1. This notice

This privacy notice (the “Notice”) applies to Geton AS’ and its subsidiaries (the “Company”, “we”, “our” or “us”) processing of our customers personal data in connection with their i) use of our mobile application service Ride (the “Service”) and ii) visits to and communication with us through our website (the “Website”).

Personal data means any information relating to an identified or identifiable natural personal. This Notice, include information on how we process your personal data and your data protection rights in connection with your use of the Service and Website.

In relation to the use of our Service, please note that this Notice together with our terms and conditions comprise of our contractual relationship with you. It is therefore important that you read this Notice in light of the terms and conditions. In any event, this Notice and any other information we may provide on specific occasion in connection with our collection and use of your personal data should be read carefully, so that you are aware of how and why we are using such information.

The protection of your personal data is important to us, and we will therefore process your personal data only to the extent permissible under the applicable data protection legislation, including the EU General Data Protection Regulation (“GDPR”).

2. The controller

Geton AS is the controller of the personal data that we process in connection with the Service and Website. This means we are legally responsible for ensuring that such processing comply with applicable data protection legislation.

For our contact details, please see section 9 below.

3. Use of terms

The terms used in this Notice when describing the type of personal data being processed, shall have the following meaning:

(a) Contact Information means phone number and e-mail address.

(b) Age Information means information about your age, including your birth date and/or your age in figures.

(d) Payment Information means credit card details.

(e) Training Program Information means information about whether our mandatory training program has been completed and confirmed.

(f) Order History means information regarding such as payment method, time of the rides, where the trip started and ended and amount paid for each ride.

(g) Ride Information means information about your rides on our vehicles, including ride duration, location and vehicle information.

(h) Test Result Information means information about whether our tests concerning reaction time/influence of alcohol have been undertaken and passed (yes/no) before commencing a ride.

(i) Service Usage Data means such as Contact Information, GPS Location Data, Payment Information, Ride information, Test Result Information, Vehicle Pictures and information you voluntary provide us in connection with a customer support process or other communication with us related to the Service.

(j) Vehicle Pictures means pictures of the vehicles that you upload to our application.

(k) Application Usage Data means information about how you use our application, e.g., time and duration of use, pages visited and functions used.

(l) Website Data means your name, phone number, e-mail address and the information you voluntary provide us when using the electronic contact form available on our Website.

(m) Cookie Information means personal data collected through the use of cookies on our Website.

(n) Personal information refers to data collected through a form in the app, which is only mandatory if you have received a parking fine from the municipality and wish to appeal the fine through us. The data collected from this form includes first name, last name, address, country, birth date.

4. Our processing of personal data

Below is an overview of why we process your data and the type of personal data being processed in relation to each purpose.

4.1 To provide the Service; enter into, fulfil and administer our contractual relationship with you

(a) Contact Information

When you sign up for a user account with us, you will need to provide us with an active phone number. We use your registered phone number to verify your identity and communicate with you. When creating a user account or using our Service, you may also register your e-mail address. This will enable us to more effectively be able to communicate directly with you when administering the contractual relationship, such as sending necessary information related to our Service.

(b) Age Information

When you sign up for a user account with us, we need to verify your age to ensure that you meet our age criteria for using the Service, currently minimum 16 years old. You can either verify your age yourself, through a third-party app (currently Vipps), or we may collect data concerning your age by using the service of a third party, Byndle (https://byndle.no/personsok/). The third-party service enables us to receive information about your age when we perform a search on your phone number in their system.

We collect GPS Location Data from your mobile phone or the vehicle at the beginning and in the end of a trip, and every 30 seconds during the trip. The information is necessary in order to provide you with our Service, e.g. give you access to nearby vehicles and calculate payment costs for the rides.

(d) Payment Information

You are required to add a credit card, or another payment method to pay for your rides. We will use payment information to complete the required transactions. We will, however, not store any of your credit card details. All transactions are handled safely by Stripe and your credit details will therefore be disclosed to them in order for the transactions to be completed.

(e) Training Program Information

For security purposes, you are obliged to complete a mandatory training program before using our Service. The aim of the training program is to increase awareness of relevant traffic rules and to ensure careful behavior in the traffic and when using our Service. The training program consists of information on slides in our mobile application which you must confirm that you have read. We will subsequently register information on whether you have completed the training program and given such confirmation in the mobile application.

