SIXT ride Privacy Policy for Service Providers and Drivers

Definitions

“Customer” shall mean an individual or a legal entity, acting on its own behalf and for its own account with whom the Service Provider will enter into a Service Agreement following a booking request for Transportation Services made by the Customer via the Sixt Platform, also referred to as “User”.

“Driver” shall mean individuals employed or subcontracted by the Service Providers to provide the Transportation Services. Insofar as the Drivers act as independent contractors (i.e. sole entrepreneurs), they are considered both Drivers and Service Providers.

“Driver App” shall mean the SIXT ride’s mobile application made available to Drivers for acceptance, dispatching and/or management of booking requests for Transportation Services.

“Driver Company Portal” shall mean the “self-service” SIXT ride’s website made available to potential and existing Service Providers for the sign-up and management of Service Provider’s user accounts with SIXT ride, acceptance and dispatching of booking requests for Transportation Services, management of Drivers and vehicles, etc.

“Include(s); Including” shall be construed as “without limitation”.

“Service Agreements” shall mean agreements on Transportation Services which are concluded directly between the Service Providers and the Customers.

“Service Provider(s)” shall mean independent transportation service providers registered with SIXT ride for the use of the Driver Company Portal and Driver App for the arrangement of Transportation Services and conclusion of Service Agreements, also referred as “You”.

“Privacy Policy” shall mean this document: “SIXT ride Privacy Policy for Service Providers and Drivers”.

“SIXT App” shall mean the SIXT mobile application publicly available for download in the Apple App Store or Google Play App Store. In the context of this Privacy Policy, SIXT app shall refer to the SIXT ride “tab” within the SIXT App which Customers use to request Transportations Services.

“Sixt Platform” shall collectively mean the SIXT App and the SIXT ride Website.

“SIXT ride Website” shall mean www.sixt.com/ride where Customers may request and arrange Transportations Services.

“Transportation Services” shall mean for-hire chauffeured ground transportation services between two points or for a period of time.

“Passenger” shall mean a person who is actually being transported for whom the User/Customer requested and/or to whom the User/Customer resold the Transportation Services. Insofar as the Passenger is the person who requested the Transportation Services, the Passenger shall also be considered the “Customer” and “User”.

Introduction

This Privacy Policy informs Service Providers and their Drivers, wanting to provide or already providing Transportation Services to SIXT ride’s Users, about what personal data pertaining to them are processed by SIXT ride and for what purpose(s). SIXT ride would also like to inform Service Providers and their Drivers about important legal aspects of data protection, such as their rights.

For the use of SIXT ride Website (www.sixt.com/ride), the SIXT ride’s general privacy policy (www.sixt.com/ride/privacy) applies. For cookies and analytic tools, the SIXT ride’s general cookies policy applies (https://www.sixt.com/ride/cookies).

For Service Providers and Drivers from third-party platforms, such as transportation network companies or taxi dispatch centers, separate privacy policies might apply.

A. Data controller, contact details of the data protection officer

The party responsible for the processing of the data described herein (i.e. the controller) is Sixt Ride GmbH & Co. KG, Zugspitzstraße 1, D-82049 Pullach (hereinafter also referred to as “SIXT ride”).

If you have any questions regarding data protection at SIXT ride, please address your query to the following email address: dataprotection-chauffeur@sixt.com.

You can also contact our data protection officer by writing to the above-stated address (reference: data protection officer).

B. Categories of personal data

Analytics data: these include, for example, unique identifiers (cookie IDs or similar), event data associated with these identifiers, IP addresses, device type, browser and version of the operating system.

Communication data: correspondence between SIXT ride, Service Provider and/or Driver.

Contract data: these include, for example, the business’ or sole entrepreneur’s name, authorized signatory first and last name, registered address, VAT or equivalent tax ID, business telephone number and email address, and bank account details. Contract data also include any supporting documents such as business registrations, permits, etc.

Dispatcher/contact person data: these include, for example, first and last name, gender, telephone number and email address.

Driver data: these include, for example, first and last name, gender, telephone number, email address, location data, profile picture (i.e. selfie) and Driver License and/or Chauffeur Permit.

