Privacy statement Vaigo
This privacy statement applies to anyone (hereinafter “you”) using the Vaigo mobility platform.
Eurides (hereinafter also “we”), located at Martelarenplein 20E, 3000 Leuven, wishes to inform you by
means of this statement why and how we collect and process your personal data.
This statement has been prepared by Eurides to provide as much transparency as possible to anyone
using our mobility platform Vaigo (hereinafter referred to as the “Vaigo platform”) in which Eurides
processes personal data.
Eurides acts as an intermediary between its customers – your employer – and you – the end user – by
offering a tool that allows its customers to offer their employees new, flexible mobility options. In this
role, Eurides processes your personal data mainly for and on behalf of its customers (your employer).
Therefore, Eurides acts as a data processor for most processing activities. Your employer then remains
the data controller.
This statement only applies to the processing of personal data via the Vaigo platform. Should you require more information on the processing of your personal data by your employer, we recommend that youread your employer’s own privacy statement and/or request more information directly from your employer.
This statement has been prepared in accordance with the General Data Protection Regulation (the
“GDPR”).
Definitions
Within this privacy statement, the following terms shall have the following meanings:
Personal Data: any information relating to an identified or identifiable natural person (“data
subject”); an identifiable natural person is considered to be one who can be identified, directly or
indirectly.
Processing: any operation or set of operations which is performed upon personal data or sets of
personal data, whether or not by automated means, such as collection, recording, arranging,
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission,
distribution or otherwise making available, alignment or combination, blocking, erasure or
destruction of data.
Data subject: refers to a person who can be directly or indirectly identified by personal data.
Controller: a natural or juridical person, public authority, agency or other entity which, alone or
jointly with others, determines the purposes and means of processing personal data. For most
processing operations, this is your employer.
Processor: a natural or juridical person, a public authority, an agency or another entity which
processes personal data on behalf of the controller. For most processing operations, this is Eurides.
Third party: a natural or juridical person, a public authority, an agency or another entity, not being
the data subject, nor the controller, nor the processor, nor the persons authorized under the direct
authority of the controller or the processor to process personal data
Data controller and processor
When using the Vaigo platform, Eurides mainly acts as a processor, which means that it collects and
processes your personal data on behalf of its customers (your employer). Your employer, as the
controller, then determines the purposes and means of processing your personal data and we process
your personal data on behalf of your employer.
For some processing activities, Eurides acts as a data controller. To define our roles, we have established an agreement outlining the roles and responsibilities of Eurides and your employer in accordance with the GDPR.
What personal data do we collect?
We may process the following personal data from you – as a processor – to facilitate the Vaigo
platform, facilitate administration within your employer’s company by suggesting flexible mobility
options available within the company, and reimburse you for your costs related to your mobility
choice:
- Identifying data such as: surname, name, gender, employee ID number, etc ..;
- Contact details such as: your (business) email address, home address.
- Information related to your role in the organization: job title, position, category.
- Financial information related to the services these providers provide to you, financial information related to the use of mobility services.
- Location data
- Consumption data such as the information related to your mobility choice and self-reported usage data such as cycling distances.
- Images such as a passport photo.
- Vehicle registration plate.
We do this on behalf of your employer. You can therefore request more information on these processing operations from your employer.
Are these personal data necessary? What are the consequences of
not providing them?
Depending on the service you request, personal data may be required to provide our service and/or to
facilitate the provision of services by external providers (e.g. NMBS, Uber, etc.).
If you do not provide the necessary personal data, we cannot facilitate your employer’s administration
of your mobility-related expenses.
Your employer has a justified need to gain insight into your business travel and to be able to shape its
mobility policy. With Vaigo, for example, your employer can gain insight into data on sustainability and
costs incurred.
With whom do we share your data?
The data may be passed on to:
- your employer;
- depending on the structure of the company where you work, it is possible that these services are outsourced. In such a situation, depending on what has been agreed with your employer, your data will often be shared with this external service provider;
- the chosen service provider ( transportation company ) you use through the Vaigo platform.
We only share your data if this has been agreed with your employer, or when necessary to comply with
a legal obligation.
Will my personal data be transferred outside the EU or EEA?
In principle, personal data processed by us will not be transferred outside the European Union (EU) or
the European Economic Area (EEA).
However, should this happen, we will ensure that minimum legal requirements and security standards
are always met. If we suspect that your personal data will be stored and processed outside the EU, we
will expressly notify you and your employer and ensure that the same level of protection is applied as
applies within the EU.
External transportation service providers may store personal data outside the EU or EEA. If this is the
case, we will inform you when you request activation of the service. You will then have the option to
cancel the request.
How long will your personal data be kept?
We will not retain your personal data for longer than necessary to fulfil the stated purposes.
