PRIVACY POLICY

1. General

This privacy policy (the ”Privacy Policy”), together with the user agreement and terms and conditions (the “Agreement”), available on the Voi website www.voi.com, describes how Voi Technology AB, a company registered in Sweden with company number 559160-2999 and with its registered office at Sveavägen 25, 111 34 Stockholm, Sweden (”Voi”, “We”, “Our“), as a data controller, process its customer’s (“You” in any form) personal data when using the Services, as defined in the Agreement. In section 2.2 in this Privacy Policy, We also describe Our processing of personal data of passers-by (who may or may not be Our customers) in the recording area of an unlocked Scooter equipped with a camera device (“Passers-by”).

Unless otherwise stated in this Privacy Policy, the definitions used herein will have the same meaning as in the Agreement. Questions regarding this Privacy Policy and Voi’s processing of Your personal data can be sent to [email protected] or to Voi’s data protection officer:

Voi Technology AB

Data protection officer: Thomas Murphy, Email: [email protected]

Address: Sveavägen 25, 111 34 Stockholm

The Privacy Policy is intended to comply with our obligations to provide you with information about our processing of your personal information under applicable privacy laws. It explains how we collect, use and share personal information in the course of our business activities.

2. Collection, purpose and use of personal data

2.1 Personal data related to You (Our customers)

Voi will collect personal data which You submit when creating an account in the Voi App or which is created when You are using the Voi App or the Services.

Voi processes Your personal data for the following purposes:

a) For the purposes of entering into, fulfilling and administering our contractual relationship (including handling payment) with You and to correspond with You in relation to the Services, we process the following personal data:

• Location data (device location and location of Scooters);
• Contact details (such as name, address, e-mail address and phone number);
• Whether or not a user has a valid driver’s licence and expiry date of the user’s licence.
• Payment information (such as bank card information, invoice history, payment history)
• Device ID of your device;
• Photos of scooters which You upload in the Voi App; and
• (If you are claiming a discounted rate as a low income user, receiver of income support / universal credit / health care contributions, key worker or student) evidence of your status, such as a copy of your HC2 / HC3 certificate, staff card, student campus card or other documentation that can evidence your status.

Our lawful basis for the processing of your personal data for this purpose is to fulfil our contractual obligations with You (Article 6(1)(b) GDPR).

b) For the purposes of performing statistical analyses, to analyze data in order to develop the Services regarding functionality, security and methods, and to analyze markets and customers, we and third parties described below process the following personal data:

• IP address;
• Information about Your device, such as make, model, and operating system;
• Information about You such as that described in (a) and age, first part of post code, gender;
• Information about Your use of the Voi App and the Services, for example, the date, time and duration of your usage; and
• Survey data; responses to user experience and demographic survey questions;
• Location data (device location and location of scooters);
• Gyroscope data from Your device (rotation rate of Your device) – if You have activated core motion on Your device; and
• Accelerometer data from Your device (orientation and velocity data from Your device) – if You have activated core motion on Your device.

Our lawful basis for the processing of your personal data for this purpose is our legitimate interest to be able to develop the Services and to increase Our understanding of the markets and customers (Article 6(1)(f) GDPR). Wherever possible, we anonymise or aggregate data processed for this purpose.

c) For the purposes of carrying out marketing campaigns we may process personal data including:

• Contact details (such as name, e-mail address and phone number)

The lawful basis on which we process personal data for marketing purposes is either our legitimate interests in marketing our business (Article 6(1)(f) GDPR), or consent (Article 6(1)(a) GDPR) where we send marketing about third party products and services, as further described in section 6.  Where our processing is based on consent you can withdraw this at any time by using the unsubscribe link in our emails or by contacting us using the details given in section 1.

d) For the purposes of segmenting and analyzing position data in order to provide custom information based on Your specific preferences and behavior patterns, we process the following personal data:

• Position data

The lawful basis for the processing of your personal data for this purpose is to fulfil Our contractual obligations with You, i.e. in order for Us to provide the Services (Article 6(1)(b) GDPR).

e) For the purpose of providing loyalty credits for wearing helmets Voi will process Your personal data when you submit a picture of yourself wearing a helmet when riding a Voi scooter. The personal data that will be processed for this purpose are:

• Selfies that You submit

The lawful basis for the processing of Your personal data for this purpose is to satisfy Our legitimate interest (Article 6(1)(f), GDPR) in being able to encourage Our users to wear helmets in order to increase safety when using Voi scooters.

f) For the purpose of improving the software that enables Voi to review selfies provided subject to purpose (e) above, Voi will use the pictures that you submit in order to train and improve the software’s ability to react to helmets that appears in the pictures. The personal data that will be processed for this purpose are:

• Selfies that You submit

The lawful basis for the processing of Your personal data for this purpose is to satisfy Our legitimate interest (Article 6(1)(f), GDPR) in being able to continuously improve our services and to ensure that the helmet selfie service is as accurate as possible.

You are not obliged to provide us with your personal data, however, not doing so may mean that you are unable to use our services.

g) For the purposes of providing You with the ability to detect Our nearby scooters and to enable Us to detect use of Our scooters in breach of Our User Agreement, we process the following personal data:

• Location data when the Voi App is in use (device location)

Our lawful basis for the processing of your personal data for this purpose is our legitimate interest to provide you with services and to ensure use of our services in accordance with Our User Agreement (Article 6(1)(f) GDPR).

h) For the purposes of developing and improving Our technology and machine learning software for detecting use of Our Services in breach of the Agreement and improving traffic safety (including functionality for accident detection/prevention and pavement detection), we process the following data from unlocked Voi Scooters equipped with camera devices:

• Recorded image data (without sound); and
• Location data (Voi scooter location)

The lawful basis for the processing of personal data for this purpose is Our legitimate interest to develop and improve Our technology and machine learning software for detecting use of Our Services in breach of the Agreement and improving traffic safety (including functionality for accident detection/prevention and pavement detection) (Article 6(1)(f), GDPR).

i) For the purpose of applying individual discounts on some of Our Services and for the purposes of developing and improving Our technology and machine learning software we process the following personal data:

• Information about your use of the Services (such as date, time and duration of your use of the Services)
• Your Voi App account data (such as no. of received vouchers)
• Your payment information (such as payment history)

The lawful basis for the processing of Your data for these purposes is our legitimate interest to apply individual discounts and develop and improve Our technology and machine learning software (Article 6(1)(f) GDPR).

2.2 Personal data related to Passers-by

a) For the purposes of developing and improving our technology and machine learning software for detecting use of Our Services in breach of the Agreement and improving traffic safety (including functionality for accident detection/prevention and pavement detection), we process the following data about Passers-by in the vicinity of unlocked Voi scooters equipped with a camera device:

• Recorded image data (without sound); and
• Location data

The lawful basis for the processing of personal for this purpose is Our legitimate interest to develop and improve Our technology/machine learning software for detecting use in breach of the Agreement and improving traffic safety (including functionality for accident detection/prevention and pavement detection) (Article 6(1)(f), GDPR).

2.3 Personal data related to all categories of data subjects

In addition to the above, Voi may process personal data (all categories of personal data and categories of data subjects as described above) in order to comply with laws and regulations or by court order (in which case the lawful basis is a legal obligation (Article 6(1)(c) GDPR)) or to protect Voi’s or any third parties’ rights, e.g. defending, exercising or establishing legal claims (in which case the lawful basis is Our legitimate interest in protecting Voi’s or any third parties’ rights (Article 6(1)(f) GDPR)).