Vehicle data: these include, for example, vehicle license plate, make and model, year of manufacture, as well as all supporting documents such as vehicle registration, inspection and insurance.

Voluntary data: these are data that are provided to SIXT ride on a voluntary basis, without SIXT ride having explicitly requested them, and include information such as the Service Provider’s website and service area.

C. The legal basis for data processing at SIXT ride

Art. 6 (1) sentence 1 point a) of the General Data Protection Regulation (GDPR): pursuant to this provision, the processing of personal data is lawful if and to the extent that the data subject has given his/her consent to such processing.

Art. 6 (1) sentence 1 point b) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (e.g. arrangement of transportation service agreements between Service Providers and SIXT ride’s users).

Art. 6 (1) sentence 1 point c) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for compliance with a legal obligation to which SIXT ride is subject.

Art. 6 (1) sentence 1 point f) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the purposes of the legitimate interests pursued by the controller, i.e., SIXT ride, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

D. The purposes of data processing at SIXT ride

D.1 Signing up as a Service Provider and Service Provider user account creation for Driver Company Portal

Purpose

Personal data will be processed during the application process to become part of the SIXT ride’s network as a Service Provider. The application process is the process immediately preceding the conclusion of a contractual relationship between SIXT ride and the Service Provider for the use of the Driver Company Portal and Driver App and the arrangement Service Agreements. The application process serves the purpose of determining whether or not you are suitable to provide Transportation Service.

You will be asked to provide information pertaining to your business activity which may contain personal data or be used to identify an individual, such as your:

Business’ or sole entrepreneur’s name;
Registered address;
Telephone number;
Email address;
VAT or equivalent local tax ID;
Bank account details; and
Legal representative’s first and last name, phone number and email address.

During the application process, this information is needed to establish who our counterparty is, and whether our potential counterparty is in good standing and has all legal and contractual prerequisites to provide Transportation Service in a given market.

If your application is successful, a contractual relationship is established between SIXT ride and the Service Provider on the basis of the data provided, and the aforementioned data will also serve the following purposes:

Create an account for the Service Provider to use the Driver Company Portal to give access to Service Providers to services and features available only in the Driver Company Portal, such as acceptance and dispatching of rides, assigning vehicles and drivers to accepted rides, adding new drivers and vehicles to their account, uploading supporting documents, etc.;
Arrangement of Service Agreements, which are concluded between Customers and Service Providers directly;
If applicable, the issuance of invoices by SIXT ride in the name and on behalf of the Service Provider to Customers after completion of the Transportation Services/Service Agreement;
Payment of completed Transportation Services/Service Agreement arranged by SIXT ride; and
Correspondence and legal notices.

Legal basis for the above processing

Art. 6 (1) sentence 1 point b) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (e.g. concluding a contractual relationship between SIXT ride and the Service Provider and arranging transportation service agreements between Users and Service Providers).

D.2 SIXT ride due diligence

Purpose

During the application process described in D.1, for the duration of the contractual relationship between SIXT ride and the Service Provider, and for as long as necessary for the purposes for which they were collected or otherwise processed, SIXT ride will store and process documents which may contain personal data or be used to identify an individual.

As part of SIXT ride’s duty of care towards its Users who book Transportation Services via the SIXT Platform, SIXT ride will require Service Providers to provide supporting documents that allow SIXT ride to confirm their compliance with local legal requirements for the provision of Transportation Services.

SIXT ride’s due diligence must be ongoing, as Service Providers must be legally compliant at all times for as long as they can accept and perform rides booked by SIXT ride’s Users. For that reasons, not only does SIXT ride request supporting documents during the application process, but also after a contractual relationship is established between SIXT ride and the Service Provider. In particular, SIXT ride requests updated/valid documents once those stored have expired.

