Политика конфиденциальности

In this document (the “Privacy Policy”), we explain how we process personal data of our customers (“you”) when you use (a) CityBee mobile app (the “App”), (b) CityBee motor vehicles and bicycles (the “Vehicle”), (c) CityBee website https://www.citybee.lt (the “Website”) and your online self-service account, and (d) when you communicate with us by phone, e-mail, social media and otherwise.

We process your personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter referred to as the GDPR), other applicable legal acts in the field of personal data protection as well as this Privacy Policy.

In this Privacy Policy, we explain the most important concepts about protection of your personal data: the purposes and grounds on which we process your data, sources from which we receive the data and persons with whom we have the right to share them, our duties with regard to the processing of your data, your rights and how they are implemented.

Take your time to carefully read this Privacy Policy and, if you have any questions, please feel free to contact us.

If you use the Website and/or the App, it means you have read this Privacy Policy and understood the purposes, methods and procedures for processing of your personal data specified herein. If you do not agree with the Privacy Policy, do not use the Website or the App.

We may combine personal data provided by you when using the App and/or the Website with data we obtain from other public and available sources (e.g. we may combine personal data provided by you with data obtained from the use of Website cookies or data lawfully received from third parties).

The Privacy Policy is a living, constantly changing document, therefore, we can improve, modify, update it. You will be additionally informed about critical policy changes, but we encourage reviewing this Privacy Policy from time to time.

 

1. DEFINITIONS

The following terms are defined as follows in this Privacy Policy:

• We, or the Company, shall mean UAB Prime Leasing, a private limited liability company, established and operating under the laws of the Republic of Lithuania, legal entity code 302565318, address of registered office: Ozo g. 10A, LT-08200 Vilnius, Lithuania.
• Services shall mean all services that the Company offers and provides to you, including (i) services of lease (use), maintenance of the Vehicle and assets therein, third party liability insurance, also providing materials and fuel necessary for the use of the Vehicle and other assets for their normal purpose, (ii) services provided via the App and the Website.
• Website shall mean the website accessible at www.citybee.lt.
• Self-service shall mean online self-service, accessible at https://selfservice.citybee.lt.
• App shall mean CityBee software for smartphones, tablets and/or other mobile devices, which is used to perform Vehicle reservation, unlocking, locking and/or other actions provided for therein.
• Account shall mean a digital account created in the App.
• Terms and Conditions or Terms shall mean the Company’s Terms on Rental and Service Provision available on the App as well as Website.
• Services Agreement shall mean the agreement on provision of the Services concluded between you and the Company in accordance with the Terms and Conditions.

Other terms shall have the meanings assigned to them and defined in the GDPR, the Terms and the Services Agreement.

In case of contradictions between this Privacy Policy and the Terms, provisions of this Privacy Policy shall prevail.

 

2. ON WHAT LEGAL GROUNDS DO WE PROCESS YOUR PERSONAL DATA?

We process your data specified in this Privacy Policy on these legal grounds:

• for conclusion, performance, amendment and administration of the Services Agreement (Article 6(1)(b) of the GDPR);
• for fulfilment of legal obligations and requirements of legal acts applicable to us (Article 6(1)(c) of the GDPR);
• for pursuing our legitimate interests and those of third parties (Article 6(1)(f) of the GDPR);
• for acting in accordance with your consent (Article 6(1)(a) of the GDPR, Article 9(2)(a) of the GDPR).

In the scope and under the conditions set by applicable legal acts, one or several of the abovementioned legal grounds may apply to processing of the same of your personal data.

 

3. WHAT PERSONAL DATA DO WE COLLECT AND FOR WHAT PURPOSES DO WE USE THEM? 

3.1. Account creation in the App

In order to start using the App, you must create an Account and provide us with the data specified below.

If you wish to rent motor vehicles, in order to verify your identity and your right to drive, we will need the following additional data about you: your facial image (selfie), photo of the first side of the driving license and the driving license data.

Before we start providing the Services, we must check whether the image of your face in the selfie made with the App coincides with the photo on the driving license and make sure that your driving license is valid.

If for your identity and driving license verification purposes you do not agree to provide your facial image (selfie) and driving license details through the App, you may contact us, and we will offer you an acceptable alternative.

