Privacy Policy
Privacy Policy Optimile
This privacy policy (“Privacy Policy”) is applicable to all processing activities of Optimile (as defined below) as controller. Please read this Privacy Policy together with our Cookie Policy and our Terms & Conditions on the Websites (as defined below). Optimile may update this Privacy Policy in the future: the latest version can always be found on our Websites. You can find our previous privacy policy here.
Last update: July 2022.
About this Privacy Policy
Due to, for example, your commercial relationship or recent contact with Optimile, or due to a visit to or an action on our “Websites” (i.e. https://optimile.eu and https://mobiflow.be and related subdomains) and app for (e-)mobility services (“Platform” and “App”), we may collect, store and otherwise process Personal Data relating to you or, if you are a company, your employees | representatives (“(your) Personal Data”) as a controller.
This Privacy Policy describes (i) how we collect, treat and store your Personal Data; (ii) the rights you can exercise in relation to your Personal Data; and (iii) the measures we take to protect it and to secure your Personal Data.
Optimile always strives to act in accordance with the applicable privacy legislation, such as (non-exhaustive): (i) the European General Data Protection Regulation 2016/679 (“GDPR”); (ii) the Belgian Privacy Act of 30 July 2018; (iii) the European ePrivacy Directive 2002/58/EC (including all future legislative changes and amendments/revisions thereof); (iv) (future) national legislation regarding the implementation of the GDPR; and (v) other applicable rules concerning the processing of Personal Data (together: “Privacy Legislation”).
Optimile is the controller
We are Optimile, a public limited company (“naamloze vennootschap”) incorporated and existing under the laws of Belgium, with registered office at BE-9000 Ghent, Sassevaartstraat 46 / B 204, Belgium with VAT/company number BE-0648.837.849 (hereinafter referred to as “Optimile”, “we” or “us”).
Optimile is the provider of the Platform and App, and is the owner of the Websites.
In light of the Privacy Legislation, Optimile will act as the CONTROLLER of your Personal Data for the purposes described in this Privacy Policy. This means, we are in control of (and thus, responsible for) processing your Personal Data.
If you read this Privacy Policy as an employee of a company relying on the Platform or App, please note that – in respect of your use of the Platform or App – your employer is to be considered your controller and Optimile merely as a facilitator of the Platform, App and related services. Please consult Optimile’s Data Processing Policy in that respect.
Optimile’s processing activities
I. Related to your use of our Websites:
| Contacting Optimile via the Website | |
| Purpose: | Answering enquiries or initiating correspondence (e.g. provide you with the requested information, etc.); |
| Personal Data: | First name, last name, email address, phone number and all other Personal Data voluntarily communicated to Optimile |
| Legal ground: | Consent |
| Retention Period: | 3 years |
| Cookies |
| Please read this Privacy Policy in conjunction with Optimile’s cookie policies for the Websites (Optimile Cookie Policy / Mobiflow Cookie Policy ) We would like to remind you that you can always withdraw your consent regarding our use of analytical and/or targeting cookies. |
II. Related to Optimile’s business relations in general:
| Prospecting (leads) | |
| Connecting during (virtual) fairs, networking (e.g. through LinkedIn) | |
| Purpose: | Follow-up after the fair |Drawing up a quote |
| Personal Data: | First name, last name, email address, phone number, company name and job title |
| Legal ground: | Your consent (B2C) and/or Optimile’s legitimate interest (boost/increase Optimile’s business) (B2B) |
| Retention Period: | 3 years (unless you have objected) |
| Collecting information regarding potential leads (with business partners, on the Internet, etc.) | |
| Purpose: | Detecting interesting leads |
| Personal Data: | First name, last name, email address, phone number, company name and job title |
| Legal ground: | Our legitimate interest (foster Optimile’s business) |
| Retention Period: | 3 years (unless you have objected) |
|
Cold calling |
|
| Purpose: | Communicating with leads to inform them about the Platform, App and Optimile’s services in general | Drawing up a quote |
| Personal Data: | First name, last name, email address, phone number, company name and job title |
| Legal ground: | Our legitimate interest (foster Optimile’s business) |
| Retention Period: | 3 years (unless you have objected) |
Registering for an Optimile webinar or expert series |
|
| Purpose: | Enabling the lead to join an Optimile webinar or expert series | Follow-up of the webinar or expert series |
| Personal Data: | First name, last name, email address, phone number, company name and job title |
| Legal ground: | Your consent |
| Retention Period: | 3 years |
| Newsletters | |
| Purpose: | Providing information on (new features of) the App, the Platform or other services of Optimile |
| Personal Data: | First name, last name, email address, company |