Generally speaking, SIXT ride may request the following documents for the following purposes:

Business level documents:

Business registration, in order to know if a business exists and is in good standing, and also to confirm who is the authorized signatory/legal representative;
Business Operator Permit (if required by applicable law), in order to know if a business is licensed to operate a Transportation Services business;
Industry-specific insurance policies (if required by applicable law), in order to know if a business is properly insured to operate a Transportation Services business;

Vehicle level documents:

Vehicle registration, in order to know to whom the vehicle belongs;
Vehicle periodic inspection report, in order to know if the vehicle conforms to local regulations governing safety standards;
Vehicle insurance policy, in order to know if the vehicle is properly insured in the event of an automobile accident;
Vehicle for-hire permit (if required by applicable law), in order to know if the vehicle is licensed to provide Transportation Services;

Driver level documents:

Driver profile picture (selfie), in order to allow Passengers to match the driver assigned to the ride with the driver actually deployed by the Service Provider;
Driver license, in order to know if a driver is licensed and qualified to operate a vehicle;
Chauffeur permit (if required by applicable law), in order to know if a driver is licensed to provide Transportation Services.

However, if a chauffeur permit is required by applicable law and a valid driver license is a prerequisite for the issuance of that permit, SIXT ride will not request a copy of the driver license (in accordance with the principle of data minimization in article 5(1)(c) of the GDPR).

Legal basis for the above processing

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

SIXT ride’s Customers have a reasonable expectation that SIXT ride makes best efforts to confirm that Service Providers, and the Drivers and vehicles they deploy, are properly licensed and insured to provide Transportation Services in order to ensure their (i.e. the Passengers’) safety and security.

D.3 Dispatcher account creation for use of Driver Company Portal

Purpose

During the application process and after the contractual relationship is already established between SIXT ride and the Service Provider, the Service Provider can request SIXT ride to create user account(s) for the use of the Driver Company Portal. The purpose of this user account is to give access to Service Providers, and their personnel, to services and features available only in the Driver Company Portal, such as acceptance and dispatching of rides, assigning vehicles and drivers to accepted rides, adding new drivers and vehicles to their account, uploading supporting documents, etc.

This type of user account will automatically be assigned the role of “dispatcher” in Driver Company Portal. The personal data collected and processed for this purpose includes the user’s:

First and last name;
Gender;
Mobile telephone number; and
Email address.

Additionally, the following information is collected:

Role (i.e. privileges attributed to the user); and
Languages spoken.

Service Providers may add/create, at any time, as many dispatcher user accounts as they wish.

Dispatchers can log-in to the Driver Company Portal using the mobile telephone number associated to the user account. A 4-digit pin will be generated and sent by text message to the phone number provided.

Legal basis for the above processing

Art. 6 (1) sentence 1 point b) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the performance of a contract to which you are party, or in order to take steps at your request prior to entering into a contract (e.g. concluding a contractual relationship between SIXT ride and the Service Provider, use of Driver Company Portal, acceptance and arrangement of transportation service agreements between Users and Service Providers).

D.4 Driver account creation for use of Driver App

Purpose

During the application process and after the contractual relationship is already established between SIXT ride and the Service Provider, the Service Provider can request SIXT ride to create user account(s) for the use of the Driver App. The purpose of this user account is to give access to Service Providers’ Drivers to services and features available only in the Driver app, such as seeing rides assigned to them, starting and completing de ride, etc.

This type of user account will automatically be assigned the role of “driver” in Driver Company Portal. The personal data collected and processed for this purpose includes the user’s:

First and last name;
Gender;
Mobile telephone number; and
Email address, if applicable.

Additionally, the following information is collected:

Role (i.e. privileges attributed to the user); and
Languages spoken.

Service Providers may add/create, at any time, as many Driver user accounts as they wish. Drivers can log-in to the Driver App using the mobile telephone number associated to the user account. A 4-digit pin will be generated and sent by text message to the number provided. Driver user accounts do not have access to the Driver Company Portal, unless they are also given the role of Dispatcher.

Additionally, these data are also processed for the purpose of informing the User (and/or Passenger) about the details of the Driver that has been assigned to a ride. In particular, SIXT ride shares with the User the Driver’s first and last name, telephone number, profile picture (if applicable) and location data. These data aim to ensure a smoother pick-up and the safety of the Passenger.

For the purpose and legal basis of data processing of Driver’s profile picture and driver license/chauffeur permit, please see D.2 SIXT ride due diligence. For the purpose and legal basis of Driver’s location data processing, please see D.6 GPS tracking.

