This privacy notice (“Notice”) applies to the user (“Data Subject”) of the innovative electric propulsion rental service provided by Chara (the “Service”). Its purpose is to explain to the Data Subject the methods, timing, and purposes of the processing of his/her personal data. It also specifies the Data Subject’s rights in relation to the processing of his/her personal data and how he/she can exercise them.

Chara offers this Service by allowing users to rent an electrically propelled velocipede in the appropriate operating area, through prior registration by downloading the application called “Let’s Fò” (hereinafter the “App”) on a mobile device, in accordance with the terms of use available on the App and on the website letsfo.it. In order to make the Service usable, we need to collect and process some personal data of the Data Subject.

Pursuant to art. 4 GDPR, the term “personal data” means any information relating to an identified or identifiable natural person (“Personal Data”).

This Notice is provided solely with reference to the App and not for any third-party websites or applications through which, for example, the Data Subject may access and/or use the App.

To provide our Service, we may collect the following Personal Data for the purposes specified below:

•  name and surname; – gender;
•  email address;
• mobile number;
• identity document or driving license;
• personal photo, possibly uploaded by the user as a “profile photo”;
• information provided to us by third parties (e.g., Apple, Facebook, Google) by logging into the Service through such platforms (i.e., single sign-on, or SSO);
• payment information;
• hourly recordings related to calls to our Customer Service and to the pick-up points of the vehicles (including date, time, and location);
• geolocation information;
• IP address and information about the device used and software (e.g., mobile device configuration information, Internet browser used, third-party applications or platforms used to access our platforms).

Personal data will be processed to ensure the User’s full usability of all the functionalities of the Service offered by Chara and, in particular:

1.  for registering the User for the Service and its use;
2. for managing payments related to the use of the Service;
3. for verifying the correct use of the Service;
4. to keep the User updated on the activities performed in relation to the Service;
5. to respond to the User’s inquiries, to provide all necessary assistance (e.g., support in recovering lost or stolen vehicles, assistance in case of accidents or mishaps, etc.), and for troubleshooting activities;
6. to keep the User informed about new features and improvements of the Service, as well as new offers and promotions available;
7. to allow the exercise of our right of defense in the appropriate venues.

The legal basis for the processing listed from points 1 to 5 above is found in the fulfillment of contractual and/or legal obligations incumbent upon the controller to properly provide the Service.

The legal basis for the processing listed in points 6 and 7 above is found in the legitimate interest of the Controller, respectively, in keeping the User updated on new features of the Service and promotions, as well as in allowing us to properly defend our rights in the appropriate venues.

Regarding the purpose outlined in point number 6, the User may object at any time to the processing by managing their notification preferences within the dedicated section in their personal area of the App, or, for email communications, by following the unsubscribe procedure specified therein. In any case, it is possible to exercise one’s rights as indicated in the “Rights of the User” paragraph.

Regarding the purpose outlined in point number 7, the User may object at any time to the processing and exercise their rights as indicated in the “Rights of the User” paragraph.

The User’s Personal Data will be processed by Chara in compliance with the principles of the Regulation and the applicable privacy legislation, which, among other things, provide that the data themselves must be:

• processed lawfully and fairly;

• collected and recorded for specific, explicit, and legitimate purposes;
• accurate and updated;
• relevant, complete, and not exceeding the purposes of processing.

The processing of Personal Data will take place using tools suitable to guarantee their security and confidentiality and may be carried out, in addition to manual tools, also through automated tools (both computer and telematic) aimed at storing, managing, and transmitting the data themselves.

Some processing of Personal Data may give rise to automated decision-making processes, necessary to prevent fraud or activities that may otherwise harm Chara. In some cases, for example, if a payment fails, the User’s use of the Service may be prevented until the issue is resolved and/or the amount due is paid.

In such cases, the User always has the right to request intervention from our Customer Service, reachable at the email address assistenza@letsfo.it.

We will retain the User’s Personal Data for the time necessary to fulfill the purposes outlined in the previous paragraph “What are the purposes and legal bases of the processing?” and, in any case, in compliance with the deadlines for retaining Personal Data provided for by law.

The aforementioned processing of Personal Data connected and/or instrumental to the provision of the Service may involve the communication of said data to the following categories of recipients, who will process them, depending on the cases, either as data controllers or data processors:

•  Companies belonging to the group;
• Companies, entities, or consortia that provide Chara with payment services, processing services, IT services, or other types of activities instrumental to the provision of the Service;
• Commercial partners;
• Public Administrations or Local Authorities;
• Professionals and studies used by Chara (lawyers, accountants, etc.).

In any case, in the event of mergers, reorganizations, acquisitions, joint ventures, etc., the User’s Personal Data may be transferred to the eventual third parties involved in said operations.

Due to the organizational structure of Chara and in order to provide the best service to the User, we may transfer Personal Data to companies collaborating with the Controller located outside the European Union or the European Economic Area. In such cases, the transfer will be subject to adequate security and data protection guarantees and will take place on the basis of standard contractual clauses negotiated with the company located in the third country, where the latter is not the recipient of an adequacy decision pursuant to art. 45 GDPR.

The User may exercise the following rights at any time:

The Controller may periodically update the Information in light of regulatory changes or legislative amendments. If significant changes are made, we will communicate such changes to the User through the App or by other means, such as via email.

We invite all users to periodically consult this Information to stay updated on our commitment to best protect their privacy.