Privacy policy.

This page explains how NECTURE GmbH processes the personal data it collects through the www.streetcrowd.com website. It follows the EU General Data Protection Regulation 2016/679 ("GDPR") and Austrian data protection law.

In this policy, you are the "Data Subject". The page covers who is responsible for your data, what we process and why, how long we keep it, who receives it and what your rights are.

If anything is unclear, contact us at hi@necture.com.

Who is the Data Controller?

Necture GmbH, with registered office in Papagenogasse 1A, 1060 Vienna, Austria, e-mail: hi@necture.com

The Company Necture GmbH (hereinafter "Necture" and/or "Data Controller") is the data controller of personal data of members (hereinafter also "Data Subject") using the www.streetcrowd.com website, including any subdomains (hereinafter "Site").

How can I contact the DPO?

Rechtsanwalt Savino Menna, Necture GmbH, Papagenogasse 1A, 1060 Vienna, Austria, e-mail: dpo@necture.com

You can contact the Data Protection Officer directly at any time with any question about data protection.

Through the site, Necture provides a set of services, including an innovative and digital approach to reshape the future of mobility.

What data do we process by the Site?

Technical information related to:

• Browser types and versions used by the Member
• Operating system used by the Member
• Website from which an accessing system reaches the Site
• Subdomains related
• The date and time of access to the Site
• IP address of the Member
• The approximate location the hosting provider works out from the IP address, used only to show the nearest city the Site serves, and not stored
• The internet service provider of the Member

The Site uses no analytics, advertising or tracking. It sets one cookie, only when a Member logs in to their StreetCrowd account, to keep them logged in, and it stores two items in your browser, which stay there and are never sent to us. All of them are described in our Cookie Policy.

Information collected via the "Tell me when it launches" form:

• E-mail address of the Member
• City chosen by the Member

Information collected via the operator sign-up forms on the Site (/sign-up/bolt and /sign-up/free2move):

• First and last name of the Member
• E-mail address and mobile number of the Member
• The city the Member signs up for
• When the Member completes the sign-up with their personal link: the e-mail address of their account with that operator; for Bolt, their confirmation that Bolt has verified their driving licence and, on Android, their Google Play Store e-mail address; for Free2Move, their confirmation that they have a Free2Move account
• For Bolt: whether the Member uses iOS or Android
• For Free2Move: the Member's confirmation that they have an Android phone
• The Member's acceptance of the User Agreement and, where the operator has one, of that operator's rule book, and the Member's acknowledgement of this Privacy Policy, each with its version and the time
• Whether the Member agrees to receive StreetCrowd news and offers by e-mail
• When a confirmation code is requested, the IP address the request came from, kept for one hour and used only to limit how many codes can be sent from one connection
• Where the link to the form carried them, the campaign tags of that link (utm_source, utm_medium, utm_campaign, utm_content, utm_term): which advert, post or website the Member came from. They are taken from the address of the page when the form is sent, not stored in the browser, and used only to see which channels bring sign-ups

Information collected when the Member registers for Starship tasks (/starship) and uses their StreetCrowd account:

• First and last name, e-mail address and mobile number of the Member (the number confirmed with a code by SMS, as above), and the city they register for
• The password the Member chooses. It is stored only in a form that cannot be turned back into the password (a hash); nobody at StreetCrowd can read it
• The Member's acceptance of the User Agreement and acknowledgement of this Privacy Policy, each with its version and the time, and whether they agree to receive StreetCrowd news and offers by e-mail
• Date of birth and address of the Member. They identify the Member in the confidentiality agreement (NDA), and the date of birth is used to check that the Member is at least 18. The Member can change them at any time; each change is recorded with the fields changed and the time
• The NDA the Member signs online: the signed document, the time of signing and the record the signing service keeps of it (such as the IP address and the steps of signing)
• The Member's training and test: which training modules they have read and when, and for each test the number of right answers, whether they passed and the time
• The steps the Member has completed and when (e-mail address confirmed, personal details, NDA, training and test), and when they log in

Information collected when the Member contacts CrowdCare, through the contact form on the Site, the chat on every page or a support ticket:

• Name of the Member
• E-mail address of the Member
• The subject and the message itself
• The service, the city and the operator the request is about
• Where the request concerns a problem with the app, the phone model, its operating system and the version of the app
• Any screenshot, photo or PDF the Member attaches, such as a screenshot of an operator account or a photo of a licence plate
• Technical data the chat receives when a page loads, such as the IP address of the Member and the page being viewed

What purpose is the data processed, on what legal basis, and for how long?

