Carpooling Program Website and App Privacy Notice

Last updated on 17.01.2023

1. Introduction

1.1 Who we are

TFS Belgium. is a company incorporated in Belgium (company no. 756.463.210) with its registered address at Leuvensesteenweg 369, 1932 Zaventem  (“KINTO Joinwe” or “us”). KINTO Join provides the “KINTO Join” smartphone app and online platform available via www.kintojoin.io which enables people in communities to identify each other and arrange to share journeys by car and other means of transportation.

Unless we have agreed otherwise in writing with you, we are a “controller” of your Personal Data for the purposes of the data protection laws including the General Data Protection Regulation (the “GDPR”), as applicable.

The term “Personal Data” means any information relating to you that identifies you, or through which you can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier or to one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity.

1.2 Purpose of this notice

The purpose of this notice is to inform you about how we process your Personal Data when you visit our website, our mobile website and application (the “App”) and when you use our website and/or App to form carpools. This notice explains what Personal Data we collect from you, and how we collect, use, store and disclose your Personal Data when you use our website and/or App to participate in the carpooling services offered by us. This notice also contains information about your rights under applicable data protection laws.

It is important that you read this notice together with any other privacy notice or fair processing notices we provide you so that you are fully aware of how and why we are using your data. This notice supplements any other such notices and is not intended to override them.

This notice sits alongside our terms and conditions https://app.kintojoin.io/terms-and-conditions/ which we also encourage you to read (our “T&Cs”).

1.3 Contact details of our data protection officer

The contact details of our data protection officer are set out below.

Post:

Toyota Motor Europe NV/SA

Attention : TME Data Protection Contact Point

Avenue du Bourget/Bourgetlaan 60

1140 Brussels

Belgium

E-mailData.Protection@toyota-europe.com

2. Description of Personal Data collected, the purposes and legal bases for processing your Personal Data

2.1 Provision of carpooling services

The carpooling services offered through KINTO Join allows users to register to carpool free of charge by registering over the mobile App or on the website. KINTO Join’s platform, accessible via the KINTO Join website and the App offers you the opportunity to create your own closed carpooling community (access is controlled by the community administrator).

Anyone can set up a community and invite their friends or colleagues to join for free.

Corporate carpooling groups are offered free of charge through KINTO Join’s corporate carpooling programs (each, a “Corporate Carpooling Program”) to employees of KINTO Join’s business customers. If you register under a Corporate Carpooling Program through your employer, please see Section 2.8 (Corporate Carpooling below) for further information about the information we collect, the purpose of the processing and with whom we share it.

2.2 Your registration and our use of location data

To use our services, you need to create an account on either our website or through the App, you need to have agreed to our T&Cs and you need to be at least eighteen (18) years old. Subject to our T&Cs, we will create an account for you upon registration.

To utilise the full functionality of the App, you will need to enable location services within your mobile device to enable us to track your location. For details of how we track your location, please see Section 2.5 (Activity Data) below. We will associate any location data we collect from your mobile device with you and your account.

2.3 Types of information that we collect

The types of information that we collect from you are described below. In all cases, the information may include Personal Data relating to you.

  • Identity data: name, gender, photograph (if you have uploaded one to your profile), home and office address, username or nickname, information about who you are, such as specific workplace authentication.
  • Contact data: email address and telephone number (mobile and work phone).
  • Location, route and activity data: your geographical location, including real-time location (from your mobile phone’s GPS tracking functionality, Wi-Fi or Bluetooth) and your travel route.
  • Ridesharing data: the date and time of the requested ride-sharing; pick-up and drop-off destination points (including place of employment, if applicable).
  • Carpooling information and preferences: your interests and preferences regarding carpooling and who you have carpooled with.
  • Vehicle data: information such as a pass number, or vehicle registration and the type of vehicle you drive.
  • Sensor data and related device data from your mobile device: sensor data from the technology in your mobile device such as gyroscope, accelerometer, Bluetooth, location data via GPS and/or Bluetooth, heading, time-stamp and the motion of the mobile device, and any calculations made by your mobile device using such data. This information (together with the calculations made by your mobile device) will enable us to determine your method of travel (e.g., whether you are travelling in a car or on a cycle).
  • Other technical data: Internet Protocol (IP) address, your login data, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, event-logs and usage patterns.
  • You work/employment data: if applicable, your employer, place of work or office location and usual working hours, and any other information relating to your work or workplace which you supply or which we may discover as a result of your joining a Corporate Carpooling Program.
  • Usage data: information about how you use our website and the App.
  • Marketing and communications data: your preferences in receiving marketing from us and our business partners and your communication preferences.
  • Information you give to us: you may give us information by corresponding with us by phone, email or otherwise. This includes information you provide when you register to use our website and App, enter a survey and when you report a problem with our website or App.
  • Other data: any other information which we describe that we collect from you as listed in this notice.

2.4 Legal bases for processing

The legal bases on which we may process your data are set out below.

  • Consent: where you have consented for us to process your Personal Data for one or more specific reasons.
  • Performance of a contract: in order to perform a contract that we may have agreed with you for the provision of our services. Such contract may include our T&Cs (which is a legal agreement between us and you).
  • Legal obligation: where processing of your Personal Data is required by law.
  • Legitimate interest: in order to effectively deliver information and services to you in the course of conducting our business, provided that our interests does not interfere with your rights. We want to offer you an efficient service and therefore we seek to understand user journeys, journey patterns and the proper functioning of the App. Our legitimate interest may include our need to comply with our obligations under any Corporate Carpooling Program of which you are a member.

2.5 Your activity data (including location data)

When you access and interact with our website or App, we need to track your activities to enable you to connect to our website and App. We use tracking cookies to identify you in performance of this service, information of which is provided in detail under the Cookies Section in 2.12 and in the Cookie List in Section 12 below.

Our servers also receive and record information about your computer, device and browser, including your IP Address, browser type, and other software and hardware information.

If you access our website and/or App from a mobile or other device, we may collect a unique device identifier assigned to that device. As mentioned above (in Section 2.3, “sensor data”), if location services are enabled by you, we also collect location data and other sensor and calculation information for that device provided via your mobile device sensors.

The recording of activity data is necessary for the provision of our carpooling services as described in our T&Cs, since without it we cannot identify your location to place you with registered users along your route, or provide you with incentives offered by your employer as part of the Corporate Carpooling Program. We use this information to verify which route you choose, your method of transportation, and the actual performance of a carpool. We also use this data to identify other users who wish to commute in the same direction to match the users and allow the building of carpools. We also use your location to provide you with important traffic updates and real-time transmissions about possible pick-ups within your area.

We also collect information about your activities throughout your journey, such as your location and the time that you arrive, information about with whom you carpool, and the routes that you choose. The Personal Data that we collect about your activities are for example:

  • Sensor data (as described above in Section 2.3, “sensor data”) such as specific geographic locations, through GPS, Bluetooth or WiFi signals for the provision of our proof of ride share service, to include geolocation accelerometer and compass information, which is combined with your unique user ID. This helps us connect you with users in your area.
  • Through your unique user ID, we allocate the time and date of your carpooling activities, and the number of passengers in a vehicle, and the location of your drop-off, pick up and stops along the way.

2.6 Text messaging and email correspondence

You may want to communicate with other users or with us through our messaging service available through our App and on the website. During your correspondence, you will provide us with Personal Data, which we will process to respond to you and provide the carpooling services. The information that you share with us or with other users will be stored in your account until you close your account in line with your Data Subject Rights.

2.7 Customer surveys

To continuously improve our products and services and adapt them to your needs, we regularly invite our users to participate in customer surveys. In doing so, we exercise our legitimate interest or rely on your consent to use the information you provide during the carpooling registration process (Section 2.2 above) to contact you and ask you for your feedback on your experience.

2.8 Corporate Carpooling Program

Participation in a Corporate Carpooling Program requires a user to register as an employee of a KINTO Join carpooling client via their company email address.