| Legal ground: | Your consent (prospects) or Optimile’s legitimate interest (active customers) |
| Retention Period: | As long as you have not objected to receiving the newsletter (unless you have objected). |
Communicating with business partners |
|
| Purpose: | Correspondence with business partners via email and/or telephone |
| Personal Data: | First name, last name, email address, phone number and all Personal Data voluntarily communicated to Optimile |
| Legal ground: | Necessary for entering into / the performance of the agreement |
| Retention Period: | As long as the business partner and Optimile have a business relationship + 1 year after termination of said business relationship. |
Customers |
|
Communicating with customers |
|
| Purpose: | Correspondence with customers via email and/or telephone |
| Personal Data: | First name, last name, email address, phone number of the (contact person of) the customer |
| Legal ground: | Necessary for entering into / the performance of the agreement |
| Retention Period: | As long as the data subject is a customer of Optimile + 1 year after termination of the customer relationship. |
Registering for an Optimile webinar/seminar |
|
| Purpose: | Organising the seminar/webinar |
| Personal Data: | First name, last name, email address, phone number, company name, country of residence, job title |
| Legal ground: | Necessary for entering into / the performance of the agreement |
| Retention Period: | 3 years |
Sending out customer satisfaction surveys |
|
| Purpose: | Improving Optimile’s services |
| Personal Data: | First name, last name, email address, phone number, company name, salutations, job title, and all other Personal Data voluntarily provided to Optimile |
| Legal ground: | Your consent (B2C) and/or Optimile’s legitimate interest (enhance customer service) (B2B) |
| Retention Period: | 3 years |
III. Related to customers – charge point operators
| Creating an account | |
| Purpose: | Account administration |
| Personal Data: | Salutation, first name, last name, email address, phone number, language preference and address |
| Legal ground: | Necessary for entering into / the performance of the agreement |
| Retention Period: | Duration of your use of the Platform + 3 years after termination of said use, on the condition that the former user has no outstanding credit or debts towards Optimile. In this case, the Personal Data are only removed after the necessary payments to Optimile. |
| Registering additional users | |
| Purpose: | Registering additional users on the Platform |
| Personal Data: | Salutation, first name, last name, email address, phone number, language preference, address and bank account number |
| Legal ground: | Necessary for entering into / the performance of the agreement |
| Retention Period: | Duration of your use of the Platform + 3 years after termination of said use, on the condition that the former user has no outstanding credit or debts towards Optimile. In this case, the Personal Data are only removed after the necessary payments to Optimile. |
Providing assistance to a user with a(n) (technical) inquiry for support |
|
| Purpose: | Support (via email and/or telephone) |
| Personal Data: | First name, last name, email address, phone number and all other Personal Data voluntarily provided to Optimile |
| Legal ground: | Necessary for the performance of the agreement |
| Retention Period: | Duration of your use of the Platform + 1 year after termination of said use |
Sending invoices |
|
| Purpose: | Invoicing |
| Personal Data: | First name, last name, company name, email address, address and VAT number |
| Legal ground: | Necessary for the performance of the agreement |
| Retention Period: | Legal minimum term of 7 years + 1 year |
Fraud detection |
|
| Purpose: | Processing of information regarding your use of your account (status) for fraud detection |
| Personal Data: | Date of activation of the account, date when the account was last used |
| Legal ground: | Our Legitimate interest (preventing fraud with your account) |
| Retention Period: | Duration of your use of the Platform + 3 years after termination of said use, on the condition that you have no outstanding credit or debts towards Optimile. In such case, your Personal Data is only removed after the necessary payments to Optimile |
Paying the charge point operator |
|
| Purpose: | Collecting information so Optimile can pay charge point operators for use that has been made of their charge points by third parties |
| Personal Data: | First name, last name and bank account number |
| Legal ground: | Necessary for the performance of the agreement |
| Retention Period: | Legal minimum term for retention of invoices (7 years) + 1 year |
IV. Related to customers – mobility users
| Creating an account | |
| Purpose: | Account administration |
| Personal Data: | Salutation, first name, last name, email address, language preference, date of birth, phone number and address |
| Legal ground: | Our Legitimate interest (account administration – facilitating the mobility user’s use of the App) |
