not be able to fulfil the purposes described.

No automated decisions will be made based on the data provided.

HOW LONG WILL WE KEEP YOUR DATA?

Two years, since the last interaction.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

In the first place, the consent of the interested party, who provides their data so that their request, claim, complaint or suggestion can be metà GDPR, article 6.1.a)

Secondly, the execution of a contract or the application of pre-contractual measures, since the calls are made to make inquiries about a current rental, requests to terminate the rental or doubts regarding the action procedure regarding the vehicles, in advance. to the perfection of the contract à GDRP, article 6.1.b)

TO WPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of managing user calls.
• Ecoeficiencia e Ingeniería, S.L., due to his role as technological developer and data analyst for the optimization of the service

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

Biometric data are those personal data referring to the physical, physiological or behavioural characteristics of a person that enable or ensure their unique identification. In the case of guppy®, facial recognition is carried out at the time the User Profile is created.

Initially, we use facial recognition (biometric personal data referring to the physical, physiological or behavioural characteristics of a person that enable or ensure their unique identification) at the time of creation of the User Profile. The face is analysed through certain digital tools, which compare it with the photograph or image that appears on the DNI and on the driver’s license provided by the person who is creating the User Profile.

On the other hand, we need the user’s geolocation data, through the location of their mobile device, to be able to evaluate the distance from the available vehicles. This transfer of data will occur when the application is active and system permissions have been granted to it through the configuration of the mobile device in question.

Finally, the vehicles are also geolocated through the GPS installed in them, to ensure, at all times, the safety of our fleet, as well as its operations. Also to deal with claims from the Authorities and other incidents that may arise from their rental, so the location of the person responsible for said rental can be determined, as it is linked to that of the vehicle.

At guppy® we treat the information provided by interested persons in order to verify that the person who is creating their user profile is the same as that which appears on the DNI and on the driver’s license that they provide when registering. At the same time, that they are eligible to drive vehicles in Spain (being over 18 years of age and have a driving license) and that they are not impersonating a third party in order to sign a lease with guppy® without a driving license in Spain.

HOW LONG WILL WE KEEP YOUR DATA?

The data will be kept as long as the interested party does not request its deletion and, where appropriate, for the years necessary to comply with legal obligations.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

In the first place, the User’s Consent, which must be free, express, specific, informed and unequivocal. Therefore, when creating the user profile, prior to the collection of biometric data (facial recognition and geolocation), the express consent of the user is requested regarding the acceptance of this Privacy Policy, after reading it à GDPR, article 6.1.a)

Second, the execution of a contract. Guppy needs to know that the user to whom it is going to rent one of its vehicles is suitable for driving and is not going to impersonate the identity of a third party, which is why facial recognition is carried out and it is verified that the person who is registering is the same as the one that appears on the DNI and on the driving license that qualifies you to drive in Spain à GPDR, article 6.1.b)

Third, the legitimate Interest of the Responsible. Guppy needs to know that the user to whom it is going to rent one of its vehicles is suitable for driving and is not going to impersonate the identity of a third party, which is why facial recognition is carried out and it is verified that the person who is registering is the same as the one that appears on the DNI and on the driving license that qualifies you to drive in Spain à GDPR, article 6.1.f)

IMPACT ASSESSMENT

The company, when processing biometric data that is considered sensitive by the GDPR, is obliged to carry out an Impact Assessment, which consists of carrying out an analysis of the risks to which the processing of biometric data is exposed and, from there, determine the security measures that must be applied to reduce or avoid the risks.

As specified, the collection of facial recognition and geolocation biometric data is necessary and effective to meet the needs that arise for the company when providing the service, such as verifying that its users comply with the legal obligation to driving with a valid driving license, being over 18 years of age, and correctly locating the vehicles in case of loss, accident or claim. It has been proven that there is no less invasive way to achieve the desired goals.

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of Customer Service and manual verification of guppy users
• Ecoeficiencia e Ingeniería, S.L., for having signed a management contract by virtue of which the correct functioning of the application and user control is verified

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA?

