We process your personal data exclusively in accordance with the statutory provisions. This includes the following categories of personal data: master data (e.g. surname, first name, address, contact details: email address, mobile number, driving licence number, date of birth); bank details (credit card, current account/IBAN).
1. Data controller and data protection officer
The data controller responsible for processing your personal data is SWK Stadtwerke Kaiserslautern Versorgungs-AG. You can contact our Data Protection Officer at the email address datenschutz@swk.-kl.de or on 0631 8001-1200.
2. Purpose and legal basis for the processing of personal data
Car-sharing is the hire of electric vehicles via a platform. Following registration, the user gains access to the booking, provision and use of vehicles.
2.1 Data processing for the purpose of contract initiation and fulfilment (Article 6(1)(b) of the GDPR)
The processing of data is necessary for the initiation, performance and billing of your contract.
2.2 Data processing on the basis of legitimate interests (Article 6(1)(f) of the GDPR)
We process your data in a lawful manner to safeguard our legitimate interests. This also includes the use of your personal data to
- provide you with product information on services relating to electric mobility.
- carry out measures to improve and develop services and products so that we can offer you a personalised approach with bespoke offers and products. (Newsletters containing information on new locations, vehicles, etc.).
- carry out market and opinion research, or have such research carried out by market and opinion research organisations. This enables us to gain an overview of the transparency and quality of our products, services and communications, and to tailor and design them in the best interests of our customers.
- To consult with and exchange data with credit reference agencies (e.g. Schufa, Creditreform) to assess creditworthiness and the risk of payment default, particularly where the conditions set out in Section 31 of the Federal Data Protection Act (BDSG) are met.
- to assert legal claims and to defend ourselves in legal disputes.
- To investigate or prevent criminal offences or administrative offences (e.g. in response to enquiries from investigating authorities regarding accidents or criminal offences, or breaches of the Road Traffic Regulations (STVO)).
- To carry out address enquiries (e.g. in the event of a change of address).
- To use your data in anonymised form for analytical purposes.
Should we wish to process your personal data for a purpose not previously mentioned, we will inform you of this in advance in accordance with the statutory provisions.
2.3 Data processing based on legal requirements (Article 6(1)(c) of the GDPR) or in the public interest (Article 6(1)(e) of the GDPR)
As a company, we are subject to various legal obligations (e.g. tax laws, the German Commercial Code) which require us to process your data in order to comply with the law and to carry out tasks in the public interest.
3. (Categories of) Recipients/Disclosure of personal data/Third countries
Within our organisation, access to your data is granted to those departments that require it to fulfil the purposes set out above (see 2. Purpose and legal bases for the processing of personal data). This also applies to service providers and agents engaged by us. We will only transfer personal data to third parties if this is necessary for the aforementioned purposes or if you have given your prior consent.
Recipients of personal data may include, for example: printing service providers, call centres, analytics specialists, credit reference agencies, metering point and network operators, or debt collection agencies.
Data transfer to SCHUFA
We transfer personal data collected within the framework of this contractual relationship concerning the application for, execution and termination of this business relationship, as well as data relating to non-contractual or fraudulent behaviour, to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden. The legal basis for these transfers is Article 6(1)(b) and Article 6(1)(f) of the General Data Protection Regulation (GDPR). Transfers on the basis of Article 6(1)(f) of the GDPR may only take place insofar as this is necessary to safeguard our legitimate interests or those of third parties and does not override the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. The exchange of data with SCHUFA also serves to fulfil statutory obligations to carry out creditworthiness checks on customers (Sections 505a and 506 of the German Civil Code).
SCHUFA processes the data it receives and also uses it for profiling (scoring) purposes in order to provide its contractual partners in the European Economic Area and Switzerland, as well as, where applicable, other third countries (provided that an adequacy decision has been issued by the European Commission in respect of such countries), with information for, amongst other things, the assessment of the creditworthiness of natural persons. Further information on SCHUFA’s activities can be found in the SCHUFA information sheet pursuant to Article 14 of the GDPR or viewed online at www.schufa.de/datenschutz.]
4. Duration of storage or erasure of personal data
We store your personal data for the purposes set out above (see 2. Purpose and legal bases for the processing of personal data). Your data will be processed from the time of collection, provided that you or a third party have provided it to us. We will delete your personal data once the contractual relationship with you has ended, all mutual claims have been settled and there are no other statutory retention obligations or legal grounds justifying storage. These include, amongst other things, retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO). This means that we will delete your personal data at the latest upon expiry of the statutory retention obligations, which is usually 10 years after the end of the contract.
Data subjects’ rights/your rights
If you have any questions or complaints regarding data protection, please feel free to contact our company, SWK Stadtwerke Kaiserslautern Versorgungs-AG. This includes the right of access under Article 15 of the GDPR, the right to rectification under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to object under Article 21 of the GDPR, and the right to data portability under Article 20 of the GDPR. In addition, you have the option of contacting the relevant supervisory authority.
4.1 Right to object
Where we process data to safeguard our legitimate interests (see 2.2 Data processing on the basis of legitimate interests) or in the public interest (see 2.3 Data processing in the public interest), you have the right to object to such processing at any time on grounds relating to your particular situation. This also includes the right to object to the processing of personal data you have provided.
Within the framework of our business relationship, you must provide the personal data (see Categories of personal data) that is necessary for the establishment and performance of the business relationship and the fulfilment of the associated contractual obligations, or which we are legally obliged to collect. Without this data, we cannot conclude the contract.
5. Automated decision-making
No automated decision-making, including profiling, takes place for the purposes of entering into and performing this contract.
6. Data sources
We process personal data that we receive from our customers in the course of our business relationship. We also process personal data which we are lawfully permitted to obtain from publicly accessible sources, e.g. from debtors’ registers, land registers, commercial and associations registers, the press and the internet. Furthermore, we use personal data which we lawfully receive from companies within our group or from third parties, e.g. credit reference agencies.
7. Amendment clause
As our data processing practices are subject to change, we will also update our privacy policy from time to time. We will inform you of any changes in good time.