We recognise you as our customer according to data you presented during registration and creation of the Account, when, for example, you want to update or change your data, contact us for presentation of certain personal information, exercise of rights in connection with personal data processing, etc.  We also use your mobile phone number, e-mail and other Account details when we need to confirm your registration, verify your identity, help you and in similar cases.

Where in the Account creation process you provide incomplete data or not all data provided for in the Terms and/or you do not perform all the actions necessary in order to be able to start using the Services, we have the right to remind you of that and urge you to provide the remaining data and perform the remaining actions in order that you could start using the Services.

 

3.2. Use of the App and the Services 

When you use the App and the Services, we collect and process the following data:

There is an electronic system installed in each piece of Vehicle that records and transmits to us information on the location of the Vehicle, distance covered by the Vehicle, speed and other data relating to the Vehicle. We need these data in order to provide Services to you and to perform the Services Agreement otherwise.

If during use of the Vehicle you connect your device to the Vehicle devices (e.g. navigation, multimedia systems), your device data, e.g. the given name, contacts stored on the device and Bluetooth ID, shall be stored in the Vehicle unless you delete them following the instructions of the Vehicle manufacturer.

When you use the Vehicle and the Services, we have the right to periodically check the validity of your driving license. If we notice that your driving license is about to expire, we may contact you (by e-mail, SMS, push notifications, other notifications in the App) and inform you about the expiry of the driving license.

Collection of data about important notifications sent to you 

We also use your contact data (e-mail, phone number, address of the place of residence) to communicate with you, including answers to your inquiries, requests, providing information relevant to you about use of our Services, changes in the Services Agreement, Terms, pricelist and/or the Privacy Policy, to contact you if you forgot your things in the Vehicle or we have identified any problems in connection with Services provided, etc.

We have the right to make sure that you have been informed of the latest changes to the Services Agreement and/or the Terms and/or this Privacy Policy and to collect evidence that this type of notification has been provided and read (opened) by you. When we send you notifications of this type, we collect the above-indicated information about the notifications sent to you.

 

3.3. Direct marketing, marketing 

3.3.1. Notifications, offers and information by e-mail, SMS, push notifications in the App

We process your personal data in order to be able to provide general and personal offers (including offers from our partners) and other information. We can send notifications, offers and information to you in several ways: by e-mail, SMS, InApp notifications, push notifications in the App.  In order to choose notifications and offers to be sent to you, to know you and your needs better, to improve your experience while using our Services, to automate use of marketing tools for the most effective customer engagement, to expand the range of Services we offer and to constantly improve them, to give you relevant, interesting and useful offers and other information about our Services, we analyse data related to customers’ behaviour on the App, patterns of use of our Services and/or other signs, and will use such data to group customers. For these purposes, we use advanced data analytics tools (such as CleverTap), which are based on automated data analysis.

For the above-indicated purposes, we process the following data of yours:

The actions described above do not have any legal or similarly significant impact on you, but they will allow us to better understand your needs, interests and hobbies, create and offer you a wider range of Services that meet your needs better, install the App updates you anticipate, provide a better-quality experience of using our Services.

You can easily object to sending of notifications with offers and information in the App settings in the Account creation process or you can easily unsubscribe from them at any time later by clicking on the unsubscribe link in the App or in newsletters sent to you, see also Chapter VII of the Privacy Policy (paragraph 2 of Article 81 of the Law on Electronic Communications). You can object to sending of push notifications in the App, which are enabled for all customers be default, in the App settings in the Account creation process or at any time later, see also Chapter VII of the Privacy Policy (paragraph 2 of Article 81 of the Law on Electronic Communications).

 

3.3.2. Optimisation of the marketing tools

In order to improve the efficiency of the management of our various marketing tools, we use Apps Flyer and other advanced tools to help us collect your data related to your behaviour in the App and/or interest in our ads displayed on websites of third parties (Apps Flyer and similar partner platforms), our offers or other our marketing tools. For this purpose, we may analyse the data collected and evaluate the effectiveness, efficiency and payback of our marketing decisions (e.g. evaluate channels where ads are displayed, their number, etc.) and make better marketing decisions for the sake of more efficient re-attracting of customers.

Data are obtained in the App with the help of the integrated data collection technology. Data are generated when you use the App and/or Apps Flyer or apps and websites of other partner platforms of Facebook and Google.

For analysis and advertising purposes, we also use third party tools such as Google FireBase, Google Ads, Google Analytics, Facebook Ads Manager, in order to collect aggregated and anonymised information on how individuals use the App, to understand how we can improve it and provide up-to-date non-personalized advertising about our services.