3. Verification of identity, age and identity document

Prior to Your first time of use of the Services in some countries, You may be required to submit photos of Your driver’s license/other identity document in order to: (i) verify and authenticate Your identity, (ii) verify Your age, and (iii) verify that Your driver’s license/other identity document is valid. For the purpose of verifying and authenticating Your identity, You may also be required to submit a selfie photo of your face. For this purpose, we will use an automated process to compare facial scan data extracted from the photo in Your driver’s license/other identity document to the facial scan data extracted from the selfie photo which You have submitted. The comparison is then used by automated means to determine whether or not You are the person displayed in the photo of the driver’s license/other identity document.

In some countries, You will not be required to authenticate Your identity by submitting a selfie photo of Your face. In this event, We will not use the automated process described above.

The lawful basis for verifying and authenticating Your identity by facial scanning and comparison is your consent (Article 6(1)(a) GDPR) and (Article 9(2)(a) GDPR), which You may withdraw at any time. Your consent is obtained in the Voi App prior to any facial scanning. Verification of Your identity by other means than facial scanning and comparison, and verification of the validity of Your driver’s license/identity document and Your age is required for the conclusion of the User Agreement, the lawful basis for these verifications is therefore (Article 6(1)(b) GDPR).

4. Transfer of personal data

Voi may transfer personal data to the following categories of recipients:

• Cities, government authorities including the Department for Transport and public transport operators. We share personal data with these recipients for the purposes of city planning, understanding mobility insights including contacting individuals to request participation in surveys, integration into public transport operators apps and journey planning apps.  The data shared for these purposes includes the following:
  • User data: Voi user identifier; name, email address; phone number; age band; first part of postal code; gender.
  • Trip data: trip ID number; date of trip; distance and duration of trip
  • Scooter data: location of scooter at start point, end point and various points during a trip
  • Survey data: responses to user experience and demographic survey questions

• Third-party researchers and collaborators. We share personal data with these recipients for the purposes of service development and understanding mobility insights. The data shared for these purposes includes the following:
  • Trip data: trip ID number; date of trip; distance and duration of trip
  • Scooter data: scooters ID number, location of scooter at start point, end point and various points during a trip
  • Survey data: responses to user experience and demographic survey questions
  • Location data (device location and location of scooters)
  • Gyroscope data from Your device (rotation rate of Your device)
  • Accelerometer data from Your device (orientation and velocity data from Your device).
• IT service providers. The purpose for these transfers is to be able to offer to You all of the functions of the Services. Such service providers process Your personal data in the capacity as data processors upon Our commissioning and on Our behalf. We only provide personal data in the context of legally permissible processing, to service providers that have been carefully selected and commissioned in writing. The service providers will receive only such personal data which is required for them to perform their tasks.
• Marketing partners. We share personal data with third party service providers which help us with our marketing. The purpose for these transfers is to perform marketing campaigns and the lawful basis is our legitimate interest to be able to perform marketing campaigns (Article 6(1)(f) GDPR).
• Group companies. The purpose for these transfers is internal administration and to provide Our Services to You. The lawful basis is our legitimate interest in being able to administer our business and thereby provide Our Services (Article 6(1)(f) GDPR).
• Insurance companies. The purpose for these transfers is to handle insurance claims and administer Our insurance policies. The lawful basis is our legitimate interest in handling insurance claims and administrating Our insurance policies on an ongoing basis (Article 6(1)(f) GDPR).
• Courts and Counter Parties in legal matters. The purpose for these transfers is to defend, exercise and establish legal claims. The lawful basis is Our legitimate interest to defend, exercise and establish legal claims (Article 6(1)(f) GDPR).
• Regulators: to comply with all applicable laws, regulations and rules, and requests of law enforcement, regulatory and other governmental agencies;
• Solicitors and other professional services firms (including our auditors).
• Law enforcement agencies, including the Police. The purpose for these transfers is to assist law enforcement agencies and the Police in its investigations, to the extent we are obligated to do so. The lawful basis is to comply with legal obligations (Article 6(1)(c)GDPR). We may also under some circumstances have a legitimate interest in assisting the Police in its investigations even if We do not have a legal obligation to do so. In these cases We may transfer personal data to the Police on the basis of Our legitimate interest in assisting the Police and also the Police’s (in its capacity as a third party) legitimate interest in law enforcement (Article 6.1(f) GDPR).
• Potential buyers and seller. The purpose for these transfers is to share information with potential buyers and sellers in a business transaction (e.g. a merger or acquisition) involving Voi. The lawful basis is our legitimate interest to carry through an acquisition or merger (Article 6(1)(f) GDPR);
• Recipients because of legal obligation. The purpose for these transfers is to share information with any third party whom we are obligated to share information with. The lawful basis is to comply with legal obligations (Article 6(1)(c)GDPR).

