Privacy Policy
Privacy information for passengers
Privacy information for passengers, referring to the EU General Data Protection Regulation ("GDPR") for users of the Ncc.it app for passengers.
October 2020
This information provides an overview of the processing of your personal data and your rights under the provisions on data protection regarding the use of our app for the booking service for rental cars with driver ("Ncc .it App Passengers ").
The type of personal data processed basically depends on the services or products used.
Sections
- Data controller information
- Definitions
- Activities and purposes of data processing
- Rights
- Data security
- Retention period
- Updates and changes
1. Data Controller Information
Referring to the Article 4 paragraph 7 of the GDPR, for passengers on Italian territory the data controller is:
Ncc.it società Cooperativa
Via Maretto,24/26 Rome 00166 (Italy)
VAT number 14915191002
Email: supporto@ncc.it
For any need regarding personal data, write to the address indicated
2. Definitions
"Personal data": any information relating to a natural person ("data subject"); the natural person who can be identified with particular reference as name, identification number, location data, online identifier or one or more characteristic elements of his physical identity is considered identifiable, physiological, genetic, psychic, economic, cultural or social;
"Processing": any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as the collection, registration, organization, structuring, storage, '' adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction;
3. Activities and purposes of data processing
Thanks to Ncc.it App you will be able to make your trips with rental cars with driver. In order to use our Ncc.it app, it is necessary that you provide your personal data which we will process to guarantee you the service. Other information may be shared voluntarily and will be indicated as "optional".
3.1 Awarding of races
Referring to services for the award of races, pursuant to Art. 6 (1) b) GDPR and to Art. 6 (1) a) of the GDPR relating to optional information, the following personal data are processed in order to continue with the contract:
3.1.1 General
You must provide the following information to register in order to use the Ncc.it app:
Name and surname, e-mail address and mobile number (personal data). We will use your mobile number to verify your customer account by sending you a code via SMS. This process is to avoid that registration is done without specifying a valid mobile number. Registration will be completed only after entering the code on Ncc.it app..
In relation to travel management, we will also process the following data: time of call, departure and destination coordinates and information about user's device (device ID). The user can provide the departure coordinates (i) by placing a pin on the map, or by entering an address, or (ii) by transmitting the GPS coordinates. The legal basis for the processing of GPS position data lies in Art. 6 (1) (a) GDPR. The use of GPS location data by Ncc.it may be allowed at the time of installation of the Ncc.it app. Through the operating system of the end user's device (smartphone, tablet, etc.), it is also possible to give consent, even later, for the use of GPS coordinates by Ncc.it or to revoke the consent. The processing of GPS coordinates occurs only if you are logged in and if the Ncc.it app is active.
Without the processing of personal data, we cannot offer you our services as a transport company. This does not apply to optional information.
Even profile photo, the address of the workplace and home are optional communications will be collected and processeby us only if they are provided to us during registration or later on. We use your profile photo for your identification and to avoid fraud. Your profile photo will be temporarily shown to the driver who must make your journey. The address of the pre-established places (e.g. work and home) are used to simplify the saving of the standard routes used by you. The processing of these personal data, provided voluntarily, takes place on the basis of your consent, pursuant to Art. 6 (1) a) GDPR. If you wish that your data, communicated optionally, are no longer processed, you can simply delete them from Ncc.it app.
The driver who will perform the service and the company will receive pick-up location, together with the name and, if provided, the destination and profile photo, which will be used for identification purposes. The driver can also proceed with identification by asking for your name before the start of the ride. After receiving the call for your ride, the driver can call you using the Ncc.it app. Meanwhile, the mobile number you provided during registration will be displayed. This way, you can be informed by the taxi driver about any delays (for example, traffic jams) and, for example, you can provide more details on the pick-up location. After finishing the ride, the taxi driver will no longer be able to access your personal information on Ncc.it app.
