Carpooling Program Privacy Policy
Last updated on 02.04.2025.
It is important that you read this document (“Privacy Policy”) so that you are aware of what we do with your Personal Data.
Contents
- Who we are
- The purpose of this Privacy Policy
- The kind of Personal Data we collect
- How we collect your Personal Data
- How and why we use your Personal Data
- Who we share your Personal Data with
- How long we will keep your Personal Data
- Security of your Personal Data
- Transferring your Personal Data outside the UK/EU
- Your rights
- Your obligations
- Changes to this Privacy Policy
1. Who we are
KINTO JOIN Limited (“Kinto”, ”we“, ”us”, “our”) is a limited company registered in England and Wales with company number: 08598706. Its registered address is Great Burgh, Burgh Heath, Epsom, Surrey KT18 5UZ.
We are the ‘Controller’ of the Personal Data we collect.
We have appointed a Data Protection Officer (DPO) to handle data protection matters. If you wish to contact us in order to exercise any of your rights referred to below or any other data protection matter, please contact the DPO via email at dataprotectionofficer@kintojoin.io. Alternatively, you may write to our DPO at: Data Protection Officer, Kinto Join Ltd, Great Burgh, Burgh Heath, Epsom, Surrey KT18 5UZ.
2. The purpose of this Privacy Policy
The purpose of this Privacy Policy is to let you know how we collect and process your Personal Data when you use the Kinto Join Carpooling Service, such as when you use the website kinto-join.co.uk (“Website”) or smartphone application (“App”), for potential customers when you request a demo, purchase any of our Mobility Business Solutions, or otherwise contact us (together, our “services”). This Privacy Policy also contains information about your rights under applicable data protection legislation.
We are committed to compliance with data protection laws. We believe that ensuring data protection compliance is the foundation of trustworthy business relationships.
It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your Personal Data.
This Privacy Policy sits alongside the Terms and Conditions (“T&Cs”) and Cookie Policy which we also encourage you to read.
3. The kind of Personal Data we collect
“Personal Data” means any information about an individual from which that person can be identified whether directly or indirectly.
The types of Personal Data we collect and process related to the use of our services includes:
- Identitydata: name, gender, photograph (if you have uploaded one to your profile), home and office address, username or nickname, information about who you are, such as specific workplace.
- Contact data: email address and telephone number (mobile and work phone).
- Location, route and activity data: your geographical location as a passenger or driver, including real-time location (from your mobile phone’s GPS tracking functionality, Wi-Fi or Bluetooth) and your travelled route. Note that to utilise the full functionality of the App, you will need to enable location services within your mobile device to enable us to track your location. If you do not allow the App to access location services within your mobile device some functions of the App will not work.
- Ridesharing data: the date and time of the requested ride-sharing; pick-up and drop-off destination points (including place of employment, if applicable).
- Carpooling information and preferences: your interests and preferences regarding carpooling and who you have carpooled.
- Vehicle data: information such as a pass number, or vehicle registration and the type of vehicle you drive.
- Sensor data and related device data from your mobile device: sensor data from the technology in your mobile device such as gyroscope, accelerometer, location data via GPS, heading, time-stamp and the motion of the mobile device, and any calculations made by your mobile device using such data. This information (together with the calculations made by your mobile device) will enable us to determine your method of travel (e.g., whether you are travelling in a car, on a cycle or on foot). We also use Bluetooth to transfer a unique user ID to identify when two known users are near each other to ascertain that they are travelling together.
- Other technical data: Internet Protocol (IP) address, your login data, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, event-logs and usage patterns.
- Your work/employment data: if applicable, your employer, place of work or office location and usual working hours, and any other information relating to your work or workplace which you supply or which we may be informed as a result of you purchasing, setting up and administering or joining a corporate carpooling group which are free to join and are offered via our corporate customers (“Corporate Carpooling Program”). This may include your personal payment details or bank details in connection with the purchase of our Mobility Business Solutions if you operate as a sole trader or unlimited liability partnership.
- Usage data: information about how you use the App or the Website.
- Marketing data: your preferences in receiving marketing from us and our business.
- Communications data: your communication preferences.
- Information you give to us: you may give us information by corresponding with us by phone, email or otherwise. This includes information you provide when you register to use the Website, App, request a demo, contact us through the website, enter a survey and when you report a problem with the Website or the App.