For the processing of data related to criminal offenses and convictions or related security measures, the RGPD provides that it can only be carried out under the supervision of public authorities or when authorized by the Law of the EU or of the Member States that establish guarantees adequate for the rights and freedoms of the interested parties.

At guppy® we will only process data related to criminal offenses and convictions of guppy users who are involved in a quick trial or other type of criminal procedure arising from the employment of a guppy or as a result of the signed lease.

These data will be, solely and exclusively, processed by the Legal Department of the company, practicing collegiate lawyers, without the rest of the staff having access to them.

HOW LONG WILL WE KEEP YOUR DATA?

The data will be kept for the time necessary to comply with legal obligations.

WHAT IS THE LAWFULNESS FOR THE TREATMENT OF YOUR DATA?

In the first place, compliance with a legal obligation by the Responsible Party, since it is common for the FFCCSE to request the identification of drivers of our vehicles, for having committed an infraction of traffic regulations. Also, it is common for there to be criminal proceedings, such as quick trials in Duty Courts in which guppy is involved as a victim, resulting in a criminal sentence that must be stored and processed, as well as the data contained therein, during the appropriate legal period à Organic Law 7/2021, of May 26, on the protection of personal data processed for the purposes of prevention, detection, investigation and prosecution of criminal offenses and the execution of criminal sanctions; GDPR, article 6.1.c)

Secondly, the legitimate interest of the company, since it is common for the FFCCSE to ask us to identify the drivers of our vehicles, for having violated traffic regulations. Also, it is common for there to be criminal proceedings, such as quick trials in Duty Courts in which guppy is involved as a victim, resulting in a criminal sentence that must be stored and processed, as well as the data contained therein, during the appropriate legal period. Failure to do so would mean disobedience to authority and could entail responsibilities for guppy à GDPR, article 6.1.f)

IMPACT ASSESSMENT

The company, when processing data related to criminal offenses and convictions, is obliged to carry out an Impact Assessment, which consists of carrying out an analysis of the risks to which said treatment is exposed and, from there, determining the security measures that must be applied to reduce or avoid risks.

As specified, the collection of data related to infractions and criminal sanctions are necessary and effective to meet the needs that arise for the company when providing the service and respond to the claims of the FFCCSE and the Administration, both the Judicial and the State. It has been proven that there is no less invasive way to achieve the desired goals.

TO WHICH RECIPIENTS WILL YOUR DATA BE COMMUNICATED?

Your data will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of the Legal Department of said company
• Ecoeficiencia e Ingeniería, S.L., due to its role as technological developer and data analyst for the optimization of the service

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not planned.

INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA

The personal data of the Gijón City Council and its Autonomous Bodies are treated with the strictest anonymization.

A specific corporate extranet has been created for this tender, by virtue of which the Gijón City Council itself, as well as its Autonomous Bodies, are in charge of registering and deregistering its users, these registrations and deregistrations not being carried out, in any case, by the company or by any of its treatment managers.

From Astur Sercomar, S.L.U., we only have access to their ID data, and cannot, in any case, link them to a specific natural person that allows the user to be identified. Among the ID data, there is their corporate email and their corporate phone. Exceptionally, and optionally, users can link their corporate account with their Personal Identification which, in no case, would be accessible by Astur Sercomar, S.L.U. or their treatment managers, as it would be encrypted and without the possibility of access to it on our part. It is the users themselves who would choose to reflect their Personal IDentification, not being required by Astur Sercomar, S.L.U. for the provision of the service, in any case.

We are aware of the geolocation of the vehicle in question, given the GPS that, for security reasons, is installed in the vehicles and for the sake of an adequate provision of the service, but, in no case, said geolocation can be linked to a specific user.

DATA TREATMENT

The fleet members of Astur Sercomar, S.L.U. receive notifications, through the Telegram messaging application, through a “bot”, about the status of the vehicles: if a vehicle is on stand-by for a certain time, as well as their geolocations and if they are found rented, reserved or blocked. Since we do not know the name, surname or ID of the users, we only have their ID data, it is not possible for us to identify a specific natural person or link a vehicle with a user.

