Jurisdiction:

Language:

Carpooling Program Website and App Privacy Notice

Last updated on 08.05.2024.

It is important that you read this document (“Privacy Policy”) so that you are aware of what we do with your Personal Data.

Who we are
What Personal Data is
The purpose of this Privacy Policy
Why we collect your Personal Data
The kind of Personal Data we collect
How we collect your Personal Data
How we use your Personal Data
Our Legal Bases for Processing Your Personal Data
Who we share your Personal Data with
Marketing
How long we will keep your Personal Data
Security of your Personal Data
Transferring your Personal Data outside the EU
Your rights
Your obligations
How to contact our Data Protection Officer
Questions or Concerns
The Data Protection Principles
Changes to this Privacy Policy

1. Who we are

KINTO JOIN Limited is a limited company registered in England and Wales with company number: 08598706. Its registered address is Great Burgh, Burgh Heath, Epsom, Surrey KT18 5UZ.

We are the ‘Controller’ of the Personal Data we collect.

We will process your Personal Data in accordance with all applicable laws, including the United Kingdom and European Union (EU) General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018).

2. What Personal Data is

The term “Personal Data” means any information relating to you that identifies you, or through which you can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data (passengers or drivers location), or an online identifier or to one or more factors specific to you physical, physiological, genetic, mental, economic, cultural or social identity.

3. The purpose of this Privacy Policy

The purpose of this Privacy Policy is to let you know how we process your Personal Data when you use the Kinto Join Carpooling Service or for potential customers when you request a demo, purchase any of our Mobility Business Solutions on our website or otherwise contact us through our website. This Privacy Policy therefore explains what Personal Data we collect from you and how we collect, use, store and disclose it. This Privacy Policy also contains information about your rights under applicable data protection legislation.

We are committed to compliance with data protection laws. We believe that ensuring data protection compliance is the foundation of trustworthy business relationships.

It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your Personal Data.

This Privacy Policy sits alongside the Terms and Conditions (“T&Cs”) https://app.kinto- join.co.uk/corp/terms-and-conditions/?country=united_kingdom&language=en and Cookie Policy which we also encourage you to read.

4. Why we collect your Personal Data

We collect your Personal Data for the purpose of providing you with the Kinto Join Carpooling Service or when you make enquiries through our website or purchase our Mobility Business Solutions.

We offer corporate carpooling groups which are free to join and are offered via our corporate customers (“Corporate Carpooling Mobility Program”). If you register under a Corporate Carpooling Program, please see the section within paragraph 9 below for further information about this.

To use these services, you need to create an account on the App, you need to have agreed to the T&Cs and you need to be at least eighteen (18) years old. Subject to the T&Cs, we will create an account for you upon registration.

To utilise the full functionality of the App, you will need to enable location services within your mobile device to enable us to track your location. If you do not allow the App to access location services within your mobile device some functions of the App will not work. For details of how we track your location, please see paragraph 7 below. We will associate any location data we collect from your mobile device with you and your account.

5. The kind of Personal Data we collect

We will collect, use and store various types of Personal Data about you when you request a demo, purchase any of Mobility Business Solutions on our website, contact us through our website or register and use the Kinto Join Carpooling Service.

We would ask that you do not send us or disclose to us any Special Category Personal Data. This type of Personal Data is more sensitive and requires a higher level of protection. Special Category Personal Data includes information about an individual’s race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data about physical and/or mental health or data concerning a natural person’s sex life or sexual orientation. This type of information is not usually required but if it is, we will only process it with your prior explicit consent for a specific purpose stated in your consent.