- Other data: any other information which we describe that we collect from you as referred to in this Privacy Policy and the Cookie Policy.
4. How we collect your Personal Data
We will collect your Personal Data from you in the following ways:
- Your interactions with us. We collect most Personal Data directly from you, for example when you register to create an account and make use of our services, when you communicate with other users or with us, when you participate in customer surveys, by requesting a Demo or purchasing any of our Mobility Business Solutions.
- Third parties or publicly available sources. We may receive Personal Data about you from other sources such as from LinkedIn or your company website.
- Automated technologies. We may also collect personal data via cookies as you interact with our services. Please see our Cookie Policy to learn more.
We may also process your anonymised and aggregated data in order to analyse trends and statistics about the use of our services.
5. How and why we use your Personal Data
Under UK and EU data protection laws, we need to have a legal basis for processing Personal Data. We rely on one or more of the following legal bases:
- Performance of a contract: in order to perform a contract that we are about to enter into or have entered into with you. Such contract may include our T&Cs (which is a legal agreement between us and you).
- Legitimate interest: where it is necessary to conduct our business and pursue our legitimate interests, for example in order to effectively deliver information and services to you in the course of conducting our business, provided that our interests does not interfere with your rights. We want to offer you an efficient service and therefore we seek to understand user journeys, journey patterns and the proper functioning of the App. Our legitimate interest may include our need to comply with our obligations under any Corporate Carpooling Program of which you are a member.
- Consent: where we have obtained your active agreement for us to process your Personal Data.
- Legal obligation: where processing of your Personal Data is necessary for compliance with a legal obligation that we are subject to.
- Vital interests: we may need to protect your vital interests or someone else’s (for example, in life-or-death type scenarios).
The table below explains what we use your personal data for and why.
| Purpose/Use | Type of Information | Legal Basis | Retention Period |
| To provide you with our services and carry out our agreement with your employer | ● Identity data
● Employment data |
● Performance of a contract | ● We will retain this data for 7 years |
| To provide you with a demo of our product | ● Identity data
● Contact data ● Information you give to us |
● To take steps at your request before entering into a contract with you
● Legitimate interests (to contact you, at your request, regarding the products and services we offer). |
● We will retain this data for 7 years |
| To calculate and verify your mode of travel to match you with incentives offered by your employer as part of a Corporate Carpooling Program or match you with potential travel partners based on your preferred route(s) and time of travel. This includes recording your journey to work for these purposes | ● Sensor data
● Device data ● Location, route, and activity data ● Identity data (your home address) ● Employment data (your working hours) |
● Performance of a contract
● Legitimate interests (to help calculate your route to work and find suitable travel partners) |
● We will retain this data for 7 years |
| To create your user profile | ● Identity data | ● Legitimate interests (to identify you) | ● We will retain this data for 7 years |
| To communicate with you about our services and to help you connect with colleagues and optimise your commute, and to respond to your queries when you contact us through our Website | ● Identity data
● Contact data ● Information you give to us |
● Legitimate interests (to contact you to help you connect with colleagues and optimise your commute – you can control how we contact you in your settings). | ● We will retain this data for 7 years |
| To enable the carpool arrangement | ● Ridesharing data | ● Legitimate interests (for running the services) | ● We will retain this data for 7 years |
| To find suitable carpools | ● Carpooling information and preferences | ● Legitimate interests (for running the services) | ● We will retain this data for 7 years |
| To verify and identify vehicles and establish the driver’s location | ● Location, route, and activity data
● Vehicle data ● Identity data
|
● Legitimate interests (to enable driver location awareness for passengers). | ● We will retain this data for 7 years |
| To keep track of the results of using the carpool | ● Location, route, and activity data | ● Legitimate interests (for running the services) | ● We will retain this data for 7 years |
| Marketing our services to you | ● Marketing data
● Communications data ● Contact data |
● Legitimate interests (to promote our services to clients and potential clients).
● Consent (and if you have provided consent, we may also contact you to promote services provided by third parties (e.g., insurance products and other services as they become available). To start or stop receiving marketing from us, simply change your marketing settings in the App, or by contacting us using the details above. |
● We will retain this data for 7 years |
| To maintain and update our records with you | ● Identity data
● Contact data ● Marketing data ● Communications data |
● Legitimate interests (to retain records of communications and accurate details to allow us to keep in touch with you).