Legal basis for the above processing

D.5 Vehicle data

Purpose

During the application process and after the contractual relationship is already established between SIXT ride and the Service Provider, the Service Provider (or its personnel (i.e. Dispatchers)) can request SIXT ride to add vehicles to their Service Provider’s account on the Driver Company Portal. For that purpose, SIXT ride will store and process data which may contain personal data or be used to identify an individual.

In particular, SIXT ride collects and processes the following vehicle data:

Vehicle’s license plate;
Vehicle’s make and model;
Vehicle’s color;
Vehicle’s year of manufacture; and
Vehicle’s seat type.

The purpose of vehicle data processing is to assign a particular vehicle to a specific internal vehicle class category. Vehicles assigned a certain vehicle class may perform rides for booking requests of their vehicle class or lower. Additionally, SIXT ride shares these data with users (and/or passengers) in order to inform them about the vehicle assigned to their ride, and to ensure a smooth pick-up and the safety of the user/passenger.

For the purpose and legal basis of data processing of vehicle’s documents (e.g. vehicle registration, inspection and insurance), please see D.2 SIXT ride due diligence.

Legal basis for the above processing

D.6 GPS tracking

Purpose

SIXT ride processes location data of Drivers whenever the Driver App is running on the Driver’s mobile phone, either in the foreground (open and visible on the screen) or in the background (app is activated, but not visible on the screen). Alternatively, the telematics in the vehicle the Driver is driving will provide SIXT ride with location data (depending on his/her employer’s technical set-up).

SIXT ride uses location data do coordinate User’s booking requests with Drivers by matching the best suitable Driver (in respect to actual location) in order to reduce the Passenger’s waiting time. Furthermore, Customer/Passenger and Driver can locate each other more easily.

SIXT ride also uses location data to find the best route in terms of time, the estimated price of the ride, the estimated arrival time at the destination and the route distance.

SIXT ride’s Users can also use the SIXT App to trace the current location, route and estimated arrival time of the booked vehicle at the agreed pick-up location. The location data are also used to provide the Driver with navigation assistance, real-time traffic information and, if required, to determine the best available alternative route.

SIXT ride may also use location data to calculate the actual price for the Transportation Service after the ride has been completed.

SIXT ride may also use location data to prevent fraudulent behavior and to ensure that Drivers do not deliberately use longer routes to increase the invoice amount. The data may also be used to process unjustified User/Customer claims by evidencing that the actual route taken when providing the Transportation Services was correct and justifiable.

Location data may also be used to determine the time period (between the arrival at the agreed pick-up location and the arrival at the destination) for which insurance is taken out for a particular Transportation Service.

Finally, location data may also be used to offer User/Customer location-related services and for Customer marketing measures.

Legal basis for the above processing

Art. 6 (1) sentence 1 point b) GDPR: insofar as the Driver is a Service Provider, pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the performance of a contract to which the Service Provider is party, or in order to take steps at its request prior to entering into a contract (applies to the processing of data in order to perform a contract with a customer).

Art. 6 (1) sentence 1 point f) GDPR: insofar as the Driver is not a Service Provider, pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the purposes of the legitimate interests pursued by the controller, i.e., SIXT ride, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (applies to the processing of data to the extent required to settle accounts vis-à-vis third parties, to assert our own claims, and to mitigate risks and prevent fraud).

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

SIXT ride’s legitimate interest in processing personal data for the aforementioned purposes lies in offering the Customers, Service Providers and Drivers with features that provide them with a better user-experience of the Sixt Platform, including smoother pick-up, booking request matching and information on estimated time of arrival. Additionally, these data are used for Service Agreement’s price calculation and/or estimation, fraud prevention, dispute resolution and so on.

D.7 Performance data

Purpose

D.7.1 SIXT ride key performance indicators

SIXT ride processes data related with the Service Provider’s performance. Among the key performance indicators that SIXT ride processes are:

Customer’s ratings of Service Provider’s Drivers and vehicles (cf. → D.7.2 User/Customer ratings; favorite Driver); and
Service Provider’s compliance with SIXT ride’s quality standards (e.g. percentage of rides confirmed and completed on time, trackable).