A. Allow access to the site, show the nearest city it serves and keep the forms from being misused

• Legal basis: Legitimate interest of the Data Controller in providing access to the Site and of the Members themselves to correctly use the Site, in pointing the Member to the nearest city StreetCrowd serves, and in stopping the forms being used to send confirmation codes to numbers at random
• Retention: See our Cookie Policy for Site. The approximate location is used for the request being answered and is not stored

B. Answer requests for information (also through the "Tell me when it launches" form, the CrowdCare chat, a support ticket and the e-mail addresses on this page)

• Legal basis: Legitimate interest of the Data Controller in answering any requests from Members
• Retention: The Data will only be kept for the duration necessary for the execution of the request

C. Fulfilling the administrative and accounting obligations provided for by the legislation (e.g. on anti-money laundering, accounting management and invoicing)

• Legal basis: Legitimate interest of the Data Controller in fulfilling the legal obligations
• Retention: The Data will only be kept for the duration necessary to comply with the legal obligations

D. For the promotion of the Services through traditional and remote communication tools (marketing purposes, e.g. by Newsletter)

• Legal basis: Consent. This is optional and withdrawable at any time
• Retention: For a maximum period of 24 months from the consent of the Data Subject and in accordance with our Cookie Policy

E. To analyse your preferences, habits, behaviours or interests of Members, in order to provide personalised service offerings (profiling purposes)

• Legal basis: Consent. This is optional and withdrawable at any time
• Retention: For a maximum period of 12 months from the consent of the Data Subject

F. Register Members for Starship tasks and check that they are qualified (account, age, NDA, training and test), and organise the tasks with them

• Legal basis: Performance of the contract with the Member and the steps they ask for before entering into it (art. 6 (1) (b) GDPR); for the check of the minimum age and the NDA, also the legitimate interest of the Data Controller and of its client Starship in a qualified, bound team (art. 6 (1) (f) GDPR)
• Retention: For as long as the Member keeps their account. When the Member deletes it or asks us to, the Data is deleted, except the signed NDA and the records needed to prove it, which are kept for as long as the NDA's obligations last and the legal limitation periods require

The Data is processed with manual or IT tools, also through automated tools, suitable to guarantee its security, confidentiality and to avoid unauthorised access.

The Data processed is stored using cloud computing tools. For the safety standards and the GDPR compliance of the selected external providers, see their own privacy policies: Vercel, Slack, Mailchimp, Supabase and DocuSeal.

After the data retention indicated above, the Data will be destroyed, deleted or anonymised, compatible with the technical procedures of deletion and backup.

To whom is the Data communicated?

• Service providers related to the activities of the Data Controller and public institutions
• Service providers related to assistance, tax and legal advice
• Service providers related to IT or storage and external service providers

The Site uses these external service providers, all acting as processors on behalf of the Data Controller:

• Vercel (Vercel Inc., United States) hosts the Site and processes technical information, such as the IP address of the Member, in order to deliver the pages. From the IP address it also works out the Member's approximate location, which the Site uses only to show a "Start in" button for the nearest city it serves. The location is not stored.
• Slack (Slack Technologies, a Salesforce company, United States) receives each "Tell me when it launches" signup, meaning the e-mail address and the city, in an internal StreetCrowd channel where the team reads it in order to answer.
• Zendesk (Zendesk, Inc.) provides the CrowdCare chat that loads on every page and the support tickets, and keeps what the Member writes and attaches. A request sent through the contact form is created in Zendesk in the Member's own name, so that Zendesk's confirmation reaches them; where the Member has no Zendesk user record yet, one is created from their e-mail address. Zendesk stores that data in its European data region. What the chat stores in the Member's browser is listed in our Cookie Policy.
• Supabase (Supabase, Inc., United States) stores each operator sign-up from the Site in a database in the European Union, so that StreetCrowd and the operator can set up the Member's account with that operator. For Starship tasks it also runs the Member's StreetCrowd account (log-in and the hashed password) and stores the registration, the personal details and the progress described above, in the same database in the European Union.
• DocuSeal (DocuSeal LLC, United States) provides the online signing of the NDA for Starship tasks. It receives the Member's name, e-mail address, date of birth and address, filled into the NDA, and keeps the signed document and the record of the signing in its European cloud (Ireland).
• Google (Google Ireland Limited) keeps a copy of each completed operator sign-up in a Google Sheet that the StreetCrowd team works from to set up accounts with the operators. For Starship tasks the sheet holds the Member's name, e-mail address, mobile number, city and the steps completed (without date of birth and address). Google also delivers the e-mails of the StreetCrowd account (confirming the e-mail address, setting a new password) from noreply@streetcrowd.com.
• seven.io (Kiel, Germany) sends the 6-digit code by SMS that confirms the Member's mobile number at sign-up. It receives the mobile number and the text of the message. StreetCrowd keeps only a fingerprint of the code, for 10 minutes and at most one day, and stores the number with the time it was confirmed.
• Mailchimp (Intuit Inc., United States) receives the name, e-mail address, mobile number, language, operator and city of each operator sign-up, where the link to the form carried them the source and campaign of its campaign tags, and the Member's personal link to complete it, and sends the e-mails about the sign-up: the next steps, reminders and the login details for the operator's app. For Starship tasks it receives the same contact details, a link to the Member's checklist and the steps the Member has completed, so that the e-mails can follow where they stand. Newsletters and offers, the marketing purpose D above, go only to Members who tick the box for StreetCrowd news and offers.