| Retention Period: | Duration of your use of the Platform + 3 years after termination of said use, on the condition that you have no outstanding credit or debts towards Optimile. In such case, your Personal Data is only removed after the necessary payments to Optimile |
Public transport ticketing |
|
| Purpose: | Collection of Personal Data in order to generate a ticket for public transport |
| Personal Data: | Train (NMBS): first name, last name, email address, date of birth, date, location and language preference
Bus (De Lijn): first name, last name, email address, phone number, location and language preference |
| Legal ground: | Our Legitimate interest (facilitating mobility user’s use of the public transport services embedded in the App) |
| Retention Period: | Duration of your use of the App and, optionally, the Platform + 3 years |
Bike renting |
|
| Purpose: | Collection of Personal Data when the mobility user rents a bike (with Blue-bike or Velo): registering the mobility user’s purchase of a ticket to rent a bike |
| Personal Data: | First name and last name |
| Legal ground: | Our legitimate interest (facilitating mobility user’s use of the rent-a-bike services embedded in the App) |
| Retention Period: | Duration of your use of the App and, optionally, the Platform + 3 years |
Taxi booking |
|
| Purpose: | Collection of Personal Data when the mobility user books a taxi: providing taxi services to the mobility users |
| Personal Data: | Mobility user: first name, last name, phone number and location
Taxi driver: information regarding his/her status (active or not), picture and information regarding the cab (car brand, license plate) |
| Legal ground: | Our legitimate interest (facilitating mobility user’s use of the rent-a-bike services embedded in the App) |
| Retention Period: | Duration of your use of the App and, optionally, the Platform + 3 years |
Analysing and reporting of the mobility user’s use of mobility services |
|
| Purpose: | Providing mobility users with information of his/her use of the mobility services | Gaining insights of the mobility users’ use of mobility services in general in order to improve our services |
| Personal Data: | Location data and information about the use of mobility services (which mobility services the mobility user has used in the past) |
| Legal ground: | Our Legitimate interest: Providing the mobility user with an overview of his/her use of the mobility services | Improving our services and/or providing new services |
| Retention Period: | 10 years |
Communication between the mobility user and taxi services |
|
| Purpose: | Providing communication facilities for the taxi services embedded in the App |
| Personal Data: | Mobility user: first name, last name, email address, language preference and the content of conversations with the taxi driver
Taxi driver: the content of conversations with the mobility user |
| Legal ground: | Our Legitimate interest (facilitating communication between the mobility user and the taxi driver) |
| Retention Period: | 1 month |
3. Legal grounds
You can find more information on the applicable ground for each of the identified processing activities in Article 2 above. In case the legal ground for processing happens to be legitimate interest, Optimile shall always
- Assess the necessity of the processing activity in relation to the purpose of processing (proportionality test); and,
- Assess whether you, the data subject, could reasonably expect the specific processing process to take place so we can estimate the possible impact of the processing activity on your fundamental rights and freedoms.
Hence, Optimile always strives to limit the impact on your fundamental rights and freedoms as much as possible. We can reassure you that we will only process your Personal Data on the basis of legitimate interest when we are absolutely sure that a balance between your rights and freedoms and our interests can be found. If no balance can be reassured, Optimile will
- No longer process your Personal Data in that specific situation (for that specific purpose); or,
- Rely on another legal ground for the processing of your Personal Data (e.g. consent).
4. Retention Periods
You can find more information on the retention period of your Personal Data for each of the identified processing activities in Article 2 above.
Unless a longer storage period is required or justified (i) by law or (ii) through compliance with another legal obligation, Optimile shall only store your Personal Data for the period necessary to achieve and fulfil the purpose for which your Personal Data have been collected. In this context, Optimile has formalized the retention periods for the different personal data that it processes in a(n) (internal) data retention policy.
5. Sharing of Personal Data to third parties
Optimile shall not disclose your Personal Data to third parties, unless it is necessary for one of the aforementioned purposes (including but not limited to delivery of public transportation or taxi services, accounting services, database management, cloud or other software (development) services to Optimile). In this respect, your Personal Data may be disclosed to public transport providers, taxi service providers, external accountants, software developers or software (cloud) providers.
