Alphabet Logo

Privacy Statement Carbon Tracker

Privacy statement

In this privacy statement, we explain what data we process, for what purposes it is used and what your rights are under the GDPR when using the Alphabet Carbon Tracker (hereinafter: Carbon Tracker), who is responsible for processing your personal data and what your rights are.

Data controller

Under the General Data Protection Regulation (GDPR), BMW Financial Services Nederland B.V. (h.o.d.n. Alphabet), located at Takkebijsters 59, 4802 HW Breda, is responsible for processing your personal data. Our Partner is Fynch Mobility, which is a trademark of Businessconcern B.V., located at Europalaan 500, Utrecht zip code and registered with the Chamber of Commerce under number 30204129.

Our Partner can also act as a processor (when your data is processed on behalf of a third party such as your employer) or controller (if you decide to use the Carbon Tracker yourself).

Applicability

This privacy statement applies to all privacy-sensitive information or personal data that our Partner receives from our clients and users via the Carbon Tracker platform tool. It is also possible that you provide us with personal data directly, for example by sending an email or filling out a contact form.

We attach importance to the privacy of our clients and users, so that we treat and protect personal data with the utmost care. All employees have signed a confidentiality agreement and are trained to handle confidential information with care. We process data in accordance with the conditions set out in the General Data Protection Regulation (GDPR).

When do we process personal data

In many cases, we instruct our Partner to process personal data for our client. These are usually clients who have concluded a contract with us to use the Carbon Tracker for their staff or that of their customers.

Our Partner can receive personal data in two different ways:

 1. From the client (your employer).

2. Or directly from yourself.

Our Partner only retrieves information from the client that is relevant to the purpose for which the app is used, such as an employee number when this is necessary to prepare the claim file. In these cases, our client is the controller within the meaning of the GDPR and our Partner is the processor.



You may have an employment relationship or contract with our client, on the basis of which you can use the Carbon Tracker. This client is responsible for ensuring that your personal data is processed properly and carefully and in accordance with the GDPR. We also recommend that you review the privacy policy of our client with whom you have an employment relationship or contract. It is also possible that we process your personal data not on behalf but independently, for example when you visit our website, use the Carbon Tracker independently or fill out a contact form. In that case, our Partner is responsible for processing within the meaning of the GDPR. Our Partner only processes your personal data if this is necessary for the execution of an agreement to which you are a party, or if the processing is necessary for our Partner's legitimate interest. In addition, our Partner may be legally obliged to process your personal data.

Overview of personal data that we can process

Below is an overview of the personal data that our Partner may be able to process about you. Partner does not always have access to all the information listed below; this depends on the product you use and possibly the agreement with our client.

  • First and last name
  • E-mail address
  • IP address of a website visitor
  • Vehicle registration number (always optional)
  • Mobility data
  • Start and end date and trip time
  • Trip start and end location
  • Route
  • Mode of transport
  • Travel time and distance
  • Purpose (commuting, private, business)
  • Home address and nearest station for calculating fixed commuting distance
  • Employer information such as employer name, employee number, department name
  • Data from mobility cards such as the NS Businesscard

Purposes of personal data processing

Our Partner processes your personal data for sufficient purposes, depending on the product you use:

  • Analyzing driving and traveling behavior of users of our software to provide insight into CO2 footprint and vitality;
  • Facilitating the administration of travel and home working days in order to be able to submit travel and home work cost claims to the employer;
  • Reporting aggregated information to the client, for example the total CO2 footprint of all employees;
  • Give users the opportunity to create an account and then access personal information;
  • Informing the client and user about changes to our products and services;
  • To contact the user via email when necessary for the performance of the service, such as sending a reward purchased in the Carbon tracker Reward Shop.

Retention period

Our Partner does not store your personal data longer than is strictly necessary to achieve the purposes for which your data is collected, unless we are legally obliged to keep certain data longer.

security

Together with the Partner, we protect your personal data and take measures against misuse, unauthorized access, disclosure, alteration and destruction. The Carbon tracker's system environment is digitally secured in accordance with prescribed guidelines and is ISO 27001 certified. The personal data is stored and processed in a well-secured data center in Western Europe.

Provision to third parties

The Partner only provides personal data to third parties, such as our client, on the basis of the user's explicit consent or when this is necessary or justified in the context of the purpose of the Carbon Tracker. This includes submitting an invoice, after which the required information is shared with the employer, or agreeing to additional participation conditions in a project or campaign.

  • Provision to others than the client only takes place when this is necessary for an agreement concluded with you, to represent a legitimate interest of us and our Partner, or to comply with any legal obligation that we are subject to.
  • With companies that process your data on behalf of our Partner, such as a hosting company, our Partner enters into an agreement to ensure the same level of security and confidentiality as we and our Partner maintain. Our Partner remains responsible for these processing operations.
  • Our Partner can also use anonymized data to make general analyses, for example about sustainable travel behavior, that are relevant to a wider audience. The results will only be published or shared if the data cannot be linked in any way to an identifiable person.
  • Your personal data can be used for market research and optimization of our services. In this context, the personal data is also anonymized and can never be traced back.
  • We will never sell or share your personal data with third parties for commercial purposes.

Cookies

A cookie is a small file that is stored on your computer, tablet or smartphone when you visit our website. If you don't want this, you can change this in your browser. Even previously stored information can be easily deleted via the browser.



Our Partner uses the following cookies:

Functional cookies. These are necessary for the technical functioning of the website and your ease of use. These analytical cookies do not infringe your privacy, so we do not require your consent.



Your rights

View, correct or delete

You have the right to view, correct, delete or restrict processing personal data. In addition, you have the right to withdraw any consent to the processing or to object to the processing of your personal data. If our client is the controller, we cannot independently decide on your request. In this case, we will communicate the request to the controller as soon as possible.

If we are no longer allowed to process your data, this may have adverse consequences for the use of the application (s). In the worst case, this request or objection may mean that it is no longer possible to use our products or services. If participation is no longer possible, we are obliged to report this to the client.

Data portability

You have the right to data portability (data portability), but only if we have personal data that we process with your consent, or process it to execute an agreement that we have concluded with you. Data portability means that you can submit a request to us to share the digital personal data that we hold about you in a readable computer file with you or an organization appointed by you.

Contact

You can send a request for access, correction, deletion or data transfer, or a request for withdrawal of consent or an objection to the processing of your personal data to data_privacy@bmw.nl. We will respond to your request as quickly as possible, but no later than 4 weeks. If we need more time for your request, we will let you know.

Automated decision making

The Carbon Tracker can make decisions based on automated processing on matters that may have consequences for people. These are decisions taken by computer programs or systems, without involving a person (e.g. an employee). This mainly involves the use of automatic trip registration, which estimates which route you have traveled and with which mode of transport based on GPS and movement data. In some cases, automatic labeling (private, commuting or business) can also be used.

You must check your trips yourself and you are responsible for ensuring that the registered information is correct.

Personal Data Authority Complaints Procedure

Finally, we would like to point out that you have the opportunity to file a complaint with the Data Protection Authority.

Data Protection Authority

 Bezuidenhoutseweg 30

 2594 AV The Hague

 P.O. Box 93374 2509 AJ THE HAGUE