(f) Vehicle Pictures

In certain cities we are obligated to require a picture of the vehicles when ending a trip and parking the vehicle in order to e.g., prevent parking that could be dangerous to the pedestrians or others in traffic. Uploading a picture of the vehicle is thus required in these cities in order to be able to end the trip.

(g) Test Result Information

In certain cities, we are obligated to require that you undertake a test concerning reaction time/influence of alcohol before commencing a trip with our vehicles. The aim of the test is to ensure careful behavior in the traffic and when using our Service, as well as ensure compliance with our contractual terms and conditions concerning intoxicated rides. The test will appear on strategic hours during the evening and nights in certain cities and provide information on whether you have undertaken the test and passed (yes/no) such test (blood alcohol level below 0,5=yes). The yes/no answer is stored for 14 days to quality check the technical solution, and will be used for no other purpose. If you want to delete the data before 14 days you can do so by contacting customer service. The information is i.a. collected by using the service of a third party, Sightic Analytics, that is dependent on Apple’s TrueDepth API, if applicable.

Our legal basis for the processing of your personal data for this purpose is the contract with you (GDPR article 6 no.1 letter b).

(n) Personal information

In specific cities, the municipality may issue a parking fine due to improperly parked scooters. Our app allows you to request our assistance in appealing such fines. Before we can process your appeal request, you must complete a form to confirm your first name, last name, address, country, and birth date. If the parking fine remains unpaid, we may utilize this personal information to forward your details to a debt collection company (Kredinor AS).

The listed type of personal data is processed by us in order to be able to provide the Service to you. If we are not able to process such personal data, we are not able to offer you the Service.

4.2 Provide customer care

(a) Ride Information

When you use any of our vehicles, we process information about your rides for the purpose of providing you with information about the trips you have made, and to enhance the Service and our customers experience of the Service. By using this information, we can for example ensure better redeployment of vehicles.

(b) Order History

An overview of your order history for the last three (3) years is made available for you in your user account, in order for you to have an overview of your use of the Service and give you the opportunity to ensure that all payments are correct. You will also find information about your available credits in your profile.

The legal basis for our processing for this purpose is our legitimate interest in providing good customer care for the benefit of our customers (GDPR article 6 no. 1 letter f).

4.3 Provide customer service

(a) Service Usage Data

We may use all personal data we have collected about you during our delivery of the Service to you to the extent it is necessary to respond to your inquiries or complaints. If needed, we will need you to identify yourself to verify that you are who you say you are.

(b) Website Data

We will use Website Data in order to respond to your inquiries or complaints.

The legal basis for our processing for this purpose is our legitimate interest in providing good customer service in order to help our customers (GDPR article 6 no. 1 letter f). Without processing said personal data we may not be able to assist you when you contact us.

4.4 Detect, investigate and prevent misuse of the Service

(a) GPS Location Data and Vehicle Picture

This information enables us to detect, investigate and prevent or take action regarding illegal activities such as misuse, situations with a potential threat to the safety of a person or entity, and breach of our contract terms, e.g., see that a vehicle has been used on a restricted area or parked in accordance with local legislation.

(b) Contact Information:

We will use this information for communication when managing any misuse of the Service or breach of contract terms.

We may use this information for detecting, investigating, preventing or taking action in the event of misuse and/or breach of our contractual age terms.

(d) Training Program Information

We may use this information for detecting, investigating, preventing or taking action in the event of misuse and/or breach of our contractual terms regarding completion of our mandatory training program.

(e) Test Result Information

We may use this information for detecting, investigating, preventing or taking action in the event of misuse and/or breach of our contractual terms regarding e.g. intoxicated rides. The information is i.a. collected by using the service of a third party, Sightic Analytics, and using Apple’s TrueDepth API to collect data, which enables us to receive information on whether you have undertaken a test concerning reaction time/influence of alcohol and passed (yes/no) such test (alcohol level below 0,5=yes). During the test we use the TrueDepth API to collect blendshapes, gaze estimation and head position, data that can not identify you. The data is transferred to Sightic Analytics via secure channels directly from your phone, and no data collected to process the test result is stored by us or Sightic Analytics. We don’t transfer any system IDs to Sightic Analytics.

The legal basis for our processing for this purpose is our legitimate interest in protecting our business interests and responsibilities as a supplier within rental of vehicles to the public. It is also in the general public’s interest that the traffic is safe and roads passable (GDPR article 6 no. 1 letter f).