Participation in a Corporate Carpooling Program allows employers to offer benefits to their employees who choose to use more environmentally-friendly modes of transportation, such as carpools, taking public transportation or riding a bicycle to and from work. Employee participation in the carpooling program is completely optional. If you sign up, your employer may provide you with certain benefits depending on whether and how often you participate in carpools and use our services to build carpools.

We only share your Personal Data that is necessary to run the website and the App and for you to receive the incentives or benefits that may be offered by your employer, such as premium reserved parking, free coffees, lunch, or other incentives as deemed appropriate by your employer.

Your employer receives aggregated data about carpooling activities. You will be allocated a unique User ID, and we will illustrate to your employer through our carpooling dashboard on our website your carpooling activities. Through your User ID, your employer may be able to identify who the frequent carpoolers are and the length of their journey.

Your employer may offer incentives for building and using carpools. Based on the information we provide to your employer, you may be entitled to receive certain benefits from them directly. Depending on what kind of benefits your employer is offering, it may be necessary for us to provide your employer with certain Personal Data to provide you the benefits, such as a prize or coupon.

We do not share your location data with your employer. We do not inform your employer about who you are carpooling with. However, you should note that your employer may be able to establish details of your location or individuals you are carpooling with depending on the nature of your particular Corporate Carpooling Program and the number of other individuals who participate in that Corporate Carpooling Program.

2.9 Sharing information you provide to us with users in your carpooling group

If you elect to join a carpooling group (including any Corporate Carpooling Program), your information, such as information about yourself, where you want to go, with whom you want to commute and which routes you take will be visible to other members of the relevant carpooling group. Accordingly, you should not join any carpooling group if you do not wish for your information to be shared with the other members of the group.

2.10 Safe Driving Scores and insurance quotes

Only if you provide us with your consent, we will process your Personal Data to create a Safe Driver Score for you. Your Safe Driver Score may give you a preliminary indication of how you are driving, give you indications on how to drive more safely, and may enable you to receive discounted insurance quotes from insurance providers, subject to your Personal Data being passed to such insurance providers by us. With your consent, we will share your Personal Data with insurance providers for the purposes of providing insurance quotes. You may withdraw your consent for this any time by adjusting your settings located in your profile.

2.11 Sensitive Information

We ask that you do not send us, and you do not disclose, any sensitive personal information (such as information related to racial or ethnic origin, political opinions, religion or other beliefs, health, criminal background or trade union membership) on or through this website, App or otherwise, save for the collection of location data described in this Notice. If we otherwise need to collect such information from you, we would generally only process a special category of Personal Data with your prior explicit consent for a specific purpose stated in your consent, or where our use of such data is otherwise permitted by law.

2.12 Our use of cookies

2.12.1 Description of our cookies

Our website and App use cookies to perform the carpooling services pursuant to your contract with us and pursuant to our contract with your employer. Other cookies are also used for the improvement of the website and App performance. “Cookies” are small text files that store information on the web browser and in the memory of your device. We can obtain certain information about you through the use of cookies. Cookies cannot run programs or transmit viruses to your computer. As is true of most websites and apps, we gather certain information automatically and store it in log files. You can see the full list of the cookies that we use for the website and for the App for what purpose these cookies are required in Section 12 below. In addition, the deactivation/deletion of cookies only affects the internet browser used for this purpose.

2.12.2 Types of cookies

This website uses cookies (described below) to provide the carpooling services in accordance with consent and in accordance with our legitimate business interest in improving user experiences during the carpooling journey.

  • Functionality of the website and/or the App: Cookies that are necessary for our website or App to function technically or that offer a service or option you have requested; e.g. a cookie that “remembers” your personal settings, such as selected language or similar.
  • Performance analysis of the website and/or the App: We are constantly striving to improve our website and App. For this purpose, we use cookies that provide us with overall statistics on the number of visitors, which areas of a page are viewed most, information on the city or location of the users and the length of their stay, etc.
  • Tracking cookies: We use cookies to provide you with the best carpooling services and to record your journey to enable you to take advantage of the incentive programs offered by your employer.
  • Social media cookies: To share content from our website or App via social media channels such as Facebook or Twitter, a cookie must be installed on your device. Further information can be found in the guidelines of the respective company and in Section 13 below.