Processing by the third party shall be governed by a contract or other legal act under Union or Member State law that obligates the third party to handle or process your Personal Data at least as restrictive as Optimile itself and that sets out (i) the subject-matter and duration of the processing, (ii) the nature and purpose of the processing, (iii) the type of Personal Data, (iv) categories of data subjects and (v) the obligations and rights of the third party and Optimile.
Notwithstanding the foregoing it is, however, possible that Optimile discloses your Personal Data:
- To the competent authorities (i) if Optimile is obliged to do so under the law or under legal or future legal proceedings, and (ii) to safeguard and defend our rights;
- To the party taking over Optimile, if Optimile, or the majority of its assets, is taken over by said third party, in which case your Personal Data – which Optimile has collected – shall be one of the transferred assets.
Optimile shall not transfer, sell, hire out or pass on your Personal Data to third parties for purposes outside the purposes listed in this Privacy Policy, such as, but not limited to marketing purposes, except when it (i) has obtained your permission to this end and (ii) has completed a data processing agreement with the third party in question, which contains the necessary guarantees regarding confidentiality and privacy compliance of your Personal Data.
6. Transfers of Personal Data to third countries
Any transfer of Personal Data to a third country or international organization shall be subject to (i) an adequacy decision by the Commission or (ii) one of the following safeguards:
- A data transfer agreement, which shall contain (i) the standard contractual clauses (“SCC”), for the transfer of personal data to third countries adopted by the European Commission on June 4, 2021. or (ii) any other mechanism pursuant to Privacy Legislation, or any other regulations pertaining to the processing of Personal Data. Before the transfer takes place, the recipient of Personal Data/processor of Optimile in the third country (“Data Importer”) has to guarantee Optimile that an adequate level of privacy compliance is ensured in this third party country; and/or
- Binding corporate rules. As it is the case for standard contractual clauses, the recipient of Personal Data/processor of Optimile in the third country has to guarantee Optimile that an adequate level of privacy compliance is ensured in the third party country; and/ or
- The recipient is certified under a certification mechanism approved by the EU commission.
Every transfer to a third country or international organisation, not recognized by an adequacy decision, is subject to an assessment by Optimile to determine if there is anything in the law and/or practices in force of said third country that may infringe on the effectiveness of the appropriate safeguards in place (as identified above).
Where required on the basis of aforementioned assessment, Optimile shall identify and implement appropriate supplementary measures to govern any data transfer to such international organization or a third country without adequacy decision to ensure the level of data protection as required by EU law.
Furthermore, Optimile shall take all reasonable efforts to oblige the Data Importer to implement sufficient guarantees and measures to protect the Personal Data and ensure the effectiveness of the protection of the SCC’s, binding corporate rules and/or certification mechanisms.
In case of non-compliance by a Data Importer or where protections in the third country are not adequate, Optimile shall – at its sole discretion – either:
- Suspend the transfer of Personal Data to the Data Importer / such third country until the issue has been solved; or,
- Terminate the transfer of Personal Data to the Data Importer / such third country and request the Data Importer to delete the Personal Data in its possession.
7. Your privacy rights
In light of the processing of your Personal Data, you enjoy the following privacy rights:
- Withdraw consent: in case the processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before the withdrawal.
- Access: you can ask for confirmation of whether or not Personal Data that relates to you is being processed, as well as more clarifications about the information referred to in this Privacy Policy. You have the right to request a copy of the Personal Data undergoing processing.
- Rectification: you can ask us to correct | complete any information you believe is inaccurate | incomplete, and you are not able to correct the Personal Data yourself (e.g. in your personal account in the App and/or Platform).
- Forget me: you can ask us to erase your Personal Data, under certain conditions. Please be aware that in this context certain services will no longer be accessible and/or can no longer be provided.
- Restriction of processing: you can ask us to restrict the processing of your Personal Data, unless we have legitimate interests for the processing of your Personal Data that prevail over your interests.
- Object: You can object to us processing your Personal Data, under certain conditions. You can always object against the use of your Personal Data for marketing purposes.
- Data portability: you can request to receive the Personal Data you provided, or to send it to another entity indicated by you, in a commonly used structured format readable by automatic device.