● To comply with our legal and regulatory obligations. |
● We will retain this data for 7 years |
| To enable you to complete a survey and provide feedback | ● Identity data
● Contact data ● Marketing data ● Usage data ● Communications data |
● Legitimate interests (to understand how customers use our products/services and to help us improve and develop them and grow our business)
● Performance of a contract |
● We will retain this data for 7 years |
| To administer and protect our business and our services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | ● Identity data
● Contact data ● Technical and usage data
|
● Legitimate interests (for running our business, to provide support, network security, and to prevent fraud).
● To comply with our legal and regulatory obligations. |
● We will retain this data for 7 years |
| Operational reasons, such as developing and testing new products and improving efficiency | ● Location, route, and activity data | ● Legitimate interests (to provide you with a better user experience and improve our services). | ● We will retain this data for 7 years |
| To enforce legal rights or defend or take legal proceedings | ● Identity data Contact data
● Technical and usage data
|
● To comply with our legal and regulatory obligations. | ● We will retain this data for 7 years |
6. Who we share your Personal Data with
Your Personal Data may be shared as follows, for the purposes set out in the table above in Section 5. Where we share your personal data with third parties, we will do so in line with this Privacy Policy and in compliance with data protection laws:
- Internally with our group companies, where necessary for the provision of our services.
- Service Providers. We engage third parties to perform services on our behalf, including the hosting of the App or the Website, the processes concerning the formation and handling of carpooling activities and providing the software technology and updates to support our services. We may share your Personal Data with identity checking entities, payment platforms such as Stripe, website hosting and maintenance providers in connection with your purchase of any of our services through our Website. We will also share your Personal Data with our technical service providers.
- Sharing with other users of the Kinto Join Carpooling Service, if you choose to join a carpooling group (including any Corporate Carpooling Program). Keep in mind that if you share your Personal Data through social media plug-ins, by activating the share or like button, then your Personal Data will be displayed outside your closed-user carpooling group.
- Your employer if you participate in a Corporate Carpooling Program.
- With third parties, such as law enforcement agencies or regulatory bodies, or legal and/or professional representatives, to comply with a legal obligation.
With other third parties if we sell or restructure the business.
7. How long we will keep your Personal Data
We will only keep your Personal Data for as long as is necessary to fulfil the purposes we collected it for, which may include satisfying any legal, accounting, or reporting requirements. The retention period depends on the type of Personal Data and the reason we are processing it. Further details of retention periods are set out in the table above in Section 5.
When calculating the appropriate retention period for your Personal Data, we consider the nature and sensitivity of the Personal Data, the purposes for which we are processing the Personal Data, and any applicable statutory retention periods. Using these criteria, we regularly review the Personal Data which we hold and the purposes for which it is held and processed.
When we determine that Personal Data can no longer be retained (or where we must comply you request us to delete your Personal Data in accordance with your right to do so) we ensure that this Personal Data is securely deleted or destroyed.
Please note that, in some circumstances we may decide to retain your Personal Data for research or statistical purposes and in such circumstances, we will anonymise your Personal Data before retaining it. We may irreversibly anonymise your personal data so that it can no longer be associated with you, in which case we may use this anonymous information indefinitely without further notice to you.
8. Security of your Personal Data
In order to protect your Personal Data, we put in place appropriate organisational and technical security measures. These measures include ensuring our internal IT systems are suitably secure and implementing procedures to deal with any suspected data breach. We have held an UKAS accredited ISO 27001:2013 certificate for a number of years. ISO 27001 is a set of global standards that focuses on information security best practice.
In the unlikely event of a data breach, we will take steps to mitigate any loss or destruction of data and, if required, will notify you and any applicable authority of such a breach.
Although we use appropriate security measures once we have received your Personal Data, you will appreciate that the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect Personal Data, but we cannot guarantee the security of data transmitted to or by us.
9. Transferring your Personal Data outside the UK/EEA
We are based in the UK, but to provide our services, we may need to share your Personal Data with third parties and suppliers outside the UK/ European Economic Area (EEA). If we do this, we will ensure your Personal Data receives the same protection as if it were being processed inside the UK/EEA. For example, our contracts with our suppliers stipulate the standards they must follow to process Personal Data.