2.12.3 Deactivation / deletion of cookies

We use “necessary” cookies to make our site work, in addition to this we provide a mechanism to opt-in to additional cookies to understand site usage, make site improvements and to remember your settings.

To prevent the use of cookies by your internet browser or on your mobile device, you can deactivate the use of cookies in your settings (see also https://support.apple.com for iOS devices, and https://support.google.com for Android devices).

Cookies that have already been set can be deleted at any time via an internet browser or other software programs in your App. You can use the help functions of your internet browser to learn how to deactivate and/or delete cookies. If you deactivate or delete the cookies, it will result in certain functions of our website or our App no longer functioning and you will no longer be able to use the service. For other internet browsers, the deactivation/deletion of cookies must be repeated accordingly. If you un-install the App, no more information will be collected.

2.12.4 Duration of the cookies

We store and process the data until the end of the term of a respective cookie or until you delete the cookies or withdraw your consent.

2.13 Statistical Data

We may process your Personal Data to conduct anonymised and aggregated analyses and statistics about the use of our services.

3. Recipients of your Personal Data

3.1 Service Providers

We engage third parties to perform certain services and tasks necessary for the provision of the platform for carpooling and the handling of issues that require special know-how and special IT-Infrastructure that cannot be taken over internally. The hosting of our website, processing of the processes concerning the formation and handling of carpooling activities and providing the software technology and updates to support the platform for the formation and performance of carpooling are outsourced. We will share your personal information with our technical service providers, who will process your information only as instructed by us and only in the ways that are described in this notice and the T&Cs.

3.2 Other carpooling users in your company

We share the Personal Data that you provide us through your use of the carpooling services with other employees in your company who have registered to use the carpooling services. The sharing of information is necessary for the performance of the services and the users only receive information you provide when you create or join a carpooling group. Keep in mind that if you share your Personal Data through social media plug-ins, by activating the share or like button, then your Personal Data will be displayed outside of your closed-user carpooling group.

3.3 Your employer

As described in Section 2.8 above, we share information about your carpooling activities with your employer to perform the carpooling services and to provide you with incentives. For more information on how your employer uses the information we share with them, you will need to refer to your employment privacy policy.

3.4 Data transfer due to a legal obligation

If we are obligated to transfer your data to a third party based on a legal obligation or in order to comply with applicable laws and governmental bodies, we will only do so in accordance with applicable laws (including the GDPR). This may include for example, defence or pursuit of our legal claims involving your use of the carpooling services, investigate fraud, cooperating with criminal investigations, such as compliance with a subpoena, or similar legal process, or to the data protection supervisory authority.

3.5 International transfers of Personal Data

To provide our services, we may need to share your Personal Data with third parties and suppliers outside your initial operating country such as outside of the UK and the European Economic Area (the “EEA”). If we do this, we will take steps to ensure your Personal Data receives an equivalent level of protection by using adequate safeguards, eventually supplemented by additional measures. For example, our contracts with our suppliers stipulate the standards they must follow to process Personal Data. If you wish for more information about these arrangements please contact our Data Protection Officer as identified in Section 1.3.

In particular, your Personal Data may be processed by our consultants in Serbia. Our consultants in Serbia provide community manager and support services to users of our services and our consultants also conduct marketing activities as well as develop and test new products. The transfer and processing of Personal Data to our consultants in Serbia is in compliance with all legal requirements, including the requirements of the GDPR regarding international transfers of Personal Data and the appointment of processors. We use Standard Contractual Clauses (eventually supplemented with additional safeguards) in addition to having conducted a Transfer Impact Assessment for data transfers from the UK and EEA to our consultants in Serbia.

4. Marketing

We may contact you via in-app notifications, push messages and email to promote and encourage the use of our services. We may also contact you to promote services provided by third parties (e.g., safe driving score, cycle to work and insurance products and other services as they become available).