In some cases, Voi may transfer your personal data outside the EU / EEA, mainly in cases where we use service providers that process personal data outside the EU / EEA. This will only be done after adequate protection measures have been taken by Voi to ensure an adequate level of data protection, e.g. by including the European Commission’s standard contractual clauses for the transfer of personal data and, where necessary, by implementation of supplementary safeguarding measures. You can obtain further information regarding the protection measures taken when personal data is transferred outside the EU / EEA by contacting Us.

5. Storage of personal data

Your personal data is stored only as long as is necessary in order to fulfil the purposes for which Your personal data was collected, however, if personal data is processed on account of Your consent or Our legitimate interest, Your withdrawal of the consent or valid objection will put an end to the processing, without affecting any processing that happened until then and without affecting any legal obligation to process personal data. The personal data which is processed to enter into, perform or administer an agreement between You and Voi, is processed for as long as You are a customer of Voi and have a Voi account. If Your account is terminated, We will delete the personal data from Your account, with the exception of personal data which needs to be stored by Us due to legal requirements or to safeguard Our legal interests.

6. Marketing

We may send You marketing regarding Voi’s Services as well as products and services offered by third parties. The marketing can be sent both by e-mail, push notifications and in-app. The purpose of sending marketing is to inform You about Our Services and relevant offers from third-parties. We may also process personal data for the purpose of evaluating a marketing campaign which may include that We will transfer some personal data, mainly e-mail addresses, to the relevant marketing campaign partners.

The lawful basis for sending marketing regarding Our Services and those of third parties is your consent (Art. 6 (1) sentence 1 point (a) GDPR), which You may withdraw at any time. Where we process personal data for evaluating marketing campaigns the relevant lawful basis is Our legitimate interests (Article 6(1)(f), GDPR) to analyze the result of Our marketing campaigns.

You may always opt out from Our marketing efforts, either directly in the actual marketing message or by contacting Us at [email protected].

7. Rights and contact

You have certain rights in relation to Our processing of Your personal data. Your rights are the following:

a) Right to access. You have the right to receive confirmation from Us that we process Your personal data, including a right to access Your personal data and receiving an electronic copy of Your personal data.

b) Right to erasure (“right to be forgotten”). Under certain circumstances, e.g. if you have objected to the processing and We do not have a compelling legitimate interest, You can request that Your personal data is erased. This does not, however, apply if we have a legal obligation to process the personal data or other legitimate purposes for which Your personal data is processed.

c) Right to rectification. You have the right to request that incorrect or inadequate personal data about Your is updated or corrected.

d) Right to withdraw consent. To the extent the processing of Your personal data is based on Your consent, You have the right to withdraw Your consent at any time.

e) Right to object. When Voi is using legitimate interest (Article 6(1)(f) GDPR) as lawful basis for the processing, or if the processing concerns direct marketing, You have the right to object to the processing. In such case, we may be entitled to continue to process Your personal data if we can demonstrate a compelling legitimate interest to continue the processing operation.

f) Right to restriction. Under certain circumstances, You have the right to request that the processing of Your personal data is restricted, so that the personal data only may be stored by Voi and not processed for any other purposes.

g) Right to data portability. If the processing is based on Your consent (Article 6(1)(a) GDPR) or a contract (Article 6(1)(b) GDPR) and the personal data has been obtained directly from You, You are entitled to request data portability, in which case you are entitled to receive Your personal data on a commonly used machine-readable format.