The listed means and tools will help us better understand your needs, interests and hobbies, which in its own turn will allow us to create and offer you a wider range of Services that meet your needs better, install the App updates you anticipate, provide a better-quality experience when you use the App and our Services.

For the above-indicated purposes, we collect and process the following data of yours:

For more information on how Apps Flyer tool works and what data it collects, go to Apps Flyer privacy policy: https://www.appsflyer.com/services-privacy-policy/.

You can read more information on how Google collects and uses these data in the Google privacy policy: https://policies.google.com/privacy?hl=en.

 

3.3.3. Marketing on social media 

We administer our profiles and accounts on social networks:

https://www.facebook.com/CityBeeCarSharing/;

https://www.instagram.com/citybee_lithuania/;

https://www.linkedin.com/company/citybee-car-sharing, etc.

If you are interested in our Services and follow our profiles on social media, we collect and process these data of yours (which we obtain directly from you (in the social media account), so that we can manage our social media accounts):

We can create and manage our fan pages or groups on the Facebook platform. Facebook and we are jointly responsible only for data processing of Facebook Insight (https://lt-lt.facebook.com/help/pages/insights) (Article 26(1) of the GDPR) and only to the extent these data are used to create “page insights” and only concerning steps from data collection from our fan page to their transfer to Facebook. As for any other data processing, we and Facebook are independent controllers.

Data processing of our fan page visitors is intended for statistical assessment of the use of such page. All information obtained with Facebook tools is linked to Facebook Insight tool, which provides us with anonymised information about pages you visit and your activeness (e.g. at what time you and other visitors pay attention to videos, when you read longer notifications, when your top activeness on a social network is recorded). These data are used to improve the content placed on the fan page and your experience of using it and to select marketing tools.

Please note that the Company’s fan page is integrated into the Facebook platform, therefore Facebook has all the possibilities to collect your other personal data, as well. Detailed information about the data processing activities of Facebook, the purposes and scope of data use related to the data provided by you can be found at: http://www.facebook.com/policy.php.

If you want to exercise your rights in connection with these data, it would be more effective for you to contact Facebook directly. If you still need help to exercise your rights, you can contact us in the ways provided in Chapter VII of the Privacy Policy.

 

3.4. Statistics, analytics, customer behaviour research 

In order to monitor, evaluate, analyse, improve and further the quality of Services provision, the App, offer new Services or new quality Services, increase the availability of Services, improve the security of use of the Services, improve user experience when using the Services, we analyse various statistical data.

The Company, as a socially responsible business entity, is implementing the mission to contribute to road safety, responsible and careful driving and a safe and healthy society. The methods and modules used to analyse data will enable us to predict, identify dangerous driving, identify drivers under the influence, which will allow to reduce accident statistics, prevent or reduce losses due to accidents, will contribute to responsible, safe and polite participation in traffic.

We use automated data analysis tools based on the latest scientific achievements (including artificial intelligence) to conduct these data research, introduce and use data analysis and processing modules and methods.

Data analysis actions, performed for the purposes described in this chapter, do not have any legal or comparable significant effect on you.

 

3.5. Operation and security of the App, information systems

We process your personal data to identify potential threats of abuse of the Services, fraud or other illegal activities, to protect the App, the Website, information systems and data from unauthorized modifications, cyber-attacks, unauthorized access and other related risks, ensure the operation, integrity, security of the App and information systems. We register information about your and our actions in the App, in the Account, on the Website:

If we notice actions in your Account that we find suspicious, we may ask you to do certain actions (e.g. check your e-mail accounts, change PIN, etc.).

 

3.6. Prevention of fraud, enforcement of legal requirements, administration of debts and damages

We process your personal data in order to implement our legal requirements and defence of legitimate interests (including fraud prevention), protect our property and interests and those of our customers and other persons, collect evidence of violations and prevent the abuse of our interests, those of our customers and other persons, abuse of the App, the Website, Vehicle, our Services, also to administer, manage and recover your debts and damages inflicted on us and our property.