As the need to retain personal data depends on the type of personal data in question and the purpose
of processing, retention periods may vary. Below are the criteria on which we base our definition of
retention periods:
- Have we established a certain retention period with your employer?
- Have we established and announced a certain retention period?
- Are we subject to a legal retention/archiving obligation, contractual or equivalent?
Regarding cookies, they are retained for 2 weeks from the last active session.
We will delete your personal data when it is no longer needed for the purposes for which it was
collected.
Should there be personal data that we cannot completely erase from our systems for technical reasons,
we will take appropriate measures to secure it by anonymizing it and/or preventing any further
processing or use of the data.
How will your personal data be protected?
We have implemented generally accepted standards of technological and operational security to protect personal data from loss, misuse, modification or destruction by unauthorized persons.
We require all our employees, customers and independent contractors to keep personal data
confidential and to ensure that only authorized employees have access to your personal data on a need- to-know basis.
In addition, we only use suppliers that provide sufficient guarantees to implement adequate technical
and organizational measures to protect personal data.
Regarding the security measures implemented by your employer, we encourage you to read your
employer’s own privacy policy and/or contact your employer directly
What are your rights regarding your personal data?
Below is an overview of your rights as a data subject.
However, please note that these rights are not absolute and may be subject to conditions.
- Right to access your personal data. You have the right to access and inspect your personal data processed by us at any time. We will provide you with a copy of your personal data free of charge.
- Right to correct your personal data. You have the right to have inaccurate, incomplete, inappropriate or outdated personal data erased, completed or corrected at any time.
- Right to erasure of your personal data. You have the right to have your personal data erased. However, we may retain the personal data if it is necessary for evidentiary purposes or must be kept as part of a legal obligation.
- Right to object to certain processing. You have the right to object to processing for reasons relating to your specific situation at any time. We and, if necessary, the controller will immediately cease processing your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and/or freedoms or grounds for the processing which relate to the establishment, exercise or defense of a legal claim.
- Right to restrict certain processing operations You have the right to restrict the processing of yourpersonal data if:– you contest the accuracy of the personal data, for a period that allows you to verify that the saiddata is accurate;– the processing is unlawful and you object to the erasure of your personal data, requesting thatwe restrict its use instead;– we and, where necessary, the controller no longer need your personal data for the purposes ofprocessing, but you still need them for the establishment, exercise or defense of legal claims– you have objected to a processing operation, pending the answer to the question whether thisobjection is justified.
- Right to transfer personal data. You have the right to request that personal data that you havepersonally provided to us – in a structured, common and digital form – be transferred to you so thatyou can store it for personal (re)use, or to transfer such personal data directly to another controller,insofar as it is technically possible for us to do so. However, data protection legislation provides forsome restrictions on this right, which means that it does not apply to all your personal data.
- Right to file a complaint with the supervisory authority. If you believe that the processing of your personal data does not comply with data protection legislation, you can lodge a complaint with the national data protection authority. In the Netherlands, this is the Personal Data Authority.
- Right to manage cookies. You have the right to manage cookies, regardless of the type of cookies. However, please note that changing the settings of these cookies (for example: by rejecting cookies) may affect your navigation on the Vaigo platform.
How can you exercise your rights?
To exercise the rights mentioned above, you can approach your employer for this purpose. The latter
will ask us, if necessary, to help answer the request. Only when your request relates to the analysis of
your travel behavior, you can direct the request to us.
When exercising your right(s), please clearly indicate the right you wish to invoke, the processing(s) you object to and/or wish to restrict and the personal data you wish to delete/add/amend.
Always be as specific as possible when you want to exercise your rights so that we can take the necessary action. These requests are free of charge, except when the request is manifestly unfounded or excessive (as in the case of a repeated request).
Your request will be dealt with within one month. This deadline may be extended by two months, taking
into account factors such as the complexity and number of requests. If the deadline is extended, you
will be notified of this and the reasons for the extension.
How can you submit questions or complaints?
If you have a question or complaint about our processing of personal data or about this statement, or
wish to exercise your rights, you can contact us by e-mail: privacy@eurides.eu
Moreover, we ask you to send a copy of this request to your employer if you deem it necessary.
We will do our best to work with you to resolve any privacy complaint. However, should you feel that
we or your employer have not been able to help with your complaint or concern, you have the right to
file a complaint with the data protection authority of your country of residence via their website. In
Belgium, this is the Belgian Data Protection Authority.
Amendments to this statement
We may amend or supplement this statement as we deem necessary.
If any significant changes are made to this statement, the date it is amended will be added and we will
notify you and make you aware of the amended statement.
We also encourage you to refer to this statement, published on the Vaigo platform, on a regular basis
to find out how we process and protect your personal data.