The legal basis for the transmission of the pick-up and destination positions as well as the name and mobile phone number to the respective transport company is written in Art. 6 (1) b) GDPR and, as regards optional information such as profile photo or GPS data, it is written in Art. 6 (1) a) GDPR.
3.1.2 Registration / Login using Facebook Connect
In addition, we offer you the possibility to log in or sign up to the FREE NOW Passenger App using your Facebook user data, a service of Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"); to do this you have to click on the Facebook Connect button. To access, you will be directed to the Facebook page, where Facebook will ask you for certain permissions to be able to log in with your Facebook user data. In this way your Facebook profile and our FREE NOW Passenger App will be connected. By virtue of this link, your data (name, surname, e-mail address, profile photo) as provided to Facebook will also become visible to us. The processing of this data by us will take place in accordance with the determinations specified in this privacy statement.
For more information you can consult the Facebook privacy policy and terms of use available at the following address:
www.facebook.com/policy.php.
If you would like your data not to be processed as defined above, you will not be able to use the Facebook Connect function. If you have used Facebook Connect in the past, you can prevent further processing by us of your data saved on Facebook by going to 'settings' in your Facebook account and deleting the FREE NOW Passengers app from the 'Apps and websites' category'.
3.1.3 Sign up/Login using Google Account.
In addition, we offer you the opportunity to log in or login with the FREE NOW Passenger App using your Google Account login details on Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). To do this, you will be transferred to the Google website, where Google will ask you for certain permissions and you can log in using your Google login details. In this way, your Google profile and our FREE NOW Passenger App will be connected. Through this link, the information you have provided to Google (name and surname, e-mail address and profile photo) will become visible to us. The processing of this data, on our part, will be carried out in accordance with the determinations of this privacy statement.
For more information you can consult the Google privacy policy and terms of use at https://policies.google.com/privacy?hl=it.
If these conditions do not suit you, do not use access or registration through your Google account. You can prevent further processing by us of the aforementioned data, saved in your Google account, by going to 'security' in
3.1.4 Google Maps integration
Ncc.it app uses the Google Maps API provided by Google Ireland Limited Gordon House, Barrow Street Dublin4 (“Google”). In this way, you can view the maps on Ncc.it app and have the possibility to interact with these maps. Without the Google Maps API application, the Ncc.it app will not work. The terms of use for Google Maps can be found on: https://www.google.com/help/terms_maps.html. There, you will also find a notice regarding Google's privacy policy: https://policies.google.com/privacy?hl=de. We use Google Maps to calculate the expected cost of the ride and to interactively show you the distance of the vehicle that will make your ride. In this context, if you have consented to such use, your GPS location data will be processed in accordance with Art. 6 (1) a) GDPR. Your GPS location data will only be provided to Google in anonymized form. Identification of you, as a person, is impossible.
3.1.5 It is not applicable
3.2 Payment
If you use the payment function with Paypal, we will have to process the following personal data, based on Art. 6 (1) b) GDPR, for the purposes of contract execution:
If you use the payment methods offered through PayPal, the data necessary for the processing of the payment will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal"). Further information on data processing via PayPal can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Credit card payments are made by: (i) the Braintree service of PayPal Inc., 22-24 Boulevard Royal, L-2449, Luxembourg, through which we will transmit your details to PayPal. The privacy policy for the use of the Braintree service is available at: https://www.braintreepayments.com/legal. (ii) Wirecard AG, Einsteinring 35, 85609 Aschheim, Germany. For payments via WireCard, the payment information you provide will be transmitted to Wirecard. Detailed information on data protection on Wirecard can be found here: https://www.wirecard.de/datenschutz/.
All payment service providers are Payment Card Industry Data Security Standard (PCI DSS) certified. The provided credit card details will be transmitted via an encrypted connection directly to the payment processor used by us. Our payment process manager will then carry out an authentication process of your payment method, assigning an amount to your account. This ensures that your payment method is an active means of payment. For security reasons, only the last four digits of your credit card are transmitted to us which we save for identification purposes and for necessary documentation..
