Last updated: 12 May 2022
Reby Rides, S.L. is a company that provides mobility services, including the aggregation of vehicles from different operators. As a consequence of this mobility aggregation service, Reby Rides, S.L. manages the different journeys requested by users, both through its own vehicles and the vehicles provided by third party operators. In order to comply with the regulations in force regarding data protection and to guarantee a correct use and treatment of personal data, Reby Rides, S.L. describes below the different data treatments carried out for the effective provision of its services.
1. Information related to the mobility service
1. 1. Responsible of the data treatment
The responsible of the data treatment is Reby Rides, S.L. ("REBY"), with tax identification number B- 67301473. REBY's contact details are as follows:
- Postal address: Av. Josep Tarradellas, 123, 6ª, 08029, Barcelona.
- E-mail: firstname.lastname@example.org
The Interested Party is informed that REBY has designated a Data Protection Officer (DPO) to whom it may refer any questions concerning the processing of his/her personal data. The interested party may contact the Data Protection Officer through the following contact details:
- Postal address: Av. Meridiana, 358  4º A-B (Torres Hipercor) 08027 Barcelona, Spain
- E-mail: email@example.com
1.2. For what purposes do we treat personal data?
The personal data of the data subject are processed for the purpose of managing the contractual relationship and providing the contracted services. Within this management and development of the contracted services, the main data processing operations that will be carried out are:
- Management of the user's account, for the maintenance of the contractual relationship, including the booking of vehicles and management of journeys, possible changes to the account, list of historical journeys, payment of the service, communications for the resolution of doubts or incidents, etc.
- Identification,through a "Selfie" photograph of the users of the Reby service for the validation of the ID/Passport and Driver's License documents provided.
- Geolocation, for the effective provision of services. Taking into account the type of mobility service provided, this is a necessary and essential treatment. Despite this, REBY offers the interested party different configuration options, although it is true that if the interested party does not wish to accept this processing, the mobility service cannot be carried out.
- Carrying out user surveys in order to improve the services offered.
In addition, the data may be processed in order to create a user profile, based on the number and type of incidents presented by each user related to the use of the service. The consequence of this decision could be the termination of the contract and the prohibition of a new registration by the interested party for a certain period of time. For this specific treatment, REBY has implemented all applicable safeguards, including the possibility to obtain the right to human intervention and to receive a reasoned explanation of the decision taken, by contacting the following e-mail address: firstname.lastname@example.org.
REBY is also interested in being able to carry out statistical studies on mobility and the use of the vehicles made available in all cities. To this end, REBY will anonymise the data in accordance with the standards set out in the data protection regulations and will subsequently use them only for statistical purposes.
Finally, the personal data of the interested party may be processed for sending information and communication of commercial promotions regarding the services contracted and requests for participation in opinion surveys.
When the data subject uses REBY's services as an employee of our corporate clients, the data on the use of the service may be used to inform the corresponding corporate client of the details of the journeys made, as well as the costs associated with them in order for the client to know how the service is actually being used by its employees. We recommend that the interested party access the privacy policies of the corporate client providing the service to obtain more information about the processing of their personal data by said company, organization, or entity.
1.3. How long do we keep the data?
The personal data provided by the data subject shall be retained for the duration of the contract concluded between the data subject and REBY and, upon its termination, shall be blocked until the applicable statute of limitations expires. Once this period has elapsed, they shall be deleted definitively.
In the event that the data subject has consented to its processing, until the data subject withdraws it, at which point it will be blocked until the applicable limitation periods have elapsed. Once these periods have elapsed, the data will be definitively deleted.
1.4. What legitimizes us to process the data?
Finally, the legal basis for the processing of data for the sending of information and communication of commercial promotions regarding the contracted services is the prior and unequivocal consent of the interested party.
1.5. To which recipients may we communicate the data?
The data subject's personal data may be disclosed to the following recipients:
- REBY Group companies located within the European Economic Area, for administrative purposes within the REBY Group.
- Public administrations, when so established by an applicable legal provision; in particular, traffic authorities, for purposes of driver identification in case of infringement and Courts and Tribunals when necessary or mandatory.
- Insurance companies and other related companies, when necessary to process a claim.
- Suppliers who provide services to REBY related to the management of the formalized contract and who have the status of data processors. In any case, third parties with whom certain personal data of the data subject is shared will have previously accredited the adoption of adequate measures for the correct protection of the data.