We have the right, to the extent permitted by applicable legal acts and in the light of our legitimate interests, to analyse and evaluate the above data and to make decisions based on them that may affect how we will provide Services to you (if you use our Services) and whether we will provide them. If we have reasonable doubts about your ability to pay for our Services or other reasonable doubts about data and information provided by you when you are registering in the App and/or use our Services, we will have the right, based on our legitimate interest, to request our service providers (e.g. UAB Creditinfo Lietuva) to provide or to access lawfully accessible data about you on our own (including your credit rating, etc.) and evaluate them for the purposes of prevention of fraud, other actions of bad faith, for assessing your solvency, for debt management and/or recovery.

 

3.7. Website administration, support, improvement

When you visit and browse our Website, for the purpose of collecting statistical data and improving the quality of Services and visitor experience, we process the following data:

 

Cookies are used on the Website. More information on cookies used on the Website can be found in our Cookie Policy {link}.

We use the analytical service Google Analytics, which allows to capture and analyse statistical data on the use of the Website. More information about Google Analytics and information collected with its tools can be found at

https://support.google.com/analytics/answer/9019185?hl=en&ref_topic=2919631#zippy=%2Cin-this-article.

If you do not want Google Analytics tools to capture your browsing information, you can use Google Analytics opt-out browser add-on or change your cookie settings.

 

3.8. Customer service – inquiries, requests, complaints

If you contact our customer service centre by phone and agree that your telephone call is recorded, we will record the information you provide, including personal data, so that we can properly examine your request and/or respond to your inquiry.

If you contact us in writing (by e-mail or otherwise), we will store the fact of you contacting us and the information provided, including personal data, so that we can properly examine your request and/or respond to your question, request or complaint.

For the above-indicated customer service purposes, we will use the following data:

 

3.9. Compliance with tax, accounting, other statutory obligations 

 

In order to be able to ensure proper implementation of tax, accounting, other statutory obligations (i.e. correct issuance of accounting documents and their declaration to public authorities, implementation of anti-money laundering requirements, etc.), we process the following personal data of yours:

 

3.10. Business Customers’ Accounts

If the Services Agreement is concluded with us by a business customer (company, institution, organisation) (hereinafter – Business Customer), we process personal data of representatives of such Business Customer, as indicated below.

We also process any other personal data referred to in paragraphs 3.1–3.9 of this Privacy Policy about employees or representatives of Business Customers, who use our App and Services.

Our Business Customers shall ensure and undertake that:

• their employees and representatives are informed that a representative of the Business Customer will have a possibility to see, process data on their trips and Services provided to them when they use the Business Customer’s Account;
• their employees and representatives would get familiar with and properly comply with conditions and requirements of the Services Agreement, the Terms and this Privacy Policy.

Representatives, employees of Business Customers have all rights of data subjects provided for in Chapter VII of this Privacy Policy.

In the event that Business Customers act as data controllers for their employees, representative and other agents, we are not responsible for such processing operations and the provisions of this Privacy Policy do not apply to such processing operations.

Business Customers acknowledge and understand that all actions taken by their employees and representatives or other persons that they perform or allow others to perform by downloading, installing, accessing, using our App, Account, Services and Vehicle, are legitimate and appropriate and assume liability for them.

 

3.11. MyBee service

When you order and use MyBee services, you agree that the Company would transfer personal data specified in paragraph 3.1 of this Privacy Policy to the provider of MyBee services (UAB Miesto Bitė). When you order MyBee services, you will have to read the rules on provision of MyBee services and MyBee privacy policy, which will give detailed information about your personal data collected and processed in the course of provision of MyBee services.

The Company also provides and can provide various services to the provider of MyBee services (e.g. identification and driving license verification, services of administration of fees for the service, intermediation in the conclusion of the services agreement, etc.) and, when providing these services, will process your personal data by its decision or by instruction of the provider of MyBee services.

You can read more about your personal data collected and processed in the course of provision of MyBee services in the MyBee privacy policy.

We may also process your data for other purposes closely related to those mentioned above as far as the requirements of the legal acts applicable to us and their implementation are concerned.

 

4. FROM WHAT SOURCES DO WE OBTAIN YOUR DATA?

We receive almost all of your personal data from you: when you download the App, create an Account, use the App, the Account, Services and in other cases, also as explained in more detail in Chapter III of this Privacy Policy.

