Private policy and data protection
We are pleased that you have visited our platform. Our platform includes our website, including all subdomains, as well as our iOS and Android apps.
Data protection is very important to us and we want you to feel safe when visiting our platform. Below we will therefore provide you with detailed information about the type, scope and purpose of the personal data we collect, use and process and explain the rights to which you are entitled as the data subject.
You can visit our platform without providing your personal data. However, as soon as you use individual functions, services or offers on our platform, personal data may be processed. We only collect, process and use personal data if you have consented to the collection, processing and use or if there is a corresponding legal basis or the processing takes place.
We have the right to change the privacy policy at any time with future effect. The current version of the privacy policy can be accessed, saved and printed out on our platform at any time.
1. Access data in server log files
Every time you access our platform, we automatically save access data in so-called server log files, such as the name of the requested file, the date and time of access, the amount of data transferred, the browser used and its version, the operating system used, the IP address, the requested URL including subpages, the referrer URL (URL that you visited immediately before) and the requesting provider. This data is evaluated solely to ensure permanent and trouble-free operation of the platform and to improve the content of our platform, as well as to transmit it to law enforcement authorities in the event of a cyber attack, and does not allow us to draw any conclusions about you personally. The anonymous data in the server log files is stored separately from all other personal data you provide. We statistically evaluate this anonymously collected data and information with the aim of increasing our data protection and data security.
2. Use of cookies
In order to make visiting our platform more attractive and to enable the use of certain functions, we use so-called “cookies” on our platform. These are small text files that are stored on your device via a browser.
Many cookies contain a so-called cookie ID. This consists of a character string that allows platforms and servers to be assigned to a specific browser in which the respective cookie was stored. After the end of the browser session, most of the cookies we use are deleted ("session cookies"). The permanent cookies ("persistent cookies"), on the other hand, remain on your device. These cookies enable us and other websites you visit to distinguish your individual browser from other browsers and thus identify you individually during a visit to our platform.
The purpose of this identification is to make it easier for you to use our platform and to make your visit to our platform more pleasant. By using cookies, you do not have to enter your login details every time you visit. Some of the third-party services we integrate may use cookies. Please visit the websites of the relevant third-party providers to find out more about how they work and how they process data. You can find out about the services we use in this privacy policy.
You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general or set it so that the setting of cookies is prevented and thus permanently object to the setting of cookies. In addition, you can delete cookies that have already been set at any time via your browser. This also applies to all third-party cookies listed by us below. If you do not accept or deactivate cookies, the functionality of our platform may be restricted.
3. Data collection and use during registration
You have the option of registering on our platform. In this case, we collect the personal data that you voluntarily provide to us as part of your registration (e.g. name, first name, email address). The specific data that is collected can be seen from the respective input forms. We only use the data you provide internally to provide the services we offer on the platform and to process your enquiries for our own purposes and to process the contract with the provider on their behalf. For more information on how the provider uses your data, please refer to their privacy policy. We may also pass your data on to one or more processors (e.g. payment service providers) who also use your data exclusively for internal use on our behalf.
We also save your IP address, the date and time of registration in order to prevent misuse of our platform and the services offered on it and to investigate any crimes that may have been committed. The storage of this data is therefore necessary for our own protection. This data is generally not passed on to third parties unless there is a legal obligation to do so or the data is passed on for criminal prosecution purposes.
After the contract has been fully processed or your account has been deleted, your data will initially be blocked for further use and deleted after the statutory retention periods have expired, unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you below.
4. Data collection and use when using the services
You also have the option of concluding a rental agreement on our platform. In this case, we collect the personal data that is required to conclude and implement the rental agreement (e.g. driver's license number, date of birth, telephone number). The data that is collected can be seen from the respective input forms. We only use the data you provide internally to provide the services we offer on the platform and to process and implement your bookings on behalf of the provider. For more information on how the provider uses your data, please refer to their privacy policy.
We also save your IP address and the date and time of the respective booking in order to prevent misuse of our platform and the services offered on it and to investigate any crimes that may have been committed. The storage of this data is therefore necessary for our own protection. This data is generally not passed on to third parties unless there is a legal obligation to do so or the transfer serves the purpose of criminal prosecution.
After the rental agreement has been fully processed or your account has been deleted, your data will initially be blocked for further use and deleted after the statutory retention periods have expired, unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you below.