The members of customer service and the Legal Department of G. Junquera Marítima, S.L., in charge of the treatment, only have access to the data of the user ID who contacts the company for a particular matter. Only if the user provides, of his own free will and optionally, at the time of the telephone conversation or email, some additional data, these workers would be aware of them, but, otherwise, they would not have access to more data than those already stated.

A limited number of workers of Ecoeficiencia e Ingeniería, S.L., in charge of the treatment, have access to the aforementioned user ID data, since they are dedicated to the implementation, improvement and maintenance of both the guppy application and the RM management system. And, if at any time the application or system crashes, there is a security breach or some other type of computer problem, it would only be this data that they could have access to. They are not aware of the names, surnames or any other additional information that could affect the quality of personal data of the users of the Gijón City Council and its Autonomous Bodies.

WHAT IS THE LEGITIMATION FOR THE PROCESSING OF THESE DATA?

The execution of a contract, the one signed by Astur Sercomar, S.L.U. and the Gijón City Council for the provision of the service offered by guppy (carsharing) à GDPR, article 6.1.b)

TO WHICH RECIPIENTS WILL THESE DATA BE COMMUNICATED?

The data collected will be communicated to:

• Junquera Marítima, S.L., for having signed a management contract with Astur Sercomar and being in charge of the Legal Department and Customer Service
• Ecoeficiencia e Ingeniería, S.L., due to its role as technological developer and for service optimization
• Guppy Movilidad Sostenible, S.L.U., for being the parent company of which Astur Sercomar, S.L.U. is a franchise, as it is the owner of the management platform and of the application through which the provision of the service is carried out

DATA TRANSFERS TO THIRD COUNTRIES

Data transfers to third countries are not foreseen.

12. Data Processing of users using TESLA vehicles

By accepting our Privacy Policy, the user gives consent to the processing of their personal data by TESLA SPAIN, S.L. Unipersonal and GUPPY MOVILIDAD SOSTENIBLE, S.L.U. in the context of providing services for rental of self-driving vehicles through the guppy app. Both companies are Data Controllers, responsible for processing the personal data of users who use TESLA vehicles through the guppy app.

By accepting our Privacy Policy, the user acknowledges having access to TESLA’s Customer Privacy Policy, available at https://www.tesla.com/about/legal and declares to have understood it, giving consent to the processing of Personal Data by TESLA, in accordance with TESLA’s Privacy Notice.

The guppy app will allow the user to benefit from advanced functionalities and will allow the company to better manage its vehicle fleet. These functionalities may include remote vehicle commands (e.g.: locking/unlocking doors, opening trunk, enable remote start if correct password is provided, open/close roof, honking horn, flashing lights, climate controls and charge limit) and remote collection of information about the vehicle state (including if the car is locked or not, charge state, climate state, current location and driver state).

By accepting our Privacy Policy, the user understands and agrees that, to benefit from the app advanced functionalities and to better manage the vehicle fleet, the company needs to process some of their personal data, which may include vehicle identification number, speed information, odometer readings, battery use management information, battery charging history, electrical system functions, software version information, safety related data (including information about the vehicle’s SRS systems, brakes, security, e-brake), data about any issues that could materially impair operation of your vehicle, data about an safety critical issues, data about software and firmware update, vehicle and drive state data (including the road segment data and current location), and other data to assist in identifying and analyzing the performance of the vehicle.

This information will only be used as described in this document and, in particular, to:

• Provide the user with the above functionalities
• Issue certain vehicle commands or collect information about certain aspects of a vehicle’s state
• Advise the user on important safety-related information
• Collect information about the vehicle’s performance and provide related services
• Collect information about the use of the vehicle, in order to better manage the fleet
• Provide services to vehicle’s passengers, where applicable

Both companies maintain administrative, technical and physical safeguards designed to protect the personal data against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use. Personal data of users will only be retained for as long as necessary to provide the application’s functionalities, unless otherwise authorized by the user or required or authorized by applicable law.

Users have the right to request access to and receive information about their personal data, update and correct inaccuracies in their personal data and have their information blocked or deleted, as appropriate, free of charge and at any time. The procedure to exercise these rights is stated at the beginning, in the section “What rights are recognized to you after providing your data to guppy?”.