The types of Personal Data we collect includes:

Identity data: name, gender, photograph (if you have uploaded one to your profile), home and office address, username or nickname, information about who you are, such as specific workplace
Contact data: email address and telephone number (mobile and work phone).
Location, route and activity data: your geographical location as a passenger or driver, including real-time location (from your mobile phone’s GPS tracking functionality, Wi-Fi or Bluetooth) and your travelled route.
Ridesharing data: the date and time of the requested ride-sharing; pick-up and drop-off destination points (including place of employment, if applicable).
Carpooling information and preferences: your interests and preferences regarding carpooling and who you have carpooled
Vehicle data: information such as a pass number, or vehicle registration and the type of vehicle you drive.
Sensor data and related device data from your mobile device: sensor data from the technology in your mobile device such as gyroscope, accelerometer, location data via GPS, heading, time-stamp and the motion of the mobile device, and any calculations made by your mobile device using such data. This information (together with the calculations made by your mobile device) will enable us to determine your method of travel (e.g., whether you are travelling in a car, on a cycle or on foot). We also use Bluetooth to transfer a unique user ID to identify when two known users are near each other to ascertain that they are travelling together.
Other technical data: Internet Protocol (IP) address, your login data, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, event-logs and usage patterns.
Your work/employment data: if applicable, your employer, place of work or office location and usual working hours, and any other information relating to your work or workplace which you supply or which we may be informed as a result of you purchasing, setting up and administering or joining a Corporate Carpooling Program. This may include your personal payment details or bank details in connection with the purchase of our Mobility Business Solutions if you operate as a sole trader or unlimited liability partnership.
Usage data: information about how you use the App or the Website
Marketing data: your preferences in receiving marketing from us and our business
Communications data: your communication preferences
Information you give to us: you may give us information by corresponding with us by phone, email or otherwise. This includes information you provide when you register to use the Website, App, request a demo, contact us through the website, enter a survey and when you report a problem with the Website or the App.
Other data: any other information which we describe that we collect from you as referred to in this Privacy Policy and the Cookie Policy.

Further details about the type of Personal Data we collect and for what purpose are provided in the Schedule of Processing at the end of this document.

6. How we collect your Personal Data

We will collect your Personal Data directly from you in the following ways:

Registration

When you register and make use of the Kinto Join Carpooling Service. In particular, when you register you will be asked to complete a registration form to provide Personal Data, such as your contact details and identity data. When you join and make use of a carpool, we will collect additional information from you such as your travelling preferences, vehicle data, location and route data.

Text messaging and email

You may want to communicate with other users or with us through the messaging service available through the App and on the Website. During your correspondence, you will be providing Personal Data. We will process the Personal Data you provide to us to respond to you and provide the Kinto Join Carpooling Service. We will also communicate with you using email. For example, we will send you an email to let you know that you have a message waiting for you in the App. Messages and emails will be stored in accordance with the retention period set out in the Schedule of Processing which can be found at the end of this document.

Customer Surveys

To continuously improve our products and services and adapt them to your needs, we regularly invite our users to participate in customer surveys. If you would like to participate, we will collect Personal Data from you as part of the process.

Statistics

We may process your Personal Data to conduct anonymised and aggregated analyses and statistics about the use of our services.

Through visiting our Website, by requesting a Demo or purchasing any of our Mobility Business Solutions

We will collect your Personal Data directly from you, such as when you contact us directly to make an enquiry, submit a request for contact or to receive personalised reports, but, we may also collect Personal Data about you online, such as from LinkedIn or your company website.

7. How we use your Personal Data

We will use your Personal Data to provide you with the Kinto Join Carpooling Service. In particular, when you access and interact with the App or the Website, we need to track your activities to enable you to connect to the Kinto Join Carpooling Service. For potential customers, we will process your Personal Data when you request a demo, contact us through our Website or purchase our Mobility Business Solutions.

We use tracking cookies to identify you in performance of this service, information of which is provided in detail in the Cookie Policy:

https://app.kinto-join.co.uk/corp/cookiepolicy/?country=united_kingdom&language=en

Our servers also receive and record information about your computer, device and browser, including your IP Address, browser type, and other software and hardware information.