5. Google Analytics
We use Google Analytics on our platform, a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google Analytics"). The information generated about your use of this platform is usually transferred to a Google Inc. server in the USA and stored there. The USA is an unsafe third country. However, Google Inc. has voluntarily certified itself under the US-EU data protection agreement "Privacy Shield" and has thus committed itself to complying with EU data protection regulations.
Google Analytics uses methods that enable an analysis of your use of the platform, in particular which website you came to our platform from (so-called referrers), which subpage you access or how often and for how long you view a subpage. Google Analytics uses cookies for this purpose. Every time you visit a page on our platform on which Google Analytics has been integrated, your browser on your device is automatically prompted to transmit data to Google Analytics for analysis purposes.
By activating IP anonymization on our platform, the IP address is shortened within the member states of the European Union or in other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google Inc. server in the USA and shortened there. The anonymized IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google Inc.
Google Inc. will use the information collected on our behalf to evaluate the use of our platform by users, to compile reports on activities within this platform and to provide us with other services relating to the use of this platform and internet usage. Google Inc. may also transfer this information to third parties if required by law or if third parties process this data on behalf of Google Inc. Pseudonymous user profiles may be created from the processed data.
You can prevent Google Inc. from collecting the data generated by the cookie and relating to your use of our platform (including your IP address) and from processing this data by Google Inc. by downloading and installing the browser add-on available under this link . Google Inc. will view the installation of the browser add-on as an objection.
As an alternative to the browser plug-in or within browsers on mobile devices, please click this link to object to the collection and use of your data by Google Analytics with effect for the future. An opt-out cookie will be stored on your device. If you delete your cookies, you must click the link again. The terms of use and privacy policy of Google Inc. and Google Analytics can be found here https://policies.google.com/privacy or here http://www.google.com/analytics/terms/de.html .
6. Amazon Web Services
The personal data you provide to us voluntarily when registering or contacting us will be processed and stored by us at Amazon Web Services, a server and hosting service provider of Amazon. Amazon Web Services Inc. (AWS) is a secure platform for cloud services that offers computing power, database storage and the provision of content. The processing servers are located in Frankfurt, the European headquarters is One Burlington Plaza, Burlington Road, Dublin 4 Ireland. However, your personal data may be stored or accessed in various countries, including the United States. The USA is an unsafe third country. However, Amazon Web Services Inc. has voluntarily certified itself under the US-EU data protection agreement "Privacy Shield" and has thus committed itself to complying with EU data protection regulations. The terms of use and privacy policy of Amazon Web Services Inc. can be found here https://aws.amazon.com/de/privacy/
We also process and store your data in the G Suite, Amphitheatre Parkway Mountain View CA 94043 USA. G Suite is a series of software tools from the US company Google LLC. https://policies.google.com/privacy
7. Firebase
We use Google Firebase, a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Firebase") in our apps. Due to the settings we have made, your personal data will be processed and stored wherever possible within the member states of the European Union or in other contracting states to the Agreement on the European Economic Area. However, we cannot rule out the possibility that Firebase will also transfer your personal data to the USA. The USA is an unsafe third country. However, Google Inc. has voluntarily certified itself under the US-EU data protection agreement "Privacy Shield" and has thus committed itself to complying with EU data protection regulations.
We use several Firebase functions in our apps: Firebase Analytics uses methods that enable an analysis of your use of the respective app, in particular which functions of the app you access, how often you open the app or when the app is uninstalled. The data is only collected in anonymized form and is not linked to your other data stored by Google Inc. The data collected about the use of our app is transferred to Google Inc. and stored there. Google Inc. uses the advertising ID of your device for this purpose. Google Inc. will use the data collected to evaluate the use of our apps and to provide us with other services related to the use of the apps. You can restrict the use of the advertising ID in the device settings.
We also use Firebase Crash Reporting to stabilize and improve our apps. This collects data about the device you use and the use of our apps (e.g. the timestamp when the respective app was started and when a problem occurred), which enables us to diagnose and solve problems. When you use Firebase Crash Report, your data is only collected in an anonymized form, so that neither Google Inc. nor we can draw any conclusions about you personally.
We use the Firebase Cloud Messaging service to send you push messages or so-called in-app messages to your device. If you use our apps on a push-enabled device, you can consent to receive "push notifications". Your device will be assigned a pseudonymized device token ID, a unique connection number generated from the device ID, which we can use to address the push messages or in-app messages to you. You can change your consent to notification via push messages at any time in the settings in the apps.
For further information on data protection, please refer to the privacy policy https://policies.google.com/privacy of Google Inc.