4.5 To improve, optimize and develop the Service and Website

(a) Service Usage Data

We will use this information in a pseudonymous or anonymized form to improve, optimize and develop the Service. This includes such as the technical and operational aspects of the Service. The fact that information is pseudonymized means that, for example, telephone numbers are removed and replaced with a unique indicator (e.g. a number code), before the information is processed as described above. Technically, however, the indicator can be “traced” back to the individual. Personal data is anonymized when it is no longer possible to re-identify the individual.

(b) Application Usage Data

The information we use is pseudonymous or anonymized and necessary in order to ensure the functionality of the application, conduct troubleshooting and sufficient security, and enables us to ensure that the Service is of the highest quality.

We use cookies on our Website for the purpose of measuring how our users interact with our Website content. For more information on such as the type of cookies we use and data being processed, please see our cookie policy which is available her.

The legal basis for our processing for this purpose is our legitimate interest in improving and developing the Service and Website for the benefit of both our business and our customers (GDPR article 6 no. 1 letter f).

4.6 To comply with our legal obligations

(a) Service Usage Data

The information will be used to the extent necessary to fulfill our legal obligations under law, regulations or legal orders. This includes such as our book keeping obligation, and obligations to respond to court order and requests by supervisory authorities.

The legal basis for our processing for this purpose is our legal obligations (GDPR article 6 no. 1 letter c).

4.7 To protect our or third parties’ interests

(a) Service Usage Data

(b) Age Information

To the extent necessary, we will use the above information to protect our or third parties’ interests. These interests may include such as legal, commercial and business interests, e.g. to protect our Service and business operations, for the purpose of the establishment, exercise or defense of legal claims, or reorganization of the Company in connection with a merger or acquisitions.

The legal basis for our processing for this purpose is our legitimate interest in protecting interests of importance to our business or a third party (GDPR article 6 no. 1 letter f).

5. From which source the personal data originate

The personal data we process is mainly collected directly from you, for example when you provide information to us directly during the registration of a user account or through your use of the Service or Website. For the purpose of verifying your age and assessing your fulfillment of our contractual terms concerning intoxicated rides, we may also collect personal data about you from a third-party service provider, as described further above.

6. Categories of recipients

6.1 Use of data processors

We may share your personal data with third parties delivering services to us, e.g., within operation, administration, maintenance or technical solutions.

In order to secure your personal data and privacy, we have signed data processing agreements with these parties to ensure that your data is not used for any other purpose than what is stated in this Notice.

We use service providers that are domiciled or may process personal data in a country outside the EEA without an adequacy decision by the European Commission. This means that these countries may not provide the same data protection as in the EEA. For more information on the relevant appropriate safeguards we have implemented to ensure an adequate level of protection for your personal data, please contact us.

6.2 Group companies

Together with our group companies, we ensure that the Service is delivered where our group companies are established and operates. This requires that your personal data will be transmitted within the group. The legal basis for this is our legitimate interest in ensuring effective internal administration of the Service, including to improve, optimize and develop the Service.

Since the Company stands for most of the operational parts of the Service delivery for its group companies, we have concluded a joint controllership with the relevant group company in these situations. We have therefore also agreed on an internal responsibility in accordance with GDPR article 26. In this agreement it is agreed that internally we have the main responsibility for the personal data being processed in the application, while the relevant group company is responsible for the local activities.

Your personal data will be processed in accordance with this Notice and for the purposes stated in section 4. Since we are all required to process your personal data in accordance with this Notice, you will not receive a separate privacy notice from our group companies unless special national rules apply in the country you are located and use the Service.

Your primary contact for your data protection rights (as described in section 8), is us. For our contact details, please see section 9. However, please note that you can assert your data protection rights both against us and the other group companies. The contact details of our group companies are available in the relevant national addendum to this Notice for your country.

6.3 Other third parties

We will not disclose your personal data to other third parties unless there is a legal basis for such disclosure. Below is an overview of categories of third parties we may share your personal data with:

(a) Municipalities

We are required to disclose data related to the use of our vehicles, e.g., trips distance, durations and trip areas to the municipality as a supplier within rental of vehicles. The data we disclose is pseudonymized, which means that personal identifiable information is removed. The data is used by the municipalities to regulate the market for rental of vehicles, and city planning. The legal basis for our processing is our legitimate interest in assisting the municipalities in their work related to city planning (GDPR article 6 no. 1 letter f).