Where we are legally required to obtain your consent to provide you with marketing materials, we will only provide you with such marketing materials if you have provided consent for us to do so.

If you want to unsubscribe from mailing lists or any marketing, you should look for and follow the instructions we have provided in our relevant communications to you. You can also toggle-off the marketing settings in the App.

If you choose to unsubscribe from any or all marketing, we may retain information sufficient to identify you so that we can honour your request.

However, please note that you may receive routine messages from us that are integral to the services that we provide. For example, you may receive correspondence from a community manager to assist you in joining a community or using the App. You may also receive correspondence to update you on the following week’s commutes. Such correspondence does not constitute marketing.

5. Retention of your data

Subject to legal and obligatory requirements laid out within Section 5, we aim to delete your Personal Data when you delete your account with us. You can request deletion of your account by emailing support@kintojoin.io.

Please note that we cannot delete your Personal Data in every instance of account deletion. We may retain your Personal Data (including any information provided by you) for such duration as is necessary for us to fulfil the purposes outlined in this notice and as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements (e.g., our T&Cs). We may therefore retain your Personal Data for 7 years, post deletion of your account.

When calculating the appropriate retention period for your data, we consider the nature and sensitivity of the data, the purposes for which we are processing the data, and any applicable statutory retention periods. Using these criteria, we regularly review the Personal Data which we hold and the purposes for which it is held and processed.

When we determine that Personal Data can no longer be retained (or where we must comply when you request us to delete your data in accordance with your right to do so), we ensure that this data is securely deleted or destroyed.

Remember that after you cancel or delete your account, copies of some information from your account may remain viewable in some circumstances where, for example, you have shared information on social media or used other services (e.g., messaging). We will use our best endeavours to contact any third parties to request the deletion of your data, if you request this.

Please note that, in some circumstances, we may decide to retain your Personal Data for research or statistical purposes and, in such circumstances, we will anonymise your data, rendering the data de-identified of any individual, before retaining it.

6. Your rights regarding your Personal Data

Set out below is information about your rights regarding your Personal Data. Please contact us by emailing support@kintojoin.io if you would like to exercise any of these rights.

6.1 Right of access

You can request information on how, by whom, for what purposes and under what conditions your data is collected and used.

6.2 Right to rectification

You have the right to update or correct the information we have collected about you.

6.3 Right to erasure

You have the right to require us to delete your data, subject to certain legal rights and obligations we have pursuant to which we may retain your data.

6.4 Right to restriction of processing

You can also ask us to use your data only to a limited extent. This means that your data may still be stored but may only be used for limited purposes (e.g. to assert legal claims).

6.5 Right to object to processing

If we collect and use your information on the basis of legitimate interests, you have the right to object to the use of your information.

You also have the right to object to the processing of your Personal Data where such Personal Data are processed for direct marketing purposes.

6.6 Right to data portability

You have the right to receive and transfer any data you have provided to us. We will provide this data in a structured, commonly used and machine-readable format.

7. Right to withdraw consent

If you have given us your consent for the processing of your Personal Data, you can withdraw this at any time. Please note, the withdrawal has no effect on the legality of the data processing carried out in the past on the basis of your consent. To exercise your right to withdraw consent, go to your profile and uncheck the relevant check box or slider in the App.

We will be unable to provide you with carpooling services if you withdraw your consent for us to track your location and/or process any Personal Data which we consider to be an integral part of our provision of services to you.

8. Right to lodge a complaint with a supervisory authority

You have the right to complain to a supervisory authority regarding the processing of your Personal Data.

If you are based in Belgium, you can lodge a complaint to the Belgian Data Protection Authority when you do not agree with they way in which your Personal Data is processed.

Drukpersstraat 35, 1000 Brussel

Phone: +32 (0)2 274 48 00

Fax: +32 (0)2 274 48 35

Mail: contact@apd-gba.be

9. Security

In order to protect your Personal Data, we put in place reasonable and appropriate organisational and technical security measures. These measures include ensuring our internal IT systems are suitably secure, and implementing procedures to deal with any suspected data breach.