8. Integration of YouTube
We embed videos from the social network youtube.com on our platform, which is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA ("Youtube"). YouTube, LLC is a subsidiary of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA.
When you access our platform, a direct connection to the YouTube servers is established via your browser. The video embedded on our platform automatically causes your browser to download a representation of the corresponding YouTube component. As part of this technical process, YouTube receives information about which specific subpage of our platform you are visiting.
If you use the videos, the corresponding information (e.g. pressing the play button) is transmitted from your browser to YouTube, linked to your user account and saved.
If you are logged in to your personal Google account while visiting our platform, YouTube can assign the visit and the specific subpage of our platform that you visit to your account. If you do not have a Google account, there is still the possibility that YouTube will save your IP address.
If you do not want such processing, you must log out of your Google account and delete your cookies before visiting our platform.
For further information on data protection, please refer to YouTube’s privacy policy https://policies.google.com/privacy .
9. Conversion measurement with Facebook’s visitor action pixel
With your consent, we use the “visitor action pixel” of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”) on our website. This allows us to track the actions of users after they have seen or clicked on a Facebook ad. This allows us to record the effectiveness of Facebook ads for statistical and market research purposes. The data collected in this way is anonymous to us, which means we do not see the personal data of individual users. However, this data is stored and processed by Facebook, and we will inform you about this to the best of our knowledge. Facebook can link this data to your Facebook account and also use it for its own advertising purposes, in accordance with Facebook’s data usage policy https://www.facebook.com/about/privacy . You can allow Facebook and its partners to place advertisements on and outside of Facebook. A cookie may also be stored on your computer for these purposes.
This consent may only be given by users who are older than 13 years. If you are younger, we ask you to ask your legal guardian for advice.
Please click here if you wish to withdraw your consent.
10. Integration of third-party content
We sometimes integrate third-party content on our platform, such as maps from Google Maps and Apple Maps, RSS feeds or graphics from other websites/services. In order to display this content, it is necessary to transmit your IP address to the third-party provider. When you access our platform, a direct connection to the servers of the respective third-party provider is therefore established via your browser. Your browser is automatically prompted by the respective content embedded on our platform to download a representation of the corresponding third-party component. As part of this technical process, the third-party provider receives information about which specific subpage of our platform you are visiting.
Unfortunately, we have no influence on whether the third-party provider collects or stores the IP address for purposes other than simply displaying the content. If we become aware of such use, we will inform you about it in this privacy policy.
11. Newsletter and Analysis
Sign up for our newsletter by providing your email address. You can also give your name. Registration uses a double opt-in process: after signing up, you'll receive a confirmation email to finalize your subscription. This process is documented, including registration and confirmation times, and your IP address, to prevent misuse.
Our newsletter includes internal news and new offers. We collect information on browser, system, IP address, open times, and clicked links to improve our services.
You can unsubscribe and revoke your consent to data use at any time via the link in the newsletter, our platform, or by emailing info@myvau.com.
12. Email and Helpdesk
Due to legal regulations, we provide information on our platform that enables quick electronic contact with us and direct communication with us. This primarily includes our email address. We also offer support. If you contact us by email or via our support, the personal data you provide will be saved automatically. However, we use the personal data you provide exclusively to process your specific request on behalf of the provider. The data you provide will always be treated confidentially.
13. Location data
When using our platform, we also need access to the location of your device in order to be able to track the distance you have traveled as part of the rental agreement. At the beginning and end of your journey, we record your current location via GPS in order to determine the distance you have traveled. We collect and store the determined distance on behalf of the respective provider in order to calculate the fare. In addition, the collection of location data is a prerequisite for effective insurance cover, so we also collect and store your location data for this reason.
If you conclude a rental agreement on our platform, you agree to the collection of location data. You can revoke your consent to the collection of location data at any time with effect for the future. Your location data is transmitted via an encrypted connection. After the rental agreement and the retention periods for insurance have ended, your location data will be anonymized and statistically evaluated to improve our service.
14. Payment Service Provider Adyen
We have commissioned Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (“Adyen”), to handle our payment process. We carry out the payment process on behalf of the respective provider. If you select “SEPA direct debit” or “payment by credit card” as a payment option during the ordering process on our platform, your data will be automatically transmitted to Adyen. By selecting one of these payment options, you consent to the transmission of personal data required for payment processing.
