Arval Mobility App – Data Protection Notice

Last updated: March 2023

The protection of your Personal Data is important to the BNP Paribas Group, which includes Arval Belgium NV,  Ikaroslaan 99, 1930 Zaventem, RLP Brussels VAT BE 0436.781.102 (hereafter “ Arval”). The BNP Paribas Group has adopted strong principles in that respect.

This specific Data Protection information Notice (the "Notice") provides you with detailed information relating to the processing of your Personal Data by Arval with regards to the Arval Mobility App.   You benefit from this App because your employer has subscribed the Arval Mobility App services and has identified you as a beneficiary of the Arval Mobility App.

The Arval Mobility App aims to offer you an integrated mobility solution, which allows you to:

  • plan, book and pay your business, commuting and private trips with  the Mobility Partners whose mobility services are offered via the Arval Mobility App;
  • respond to other mobility needs; and
  • manage the budget allocated by your employer for mobility purposes and facilitate the  reimbursement of your expenses in line with your employer’s mobility policies

(hereafter jointly referred to as “the Services”).

In the scope of these Services, Arval, as “controller”, collects and processes some of your Personal Data via the  Arval Mobility App in order to perform the Services. This Notice provides you with detailed information regarding such processing,  the purposes of such Personal Data collection, the retention period of the Personal Data, and your rights and how to exercise them.

Your employer may also process personal data for its own purposes; please revert to your employer to be informed hereof.

 

  1. Data collection

In connection with the access to and use of the Arval Mobility App,  Arval may collect and/or process Personal Data relating to you. For the purposes of this Notice, the term “Personal Data” has the meaning defined in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data.

Arval collects and processes Personal Data provided by  you and/or your employer during the creation of an account and use the Arval Mobility App.

Arval also collects and processes your Personal Data communicated by the Mobility Partners who have provided the Services to you.

 

  1. Type of Personal Data processed, purpose, retention and legal basis

Arval may process your Personal Data as detailed in the table below:

(a) to allow you to  access and use the Arval Mobility App and Services as requested by your employer and to manage the relationship with you and the Mobility Partners.

(b) to serve its own legitimate interests: Arval processes your Personal Data in order to

i. provide and verify access to the Arval Mobility App

ii. develop, improve and optimise the features, quality and performance of the Arval Mobility App and Services, and expand the Services offering and analyse the use of the Arval Mobility App and/or Services

iii. be able to notify you in the event of maintenance of the Arval Mobility App and/or Services,

iv. inform you of developments and improvements to the features of the Application and/or Service

 

The purposes of processing and the data retention time will not exceed the indications provided in the table below.

 

Purpose of the processing Data drocessed Legal basis for processing Data retention

Registration of Client data to enable the implementation of the rule-setting of the Client

- E-mail address

- First name

- Last name

- Language

- Date of End of employment contract

Execution of the contract

Duration of use of the app (and, if applicable, the platform) by the data subject + 3 years after termination of such use, provided that the former customer - mobility user has no outstanding credits or debts to Optimile. In this case, the personal data will only be deleted after the necessary payments have been made to Optimile.

- Account creation to access the Application

- Identification of User to be able to make use of the mobility services (communication, facilitating use of the app, …)

- Allocation of users to mobility policies

- Employee ID, Department, cost center

- Company name

- Function, Category, Status of salary

- Contract number, type of contract

- Contract start and end date

- Job title, first name, last name

- Business email, phone number

- Language

- Username, password

- Date of birth, address

- Bank account number

- Allocated role in the Platform

- Subscriptions

- Type of mobile device (Android or IOS)

Execution of the contract

Duration of use of the app (and, if applicable, the platform) by the data subject + 3 years after termination of such use, provided that the former customer - mobility user has no outstanding credits or debts to Optimile. In this case, the personal data will only be deleted after the necessary payments have been made to Optimile.

Route planner: offering the User to plan alternative mobility options

- Start and Stop address and time for each trip

- Date

- Distance

- Duration

- Means of mobility

- Geolocation (provided the feature is activated by the User and the User has given his consent)

- Execution of the contract

- Consent for geolocalisation

Duration of use of the app (and, if applicable, the platform) by the data subject

Plan, book and pay the trips

- First and last name

- Phone number

- Email address

- Address

- Date of birth

- License plate

- Language

- Country

- Start and stop / departure / return

- Address / Location / Place / Station (departure / arrival)

Execution of the contract

Duration of use of the app (and, if applicable, the platform) by the data subject + 3 years after the termination of such use