If you access the App or the Website from a mobile or other device, we may collect a unique device identifier assigned to that device. As mentioned above (in paragraph 5, “sensor data”), if location services are enabled by you, we also collect location data of both the passenger and the driver and other sensor and calculation information for that device provided via your mobile device sensors.

The recording of location, route and activity data is necessary for the provision of the Kinto Join Carpooling Service as described in the T&Cs, since without it we cannot establish the drivers location or verify your mode of travel to match you with incentives offered by your employer as part of a Corporate Carpooling Program or match you with potential travel partners based on your preferred route(s) and time of travel.

We use this Personal Data, together with some of the sensor data and related device data to verify which route you choose, your method of transportation, and the actual performance of a carpool. (However, no location data is transferred via Bluetooth). We also use this data to identify other users who wish to commute in the same direction to match the users and allow the building of carpools.

We may contact you via in-app push notifications, email and / or phone to help you connect with colleagues and optimise your commute. You can control how we contact you in your settings.

We also collect information about your activities throughout your journey, such as your location, information about with whom you carpool, and the routes that you choose. The Personal Data that we collect about your activities are for example:

Sensor data (as described above in paragraph 5, “sensor data”) such as specific geographic locations, through GPS or WiFi signals for the provision of our proof of ride share service, to include geolocation accelerometer and compass information, which is combined with your unique user ID. This helps us connect with other users in your area. As a driver, specific geographic locations through GPS or WiFi signals may also be used ,with your consent ,to enable driver location awareness to fellow passengers.
Through your unique user ID you collect and pass to us details of your commute that allow us to verify carpooling activity such as number & ID of passengers, distances passengers are transported and times of specific events along your route/ commute/journey.

We will only use your Personal Data for the purpose we collected it and in accordance with the law. We will not use your Personal Data for any other purpose without your prior consent. The only exception to this is if it is required or permitted by law, such as where it is necessary for the prevention, investigation, detection or prosecution of criminal offences or the enforcement of civil law matters.

8. Our Legal Bases for processing your Personal Data

The UK and EU GDPR requires that a Controller must have a legal basis for processing Personal Data. More details are provided in the Schedule of Processing but, in most instances, our legal bases for processing your Personal Data are:

Consent: where you have consented for us to process your Personal Data for one or more specific reasons.
Performance of a contract: in order to perform a contract that we may have agreed with you for the provision of our services. Such contract may include our T&Cs (which is a legal agreement between us and you).
Legal obligation: where processing of your Personal Data is required by law.
Legitimate interest: in order to effectively deliver information and services to you in the course of conducting our business, provided that our interests does not interfere with your rights. We want to offer you an efficient service and therefore we seek to understand user journeys, journey patterns and the proper functioning of the App. Our legitimate interest may include our need to comply with our obligations under any Corporate Carpooling Program of which you are a member.

On rare occasions we may need to use your Personal Data as follows:

We need to protect your vital interests or someone else’s. (This relates to life or death type scenarios).

9. Who we share your Personal Data with

Your Personal Data may be shared internally at Kinto Join Ltd for purposes of providing the Kinto Join Carpooling Service, which includes maintenance and troubleshooting activities. Responding to your requests through the Website, answering your queries, setting up and managing the contract with the organisation you work for.

Your Personal Data may also be shared as follows:

Service Providers

We engage third parties to perform certain services and tasks necessary for the provision of the platform for carpooling and the handling of issues that require special know-how and special IT-Infrastructure that cannot be taken over internally. The hosting of the App or the Website, processing of the processes concerning the formation and handling of carpooling activities and providing the software technology and updates to support the platform for the formation and performance of carpooling are outsourced. We may share your Personal Data with identity checking entities, payment platforms such as Stripe, website hosting and maintenance providers in connection with your purchase of any of our services through our website. We will share your Personal Data with our technical service providers, who will process your information only as instructed by us and only in the ways that are described in this Privacy Policy and the T&Cs. We ensure that we enter into written contracts with all technical service providers we instruct. These agreements place obligations on the providers to comply with the UK and EU GDPR and all relevant data protection legislation and to act only under our strict instructions.