- Mobility operators with which REBY has signed a collaboration agreement when consent has been obtained.
- Payment entities: User payments willbe managed securely through the entity Stripe Spain, S.L., with address at Zurbarán Street, 9-LOC DR, Madrid, CP 28010, Madrid, Identification B88501820. Under no circumstances will Users' personal data be used for their own purposes or for purposes other than the payment management entrusted by Reby, which has a data processor contract signed with this entity for this purpose.
- Where the data subject uses the services of REBY as an employee of our corporate clients, the data relating to the use of the vehicles (details of the journey made and associated costs) may be communicated to and accessed by the corporate client of which the data subject is an employee by virtue of the contract concluded between REBY and the corporate client in the interest of the data subject.
1.6. What are the rights of data subjects in relation to the data they provide us with?
Any person has the right to obtain confirmation as to whether we are processing personal data concerning him/her. Interested parties have the right to access their personal data, as well as to request the rectification of inaccurate data or, where appropriate, to request its deletion when, among other reasons, the data is no longer necessary for the purposes for which it was collected.
In certain cases, the data subject shall have the right to request the limitation of the processing of his/her data, in which case we shall only keep them for the exercise or defence of claims.
In certain circumstances and for reasons relating to their particular situation, data subjects may object to the processing of their data. In such a case, REBY will cease to process the data, except for compelling legitimate reasons or for the exercise or defence of possible claims.
In any of the above cases, REBY will communicate any rectification or erasure of personal data, as well as any limitation of processing carried out to each of the recipients to whom the personal data have been communicated, unless it is or requires a disproportionate effort. If the data subject so requests, REBY shall inform him or her of these recipients.
The data subject shall also have the right to receive the personal data concerning him or her that he or she has provided to REBY in a structured, commonly used, machine-readable format and to transfer this data to another controller where the processing is based on consent or a contract and is carried out by automated means.
The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to personal data relating to him or her being processed on the basis of legitimate interest by REBY, including profiling, in order for REBY to stop processing the personal data, unless REBY can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of claims.
Likewise, the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on him/her or significantly affects him/her, unless this decision proves necessary for the conclusion or performance of a contract with REBY and is authorized by current European or national law.
The aforementioned rights of access, rectification, deletion, opposition, portability and limitation, as well as the right not to be subject to automated individual decisions and to withdraw consent, may be exercised via the following e-mail address: email@example.com
Finally, the data subject shall have the right to lodge a complaint with the data protection authorities (www.aepd.es).
1.7. How do we obtain the data?
The personal data that we process comes from the data subject through their registration in the App and the use of our services.
The categories of data processed are as follows:
- Identification data (full name, ID card or passport).
- Driving licence
- "Selfie" photography for user identification
- E-mail address
- Financial data or Token (partial data of the means of payment provided by the user). REBY will not process financial data or tokens if the data subject uses the services as an employee of our corporate clients.
In addition, during the provision of the mobility service, REBY may collect data generated during the use of the mobility service. For the purposes described above, REBY does not process specially protected data.
2. Information related to the aggregation service
In addition to the mobility service, REBY provides an aggregation service for other mobility operators, with the sole purpose of facilitating mobility in a quick and easy way for all users in the cities where we are located ("Mobility Aggregation Service"). For more information about the Mobility Aggregation Service, please refer to our Terms and Conditions.
For the purposes of data protection, REBY acts as data processor for the data of third party operators who have contracted its aggregation service and carries out the management of the user's account for the maintenance of the contractual relationship, including the reservation of vehicles and management of journeys, possible changes to the account, list of historical journeys, payment for the service, etc.
In the event that the user chooses to contract a mobility service from a third party operator through REBY's Mobility Aggregation Service, the user will have the option of allowing REBY to communicate the registration data it has, to the third party operator which, where applicable, acts as data controller, in order to facilitate the registration process.
The registration data communicated to the operator shall be as follows:
- First name
- Date of birth
- E-mail address
- Validation status of the ID card/passport and driving license
Incase the ID/Passport documents are duly validated with Reby, they will also becommunicated to the operator.
Below is the name of the mobility operators to which we provide our aggregation service, together with a link to the terms and conditions and privacy policies that apply to their users: