Privacy Policy

PRIVACY POLICY FOR CUSTOMERS OF “BINBIN BULGARIA” EOOD Please read carefully the present document. It contains the Privacy Policy for customers of “BINBIN BULGARIA” EOOD, the users of its website https://www.binbin.tech and the users of the BINBIN Scooters mobile application (“the Policy”) and is aimed to explain our practices related to personal data processing in the context of the services provided and activities performed by us. The Policy is drafted in compliance with the requirements under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the Regulation). General provisions 1. In connection with the provision of its services and performance of its activities, BINBIN BULGARIA EOOD (“BINBIN” / “we”), in its capacity as data controller, processes personal data of its customers – natural persons, as well as personal data of other individuals specified below (“Data Subjects”/ “you”), in compliance with the rules and principles under the present Policy. 2. BINBIN BULGARIA EOOD is a company with UIC 206883242, head office and registered address: Sofia, 206 Tsar Boris III Blvd., 4th floor, phone number: 070010279, email address: support@binbinscooter.com , web: https://www.binbin.tech and BINBIN Scooters mobile app. Data Subjects 3. In connection with the provided services we process information regarding the following Data Subjects: (a) individuals visiting or registering through the website https://www.binbin.tech or the application (the Apps jointly); (b) individuals making purchases through the Apps, in their name or on behalf of another individual or legal entity (if so possible and allowed as per our GTC); (c) individuals using the services provided by us, including, rental of electrical scooters as per our GTC and related services, including individuals representing or acting in another manner on behalf of legal persons using the said services; (d) individuals who, on their own behalf or on behalf of another person, have addressed inquiries (including, but not limited, by email, fax, phone, or other), requests, signals, complaints or other correspondence to BINBIN. Categories of Personal Data 4. The information (categories of personal data) concerning Data Subjects which is processed by BINBIN pursuant to the present Policy may include: Categories of Data Data Types In connection with the rental services as well as the App functionalities, including for the purposes of automated facial recognition between an ID document and a face picture • identification data: receiver’s full name; date of birth; gender; nationality; national identification number (such as PIN for Bulgarian citizens or identification number for foreigners) ID document number and date of issue; ID document date of expiry; country issuing the ID document; tax number; signature; telephone number; email address; address; special offers and preferences; • data for contact: full name; address; email address; telephone number; • data for purchase of goods: names, date and hour of purchase; address; e-mail; telephone; offers and preferences; • information from log-in logs (if applicable), server logs, Web Application Firewalls, and other devices falling in this category: date and time, IP address, URL, browser and device information; • Cookies: The operation of the Website requires the use of cookies. You can find a detailed description of the cookies used, their designation and the information which is processed by means of cookies in the Cookies Policy of BINBIN, accessible at: https://www.binbin.tech • Copies of ID documents and face pictures; Data relating to payments and issuance of invoices information regarding the payment method (, by credit card, etc.); information regarding due and effected payments; information regarding the due date of payment and overdue/outstanding debts; bank details (credit card); currency of the payment; number, expiry date and holder of the credit/ debit card; CVC code; data contained in the payment authorization slip; authorization slips (signed). In cases where the Data Subject represents another person (e.g. a company): information regarding the represented person and the capacity of the representative (incl. workplace, position), as well as information of ordered services/ submitted orders in such capacity. Respectively, in cases where the services are ordered by a person other than the Data Subject on behalf of the Data Subject – in what capacity the Data Subject will use the services, who has ordered the services, who will make the payment, etc. (for instance, in case of accommodations organized by an employer or a business partner of the Data Subject, etc.). Only in the context of the services used and the location of the vehicle used. The user’s location is not monitored or recorded Location In connection with problems, complaints, applications, requests and signals (including in free text) non-structured information contained in the respective complaints, applications, requests and signal, voice recording included; behavioural data - operating system, browser or other device used; Surveillance and Security 5. We may apply security measures including a 24-hour video surveillance system of recording and storage devices for ensuring the physical security against violations on the buildings and sites, and for protection of the life and health of citizens. 6. Video surveillance and video recording may be performed in publicly accessible zones and premises in the buildings of BINBIN and in zones and premises with an exclusive access regime. As far as this cannot be avoided upon the installation of the video surveillance devices it is possible that they record also part of the street in front of BINBIN’s premises, but this is made accidentally and is not the purpose of the video surveillance. There is no video surveillance in the WCs, recreation rooms, etc. The data of video surveillance activities are stored in a separate locked room with limited access. The records are being reviewed only upon occurrence of an accident (such as incident, unlawful act of an employee, client or a third person) as the respective section of the recording shall be archived and stored for the period necessary for us to exercise our respective rights. 7. Information boards are available at visible places to notify Data Subjects and other visitors that technical means for surveillance and control are used and provide any other related information. Direct Marketing and Statistical Data 8. We, respectively other companies related to or partners of us, may process the following your personal data: names; telephone number; address; email address; information of the type and number of used and preferred services provided by us and other data explicitly specified in additional consent for the purposes of direct marketing, such as offering of goods and services, including goods and/or services offered by other persons, conducting inquiries and polls for the purpose of improving the quality of the services provided, etc., within the scope of the respective consent. 9. Where personal data are processed for direct marketing purposes you shall be entitled at any time to object to such processing or withdraw your consent to the processing. In such cases, the processing of personal data for such purposes is terminated. 10. The providing of transport solutions leads to necessity for sharing of data with universities, municipalities, NGOs related to green efficiency measures. The data which may be provided to them includes: (a) Information on usage – daily, monthly, yearly; (b) Overall distances covered; (c) GPS coverage of the scooters; (d) Reduced travel times; (e) Reduced CO emissions; Purposes of Personal Data Processing 11. We collect, store, and process the information described above for the purposes provided for in the present Policy, which, depending on the legal grounds for the processing may be: (a) purposes related to the compliance with legal obligations of BINBIN; (b) purposes related to and/or necessary for the performance of the contracts concluded with us or for taking steps at the request of the Data Subject prior to entering into a contract; (c) purposes related to our legitimate interest or of third parties; (d) purposes for which the Data Subject has given his/her consent to the processing of his/her data. Provision of personal data and consequences from refusal 12. We clearly indicate, where applicable and in the appropriate manner, whether the provision of the respective data and/ or documents is mandatory or constitutes a requirement necessary for the conclusion or performance of a contract, as well as the consequences from the refusal to provide such data. Any refusal to provide data and documents indicated as mandatory may prove an impediment to the provision of a service by us to the satisfaction and execution of submitted requests, applications, signals, etc., which releases us from liability for default. Other Sources of Personal Data 13. In certain cases, the personal data processed by us are not collected and received directly from the Data Subject of the relevant data, but from third parties, such as: (a) persons representing, working for or otherwise cooperating with the Data Subject; (b) event organizers – with respect to information concerning the participants in the event; (c) business partners (e.g., sites; agencies, other persons that provide intermediary services in the context of ordering of other services, etc.) of BINBIN; (d) competent state and judicial authorities. Categories of Recipients of Personal Data. Data Processors 14. We not disclose personal data concerning the Data Subject to third parties except where: (a) this is necessary for compliance with our legal obligation – such as to competent state, municipal or judicial authorities, auditors; (b) this is explicitly provided for in the Privacy policy and/or the general terms (the contract) for use of the services by us – such as data processors as assigned by us, companies for receivables collection; (c) this is necessary for the provision of our services – such as to banks and payment services providers, postal and delivery services providers, our business partners such as: sites; agencies and other sellers or other supportive services; (d) the Data Subject has given his/her explicit consent – to the persons provided for in the relevant consent (e.g. our related parties, our business partners, etc.); (e) this is necessary to protect our rights and legitimate interests or of third parties or the Data Subject – such as to state, municipal and judicial authorities, private and public judicial enforcement officers, lawyers; (f) in other cases, provided by law. 15. For the purposes specified in the present Policy, BINBIN may assign data storage and processing activities to third parties – data processors, in compliance with the requirements under the Regulation and the other applicable personal data protection rules. Where personal data are disclosed to and processed by data processors, such disclosure and processing will be carried out only to the extent and in the amount necessary for the performance of the tasks assigned by us. Data processors act on our behalf and are obliged to process personal data only in strict compliance with our instructions. Data processors shall not be entitled to use or otherwise process the information for purposes other than for the purposes specified in the present Policy. 16. BINBIN will transfer your personal data storing and processing to the sole owner of BINBIN - BIN ULAŞIM VE AKILLI ŞEHIR TEKNOLOJILERI ANONIM ŞIRKETI, a joint-stock company incorporated under the laws of Turkey, Istanbul Trade Registry / Registration Number: 205981-5, address: Saray Mahallesi, Sanayi Caddesi, No 54/2 Ümraniye/İstanbul Turkey and through it – with organizations / entities for the core storage and processing of data for our purposes. Those entities are non-EU based and BINBIN has undertaken all necessary measures for adequate protection measures, including entering into agreement for implementing of the approved by the EU standard contractual clauses for data protection. All non-EU entities storing / with access to data do have implemented TIER III and ISO 27001, ISO 50001, ISO 10002, ISO 22301, ISO 9001. Retention Periods 17. We process and store information about the Data Subject until achieving the relevant purposes it is collected and processed for. In accordance with the applicable legislation, we process and store information about the Data Subject for the periods as follows: Type of data Storage period Data relating to obligations under the Consumer Protection Act and the applicable legislation for services (including names of client and all related data) 5 calendar years Information relating to requested and purchased services, events, including such relating to cancellation of those (as far as they involve a refund of pre-paid amounts and/or a deduction of amounts due) From making the respective purchase/ request up to 5 /five/ years from the reservation / purchase / completion of the contract/ cancellation. In cases where the services are requested and used based on a long-term contract, the period starts running from the complete performance and/ or termination of the contract. Financial and accounting documents; invoices; authorisation slips; other information related to tax and insurance control. Up to 10 /ten/ years from the beginning of the year following the one in which payment of the amount for the relevant year is due. Unstructured communication, correspondence, complaints, signals, voice records, etc. as well as any other data not explicitly listed 5 years In cases where the correspondence concerns a long-term contract, the period starts running from the complete performance and/ or termination of the contract. System logs. Logs related to security, technical support, etc. (these may contain information such as: date and time, IP address, URL, information about the browser version and device) Up to 5 years Data from video recordings 2 months Data from feedback cards/client’s ratings The information from the feedback cards is filled in the internal systems of BINBIN in a fully anonymized form (only the feedback, comments and recommendations) without any information regarding the person who has given this feedback. After that the feedback cards are destroyed immediately. Up to 30 days after they have been filled in Personal data included in client’s ratings, published on websites, shall be stored for the periods specified by the relevant websites Data processed on the grounds of Data Subject’s explicit consent As of the moment of obtaining the consent till its withdrawal by the Data Subject The personal data referred to in this Policy may also be processed for a longer period than the ones specified above if this is necessary to achieve the objectives set forth therein or to protect the rights and/or legitimate interests (including in legal proceedings) of BINBIN or if the current legislation provides for data processing for a longer period. Rights of the Data Subjects Regarding Their Personal Data 18. In relation to the processing of the personal data concerning him/her, each Data Subject has the following rights: (a) right of access and information – to be provided with information on the processing of his/her personal data from us and to have access to the processed personal data; (b) right of rectification – to require his/her personal data to be rectified and completed if the data are inaccurate or incomplete; (c) right of erasure – to require his/her personal data to be erased if there are the grounds for this provided for in the Regulation; (d) right of restriction of personal data processing – to require that we restrict the processing of his/her personal data within the limits provided for the Regulation if there are the grounds for this set forth therein; (e) right to notify third parties – to require that we notify the third parties to whom his/her personal data have been disclosed of any rectification, erasure or restriction of the processing of his/her personal data unless this proves impossible or involves disproportionate effort from us; (f) right of data portability – to receive the personal data concerning him/her and which he/she has provided to us, in a structured, commonly used, machine-readable format, as well as to have the right to transmit such data to another controller without any hindrance on our part; (g) right not to be a subject to an automated decision which is based solely on automated processing (i.е. processing without human intervention), including profiling within the meaning of the Regulation. We at BINBIN use programmes for automated personal data processing and decision making, including your profiling; (h) right to withdraw consent for processing – where personal data processing is based solely on consent given by the Data Subject, the latter shall have the right to withdraw his/her consent at any time. Such withdrawal shall not affect the lawfulness of the processing based on consent before its withdrawal; (i) right to object - the Data Subject shall have the right to object, on grounds relating to his/her particular situation, at any time to processing of personal data concerning him/her, including profiling within the meaning of the Regulation, based on public interest, exercise of official authority and the legitimate interests of BINBIN or a third party. In these cases, we shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or where necessary for establishing, exercising or defending legal claims. 19. The Data Subject may exercise his/her personal data protection rights by personally submitting a written request at the address specified in Item 2 of this Policy or by sending a written non-anonymous request by post. 20. The Data Subject may exercise the rights relating to his/her personal data also through an explicitly authorized person (with a power of attorney certified by a notary). Part of the rights may also be exercised through the functionalities available on the Website. Data Security 21. We will take reasonable measures to: (a) protect personal data against unauthorized access, disclosure, change or destruction, and (b) maintain accurate and updated personal information, as appropriate. We also require from service providers, with whom we share personal data, to take measures analogical to ours, for the provision of confidentiality for your personal data. Such protection is in place with respect to the information which we keep electronically or on a paper copy. The access to your personal information is restricted to specific personnel or representatives. In addition, we use generally accepted techniques for protection of the information such as firewalls, access control, etc. However, regrettably, there is no security system or data transfer system online, which is guaranteed to be completely secured, and in case of breach, we are under the responsibility to address the case to the persons and authorities concerned. Right to Lodge a Complaint with a Supervisory Authority 22. Any Data Subject has the right to lodge a complaint with a personal data supervisory authority. Supervisory authority in the Republic of Bulgaria is: Commission for Personal Data Protection Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592 Website: https://www.cpdp.bg/. Explanations and Additional Information 23. The Data Subject may seek clarifications regarding the content, the grounds and the way of exercising his/her rights under this Policy, as well as any additional information regarding his/her rights regarding the processing of personal data by BINBIN on the contact details given in Item 2 above. This Privacy Policy has been drafted by BINBIN in its capacity as data controller to fulfil its obligations to provide information to the data subjects under Art. 13 and Art. 14 of Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). We reserve the right to periodically update and amend this Privacy Policy to reflect any changes to the way we process your personal information or changes to your legal requirements. In the event of such modifications, we will publish the modified version of the Privacy Policy on our website and therefore kindly request that you periodically review its content. This Privacy Policy will take effect from18/05/2022.