Sharing with other users of the Kinto Join Carpooling Service

If you elect to join a carpooling group (including any Corporate Carpooling Program), your information, such as information about yourself, where you want to go, with whom you want to commute, which routes you take, how many journeys you have made and how much CO2 you have saved will be visible to other members of the relevant carpooling group. The date and time you last logged in may also be displayed but you can turn this off, if you wish. The sharing of information is necessary for the performance of the services. Accordingly, you should not join any carpooling group if you do not wish for your information to be shared with the other members of the group.

Keep in mind that if you share your Personal Data through social media plug-ins, by activating the share or like button, then your Personal Data will be displayed outside your closed-user carpooling group.

Corporate Carpooling Program

We may share your Personal Data with your employer if you participate in a Corporate Carpooling Program.

These programs require users to register as an employee of a Corporate Carpooling Program customer using an email address associated with their employer’s business and participation allows the employers to offer benefits to their employees who choose to use more environmentally-friendly modes of transportation, such as carpools, using public transport or riding a bicycle to and from work. Employee participation in the carpooling program is optional. If you sign up, your employer may provide you with certain benefits depending on whether and how often you participate in carpools and use these services to build carpools.

We only share your Personal Data that is necessary to run the App or the Website and the App and for you to receive the incentives or benefits that may be offered by your employer, such as premium reserved parking, free coffees, lunch, or other incentives as deemed appropriate by your employer.

Your employer receives aggregated data about carpooling activities. You will be allocated a unique user ID and username, and we will illustrate to your employer through the carpooling dashboard on the Website your carpooling activities. Through your user ID and/or username, your employer may be able to identify you and ascertain who the frequent carpoolers are and the length of their journey.

Your employer may offer incentives for building and using carpools. Based on the information we provide to your employer; you may be entitled to receive certain benefits from them directly. Depending on what kind of benefits your employer is offering, it may be necessary for us to provide your employer with certain aspects of Personal Data to enable them to give you the benefits, such as a prize or coupon.

We do not share your location data with your employer. We do not inform your employer about who you are carpooling with. However, you should note that your employer may be able to establish these details from the information we do provide to them, depending on the nature of the particular Corporate Carpooling Program and the number of other individuals who participate in that Corporate Carpooling Program.

Data transfer due to legal obligation

If we are obligated to transfer your data to a third party based on a legal obligation or in order to comply with applicable laws and governmental bodies, we will only do so in accordance with applicable laws (including the DPA 2018 and the UK and EU GDPR). This may include for example, defence or pursuit of our legal claims involving your use of the carpooling services, investigate fraud, cooperating with criminal investigations, such as compliance with a subpoena, or similar legal process, or to the data protection supervisory authority.

When entering into contracts with third parties, we always require them to take appropriate technical and organisational measures to safeguard your Personal Data and confirm that they will adhere to the data protection law to ensure your Personal Data is kept secure.

We may share your Personal Data with other third parties if we sell or restructure the business.

We may also need to share your Personal Data with other third parties such as legal and/or professional representatives in order to comply with the law or legal obligation.

10. Marketing

With your consent, we may contact you via in-app notifications, push messages and email to promote our services. To start or stop receiving marketing from us, simply change your marketing settings in the App.

If you have provided consent, we may also contact you to promote services provided by third parties (e.g. insurance products and other services as they become available).

Where we are legally required to obtain your consent to provide you with marketing materials, we will only provide you with such marketing materials if you have provided consent for us to do so.

If you want to unsubscribe from mailing lists or any marketing, you can toggle-off the marketing settings in the App.

If you choose to unsubscribe from any or all marketing, we may retain information sufficient to identify you so that we can honour your request.

Potential Customers who request a demo or make contact through our Website.