Data we receive from you indirectly under a legitimate basis (the list is non-exhaustive):

• data of periodic (regular) verification of driving license validity;
• information on violations of Road Traffic Regulations, traffic accidents, damage to the Company, Vehicle, third parties;
• information on your payment transactions that we receive from providers of payment services;
• information about inquiries, requests, information, etc. provided by companies (e.g. insurance companies), authorities (e.g. police).;
• your data lawfully accessed by providers of debt, damages management, administration, credit rating and/or debt recovery services, other service providers;
• data transferred by providers of internet services, communication services when you use the internet, communications;
• information we receive from service providers, partners, competent authorities (e.g. when the State Data Protection Inspectorate performs an investigation), other data controllers indicated in Chapter V of the Privacy Policy;
• information we receive from public registers and information systems.

5. DO WE SHARE YOUR DATA WITH OTHERS?

The Company has involved various service providers (e.g. providers of server hosting, data centres, cloud computing, support, IT, payment, identity verification, document validity verification, intermediation, payments, audit, accounting, legal, tax advisory services, administration of damages, debt collection, analytics, direct marketing, e-mail, SMS messaging, customer service, call centre and other services).

Data processors we use are usually located in the Member States of the European Union or store data entrusted to them by the Company in the European Union. Only a few carefully selected data processors (such as Google, Apps Flyer, CleverTap) process data outside the European Union. In addition, when we manage our social media accounts, we receive and provide data to social network platform operators (e.g. LinkedIn, Facebook, Google), which also operate outside the European Union, e.g. in the USA. We closely follow practices of data protection supervisory authorities and the guidelines on the transfer of data outside the European Union, and we diligently consider conditions, under which data are transferred and may be subsequently processed and stored after the transfer outside the European Union. To ensure an adequate level of security of data and to guarantee legitimate transfer of data, we conclude Standard Contractual Clauses approved by the European Commission for data transfer outside the European Economic Area (EEA) or follow other grounds and conditions set out in the GDPR.

We use cloud computing solutions (e.g. Microsoft Azure) for data processing. Servers / storage facilities for the cloud computing solutions used are located and operate in the Member States of the European Union. Microsoft Azure database data are stored in data centres located in the EEA Member States (see more at https://azure.microsoft.com/en-us/global-infrastructure/geographies/).

Data processors can process your personal data only according to our instructions. Besides, they must ensure security of your data in accordance with applicable legal acts and agreements concluded with us.

If necessary and legally justified, we also provide your data to service providers that are separate data controllers, also to competent authorities, institutions, organisations, also other data controllers who are entitled to receive information in accordance with applicable legal acts and/or our legitimate interests (Article 6(1)(b) of the GDPR, Article 6(1)(c) of the GDPR, Article 6(1)(e) of the GDPR, Article 6(1)(f) of the GDPR) (the list is non-exhaustive):

• we contact (or that is done by service providers selected by us) the authority that issued the driving license to make sure that the driving license you have presented is valid;
• in the event of a traffic accident, your data will be transferred to insurance companies and, if necessary, to other parties involved in the traffic accident;
• based on Vehicle data available to us, we have the right and, in certain cases, an obligation to transfer information about violations of Road Traffic Regulations (e.g. about speeding, driving under the influence) to competent authorities (e.g., the police);
• we have the right and the obligation to transfer information to the competent authorities (pre-trial investigation bodies, etc.) for the purposes of prevention of fraud, offence and crime prevention and investigation;
• if you fail to meet your financial obligations under the conditions of the Services Agreement and the Terms and do not pay your debt within the time limit specified in the notice, we have the right to transfer data on your debt and your personal data (including first name, surname, personal ID number and other data proving the debt) to persons with legitimate interest in obtaining such data for the purposes of debt management, administration, credit rating and/or debt recovery;
• your personal data may also be transferred to other data controllers (insurance companies, motor vehicle maintenance service providers or other additional service providers) if you order additional services, as well as to providers of motor vehicle financial lease services, credit institutions;
• we provide data to service providers that are separate controllers of your data (partners whose offers you have agreed to receive, etc.).

With your consent, your data may be disclosed to persons you have indicated.

 

6. HOW LONG DO WE STORE YOUR PERSONAL DATA?

Personal data specified in this Privacy Policy shall be stored and otherwise processed for no longer than the period specified in Chapter III of this Privacy Policy for each relevant data category and for no longer than necessary to achieve the purposes for which the data were collected.

In those cases when the data storage period is not indicated in this Privacy Policy, your data will be stored no longer than necessary for achievement of the purposes, for which the data were collected, or for a period set by legal acts.

