This page explains how NECTURE GmbH processes the personal data it collects through the www.streetcrowd.com website. It follows the EU General Data Protection Regulation 2016/679 ("GDPR") and Austrian data protection law.
In this policy, you are the "Data Subject". The page covers who is responsible for your data, what we process and why, how long we keep it, who receives it and what your rights are.
If anything is unclear, contact us at hi@necture.com.
Who is the Data Controller?
Necture GmbH, with registered office in Papagenogasse 1A, 1060 Vienna, Austria, e-mail: hi@necture.com
The Company Necture GmbH (hereinafter "Necture" and/or "Data Controller") is the data controller of personal data of members (hereinafter also "Data Subject") using the www.streetcrowd.com website, including any subdomains (hereinafter "Site").
How can I contact the DPO?
Rechtsanwalt Savino Menna, Necture GmbH, Papagenogasse 1A, 1060 Vienna, Austria, e-mail: dpo@necture.com
You can contact the Data Protection Officer directly at any time with any question about data protection.
Through the site, Necture provides a set of services, including an innovative and digital approach to reshape the future of mobility.
What data do we process by the Site?
Technical information related to:
- Browser types and versions used by the Member
- Operating system used by the Member
- Website from which an accessing system reaches the Site
- Subdomains related
- The date and time of access to the Site
- IP address of the Member
- The approximate location the hosting provider works out from the IP address, used only to show the nearest city the Site serves, and not stored
- The internet service provider of the Member
The Site sets no cookies and uses no analytics, advertising or tracking. It stores two items in your browser, which stay there and are never sent to us; both are described in our Cookie Policy.
Information collected via the "Tell me when it launches" form:
- E-mail address of the Member
- City chosen by the Member
Information collected via the operator sign-up forms, which the operator and help pages link to and which are hosted by Mailchimp on its own site (us20.list-manage.com), not on the Site:
- First and last name of the Member
- StreetCrowd e-mail address of the Member
- The e-mail address the Member uses with that operator
- Whether the Member uses iOS or Android
- On Android, the Google Play Store e-mail address of the Member
Information collected when the Member contacts CrowdCare through a support ticket:
- Name of the Member
- E-mail address of the Member
- The message itself
- Any screenshot or photo the Member attaches, such as a screenshot of an operator account or a photo of a licence plate
What purpose is the data processed, on what legal basis, and for how long?
A. Allow access to the site and show the nearest city it serves
- Legal basis: Legitimate interest of the Data Controller in providing access to the Site and of the Members themselves to correctly use the Site, and in pointing the Member to the nearest city StreetCrowd serves
- Retention: See our Cookie Policy for Site. The approximate location is used for the request being answered and is not stored
B. Answer requests for information (also through the "Tell me when it launches" form, a CrowdCare support ticket and the e-mail addresses on this page)
- Legal basis: Legitimate interest of the Data Controller in answering any requests from Members
- Retention: The Data will only be kept for the duration necessary for the execution of the request
C. Fulfilling the administrative and accounting obligations provided for by the legislation (e.g. on anti-money laundering, accounting management and invoicing)
- Legal basis: Legitimate interest of the Data Controller in fulfilling the legal obligations
- Retention: The Data will only be kept for the duration necessary to comply with the legal obligations
D. For the promotion of the Services through traditional and remote communication tools (marketing purposes, e.g. by Newsletter)
- Legal basis: Consent. This is optional and withdrawable at any time
- Retention: For a maximum period of 24 months from the consent of the Data Subject and in accordance with our Cookie Policy
E. To analyse your preferences, habits, behaviours or interests of Members, in order to provide personalised service offerings (profiling purposes)
- Legal basis: Consent. This is optional and withdrawable at any time
- Retention: For a maximum period of 12 months from the consent of the Data Subject
The Data is processed with manual or IT tools, also through automated tools, suitable to guarantee its security, confidentiality and to avoid unauthorised access.
The Data processed is stored using cloud computing tools. For the safety standards and the GDPR compliance of the selected external providers, see their own privacy policies: Vercel, Slack and Mailchimp.
After the data retention indicated above, the Data will be destroyed, deleted or anonymised, compatible with the technical procedures of deletion and backup.
To whom is the Data communicated?
- Service providers related to the activities of the Data Controller and public institutions
- Service providers related to assistance, tax and legal advice
- Service providers related to IT or storage and external service providers
The Site uses four of these external service providers, all acting as processors on behalf of the Data Controller:
- Vercel (Vercel Inc., United States) hosts the Site and processes technical information, such as the IP address of the Member, in order to deliver the pages. From the IP address it also works out the Member's approximate location, which the Site uses only to show a "Start in" button for the nearest city it serves. The location is not stored.