- Lodge a complaint: in case you are not satisfied with the way Optimile processes your Personal Data, you have the right to lodge a complaint with the applicable EEA data protection authority (see Article 12)
Exercising your rights. At any time you can exercise your privacy rights towards Optimile by contacting us (i) via email (info@optimile.eu, info@mobiflow.be), (ii) via an authorized third party with a specific power of attorney or (iii) by completing the Data Subject’s Rights Form and deliver it to Optimile by email or post.
In principle, you can exercise these rights free of charge via the above-mentioned form. In addition, you can always – via your personal account – update, modify and/or verify your Personal Data, which you were required to submit when creating and/or accessing your account on the Platform and/or App for the first time.
Updates | Newsletters: Where and as permitted under applicable law, Optimile may process your contact information for direct marketing purposes (e.g. information about the services and/or products of Optimile (such as Mobiflow)). If you no longer wish to receive our general newsletters or product updates, you can object to these mailings (‘Right to object’) by (i) using our Data Subject’s Rights Form (as indicated above), or (ii) replying to the email containing the newsletter of Optimile.
8. Security of Personal Data
The security and safety of your Personal Data is Optimile’s top priority. Optimile implements technical, administrative and physical security measures designed to protect your Personal Data from (i) unauthorized access or disclosure and (ii) loss, abuse or alteration.
In concrete terms, Optimile has taken following security measures (non-exhaustive list):
- All persons who have access to your Personal Data on behalf of Optimile are bound by confidentiality obligations;
- If Optimile calls on processors of Personal Data, the necessary data processing agreement has been concluded, which contains the necessary guarantees regarding confidentiality and privacy-compliance of the processing activities of the processor with regard to of your Personal Data;
- Optimile employees have strong passwords for access to all of Optimile’s IT-systems;
- Access to Optime’s IT-system has been differentiated so access to certain Personal Data is restricted to employees who need to have access to said data for the execution of their job (access on a ‘need to know’ basis);
- We make back-ups of the Personal Data in order to be able to recover these data in case of an incident (e.g. data breach);
- We regularly test and evaluate our security measures;
- Our employees are aware of the importance of the protection of Personal Data;
- We have implemented state-of-the art technical security measures to protect our IT-systems against viruses or malware;
- There is a “clean desk”-policy.
Finally, the security of your personal account will also partly depend on the confidentiality and complexity of your password. Optimile will never ask for your password, meaning that you will never be required to communicate it personally. If you have nonetheless communicated your password to a third party – for example because this third party has indicated that it wishes to offer additional services – this third party shall have access to your account and your Personal Data via your password. In such cases, you are liable for the transactions which occur as a result of the use made of your account. Optimile therefore strongly advises you, if you observe that someone has accessed your account, to immediately change your password and contact us.
9. Update Privacy Policy
Optimile is entitled to update this Privacy Policy by posting a new version on the Websites, the Platform and the App whereby Optimile will indicate the revision date at the top of the first page of this Privacy Policy. As such, it is strongly recommended to regularly consult the Websites, the Platform and the App and more specifically the page displaying the Privacy Policy, to make sure that you are aware of any changes. You can always consult the previous privacy policy via the link on top of this privacy policy . Hence, you can check the differences compared to the current privacy policy.
10. Other websites
The Websites may potentially contain hyperlinks to other websites. When you click on one of these links, you may be redirected to another website or internet source that could collect information about you through cookies or other tracking technologies. Optimile does not bear any responsibility, liability or control authority over these other websites or internet resources, nor about their collection, use and disclosure of your Personal Data. You must check the privacy statements of these other websites and internet sources in order to be able to judge whether they act in accordance with the Privacy Legislation.
11. Contact Optimile
If you have questions and/or remarks about this Privacy Policy or the manner in which Optimile collects, uses and/or processes your Personal Data, please contact us:
- Via email: info@optimile.eu, info@mobiflow.be;
- Via the phone number mentioned on the Platform.
12. Complaints
You are not satisfied with the manner in which we collect, store or otherwise treat or secure your Personal Data? We are sorry to hear that, and are prepared to take all measures to remedy this situation. Please do contact us as specified above in Article 11.
You also have the right to lodge a complaint with the authorized supervisory authority (either the Belgian Data Protection Authority or the data protection authority of (i) your residence or (ii) your workplace) should you consider that the processing of your Personal Data infringes the Privacy Legislation. You can send an email to the Belgian Data Protection Authority at contact@apd-gba.be or any other email address provided by the Belgian Data Protection Authority (https://www.dataprotectionauthority.be/contact-us).