This information may be used as grounds to reward Service Providers that perform above average and penalize and/or deactivate those that perform below average.

D.7.2 User/Customer ratings; favorite Driver

SIXT ride’s Users can rate the Driver and vehicle after the Transportation Service is completed with a score between 1 and 5 starts (5 being the best score, 1 being the worse). Users can also leave a comment. The rating will then be associated with a specific Service Agreement, as well as the Service Provider’s and/or Driver’s user accounts. Comments left from Users are for SIXT ride’s and the Service Provider’s internal use only. When a Driver is dispatched to a booking request, his/her average rating may be shared with the User who requested the Transportation Services.

User’s ratings and feedback may be used as grounds for penalizing and/or deactivating Service Providers, Drivers and/or vehicles with low ratings or that otherwise violated the Sixt ride’s terms and conditions for Service Providers.

Additionally, Users can add Drivers as favorite Drivers in their SIXT ride’s user account. In this context, the Driver’s first and last name, profile picture (i.e. selfie) and rating will be saved on the Sixt Platform user account of the respective User/Customer.

Legal basis for the above processing

Art. 6 (1) sentence 1 point b) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the performance of a contract to which the Service Provider is party, or in order to take steps at its request prior to entering into a contract (applies to the processing of data in order to implement the contractual stipulations between SIXT ride and the Service Provider, such as the application of penalties due to breach of contract).

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

SIXT ride’s legitimate interest in the processing of performance data is the safeguard of Customer’s satisfaction through quality control and the provision of standardized user-experience. A satisfied Customer will return to the SIXT Platform and continue booking with SIXT ride, consequently also benefiting Service Providers that perform well.

D.8 Communication data

Purpose

SIXT ride processes correspondence data such as phone calls, text messages, emails contact forms, every time SIXT ride contacts the Service Provider and/or the Driver or the Service Provider and/or Driver contacts SIXT ride. The data exchanges between the parties will be processed to handle the particular issue or question thar cause the interaction. SIXT ride might use external services and tools to communicate with Service Providers and Drivers.

Legal basis for the above processing

Art. 6 (1) sentence 1 point b) GDPR: pursuant to this provision, the processing of personal data is lawful if such processing is necessary for the performance of a contract to which the Service Provider is party, or in order to take steps at its request prior to entering into a contract (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. operational issues regarding a Service Agreement or question about the contractual relationship between SIXT ride and the Service Provider).

D.9 Analytics data

Purpose

The Driver Company Portal uses “cookies”, the Driver App uses equivalent analytics tools. Cookies are small text files that are copied from a web server onto the user’s hard disk. Cookies contain information that can later be read by a web server within the domain in which the cookie was assigned to the user. Cookies cannot execute any programs or infect the user’s computer with viruses. The cookies used by SIXT ride do not contain personal data that can be directly linked to individuals.. Tracking tools store data about the use of the app either in the app itself or they transmit (anonymized or pseudonymized) usage evaluations to the operator of the app. The main purpose of cookies used by SIXT ride is to keep the user logged-in (i.e. avoid automatic log-off from the Driver Company Portal and Driver App).

Further information on cookies and on deactivating them can be found in the cookie policy of the respective website (accessible via the link in the respective cookie banner and under the menu item “Cookie Policy”, https://www.sixt.com/ride/cookies).

Legal basis for the above processing

n Art. 6 (1) (a) (for cookies that are not necessary for the technical operation of the website/app) and f) GDPR (for cookies that are necessary for the technical operation of the website/app), if personal processing operations are performed.

Legitimate interest, to the extent that Art. 6 (1) point f) GDPR applies to the type of processing concerned

SIXT ride’s legitimate interest in processing these data via the Driver Company Portal and Driver App lies in SIXT ride’s desire to optimize the Service Provider’s and Driver’s user-experience.

