Privacy Notice under Article 13 of the GDPR
Protecting your privacy when using our website is important to us. Therefore, the present data protection information explains in detail which of your personal data is processed when you use our website and how we protect this data (= responsible processor). The data is processed on the basis of the applicable legal provisions.
Contact Details of the Data Controller
Holding Graz – Kommunale Dienstleistungen GmbH
Andreas-Hofer-Platz 15
8010 Graz
Postfach 848
Tel.: +43 316 887-0
Fax: +43 316 887-1154
Customer Service: office@holding-graz.at
Managing Directors:
- Dr. Gert Heigl
- Mark Perz, MA, MBA
- DI Dr. Alexandra Loidl
Contact Details of the Data Protection Officer
Mag. Florian Alexander Hutzl
datenschutz@holding-graz.at
What Data Is Processed?
The following data is processed:
Personal Data
- Titel/Gender
- First and last name
- Address
- Email adress
- Telephone numbers
- Date of birth
- Nationality
We collect this personal data during the registration process, which is a prerequisite for booking vehicles.
Identification Data
- Driving licence data
- Public transport ticket
- Customer number
- Username
We collect this personal data during the registration process and the vehicle booking process.
Payment Data
- Type of payment instrument or payment method
- Account holder (first name, last name, address, email address)
- Credit and debit card data (cardholder, card issuer name, IBAN, BIC, expiry date)
- Creditworthiness data
We collect this personal data during the registration process and/or billing.
Vehicle Usage Data
- Vehicle GPS location
- Odometer reading
- Distance travelled
- Fuel level/charge status
- Booking data (planned booking)
- Start and end time of the booking
- Start and destination points of individual trips within a booking (street from/street to)
- Motion data (based on acceleration along the x, y, and z axes, rotation around the x, y, and z axes, and vehicle speed)
- Speed, driving behaviour, and door activity before and after a damage event
- Date, time, location, and route of any damage event
We collect this personal data during the vehicle booking process and/or the use of a booked vehicle.
For What Purpose and on What Legal Basis Is Data Processed?
Data processing is carried out for the following purposes:
- Contract conclusion
- Document and contract management
- Contract execution, performance, and invoicing of memberships and bookings
- Compliance with data protection obligations
- Conducting relevant communication
- Provision of suitable booking software
- Ensuring operations, security, and fraud prevention
- Handling claims and complaint cases
- Analysis and evaluation of user behaviour for research purposes, service evaluation, and the strategic development of the offering
- Contacting users for marketing purposes
- Compliance with legal obligations under the ITS (Intelligent Transport Systems) Act
The provision of your personal data is necessary for the performance of the contract. Failure to provide your personal data may result in the inability to conclude or perform the contract.
The legal basis for processing your personal master data, identification data, payment data, and vehicle usage data is the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), our legitimate interest in improving our services, protecting vehicles from damage or unauthorized or improper use, and establishing, exercising, or defending legal claims (Art. 6(1)(f) GDPR), as well as, in the case of contacting customer service or contacting users for marketing purposes, your consent under the General Terms and Conditions (Art. 6(1)(a) GDPR). Where we are subject to a legal obligation that requires the processing of personal data, such as compliance with tax law obligations or disclosure obligations towards authorities, the processing is based on Art. 6(1)(c) GDPR.
To Whom Do We Disclose Your Data?
Categories of Recipients
To achieve the purposes described above under Section 1, your data may be disclosed to the following categories of recipients:
- Prime Mobility & Consulting GmbH for customer service, contract administration, service communication, as well as statistical evaluations and analyses
- Benefit Büroservice GmbH, for customer service
- ibiola mobility solutions GmbH, for the technical operation and administration of the booking platform
- Regionalmanagement Steirischer Zentralraum GmbH, statistical evaluations and analyses
- carValoo GmbH, for the processing of automated damage detection
Authorities, where there is a legal obligation or authorization to do so (e.g. as part of a driver identification procedure or for legal enforcement purposes)
Transfer of Data Abroad
There are no plans to transfer your personal data to a third country or an international organization.
How Long Do We Store Your Personal Data?
Unless otherwise stipulated in this Privacy Policy, we do not store your data longer than necessary to achieve the processing purposes described above under Section 1 or otherwise to fulfill our contractual or legal obligations. Data will therefore be retained for as long as required by the purpose of the processing and/or as long as applicable law requires (i.e. for the duration of statutory retention obligations) or permits (i.e. until the expiry of limitation periods for potential legal claims or as long as we have a legitimate interest).
Rights of Data Subjects
Under applicable law, as a data subject, you have the right at any time to:
- Obtain information about the data we process concerning you
- Rectify inaccurate data
- Data portability
- Restrict processing
- Erasure (“right to be forgotten”)
Where your data is processed on the basis of our legitimate interests, you also have the right to object at any time to the processing of your personal data on grounds relating to your particular situation.
Where the processing of your data is based on your consent, you also have the right to withdraw your consent at any time with effect for the future. Such withdrawal does not affect the lawfulness of processing carried out prior to the withdrawal.
To exercise the above rights, please contact us using the contact details provided above under Section 1.
If you believe that our processing of your data violates applicable data protection law or that your data protection rights have otherwise been infringed, please contact us using the contact details provided above under Section 1 so that we can become aware of your concerns and address them accordingly. You also have the right to lodge a complaint with a competent supervisory authority (in Austria: the Austrian Data Protection Authority).