After the end of your data processing and storage period set in this Privacy Policy, we destroy your data or anonymise them irreversibly and reliably as soon as possible, within a period reasonably necessary for performance of such an action.

If different processing or storage periods can be applied to the same data category for different purposes in accordance with this Privacy Policy, the longest of the applicable periods shall apply.

Your personal data can be stored for a period longer than indicated in this Privacy Policy only when:

• your data is necessary for the proper administration of the debt, damages (for example, you have not fulfilled your financial and/or property obligations or caused damage to us or other persons), examination and settlement of a dispute, complaint, the protection of our legitimate interests or those of third parties;
• that is necessary in order that we could defend ourselves from existing or threatening demands, claims or legal actions and exercise our rights;
• there are reasonable suspicions of violations, illegal activities, which are or may be a subject to investigation;
• this is necessary for ensuring the functioning, resilience, integrity of backup copies, information systems, traceability of operations, statistical and other similar purposes;
• there are other grounds provided for in legal acts.

 

7. WHAT RIGHTS DO YOU HAVE?

You, as a data subject, have rights under the GDPR, including the right:

• to request access to your personal data and get their copy;
• to request rectification or restriction of inaccurate or incomplete personal data;
• to request deletion or restriction of personal data which are excessive or unlawfully processed;
• to object to the processing of your personal data;
• to request transfer of your personal data provided in a structured, machine-readable format;
• to withdraw your consent at any time if data processing is based on the data subject’s consent. Withdrawal of the data subject’s consent shall not affect lawfulness of data processing before the withdrawal of the consent;
• to file a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, by e-mail: ada@ada.lt), but we would recommend contacting us first and we will try to resolve all your concerns together with you.

 

7.1. How can you contact us to exercise of your rights?

You can submit your request for the exercise of your rights (as far as your Account is concerned) to us in the following ways:

• submitting a request by e-mail at info@citybee.lt, signed with qualified e-signature (e.g. by use of Smart-ID or M-signature), or
• sending a request by e-mail at info@citybee.lt with a notarised copy of the personal ID document, or
• arriving at our customer service department (in such a case, we will ask to produce a personal ID document).

 

7.2. The right to access data processed and the right to obtain a copy of personal data 

If you are our customer, you can download an automatically generated copy of personal data related to your Account (i.e. data indicated in paragraphs 3.1–3.3 of the Privacy Policy) by logging to your Account in the Self-service at https://selfservice.citybee.lt/. After you log in to your Account in the Self-service at https://selfservice.citybee.lt/, select you email address at the right on the top and then click “Get my data in CityBee”.

If you do not have an Account any longer, write us at info@citybee.lt and we will send you an e-mail at your e-mail address, which you have previously indicated when registering in the Account, with information on how you can receive an automatically generated copy of your Account related personal data.

Please note that the Self-service can be accessed, and a data copy can be downloaded only online, upon entering the address https://selfservice.citybee.lt/ in the browser. You will not be able to download a data copy via the App.

 

7.3. Right to rectification of personal data

In case of changes in data presented by you to us (surname, e-mail address, telephone number), change of driving license data (you changed or updated your driving license) or in case you think that the information processed by us about you is inaccurate or incorrect, you have the right to demand to modify, amend or correct such information.

You can make some corrections and changes to your data on your Account in the App (e.g. upload a new driving license after the previous license expires). In other cases, you must contact us in the ways indicated in paragraph 7.1 of the Privacy Policy and request that we correct or amend your data.

 

7.4. Right to withdraw the consent

In case where we process your data on the basis of your consent, you have the right to withdraw your consent at any time and data processing based on your consent will stop.

For example, you can withdraw your consent to receive offers and information at any time. The withdrawal of these consents will not prevent you from continuing to use our Services, but this will mean that we will not be able to give offers that may be useful to you.

You have the right to withdraw consent at any time in the following ways:

• by phone: +370 700 44844;
• by e-mail: info@citybee.lt;
• by clicking on the link “Unsubscribe from newsletters” in the e-mail at any time; or
• by opting out of receipt of marketing notifications in the Account settings in the App.

You can opt out of push notifications:

• by opting out of push notifications in the Account settings in the App;
• by changing the operating system settings in your device.