- Slack (Slack Technologies, a Salesforce company, United States) receives each "Tell me when it launches" signup, meaning the e-mail address and the city, in an internal StreetCrowd channel where the team reads it in order to answer.
- Zendesk (Zendesk, Inc.) provides the CrowdCare support tickets and keeps what the Member writes and attaches. Zendesk stores that data in its European data region.
- Mailchimp (Intuit Inc., United States) hosts the operator sign-up forms and keeps what the Member fills in, so that StreetCrowd and the operator can set up the Member's account with that operator. What the Member fills in is also added to a Mailchimp audience that later receives campaigns, which is the marketing purpose D above.
The Data collected through the Site will be processed only to ensure the correct use of the Site and may be viewed and used by the Necture team (employees and collaborators) appropriately authorised to process them.
The Data may be disclosed for legitimate interest purposes, to suppliers of assistance services, technical, tax and legal consultancy, assignees of receivables in the context of credit securitisation or credit assignment operations for strictly connected and instrumental purposes to the management of the relationship with the transferred Data Subject, as well as to the issue of securities, assignees of company or business unit, potential buyers of Necture and companies resulting from possible mergers, divisions or other transformations of Necture, also in the context of the activities functional to these operations, and to competent authorities.
The above-mentioned subjects may act, where appropriate, as external data controllers or independent data controllers in accordance with current legislation. You can request the updated list of companies to which the Data will be communicated at any time to the Data Controller, by means of a specific request to be sent using the contact information indicated in the Privacy Policy.
Is the Data transferred abroad?
The Data will mainly be processed in Austria and within the European Union, but could also be transferred to extra EU Countries.
Any transfer of the Data and the Data Subject to countries located outside the European Union will take place only in compliance with adequate guarantees for the purposes of the transfer itself (and in particular complying with the provisions of art. 45, 46 and 49 of GDPR), e.g. provided that the European Commission has confirmed that the third country has an adequate level of data protection or other data protection guarantees exist, such as binding business rules or signing up to standard EU contractual clauses.
In particular, Vercel, Slack and Mailchimp are established in the United States, so the technical information processed by Vercel, the signups sent to Slack and everything filled into the operator sign-up forms reach a country outside the European Union. What the Member writes to CrowdCare is different: Zendesk keeps it in its European data region.
In any case, the processing of Data is carried out in compliance with the national and supranational provisions in force (EU Regulation 679/2016 and the Austrian Data Protection Act, Datenschutzgesetz).
The Data Subject will have the right to obtain from the data Controller a copy of the Data held abroad and to obtain information about the place where such data is stored making an express request to be sent using the contacts indicated in this document.
What are my rights?
By contacting the Data Controller or the DPO using the e-mail addresses described above, you can ask Necture at any time:
- the access to the Data concerning you, the rectification of inaccurate data, the integration of incomplete Data, their deletion (right to be forgotten), the limitation of processing in the cases provided for by art. 18 GDPR
- to receive in a structured format, common use and readable by automatic device the Data concerning you in the cases provided for by art. 20 GDPR; and, if technically feasible, to transmit such data to another Data Controller without hindrance
- to withdraw the consent given at any time; as well as oppose at any time the processing of data pursuant to art. 21 GDPR, giving evidence of the reasons justifying the opposition
- any other request for clarification regarding the processing of data carried out by the Data Controller
Finally, we remind you that it is always possible to make a complaint to the competent Supervisory Authority pursuant to art. 77 of the GDPR, in Austria the Datenschutzbehörde, if it considers that the processing carried out by the Data Controller is contrary to the current legislation.
Do I have to provide my Data?
Providing personal data is in part required by law (for example by tax rules) or can follow from a contract (for example the details of a contracting party). In some cases a contract can only be concluded if the Data Subject provides us with personal data that we then have to process. Not providing the Data would mean that the contract could not be concluded.
Before providing personal data, the Data Subject can contact the Data Controller or the DPO, who will explain for that specific case whether providing the Data is required by law or by contract, whether there is an obligation to provide it, and what the consequences of not providing it would be.
Is there automated decision-making?
No. The Data Controller takes no decision based solely on automated processing, including profiling, that produces legal effects concerning the Data Subject or similarly significantly affects them, within the meaning of art. 22 GDPR.
The profiling described under purpose E above serves to personalise service offerings. It is not used to take decisions of that kind.
Changes to this Privacy Policy
The Data Controller may make changes and/or additions to this Privacy Policy, also as a result of changes in the applicable legislation. You can view the text of the Privacy Policy constantly updated on our Site in the Privacy Policy section, or make an explicit request by contacting the Data Controller or the DPO directly using the contact information indicated above.