We send Adyen your first and last name as well as IBAN as a prerequisite for payment processing. Personal data related to your respective booking is also necessary for processing the payment. In particular, there may be a mutual exchange of payment information, such as booking data, prices, and tax payments or information on previous booking behavior.
The purpose of transmitting the data is solely to process payments. We will transmit personal data to Adyen if the provider has a legitimate interest in the transmission. Adyen may also pass on the personal data to affiliated companies and service providers or subcontractors if this is necessary to fulfill the contractual obligations or if the data is to be processed on behalf of the provider.
For further information on data protection, please refer to Adyen’s privacy policy at https://www.adyen.com/policies-and-disclaimer/privacy-policy.
15. Reviews
You have the option of submitting reviews on our platform. Submitting a review is voluntary. To submit a review, you must log into your account and enter a review text. Your review will be sent to our customer support team along with your name. If you want us to actively request that you submit a review by email, you must confirm this service in advance during the registration process. The request to submit a review serves to ensure the quality of our platform and to ensure the transparency of the services on our platform for other users. You can unsubscribe from this service at any time. Please use the link provided in the respective email or change the settings in your account.
16. Data security
We protect our platform and other systems through numerous technical and organizational measures against loss, destruction, access, alteration or distribution of your data by unauthorized persons. Despite regular checks, complete protection against all risks is not possible and cannot be guaranteed by us. For this reason, you are always free to send us your personal data by other means, for example by telephone or by post.
17. Deletion and blocking of data
We process and store your personal data only for the period necessary to achieve the purpose of storage, until you withdraw your consent to storage or as far as this has been provided for by the European legislator or another legislator in laws or regulations to which we are subject.
If the purpose of storage no longer applies, you withdraw your consent, or if a storage period prescribed by the European legislator or another competent legislator expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.
18. Right to confirmation
You have the right to request confirmation from us as to whether personal data concerning you is being processed. If you would like to exercise this right of confirmation, you can contact us at any time.
19. Right to information
You also have the right to obtain information about the personal data stored about you and a copy of this information from us at any time and free of charge. You also have a right to information regarding the following information:
the purposes of processing,
the categories of personal data being processed,
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations,
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
the existence of a right to rectification or erasure of personal data concerning him or her or to restriction of processing by the controller or a right to object to such processing,
the existence of a right to lodge a complaint with a supervisory authority,
if the personal data are not collected from the data subject: all available information about their origin,
the existence of automated decision-making, including profiling, referred to in Article 22 (1) and (4) of the GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
You also have the right to know whether personal data has been transferred to a third country or to an international organization. If this is the case, you also have the right to receive information about the appropriate guarantees in connection with the transfer. If you would like to exercise this right to information, you can contact us at any time.
19. Right to rectification
You have the right to demand the immediate rectification of inaccurate personal data concerning you. In addition, you have the right to demand the completion of incomplete personal data - also by means of a supplementary statement - taking into account the purposes of the processing. If you would like to exercise this right to rectification, you can contact us at any time.
20. Right to erasure
You have the right to request that we delete your personal data immediately if one of the following reasons applies and processing is not necessary:
The personal data were collected or otherwise processed for purposes for which they are no longer necessary.
The data subject withdraws consent on which the processing is based according to point (a) of Art. 6(1) GDPR or point (a) of Art. 9(2) GDPR, and where there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. 21 Para. 2 GDPR.
The personal data were processed unlawfully.
The erasure of personal data is necessary to fulfill a legal obligation under Union or Member State law to which the controller is subject.
The personal data were collected in relation to information society services offered in accordance with Art. 8 Para. 1 GDPR.
If you would like to exercise this right to erasure, you can contact us at any time. We will comply with the erasure request immediately. If the personal data was made public by us and we as the controller pursuant to Art. 17 Para. 1 GDPR are obliged to erase the personal data, we shall take appropriate measures, including technical ones, taking into account the available technology and the implementation costs, in order to inform other data controllers which process the published personal data that the data subject has requested the erasure by such controllers of all links to these personal data or of copies or replications of these personal data, unless processing is required.
21. Right to restriction of processing
You have the right to request that we restrict processing if one of the following conditions applies:
The accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, the data subject opposes the erasure of the personal data and requests the restriction of the use of the personal data instead.
The controller no longer needs the personal data for the purposes of the processing, but the data subject needs them to assert, exercise or defend legal claims.
The data subject has objected to processing pursuant to Art. 21 Para. 1 GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
If one of the above conditions is met and you would like to request the restriction of your personal data stored by us, you can contact us at any time. We will arrange for the processing to be restricted.