(b) Insurance companies

In connection with insurance cases, we may disclose personal data about you to insurance companies. The legal basis for our processing is our legitimate interest in handling insurance cases (GDPR article 6 no. 1 letter f).

The Company may be obligated to assist supervisory authorities or the police requiring disclosure of your personal data. In these cases, the processing is based on our legal obligation (GDPR article 6 no. 1 letter c). Further, in certain cases we may also have a particular legitimate interest in assisting the police in the law enforcement (GDPR article 6 no. 1 letter f).

(d) Potential buyers or sellers

In the event that the Company is involved in a potential business transaction, personal data about you may be disclosed to potential buyers or sellers. The legal basis for our processing is our legitimate interest in completing the relevant transactions (GDPR article 6 no. 1 letter f).

(e) Courts, counterparties and lawyers

In connection with legal matters, we may need to disclose personal data about you to courts, counterparties and lawyers. The legal basis for our processing is our legitimate interest in establish, exercise or defense legal claims (GDPR article 6 no. 1 letter f).

We will at all times ensure that only strictly necessary information is disclosed to any third parties in accordance with this section 6.3.

7. Retention of personal data

We will only process your personal data as long as it is necessary in relation to the specific purpose the relevant personal data was collected for, unless we have a legal obligation to retain the said data for a longer period or longer storage is necessary in order to establish, protect or defend legal claims.

This means inter alia that with regard to personal data processed for the purpose of enter into, fulfil and administer our contractual relationship with you, we will process these personal data as long as you have a user account for our Service. GPS Location Data will, however, always be anonymized after 60 days. Personal data processed in relation to customer support service, will be anonymized once the request or complaint have been handled satisfactory. Personal data, (yes/no) if you passed the test concerning reaction time/influence of alcohol, if any, is normally processed/stored for fourteen days from the time the test was undertaken.

We will also delete your user account for the Service upon request or in the event of inactivity for a period of 3 years, and all personal data we have collected about you will be anonymized.

Note, however, we may not comply with requests for deletion if it regards personal data necessary for us to deliver the Service you still want to use, and/or we are required to retain the data or in order to establish, protect or defend legal claims.

8. Information about your data protection rights

Applicable data protection legislation gives you various rights related to the personal data we have collected about you and use in our processing in connection with the Service and Website.

You have the following data protection rights. Please note, these rights are not absolute and in certain cases are subject to conditions set out in applicable law:

• Access: you have the right to request information about how we process your personal data and to obtain a copy of that personal data.

• Rectification: you have the right to request the rectification of inaccurate personal data about you and for any incomplete personal data about you to be completed.

• Objection: you have the right to object to the processing of your personal data, which is based on our legitimate interests (as described above in section 4).

• Erasure: you have the right to request the erasure of your personal data (subject to certain conditions).

• Automated decision-making: you have the right not to have a decision made about you that is based solely on automated processing if that decision produces legal effects about you or significantly affects you. We do not use automated individual decision-making, such as profiling.

• Restriction: you have the right to ask us to restrict our processing of your personal data, so that we no longer process that information until the restriction is lifted.

• Portability: you have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and to have that information transmitted to another organization in certain circumstances.

• Complaint: You have the right to file a complaint with the Data Protection Authority (Datatilsynet) if you have reason to believe that processing of your personal data does not comply with applicable data protection legislation.

You can read more about the data protection legislation and your rights on the webpage of the Data Protection Authority (Datatilsynet): https://www.datatilsynet.no/rettigheter-og-plikter/den-registrertes-rettigheter/

According to the applicable data protection law we are, if appropriate, obligated to inform whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data. In this context, and as referred to above under section 4, please note that the main part of the personal data referred to in this document is processed by us in order to be able to provide the Service to you (GDPR article 6 (1) b). If we are not able to process such personal data, we are not able to offer you the Service.

9. Contact information

The Company has the following contact details:

• Organization number: 926 117 076

• Address: idrettsvegen 178, Sotra, Norway

• Email: support@getomobility.com

If you have any questions about this Notice and our processing of personal data, or want to utilize any of your data protection rights, please contact us at support@getomobility.com.

10. Changes

We reserve the right to make changes in the Service and Website, e.g., to meet new needs. Thus, this Notice may be subject to alterations because of changes in our processing activity or in the applicable legislation. You will be informed of any changes. The latest version of the Notice will always be available on our Website and in our mobile application.