E. Transfer to third countries

SIXT ride might transfer Service Provider’s, Driver’s and vehicle’s data to cooperation partners located outside the EU/EEA (e.g. brokers, intermediaries, travel agencies, online booking engines/systems, etc.). SIXT ride has agreements with certain cooperation partners located outside the EU/EEA that either: a) allow their customers to book Transportation Services with SIXT ride; or b) allow these cooperation partners to book Transportation Services on behalf of their customers. In these cases, SIXT ride will transfer Service Provider’s, Driver’s and Vehicle’s data to the cooperation partner in the third country on the basis of an adequate decision according to Art. 45 of GDPR or on the basis of the requirements of Art. 49 (1) (b) or (c) GDPR, insofar as the transfer is necessary to conduct pre-contractual or contractual provisions entered into by the Service Provider.

In all other cases, the transfer of personal data to a third country is based on an adequacy decision by the European Commission or appropriate safeguards as per Art. 46 (2) GDPR. In particular, as per Art. 46 (2) (c) GDPR, SIXT ride will sign the European Commission’s standard data protection clauses with data controllers and processors based in third countries where no adequacy decision exists. Service Providers and Drivers can request copies of the aforementioned safeguards from SIXT ride by writing to the address specified above (cf. → A. Data controller, contact details of data protection officer). Third countries are countries outside the European Economic Area. The European Economic Area comprises all countries of the European Union as well as the countries of the so-called European Free Trade Association, which are Norway, Iceland and Liechtenstein.

F. Categories of recipients

SIXT ride stores data in data centers located in the EU/EEA. While no data is stored outside the EU/EEA, some Sixt SE Group Entities might have access to SIXT ride’s data outside the EU/EEA.

SIXT ride may disclose Service Provider’s and Driver’s data to the following recipients for the purposes named above (in particular to inform Customers and/or Passengers about the Service Provider which has accepted their request for transportation services and who will be the Driver and which will be the vehicle picking them up): Users/Customer, Passengers, financial/payment service providers (e.g. Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, The Netherlands - https://www.adyen.com/policies-and-disclaimer/privacy-policy), risk prevention service providers, SIXT Group companies, IT services and cooperation partners (e.g. brokers, intermediaries, travel agencies, etc.).

Service Provider’s data from unsuccessful or incomplete applications will generally not be forwarded to external parties. Documents provided by the Service Provider will also generally not be forwarded to external parties, unless there is an additional legitimate need or reason to share the data with external parties (i.e. court order).

G. Duration of storage

SIXT ride stores Service Providers’ and Drivers’ personal data until they are no longer necessary in relation to the purposes for which they were collected or otherwise processed (cf. → D. Purposes of data processing at SIXT ride).

SIXT ride will generally delete the Service Provider’ application data, including Driver and vehicle data submitted during the application process, if the application is not successful or remains incomplete after 3 months of respectively a) SIXT ride’s rejection of the Service Provider’s application; or b) the Service Provider’s last interaction with the Driver Company Portal, unless there is an additional need or reason to store the data longer.

SIXT ride will generally delete the Service Provider’s data, including Driver and vehicle data associated with the Service Provider’s account on the Driver Company Portal, if the Service Provider remains inactive in the Driver Company Portal for a period of 3 years, unless there is an additional need or reason to store the data longer. The period of 3 years will be calculated from the date of the Service Provider’s last interaction with the Driver Company Portal.

SIXT ride will generally delete the Driver’s data, the Driver remains inactive in the Drier App for a period of 3 years, unless there is an additional need or reason to store the data longer. The period of 3 years will be calculated from the date of the Driver’s last interaction with the Driver App.

An interaction shall mean a log-in, acceptance of rides, assignment of rides, update of documents, etc.

Where SIXT ride is under legal obligation to store personal data, SIXT ride will store personal data for the preservation period stipulated by law. These include statutory periods of limitation, which may be anywhere between three and thirty years. There may also be retention periods stipulated of between six and ten years for tax and commercial reasons under the German Commercial Code and the Tax Code. During this period, Service Provider’s and Driver’s data may be subject to restricted use within day-to-day operations if its processing serves no further purposes.

H. Automated decision making

The aforementioned processing activities do not include any decision making based solely on automated processing pursuant to Art. 22 GDPR.

I. Profiling

SIXT ride sometimes processes data in an automated way with the aim of evaluating certain personal aspects (profiling). We use profiling in the following cases:

Evaluation of the Service Provider’s performance (cf. → D.7 Performance data);
Assigning a certain label/ranking to different clusters of Service Providers;
Automatically assigning certain bookings to a cluster of Service Providers;

Giving preference to a cluster of Service Providers in the acceptance of certain bookings.