 

7.5 Right to object to data processing, when processing is based on legitimate interests

You have the right to object to personal data processing, when personal data is processed based on our legitimate interests. In the event that we send you general offers and information on the basis of our legitimate interest, you have the right to opt out of general offers at any time:

• by phone: +370 700 44844;
• by e-mail: info@citybee.lt;
• by clicking on the link “Unsubscribe from newsletters” in the e-mail at any time;
• by opting out of receipt of marketing notifications in the Account settings in the App.

You can opt out of push notifications in the App:

• by opting out of push notifications in the Account settings in the App;
• by changing the operating system settings in your device.

 

7.5. Right to erasure (right to be forgotten) 

When there are certain circumstances indicated in legal acts on personal data protection (e.g. when the basis for data processing has disappeared, etc.), you have the right to request that we erase your personal data. In order to exercise this right, please contact us in the ways indicated in paragraph 7.1 of the Privacy Policy.

We will treat your request to erase all your data as a request to terminate the Services Agreement, which shall be terminated in accordance with the Terms.

A request to erase some of the data of yours can result in suspension or termination of the Services Agreement or that we will not be able to provide all the Services to you. For example, if the driving license is removed at your request, you will be able to order and use only those Services which do not require a valid driving license (e.g. you will be able to rent a bicycle). Your request to erase or change some of your data (for example, adding new payment card, removing payment card from payment methods, etc.) may result in this data no longer appearing in your Account, although we will have the right to further process such data on the grounds set out below in this section.

If you provide us with the request to erase all or some of your data and express your wish  “to be forgotten”, we will no longer process those data of yours which will no longer be necessary for the purposes for which they were collected or otherwise processed. After you have exercised the right “to be forgotten”, your personal data will be further processed for the following main purposes and on the following main grounds (the list is non-exhaustive):

• for the purposes of meeting accounting, tax requirements, personal data will be further processed according to Article 6(1)(c) of the GDPR (data processing is necessary to fulfil the legal obligation imposed on the data controller);
• GPS (location) data will be further processed according to Article 6(1)(f) of the GDPR (data processing is necessary in pursuance of legitimate interests of the data controller or a third party);
• in order to manage customers’ complaints and other requests and inquiries, personal data will be processed according to Article 6(1)(b) of the GDPR (it is necessary to process data in order to fulfil the contract, a party to which the data subject is);
• in order to ensure the implementation of the prohibition to order Services and use them in the future, as provided for in the Services Agreement, data (the reason, date, duration of termination of the Services Agreement, your certain identification data, etc.) will be stored and processed according to Article 6(1)(f) of the GDPR (data processing is necessary in pursuance of legitimate interests of the data controller or a third party);
• in case of disputes, administration of damages and debts, in order to pursue our other legal claims and protect our rights, data will be further processed according to Article 6(1)(f) of the GDPR (data processing is necessary in pursuance of legitimate interests of the data controller or a third party).

If you delete (uninstall) the App, it shall not mean termination of the Services Agreement, it will continue in effect until terminated in accordance with the Terms.

 

7.6. Right to restriction of data processing

When there are certain circumstances indicated in personal data protection legal acts (when personal data is processed unlawfully, when you challenge data accuracy, you stated an objection to data processing on the basis of our legitimate interest, etc.), you also have the right to restrict your data processing.

However, we must point out that, because of the restriction of data processing and during the period of such restriction, we may be unable to guarantee you all the Services, which may lead to the suspension or termination of the Services Agreement or that we will be unable to provide you with some Services. For example, if the driving license is removed at your request, you will be able to order and use only those Services which do not require a valid driving license (e.g. you will be able to rent a bicycle).

In order to exercise this right, please contact us in the ways indicated in paragraph 7.1 of the Privacy Policy.

 

7.8. Right to data portability

You can download an automatically generated copy of personal data related to the Account by logging into your Account in the Self-service. If you do not have an Account any longer, write us at info@citybee.lt and we will send you an e-mail at your e-mail address, which you have previously indicated when registering in the Account, with information on how you can receive an automatically generated copy of your Account related personal data.

We will provide a data copy to you in a structured form in JSON electronic files or electronic files of another comparable format, which will enable you to move your data to another service provider.

In order to exercise this right, please contact us in the ways indicated in paragraph 7.1 of the Privacy Policy.

 

7.9. Right to lodge a complain

If you think that we process your data in breach of requirements of personal data protection legal acts, we always ask that you contact us directly at first. We believe that our good will efforts will be enough to disperse any doubts you may have, to answer your questions, to satisfy requests and correct any errors we made, if any.