In particular, your Personal Data may be processed by our service providers in Serbia. Our service providers in Serbia develop and test new products to improve the Kinto Join Carpooling Service. The transfer and processing of Personal Data to our service providers in Serbia is in compliance with the requirements of the UK and EU GDPR regarding international transfers of Personal Data and the appointment of processors.
We will only transfer personal data to countries that have been deemed by the Information Commissioner or European Commission to provide an adequate level of protection, or by using specific contractual protections, such as the standard contractual clauses (see European Commission: Model contracts for the transfer of personal data to third countries and United Kingdom Addendum).
10. Your rights
You have a number of rights under the data protection legislation. Some of these rights apply generally, while others will only apply in certain circumstances. Usually, there is no charge, unless your requests are manifestly unfounded or excessive. In such circumstances, we may make a reasonable charge or decline to act on your request. Before we action your request, we may ask you for proof of your identity. Once in receipt of this, we will process the request without undue delay and within one month. In order to exercise your rights please contact our DPO at dataprotectionofficer@kintojoin.io.
Your rights in connection with Personal Data are set out below.
- Right to be informed
You have the right to be provided with clear, transparent, and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this Privacy Policy.
- Subject Access Request
You have a right to receive a copy of the Personal Data we hold about you.
- Rectification
If any of the Personal Data we hold about you is incomplete or inaccurate, you have a right to have it corrected and updated.
- Erasure
This is also known as the “right to be forgotten”. You have a right to ask us to delete your Personal Data where there is no good reason for us continuing to process it. However, certain criteria apply and if we have a legitimate reason to continue processing your Personal Data, we will not be legally required to delete it.
- Objection
You have a right to object where we are relying on legitimate interests as our legal basis for processing your Personal Data but, in certain circumstances we may be able to continue with the processing. For example, if we have compelling legitimate grounds which override your interests, rights and freedoms or your Personal Data is needed for the establishment, exercise or defence of legal However, you have an absolute right to object to us processing your Personal Data for direct marketing purposes.
- Restriction
You have a right to ask us to restrict the processing of your Personal Data in certain For example, you may require us to suspend processing your Personal Data whilst checks are made to ensure it is accurate.
- Portability
You have the right to ask us to transfer any Personal Data you have provided to us to another party, subject to certain criteria being satisfied. We will provide this Personal Data in a structured, commonly used and machine-readable format.
- Right to withdraw consent
If you have given us your consent for the processing of your Personal Data (where consent is the lawful basis for processing), you can withdraw this at any time. Please note, the withdrawal has no effect on the legality of the data processing carried out in the past on the basis of your consent. To exercise your right to withdraw consent go to your profile and uncheck the relevant check box or slider in the App.
- Automated Decision Making
You have the right to object to any decisions which significantly affect you if they are made solely by automated means. In these circumstances, you are entitled to ask for human intervention. Some decisions within the Kinto Join Carpooling Service are made solely by automated means. For example, if your employer allocates priority car park spaces to users of the Kinto Join Carpooling Service, the allocation may be entirely automated, depending on how the facility is set up with your employer. In these cases, a “digital ticket” will be automatically sent to your mobile phone which you can use to access the car park. However, if you do not receive a “digital ticket” but you are expecting one, you may click on “where is my ticket” and when this happens the Kinto Join support team will be alerted to the problem and will look into it. Therefore, human intervention will be provided.
Our processing activities therefore do not amount to automated decision making.
- Right to complain
If you are unhappy with the way in which your Personal Data has been or is being processed, you have the right to make a complaint about it to your national data protection regulator. In the UK, this is the Information Commissioner’s Office (ICO).
11. Your obligations
If any of your Personal Data changes whilst you are a user of the Kinto Join Carpooling Service, it is important that you update the information within your profile to ensure that the data we hold about you is accurate and up to date.
12. Changes to this Privacy Policy
We reserve the right to update this Privacy Policy from time to time. Updates to this Privacy Policy will be published on the Website and the App, and we will notify you of any significant changes. To ensure you are aware of when we make changes to this Privacy Policy, we will amend the revision date at the top of this page. Changes apply as soon as they are published on the Website and the App. We therefore recommend that you visit this page regularly to find out about any updates that may have been made.