In the unlikely event of a data breach, we will take steps to mitigate any loss or destruction of data and, if required, will notify you and any applicable authority of such a breach.

Although we use reasonable and appropriate security measures once we have received your personal data, you will appreciate that the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect Personal Data, but we cannot guarantee the security of data transmitted to or by us.

10. Changes to this notice

We may update this notice from time to time. Updates will be published on our website and App. To ensure you are aware of when we make changes to this notice, we will amend the revision date at the top of this page and notify you either by email or direct “push notification” of a change to policy. Changes apply as soon as they are published on our website and App. We, therefore, recommend that you visit this page regularly to find out about any updates that may have been made.

11. Questions or concerns

You can also contact us if you wish to complain about how we collect, store and use your Personal Data (please see the contact details of our data protection officer in Section 1.3 above).

It is our goal to provide the best possible remedy with regard to your complaints. However, if you are not satisfied with our answer, you can also contact the competent supervisory authority where you are based.

12. Social media plug-ins

We have also implemented Facebook’s, Google+’s, YouTube, and LinkedIn social plug-ins on our website and App. You can recognise the provider of the plug-in by the marketing by their initial letter or the logo on the respective icon. We use the so-called “two-click solution”. As a result, no Personal Data is passed on to the providers of the plug-ins during a purely informational visit to our website or App. We offer you the possibility to communicate directly with the provider of the plug-in via the “share” or “like” button. Only if you click on the marked field and thereby activate it, the plug-in provider receives the information that you have accessed via our website or App. The data is transferred regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, your data collected with us will be directly assigned to your existing account with the plug-in provider. If you click the activate button and, for example share the page, the plug-in provider will also store this information in your user account and will share it publicly with your contacts.

Through the plug-ins we offer you the possibility to interact with your social networks and other users, so that we can improve our services offering and make it more interesting for you as a user. The plug-in provider stores the data collected about you as user profiles and uses these for the purposes of advertising, market research and demand-oriented design of its website. Such an analysis takes place (also for not logged in users) for displaying of demand-driven advertisement and in order to inform other users of the social network about your activities on our website and/or App.

For more information on the purpose and scope of data collection and its processing by the plug-in provider, please refer to the privacy policies of the respective providers as notified below. There you will also receive further information on your rights in this regard and setting options for the protection of your privacy. Below we have listed the addresses of the respective plug-in providers and URL with their data protection information.

Facebook

Plugins of the social network Facebook that involve the processing of information within the European Union is operated by Facebook Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland (“Facebook”). Information on Facebook’s data protection: http://www.facebook.com/policy.php.

Google + and YouTube

Plugins of the social network Google; is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). An overview of the Google+ plugins and their appearance can be found here: https://developers.google.com/+/plugins; information on data protection at Google+ can be found here: http://www.google.de/intl/de/policies/privacy/.

LinkedIn

Plugins of the social network LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; https://www.linkedin.com/legal/privacy-policy.

13. Links to social media websites

You will also find links to social media networks such as Facebook, Twitter, Google+, YouTube, LinkedIn and Xing on our website. These are not social plug-ins provided by the social media provider and by clicking on these links you will transmit your data to the provider when the page is loaded. Behind the buttons to the social media networks there is only a link to the social media network including the transfer of the website to be shared. No user data is transmitted from the website to the social media network. If you are already logged in to the respective social media service at the time you click the button, the sharing dialog will recognise this so that you can share the content directly. If this is not the case, you will be asked to log into the social media network. From this point on you will be on the website of the respective social media network. Please find the information on data processing of the respective providers below.

Facebook

Facebook Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland (“Facebook”). Information on Facebook’s data protection: http://www.facebook.com/policy.php.

Twitter

Twitter, Inc. 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy.

Google + and YouTube

Google+ and YouTube are operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Information on data protection at Google+ can be found here: http://www.google.de/intl/de/policies/privacy/.

LinkedIn

LinkedIn operates from Ireland with regard to its activities in in the European Union, under LinkedIn Unlimited Company, Wilton Place, Dublin 2, Ireland; https://www.linkedin.com/legal/privacy-policy.