We will provide you with information on our products and services that may be of interest to you under a Legitimate Interest. Should you advise us you no longer wish to hear from us we will add your details to a suppression list, and this can be done by emailing dataprotectionofficer@kintojoin.io.

11. How long we will keep your Personal Data

We will only keep your Personal Data for as long as is necessary to fulfil the purposes we collected it for, which may include satisfying any legal, accounting, or reporting requirements. The retention period depends on the type of Personal Data and the reason we are processing it. Further details of retention periods are set out in the Schedule of Processing which can be found at the end of this document.

When calculating the appropriate retention period for your Personal Data, we consider the nature and sensitivity of the Personal Data, the purposes for which we are processing the Personal Data, and any applicable statutory retention periods. Using these criteria, we regularly review the Personal Data which we hold and the purposes for which it is held and processed.

When we determine that Personal Data can no longer be retained (or where we must comply you request us to delete your Personal Data in accordance with your right to do so) we ensure that this Personal Data is securely deleted or destroyed.

Remember that after you cancel or delete your account, copies of some information from your account may remain viewable in some circumstances where, for example, you have shared information on social media or you have used other services (e.g., messaging). We will use our best endeavours to contact any third parties to request the deletion of your Personal Data, if you request this.

Please note that, in some circumstances we may decide to retain your Personal Data for research or statistical purposes and in such circumstances, we will anonymise your Personal Data before retaining it. We may irreversibly anonymise your personal data so that it can no longer be associated with you, in which case we may use this anonymous information indefinitely without further notice to you.

12. Security of your Personal Data

In order to protect your Personal Data, we put in place appropriate organisational and technical security measures. These measures include ensuring our internal IT systems are suitably secure and implementing procedures to deal with any suspected data breach. We have held an UKAS accredited ISO 27001:2013 certificate for a number of years. ISO 27001 is a set of global standards that focuses on information security best practice.

In the unlikely event of a data breach, we will take steps to mitigate any loss or destruction of data and, if required, will notify you and any applicable authority of such a breach.

Although we use appropriate security measures once we have received your Personal Data, you will appreciate that the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect Personal Data, but we cannot guarantee the security of data transmitted to or by us.

13. Transferring your Personal Data outside the UK

To provide our services, we may need to share your Personal Data with third parties and suppliers outside the UK If we do this, we will ensure your Personal Data receives the same protection as if it were being processed inside the UK. For example, our contracts with our suppliers stipulate the standards they must follow to process Personal Data.

In particular, your Personal Data may be processed by our service providers in Serbia. Our service providers in Serbia develop and test new products to improve the Kinto Join Carpooling Service. The transfer and processing of Personal Data to our service providers in Serbia is in compliance with the requirements of the UK and EU GDPR regarding international transfers of Personal Data and the appointment of processors. We use the European Commission and UK’s standard contractual clauses for data transfers from the UK to our service providers in Serbia. (see European Commission: Model contracts for the transfer of personal data to third countries and United Kingdom Addendum).

14. Your rights

You have rights under the data protection legislation and, subject to certain legal exemptions, we must comply when you inform us that you wish to exercise these rights. There is no charge, unless your requests are manifestly unfounded or excessive. In such circumstances, we may make a reasonable charge or decline to act on your request. Before we action your request, we may ask you for proof of your identity. Once in receipt of this, we will process the request without undue delay and within one month. In order to exercise your rights please contact the Data Protection Officer at datprotectionofficer@kintojoin.io.

Your rights in connection with Personal Data are set out below.

Subject Access Request

You have a right to receive a copy of the Personal Data we hold about

Rectification

If any of the Personal Data we hold about you is incomplete or inaccurate, you have a right to have it

Erasure

This is also known as the “right to be forgotten”. You have a right to ask us to delete your Personal Data where there is no good reason for us continuing to process it. However, certain criteria apply and if we have a legitimate reason to continue processing your Personal Data, we will not be legally required to delete it.