22. Right to data portability
You have the right to receive the personal data concerning you that you have made available to us in a structured, common and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent in accordance with Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract in accordance with Art. 6 (1) (b) GDPR and the processing is carried out using automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Furthermore, when exercising your right to data portability in accordance with Art. 20 Para. 1 GDPR, you have the right to have the personal data transmitted directly from us to another controller, provided this is technically feasible and provided that this does not adversely affect the rights and freedoms of others. You can contact us at any time to assert your right to data portability.
23. Right to object
You have the right to object at any time to the processing of personal data concerning you based on Art. 6 (1) e or f GDPR, for reasons related to your particular situation. This also applies to profiling based on these provisions.
In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If we process your personal data to conduct direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising. This also applies to profiling insofar as it is associated with such direct advertising. If you object to us processing for direct marketing purposes, we will no longer process your personal data for these purposes.
You also have the right to object to the processing of your personal data concerning you for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 (1) GDPR, unless such processing is necessary to perform a task carried out in the public interest, for reasons related to your particular situation. You can contact us at any time to exercise your right to object. You are also free to exercise your right of objection by means of automated procedures that use technical specifications in connection with the use of information society services, notwithstanding Directive 2002/58/EC.
24. Right to automated individual decisions, including profiling
You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, provided that the decision
is not necessary for the conclusion or performance of a contract between you and us, or
is permitted by Union or Member State law to which we are subject and which contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
with your express consent.
Is the decision
necessary for the conclusion or performance of a contract between you and us or
If it is based on your explicit consent, we will take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.
If you wish to assert rights with regard to automated decisions, you can contact us at any time.
25. Right to withdraw consent to data protection
You have the right to withdraw your consent to the processing of personal data at any time. If you wish to exercise your right to withdraw your consent, you can contact us at any time.
26. Legal basis for processing
Art. 6 I lit. a GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary to fulfill a contract to which you are a party, as is the case, for example, with processing operations necessary for the delivery of goods or the provision of other services or consideration, the processing is based on Art. 6 I lit. b GDPR. The same applies to processing operations that are necessary to carry out pre-contractual measures, for example in cases of enquiries about our products or services. If we are subject to a legal obligation which requires the processing of your personal data, such as to fulfill tax obligations, the processing is based on Art. 6 I lit. c GDPR. In rare cases, the processing of your personal data may be necessary to protect your vital interests or the vital interests of another natural person. This would be the case, for example, if you were injured as a visitor to our company and your name, age, health insurance data or other vital information had to be passed on to a doctor, hospital or other third parties. In that case, the processing would be based on Art. 6 I lit. d GDPR. Ultimately, processing operations could be based on Art. 6 I lit. f GDPR. This legal basis is used for processing operations that are not covered by any of the aforementioned legal bases if the processing is necessary to protect a legitimate interest of ours or a third party, provided that your interests, fundamental rights and freedoms do not outweigh them. We are permitted to carry out such processing operations in particular because they were specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if you are one of our customers (Recital 47, Sentence 2 GDPR).
27. Legitimate interests in processing
If the processing of your personal data is based on Article 6 I lit. f GDPR, our legitimate interest is the conduct of our business activities for the benefit of the well-being of all our employees and our shareholders. Furthermore, we have stated our purposes and interests in the above list of processing.
28. Period for which personal data will be stored
The criterion for the duration of storage of your personal data is the respective statutory retention period. After expiry of the period, the corresponding data is routinely deleted unless it is no longer required to fulfill or initiate a contract.
29. Legal or contractual provisions for the provision of personal data; necessity for the conclusion of the contract; obligation of the data subject to provide the personal data; possible consequences of non-provision
We would like to inform you that the provision of personal data is sometimes required by law (e.g. tax regulations) or may also arise from contractual provisions (e.g. information on the contractual partner). Sometimes it may be necessary for you to provide us with personal data in order to conclude a contract, which we must subsequently process. For example, you are obliged to provide us with your personal data if you conclude a contract with us. Failure to provide your personal data would mean that the contract with you could not be concluded.
You must contact us before providing your personal data. We will clarify to you on a case-by-case basis whether the provision of your personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and what consequences non-provision of the personal data would have.
30. Existence of automated decision-making
We do not carry out any automated decision-making or profiling.
35. Contact details
VAU S.r.l.
IT02746520226
Via Linfano 52 Arco (TN) Italy 38062
info@myvau.com
Status: June 2024