3.2.1 Payment Services Directive
The new regulation relating to Directive 2 on payment services (Payment Services Directive 2: PSD2) will come into force. The goal is to standardize security standards and reduce fraud for payments made with alternative instruments to cash, throughout the European Economic Area, through the recent “Strong Customer Authentication” (SCA). This regulation puts in place a uniform legal framework across the EEA for the amounts and frequencies for which authentication is required. Two of three possible authentication factors must be validated: 1) Something the user knows, such as a password or PIN. 2) Something the user has, such as a credit card or device. 3) Something the user is. For example, iris scan, fingerprint or other biometric data. The choice of the relevant authentication methods is the responsibility of the issuing bank
3.3 Evaluation of drivers and passengers
Thanks to Ncc.it app, you can provide public assessments of drivers and cars. If you provide an evaluation, this will be associated with a particular ride and will be taken into consideration in the context of the average evaluation of the driver and the corresponding vehicle. None of your personal data will be transmitted to the driver. The processing of personal data by Ncc.it is carried out on the basis of your consent pursuant to Art. 6 (1) a) GDPR, which you offer by leaving an evaluation. In addition to this, the respective Driver has the possibility to positively evaluate you as a passenger, but also to inform us about any problems. The star rating ranges from one to five, with five being the highest point value. Drivers are invited to leave an evaluation based on the kindness and behavior of the passenger. The ratings can only be viewed by Ncc.it. The processing of this data takes place on the basis of our legitimate interest, pursuant to Art. 6 (1) f) GDPR, in the further development and improvement of the quality of our services.
3.4 Anti-fraud and non-payment measures
3.4.1 General
If you do not want to use the payment service through the app, you can still use the Ncc.it App and make the payment in cash or by debit card. Therefore, we remind you that you can use the Ncc.it App for passengers and our travel booking service at any time, even if the payment service via the app has been deactivated.
In order to protect you from overpaid travel payments, the driver's mobile device sends us the GPS coordinates during close intervals during the ride, allowing us to reconstruct the entire course of the ride. In fact, we intend to ensure that the driver does not purposely extend the journey to earn a higher fee. If you believe you have paid an excessive price, at the end of the race you can ask us for information on its progress. The processing of GPS coordinates serves to protect you and us from fraudulent drivers and/or passengers based on the provisions of Article 6 (1) f) GDPR for the protection of your and our interests (e.g. protection from higher payments due).
3.5 Bug fixes (operating errors) and improved functioning
In order to correct bugs (operating errors) and to improve the functionality of Ncc.it app and adapt it to the needs of passengers, we process the following personal data, pursuant to Art. 6 (1) f) GDPR on the basis of our legitimate interest:
Name and surname, email address, country, mobile number, profile photo (optional), GPS coordinates at the time of the call (if you have allowed access), address of the workplace and home (optional data) , departure and arrival location of the ride and information about your device (device ID, Ad ID), language and time zone.
It is sufficient to achieve the corresponding purpose, we work with anonymous data rather than personal data.
3.6 News and personalized offers
3.6.1 General
You will receive offers and advertising from us if you have consented to the sending of news and personalized offers (advertising, vouchers and offers) and the display of usage-based advertising (“Retargeting”). The service consists of sending personalized advertising via e-mail (e-mail, SMS, MMS) or other electronic means (in-app notifications, push notifications) to your device (smartphone, tablet, PC, etc.). In this regard, we process the following personal data, pursuant to Art. 6 (1) a) GDPR, insofar as you have given us the corresponding consent:
Name and surname, passenger ID, email address, home or workplace address (optional), mobile number, profile photo (optional), payment method, registration date, set language, profile of the Ncc.it App (corporate or private customer), type of ride (booking, flight), version of Ncc.it App, access data, GPS coordinates at the time of the call and at the end of the ride, or place outlet and destination, device ID (device identification code), GAID (Google advertising identifier), IP address and usage data (frequency of use, number of app installations, registration and travel status), language , time zone and city.