Objection

You have a right to object where we are relying on legitimate interests as our legal basis for processing your Personal Data but, in certain circumstances we may be able to continue with the processing. For example, if we have compelling legitimate grounds which override your interests, rights and freedoms or your Personal Data is needed for the establishment, exercise or defence of legal However, you have an absolute right to object to us processing your Personal Data for direct marketing purposes.

Restriction

You have a right to ask us to restrict the processing of your Personal Data in certain For example, you may require us to suspend processing your Personal Data whilst checks are made to ensure it is accurate.

Portability

You have the right to ask us to transfer any Personal Data you have provided to us to another party, subject to certain criteria being satisfied. We will provide this Personal Data in a structured, commonly used and machine-readable format.

Right to withdraw consent

If you have given us your consent for the processing of your Personal Data (where consent is the lawful basis for processing), you can withdraw this at any Please note, the withdrawal has no effect on the legality of the data processing carried out in the past on the basis of your consent. To exercise your right to withdraw consent go to your profile and uncheck the relevant check box or slider in the App.

Automated Decision Making

You have the right to object to any decisions which significantly affect you if they are made solely by automated In these circumstances, you are entitled to ask for human intervention. Some decisions within the Kinto Join Carpooling Service are made solely by automated means. For example, if your employer allocates priority car park spaces to users of the Kinto Join Carpooling Service, the allocation may be entirely automated, depending on how the facility is set up with your employer. In these cases, a “digital ticket” will be automatically sent to your mobile phone which you can use to access the car park. However, if you do not receive a “digital ticket” but you are expecting one, you may click on “where is my ticket” and when this happens the Kinto Join support team will be alerted to the problem and will look into it. Therefore, human intervention will be provided.

Right to complain

If you are unhappy with the way in which your Personal Data has been or is being processed, you have the right to make a complaint about it to the Information Commissioner’s Office (ICO). They can be contacted at:

Information Commissioner’s Office Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

www.ico.org.uk

15. Your obligations

If any of your Personal Data changes whilst you are a user of the Kinto Join Carpooling Service, it is important that you update the information within your profile to ensure that the data we hold about you is accurate and up to date.

16. How to contact our Data Protection Officer

We have appointed a Data Protection Officer (DPO) to handle data protection matters. If you wish to contact us in order to exercise any of your rights referred to above or any other data protection matter, please contact the DPO via email dataprotectionofficer@kintojoin.io. Alternatively, you may write to our DPO at:

Data Protection Officer

Kinto Join Ltd

Great Burgh,

Burgh Heath,

Epsom,

Surrey

KT18 5UZ.

17. Questions or concerns

You can contact us if you wish to complain about how we collect, store and use your Personal Data (please see the contact details of our data protection officer in paragraph 16 above).

It is our goal to provide the best possible remedy with regard to your complaints. However, if you are not satisfied with our answer, you can also contact the Information Commissioner’s

Office. The ICO is the relevant supervisory authority in the UK. Their contact details are specified above under paragraph 14.

18. The Data Protection Principles

We will comply with the UK and EU GDPR and the DPA 2018. Article 5 of the UK and EU GDPR contains the data protection principles, which require that Personal Data shall be:

processed lawfully, fairly and in a transparent way
collected for specified, explicit and legitimate purposes and not used in any way that is incompatible with those purposes
adequate, relevant and limited to what is necessary
accurate and, where necessary, kept up to date
kept for no longer than is necessary for the purposes we have told you about
kept secure

19. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy from time to time. Updates to this Privacy Policy will be published on the Website and the App. To ensure you are aware of when we make changes to this Privacy Policy, we will amend the revision date at the top of this page. Changes apply as soon as they are published on the Website and the App. We therefore recommend that you visit this page regularly to find out about any updates that may have been made.

Carpooling Program Website and App Privacy Notice

Contents