- Invoice management to settle the mobility cost of the User

- Control and Reimbursement of User; and User expense management and reporting

- User first and last name

- Contract number related to User

- Amount/price of product purchased of Mobility Service and mobility provider

- Date of Purchase

- Date of birth

- Telephone number

- Date

- Place of purchase

- Vehicle License plate number

Execution of the contract

8 years as from the invoice date

Payroll management

- User first and last name

- Employee ID

- Company ID

- Contract number related to User

- Amount/price of product purchased of Mobility Service and mobility provider

- Unused or consumed budget

- Period

Execution of the contract

8 years as from the invoice date

Maintenance and security to the Application and its access ; management of permissions

Permissions and Security:

- User name

- Passwords

- Logs

- User permissions

Execution of the contract

Duration of use of the app (and, if applicable, the platform) by the data subject + 3 years after the termination of such use

Budget and mobility policy management of User enabling User to have permanent accurate view on available budget

- Credit (Wallet) information

- Authorized mobility options

- Credit amount reserved

- Refill limit and refill period

- Latest refill date

Execution of the contract

Duration of use of the app (and, if applicable, the platform) by the data subject + 3 years after the termination of such use

Complaints and Incident management

Support to technical issues which user faces

Complaint, incident and support records:

- first Name

- last Name

- e-mail address

- phone number

- content of complaint / Incident

- location

Legitimate interest

Duration of use of the app (and, if applicable, the platform) by the data subject + 3 years after the termination of such use

Analysis and Reporting on the use of the Application to optimize the Mobility App/ Platform and the use of the Mobility Services

Only pseudonymized data

Legitimate interest

10 years

 

  1. Who does Arval share your Personal Data with?

In order to fulfil some of the purposes described in this notice, Arval may disclose from time to time your Personal Data to:

  • commercial partners (such as the Mobility and Payment Service Providers)
  • social Secretariat used by your employer
  • (sub)processors providing services on behalf of Arval
  • Your employer

 

  1. What are your rights and how can you exercise them?

In accordance with applicable privacy Personal Data protection regulations, you have the following rights:

  • to access: you can obtain information relating to the processing of your personal data, and a copy of such personal data.
  • to rectify: where you consider that your personal data are inaccurate or incomplete, you can request that such personal data be modified accordingly.
  • to erase: you can require the deletion of your personal data, to the extent permitted by law.
  • to restrict: you can request the restriction of the processing of your personal data, to the extent permitted by law.
  • to object: you can object to the processing of your personal data, on grounds relating to your particular situation. You have the absolute right to object to the processing of your personal data for direct marketing purposes, which includes profiling related to such direct marketing.
  • to withdraw your consent: where you have given your consent for the processing of your personal data, you have the right to withdraw your consent at any time.
  • to data portability: where legally applicable, you have the right to have the personal data you have provided to us be returned to you or, where technically feasible, transferred to a third party.

If you want to exercise the rights listed above, please send:

  • a letter to the following address: Arval Belgium N.V./S.A., DPO Office, Ikaroslaan 99, 1930 Zaventem, or
  • an e-mail to the following address: privacy@arval.be.

Please include a scan/copy of your identity card for identification purposes.

In accordance with applicable regulations, in addition to your rights above, you are also entitled to lodge a complaint with the competent supervisory authority:

Data Protection Authority

Drukpersstraat 35, 1000 Brussel

Tel +32 (0)2 274 48 00

Fax +32 (0)2 274 48 35

e-mail: contact@apd-gba.be

Personal Data collected and/or processed by Mobility Partners for the purpose of providing a Service are collected and/or processed under their own responsibility, in their capacity as data controller. Such processing is subject to their own privacy policies and terms and conditions of use, which you acknowledge and accept. Any complaints or exercise of rights relating to these Personal Data must be made to the Mobility Partner concerned.

 

  1. Transfer of Personal Data outside the EEA

In case of international transfers originating from the European Economic Area (EEA), where the European Commission has recognized a non-EEA country as providing an adequate level of data protection, your Personal Data may be transferred on this basis.

For transfers to non-EEA countries whose level of protection have not been recognized by the European Commission, Arval will either rely on a derogation applicable to the specific situation or implement one of the following safeguards to ensure the protection of your Personal Data:

  • standard contractual clauses approved by the European Commission; or
  • binding corporate rules, where applicable.

To obtain a copy of these safeguards or details on where they are available, you can send a written request to privacy@arval.be.

 

  1. How can you keep up with changes to this data protection notice?

In a world of constant technological changes, Arval may need to regularly update this Data Protection Notice. You will be informed of any material changes through the Arval Mobility App.