J. Rights of data subjects

J.1 Right of access by the data subject, Art. 15 GDPR

Service Providers and Drivers have the right to, at reasonable intervals, obtain information about their personal data under storage. The information they are entitled to includes information about whether or not SIXT ride has stored personal data concerning them, about the categories of personal data concerned, and about the purposes of the processing. Upon request, SIXT ride will provide them with a copy of the personal data that are processed.

J.2 Right to rectification, Art. 16 GDPR

Service Providers and Drivers also have the right to obtain from SIXT ride the rectification of inaccurate personal data concerning them or to have incomplete data completed.

J.3 Right to erasure, Art. 17 GDPR

Service Providers and Drivers furthermore have the right to obtain from SIXT ride the erasure of personal data concerning them. SIXT ride is under obligation to erase personal data in certain circumstances, including if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if either the Service Providers or the Drivers withdraw their consent on which the processing is based, or if the personal data have been processed unlawfully.

J.4 Right to restriction of processing, Art. 18 GDPR

Under certain circumstances, Service Providers and Drivers have the right to have the processing of their personal data restricted. These include circumstances in which their contest the accuracy of their personal data and SIXT ride then has to verify such accuracy. In such cases, SIXT ride must refrain from further processing their personal data, with the exception of storage, until the matter has been clarified.

J.5 Right to data portability, Art. 20 GDPR

Should the Service Provider and/or the Driver opts to change to a different platform, they have the right either to receive, in a machine-readable format, the data that they provided to SIXT ride based on their consent or on a contractual agreement with SIXT ride, or to have SIXT ride transmit, also in a machine readable format, such data to a third party of their choice.

J.6 Right to object, Art. 21 GDPR

Right to object in certain cases

If the processing of the Service Provider and/or Driver data by SIXT ride is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Art. 6 (1) sentence 1 point e) GDPR) or is based on the legitimate interests of SIXT ride (Art. 6 (1) sentence 1 point f) GDPR), then the Service Provider and/or the Driver have the right to object at any time, on grounds relating to your particular situation, to the processing of their data. . SIXT ride will then end the processing, unless SIXT ride can present compelling legitimate grounds for such processing that supersede the grounds for ending the processing.

Right to object against the processing of data for the purposes of direct marketing (as defined by section D, no. 7 of this Privacy Policy)

In individual cases, SIXT ride processes Service Provider’s and Driver’s personal data for direct marketing purposes. Service Providers and Drivers have the right to object to their personal data being processed for the purposes of such marketing activities; this also applies to profiling to the extent that it is associated with such direct marketing. If they object to their data being processed for direct marketing purposes, SIXT ride will no longer process your personal data in this way. Service Providers and Drivers may exercise their right to object without the need to adhere to a particular format and direct it to: Sixt Ride GmbH & Co KG, Zugspitzstraße 1, DE 82049 Pullach or to the e-mail address: dataprotection-chauffeur@sixt.com.

J.7 Right to withdraw, Art. 7 (3) GDPR

If data processing at SIXT ride is based on the Service Provider’s or Driver’s consent, then they have the right to, at any time, withdraw the consent they granted. The withdrawal of consent shall not affect the lawfulness of processing between the time consent was granted and the time it was revoked.

J.8 Contact information to exercise the rights of data subjects

If the Service Provider and/or the Driver wish to exercise their rights as a data subject, they shall direct such requests to the e-mail address: dataprotection-chauffeur@sixt.com.

J.9 Right to lodge a complaint, Art. 77 GDPR

Service Providers and Drivers have the right to lodge a complaint with a supervisory authority (Art.77 GDPR). Service Providers and Drivers can exercise this right before a supervisory authority in the Member State in which they are resident, where their place of work is or the place where the suspected infringement is committed.

In Bavaria, where SIXT ride has its headquarters, the competent supervisory authority is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Promenade 18

D-91522 Ansbach

Germany

K. General Information

We reserve the right to amend and adapt this Privacy Policy with effect for the future.

Current version: August 2021