If you are not satisfied with a problem solution we suggest or if, in your opinion, we are not taking actions that must be taken in order to satisfy your request, you will have the right to lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, LT-10312 Vilnius, e-mail ada@ada.lt).

 

7.10. Examination procedure of requests

In order to protect our customers’ data from illegal disclosure, upon receipt of your request to present data or implement other rights of yours, we will have to verify your identity. For identity verification, we, first of all, use the ways indicated in paragraph 7.1 of the Privacy Policy.

In those cases when you do not have an Account any more or there is no possibility to use the ways indicated in paragraph 7.1 of the Privacy Policy, in order to verify your identity, we may ask you to indicate relevant data of your Account (e.g. name, date of birth, e-mail address or telephone number). In performance of this verification, we may also send a control notification at the last contact that was in the Account (SMS or e-mail), asking to take an authorisation action, we may also request additional documents or data. If the verification procedure fails, we will be forced to state that you are not the data subject of the requested data and we will have to reject your request.

Upon receipt of your request regarding implementation of any right of yours and having successfully performed the above-indicated verification procedure, we undertake without undue delay, but in any case no later than within one month after receipt of your request and completion of the verification procedure, to give you information about actions we took with regard to your request. With regard to complexity and number of requests, we have the right to extent the period of one month for two more months, informing you about it before the end of the first month and indicating reasons for such an extension.

If your request is submitted electronically, we will give the answer to you electronically, too, unless it is impossible (e.g. due to a particularly large scope of information) or when you request to answer you in some other way.

We have the right to refuse to satisfy your request by our reasoned written response under the conditions and grounds provided for in legal acts. We will provide you with information free of charge, however, if the requests are manifestly unfounded or disproportionate, in particular because of their repetitive content, we may require a reasonable fee to cover administrative costs or may refuse to act upon your request.

 

8. HOW DO WE ENSURE THE SECURITY OF YOUR PERSONAL DATA?

We use appropriate organizational and technical personal data security measures, including protection against unauthorized or unlawful processing of data and against accidental loss, destruction or damage. Such measures have been selected taking into account the risks that may arise for your rights and freedoms as those of a data subject.

We strictly control access to your personal data, providing it only to those employees who need personal data for the performance of their work duties, and monitor how they use the access provided. Employees who have access to personal data shall be made aware of the personal data protection requirements and shall ensure the confidentiality of the personal data processed. We provide access to personal data with passwords of the required level and prepare agreements for the protection of confidential information with individuals or partners who are given access to your personal data.

We regularly monitor our systems for possible breaches or attacks, but it is not possible to guarantee full security of information transmitted online. With this in mind, you provide us with information by use of the internet connection via the App at your sole discretion and assuming any associated risks.

In order to ensure the security of customers’ data, we constantly assess and strengthen applicable security requirements. For example, in 2020, a global change of passwords used by customers was initiated as new requirements for the complexity of passwords were introduced. At the beginning of 2021, the Company refused passwords altogether and switched to customer identification using unique PIN codes or biometric data. Please note that if you allow the App to use the device functionality that allows recognizing a fingerprint or face image, we will not receive and will not process such data (we will only process the system confirmation from your device whether the device user login was successful).

In order to ensure your data security, the Company will continue performing regular IT security audits in the future.

 

9. YOU CAN CONTACT US AS FOLLOWS:

The data controller that processes your personal data indicated in this Privacy Policy is:

• UAB Prime Leasing, legal entity code 302565318, address: Ozo g. 10A, LT-08200 Vilnius, Lithuania.

You can contact us on all issues concerning this Privacy Policy, data processing by UAB Prime Leasing as follows:

by e-mail: info@citybee.lt;

by phone: +370 700 44844.

Also, a lot of relevant information can also be found in the FAQ section on our Website.

 

10. VALIDITY AND CHANGES TO THE PRIVACY POLICY

If we change this Privacy Policy, we will publish its updated version on our Website and in the App, besides, you will be additionally informed about the most important changes via e-mail and/or otherwise. The latest changes to the Privacy Policy were made and are valid from 16 February 2022.

[1] Your consents given before this Privacy Policy shall continue in effect until they are withdrawn. You will be able to withdraw them at any time under the procedure set in Chapter VII of the Privacy Policy. Besides, before we start obtaining updated consents, we will continue to obtain consents according to our old Privacy Policy (last updated on 14 January 2021).