If you do not want to receive news and personalized offers, you can revoke your consent by deactivating the corresponding option. You can also contact us by writing an e-mail to supporto@ncc.it.
We remind you that the revocation and the consequent changes will not have retroactive effect and it may take up to 72 hours from the request before they are implemented. For technical reasons it is not possible for us to act more quickly.
3.6.2 Direct advertising for existing customers
Once we have received your email address or mobile phone number for the provision of our service and once you have completed a ride using our service, we may use this data for direct advertising for our products and services via email. (e-mail, SMS and MMS), unless you have declined the direct advertising service. For this purpose, we process your e-mail address or your mobile number according to Article 6 (1) f) GDPR. Our legitimate interest lies in intensifying the relationship with the customer, offering him adequate and interesting information on the products. You can unsubscribe from the service at any time by clicking on the appropriate link at the bottom of the respective email (eg unsubscribe from the newsletter) or by contacting us via SMS, without retroactive effect. The direct advertising sent by us is not personalized. We remind you that the revocation and consequent changes will not have retroactive effect and can be implemented no later than 72 hours from the request. For technical reasons it is not possible for us to act faster.
3.7 Presence on social media
3.8 Facebook
When you view our Facebook page (via a link from our website, our newsletter or directly), you access the prepared technical platform and the services of Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbor, Dublin 2, Ireland ("Facebook").
Please note that the use of the Facebook site and its functions takes place under one's own responsibility. This applies in particular to the use of interactive features (eg. Comments, sharing, evaluation).
When you visit our Facebook page, Ncc.it collects personally identifiable data only if you interact with us through our Facebook page, eg. if you comment on something, click on a "Like" button or send us a message. The legal basis for the processing of such data by Ncc.it is different according to the way in which the features of our Facebook page are used. If you send us eg. a contractually relevant request, the processing of data on our part is based on art. 6, par. 1, lett. b) of the GDPR. Furthermore, data processing may also take place on the basis of consent pursuant to art. 6, par. 1, lett. a) of the GDPR, eg. if you click on "Like", you comment on one of our publications / posts or upload content to our Facebook page. You can revoke the consent given at any time with effect for the future by deleting the comment or its own content. Any revocation does not affect the legality of the processing carried out on the basis of consent up to the time of revocation. Furthermore, we analyze the accesses made and the interactions on our Facebook page. To this end, Facebook creates user profiles and provides us with exclusively anonymised data in the form of Page Insights (“Page Insights”). Page Insights are summarized data that help us better understand how visitors interact with our Facebook Page. Further information is made available by Facebook at the following link: de-de.facebook.com/help/pages/Insights.
Please note that when you use and access our Facebook page, your personal data is processed by Facebook as well as by Ncc.it. For the processing of Insights data, Ncc.it and Facebook are jointly responsible. The respective responsibilities of Ncc.it and Facebook in relation to the processing of Insights data are set out in the appendix for Insights of the Page, available at the following address: https://www.facebook.com/legal/terms/page_controller_addendum.
How Facebook uses Facebook page visit Insights data for its purposes, to what extent Facebook page activities are associated with individual users, how long Facebook retains this data and whether data from a Facebook page visit Facebook page are transmitted to third parties, for all this the sole responsibility lies with Facebook.
With reference to the processing of data through our Facebook page, you have the possibility to assert your rights as an interested person (see also point 4 "Your rights") both towards Ncc.it and towards Facebook. For more information, see Facebook's "Data Policy" available at: de-de.facebook.com/about/privacy.