If You wish to exercise Your rights mentioned above under (a) – (b), please use Our web portal here.

If You wish to exercise Your rights mentioned above under (c) – (g), please contact Us using the contact details below (Voi will normally answer Your request within one month):

• Email: [email protected], or
• Mail: Voi Technology AB, Sveavägen 25, 111 34 Stockholm, Sweden.

8. Right to lodge complaints

If You have any complaints regarding Our processing of Your personal data, You have the right to lodge a complaint to the relevant data protection authority in Your country.

• In Sweden, please contact the Swedish Data Protection Authority (Sw. Integritetsskyddsmyndigheten).
• In Denmark, please contact the Danish Data Protection Agency (Da. Datatilsynet).
• In Norway, please contact the Norwegian Data Protection Authority (No. Datatilsynet).
• In Finland, please contact the Finnish Data Protection Authority (Fi. Tietosuojavaltuutettu).
• Sie haben das Recht, eine Beschwerde bei Ihrer lokal zuständigen Datenschutzbehörde einzureichen.
• En España, sírvase ponerse en contacto con la Agencia Española de Protección de Datos.
• En France, veuillez contacter la Commission Nationale de l’Informatique et des Libertés (CNIL)
• Per l’Italia, si prega di contattare l’Autorità garante per la protezione dei dati personali italiana (It. Garante per la protezione dei dati personali)
• In Switzerland :
  • veuillez Vous adresser au Préposé fédéral à la protection des données et à la transparence
  • wenden Sie sich bitte an den Eidgenössischen Datenschutz- und Öffentlichkeitsbeauftragten. (Dt. Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter)
  • si prega di contattare l’Incaricato federale della protezione dei dati e della trasparenza. (Dt. Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter)
• In the United Kingdom, please contact the Information Commissioner’s Office (ICO).

9. Security

The technology used by Voi, together with this Privacy Policy, aims to protect Your personal data from unauthorized access and unauthorized use by using appropriate technical, physical and organisational measures to ensure a level of security appropriate to the risk. For example, amongst other measures, we maintain a security policy and store all of your personal information on our secure servers. We may update these actions as new technology becomes available.

10. Joint controllers

Voi provides its services via local subsidiaries in each jurisdiction it operates in conjunction with Voi Technology AB. The following is a list of those subsidiaries, and Your location will determine which of these entities is Your local relevant entity. You can contact each of the entities through [email protected]

Voi Technology AB and the relevant local entity determine together why and how Your personal data is processed which means that both Voi Technology AB and the relevant local entity are joint controllers in relation to Your personal data (Article 26 GDPR).

Voi Technology AB has the responsibility and capacity to provide You with central services related to Your use of Our scooters, including but not limited to:

• User support services;
• Marketing;
• Payments and discounts;
• Application software management; and
• Server management.

The relevant local entity manages the local operational services of Our scooters in your country and it enters into the user agreement and terms and conditions with You (see above).

For the purpose of providing You with the above services and for Us to develop Our services, Your personal data will be transferred between Voi Technology AB and the relevant local entity. Our lawful basis for the transfers of Your personal data internally between the companies is our legitimate interest to manage, develop and facilitate the performance of our services (Article 6(1)(f) GDPR).

You have the right to exercise Your rights under section 7 above against both Voi Technology AB and the relevant local entity (you can find our email contact details under the same section).

Because both companies have an obligation to process Your personal data in accordance with the Privacy Policy, You will not receive a separate privacy policy from the relevant local entity.

11. Changes to the Privacy Policy

Voi may change this Privacy Policy by publishing a new version of this Privacy Policy on the Website and in the Voi App. However, in case a change is due to any changes in Our processing operations, We will notify You by sending You an e-mail with information about the change.