The Data collected through the Site will be processed only to ensure the correct use of the Site and may be viewed and used by the Necture team (employees and collaborators) appropriately authorised to process them.

The Data may be disclosed for legitimate interest purposes, to suppliers of assistance services, technical, tax and legal consultancy, assignees of receivables in the context of credit securitisation or credit assignment operations for strictly connected and instrumental purposes to the management of the relationship with the transferred Data Subject, as well as to the issue of securities, assignees of company or business unit, potential buyers of Necture and companies resulting from possible mergers, divisions or other transformations of Necture, also in the context of the activities functional to these operations, and to competent authorities.

The above-mentioned subjects may act, where appropriate, as external data controllers or independent data controllers in accordance with current legislation. You can request the updated list of companies to which the Data will be communicated at any time to the Data Controller, by means of a specific request to be sent using the contact information indicated in the Privacy Policy.

Is the Data transferred abroad?

The Data will mainly be processed in Austria and within the European Union, but could also be transferred to extra EU Countries.

Any transfer of the Data and the Data Subject to countries located outside the European Union will take place only in compliance with adequate guarantees for the purposes of the transfer itself (and in particular complying with the provisions of art. 45, 46 and 49 of GDPR), e.g. provided that the European Commission has confirmed that the third country has an adequate level of data protection or other data protection guarantees exist, such as binding business rules or signing up to standard EU contractual clauses.

In particular, Vercel, Slack, Supabase and Mailchimp are established in the United States, so the technical information processed by Vercel, the signups sent to Slack and the operator sign-up details passed to Mailchimp reach a country outside the European Union. Supabase stores the operator sign-ups and the StreetCrowd accounts in the European Union, DocuSeal keeps the NDAs in its European cloud, and Google keeps its copy under Google Ireland Limited. What the Member writes to CrowdCare is different: Zendesk keeps it in its European data region.

In any case, the processing of Data is carried out in compliance with the national and supranational provisions in force (EU Regulation 679/2016 and the Austrian Data Protection Act, Datenschutzgesetz).

The Data Subject will have the right to obtain from the data Controller a copy of the Data held abroad and to obtain information about the place where such data is stored making an express request to be sent using the contacts indicated in this document.

What are my rights?

By contacting the Data Controller or the DPO using the e-mail addresses described above, you can ask Necture at any time:

• the access to the Data concerning you, the rectification of inaccurate data, the integration of incomplete Data, their deletion (right to be forgotten), the limitation of processing in the cases provided for by art. 18 GDPR
• to receive in a structured format, common use and readable by automatic device the Data concerning you in the cases provided for by art. 20 GDPR; and, if technically feasible, to transmit such data to another Data Controller without hindrance
• to withdraw the consent given at any time; as well as oppose at any time the processing of data pursuant to art. 21 GDPR, giving evidence of the reasons justifying the opposition
• any other request for clarification regarding the processing of data carried out by the Data Controller

Finally, we remind you that it is always possible to make a complaint to the competent Supervisory Authority pursuant to art. 77 of the GDPR, in Austria the Datenschutzbehörde, if it considers that the processing carried out by the Data Controller is contrary to the current legislation.

Do I have to provide my Data?

Providing personal data is in part required by law (for example by tax rules) or can follow from a contract (for example the details of a contracting party). In some cases a contract can only be concluded if the Data Subject provides us with personal data that we then have to process. Not providing the Data would mean that the contract could not be concluded.

Before providing personal data, the Data Subject can contact the Data Controller or the DPO, who will explain for that specific case whether providing the Data is required by law or by contract, whether there is an obligation to provide it, and what the consequences of not providing it would be.

Is there automated decision-making?

No. The Data Controller takes no decision based solely on automated processing, including profiling, that produces legal effects concerning the Data Subject or similarly significantly affects them, within the meaning of art. 22 GDPR.

The profiling described under purpose E above serves to personalise service offerings. It is not used to take decisions of that kind.

For Starship tasks, the test at the end of the training is marked automatically, and a Member needs to pass it before taking Starship tasks. A Member who doesn't pass can take a new test straight away, as often as they like, and can ask CrowdCare to have their result looked at by a person. Registration is also refused automatically when the date of birth shows the Member is under 18.

Changes to this Privacy Policy

The Data Controller may make changes and/or additions to this Privacy Policy, also as a result of changes in the applicable legislation. You can view the text of the Privacy Policy constantly updated on our Site in the Privacy Policy section, or make an explicit request by contacting the Data Controller or the DPO directly using the contact information indicated above.