In addition to the processing described above, Facebook also processes your data for analysis and advertising purposes or to display personalized advertising. At the same time, Facebook also uses, according to our knowledge, cookies, pixels or other techniques that memorize user behavior (even on different terminal devices). In this way, Facebook can display targeted advertising both in the context of its platform and on third-party websites. The data collected about you in this context are transmitted by Facebook to the United States and other countries outside the European Union. Facebook's Data Policy explains in general terms what information Facebook receives exactly and how it is used. There you will also find information on Facebook contact details and setting options for advertisements. The guidelines on the use of data are available at the following link: de-de.facebook.com/about/privacy. The full version of the Facebook Data Policy is available here: https://de-de.facebook.com/full_data_use_policy.
Furthermore, Facebook offers Facebook members the opportunity to object to certain types of data processing. Information on this and the possibility of opt-out are available at: https://www.facebook.com/settings?tab=ads.
3.8.1 Links to social networks Instagram, Youtube
On our website and in our newsletters, we also integrate links to our other profiles in the social networks Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, California, 94025, USA; "Instagram"), Youtube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Youtube”) via the respective social network logo.
If you click on the link or directly access the contents of Ncc.it on these platforms, you will find yourself on the websites of the respective social media providers. The general terms and conditions and data processing conditions of the respective social media providers apply.
We point out that we are not aware of the content and extent of data processing by the respective service providers. Information on the use of your personal data by the respective social media providers can be found in the respective information on the processing of personal data of these services:
• Instagram: instagram.com/about/legal/privacy/
• Youtube: https://policies.google.com/privacy?hl=de&gl=de
We process data via our social media profiles to the extent that users of social media platforms use our profile to send messages or comments directly to us. The legal basis for data processing is therefore the consent of the respective user pursuant to art. 6, par. 1, lett. a) GDPR or, in the case of contractually relevant requests, art. 6, par. 1, lett. b) of the GDPR. Eventually, we will share your content on our site if this is permitted by a function of the social media platform and communicate with you via the social media platform. The legal basis for this is constituted by art. 6, par. 1, sentence 1, lett. f) of the GDPR. In this case, the data processing takes place on the basis of our legitimate interest in public relations and communication.
4. Rights
If your personal data is processed, then you are a so-called interested party, in the sense specified by the GDPR and therefore you have the following rights before Ncc.it: :
You can, at any time and free of charge, request information relating to the purpose of storing data (Article 15 of the GDPR). You can, at any time, request the correction of incorrect data (Article 16 GDPR). In addition, you can request that your personal data be provided to you in a structured, common and machine-readable format (Art. 20 GDPR).
You can object to the future use of your personal data (Article 21 GDPR). You can also request a partial or complete cancellation (Article 17 GDPR), a limitation of the processing or a block (Article 18 GDPR) of your personal data. We will investigate these requests and, if there is no legal basis for continuing with the processing of such data, we will fulfill your requests. We will inform you about the decisions made.
Regardless of any other administrative or judicial appeal, you have the right to lodge a complaint regarding the processing of your personal data with a supervisory authority.
All requests for information, access, revocation of consent, objections and of any other type relating to data protection can also be sent by e-mail to supporto@ncc.it
5. Data security
We take appropriate technical and organizational measures to ensure data security, in particular to protect your personal data and prevent them from being disclosed to third parties, accidentally or intentionally modified, lost or destroyed. These measures are regularly reviewed and updated to the most current state of the art. The transmission of your personal data from your device (e.g. smartphone) generally takes place encrypted. Ncc.it maintains the highest safety standard
6. Retention period
The data are kept only for the time necessary for the respective purposes for which you have transmitted your data, or to the extent required for compliance with legal or official requirements. We will, in principle, anonymize your personal data after three years, unless we may have a legitimate interest in a longer retention period (e.g. accounting obligations or statutory limitation periods).
7. Updates and changes
We reserve the right to change this privacy policy in the future. In the event that we change the information, we will inform you of the changes and give you the opportunity to give your consent or to refuse it.
