We are committed to your privacy and always process your personal information in accordance with the provisions of Belgian and European law (Law of 30 July 2018 on the protection of natural persons with respect to the processing of personal data and European Regulation (EU) no. 2016/679 on the protection of natural persons with regard to the processing of personal data).
In this article we provide clear and transparent information about which information we collect and how we handle this personal information.
In general we always act as the controller for all personal information that is processed in the context of the service that we offer by means of the Olympus App.
In certain exceptional cases we shall process (some of) your personal information as processor. This is among others the case for personal information that we process on the instructions of De Lijn, acting as controller, with respect the delivery and verification of an M-Ticket.
When the personal information of employees is supplied to us either by or on the instructions of employers, we process this personal information as a (sub-)processor of the controller for as long as the employee concerned has not activated his account, where said activation causes the commencement of the provision of our service.
As far as the processing of personal information is concerned merely in the context of the creation and administration of the mobility account in the meaning of the legislation on the mobility budget, we are a (sub-)processor of the employer acting as controller.
Types of personal data collected and the legal basis of the processing of same
The following data, amongst others, may be collected via the Olympus App and via Third Party Apps and via transfers from Business Clients and MRPs: your name, language, gender, address, mobile number, date of birth, company details, VAT number, e-mail address, browser, operating system, user ID, recto-verso copy identity card, Token information such as number plate, Token numbers (e.g. Mobib card, charging card and fuel card numbers). We also collect data on how you use the Mobility Services and the Olympus App. These include data regarding the purchase and use of Mobility Services (including time of purchase, price, information specific to the mode of mobility, such as data, departure point and destination of the journey) data regarding use of the Olympus App, details of the User’s employment (including address and location of employment), home address or location data (GPS positioning) of the User to enable provision of appropriate mobility solutions (e.g. ‘Smart to Antwerp’, automatic management of kilometres cycled).
Kilometre records (without GPS tracking) may be used for the registration of travel to and from work, on condition this is selected by the User in the App.
We receive this personal information thus because:
- You supply it to us (e.g. by making a profile or purchasing Mobility Services in the Olympus App or by using the App, by completing our Online forms …);
- Third parties, such as your employer or family members supply this information to us so that you may make use of our services, for example when your employer provides you with a mobility account that is administered via the Olympus App;
- Third-party service providers whom we make use of in the context of the performance of our activities provide us with same (e.g. MRPs from whom you procure a Mobility Service via the Olympus App).
The collection and processing of this personal information is required for the User to be able make use of the Olympus App. The lawful nature of the processing of personal information is thus based on its necessity for the performance of the contract to which party concerned is a party and on our justifiable interest in maintaining, safeguarding and improving the provision of the service.
A failure to provide correct information makes the use of the Olympus App impossible.
Your consent will be requested for the following processing operations: location details (GPS tracking: see Art. 17.2) and direct marketing where relevant. You may retract your consent to these processing operations, which are performed in order to optimize the service we provide you with, at all times, without this is any way diminishing the lawful nature of the processing prior to the retraction of the consent.
Background location data
For certain applications, the Olympus App collects location data or the Olympus App needs extended permissions for location determination:
- a) Collection of data from location sensors (GPS, Wi-Fi, telecom network) and other sensors (gyroscope, accelerometer) in the context of projects aimed at controlling the mobility behaviour of Users such as Slim Naar Antwerpen
- b) Permission for the App to keep track of the User’s location in the background, thus also when the App is not active, for example because the User wishes to receive a reminder to stop his parking session when he is back in the vicinity of his car.
Permission will always be requested separately for this. If for any reason you wish to stop this latter data collection, you can deactivate your location determination and tracking for the Olympus app via the phone’s settings and thus withdraw your consent.
Additional data may be requested for the optimum functioning of the Olympus App where this is useful or necessary to improve or extend the existing service provision.
Reasons for collecting personal data and transfer of same
We use the data that we collect from all our services because these are necessary for the performance of the service contract agreed with you for the provision of our mobility services and in general to do everything necessary for the agreement and performance of contracts.
In this way the collected data will be used, amongst other things, for the financial processing of the use of the Olympus App and Third Party Apps and tracking consent for these User Terms and Conditions. The collected data may furthermore be used for the performance of the Mobility Services by the MRP and to handle claims under or breaches of the general terms and conditions of the MRP.
The collected data are likewise used in our justified interest for the maintenance, safeguarding and improvement of our services, as well as for the purposes of scientific and historical research or statistics carried out on anonymized or pseudonymized personal information in accordance with the provisions Article 89.1 of the AVG. The collected data may after anonymization also be stored, processed and used further in respect of the MRPs to whom offer the mobility services in order to optimize this working method further. 17.4 Parties with access to the personal data
The data relating to a specific Mobility Service are used for the purposes of reporting in respect of the MRP concerned. This data is only passed on to an MRP when they are strictly necessary for the satisfactory operation of the Mobility Service provided to the MRP and the performance of the contract between us and the User and between us and the MRP (For example the NMBS is supplied with the following personal data: surname, forename, date of birth, email address, journey date and the points of departure and arrival of the journey).
The personal information may also be provided to the Business Client who has given the Indirect User access to the Olympus App to the extent said Business Client does not yet dispose of and only in relation to the contractual undertakings between Us and the Business Client, where this takes place on the basis of our justified interest and the necessity of performing the contracts with our Business Clients.
The processing by the MRP or Business Client takes place in accordance with the privacy policy of the MRP or the Business Client concerned, which may be found on the website of their respective websites. The data may be processed further by us or by those enterprises with whom we have a contractual relationship.
We do not pass your personal information on to recipients who are located in countries outside the European Economic Area (EEA), with the exception of the sending of emails via Mailchimp and Sendgrid the maintenance of logs via Datadog. These processors have contractually agreed to the standard provisions (SCC – Standard Contractual Clauses) in order to offer a uniform level of protection. Moreover we shall take all steps that are reasonably necessary for guaranteeing that your information is processed by the recipients safely and in accordance with this “Privacy Policy” Article and the applicable regulatory provisions.
Finally we reserve the right to pass on your personal information if such is required by law or when we believe that such is necessary for the protection of our rights and/or in the context of criminal proceedings, a court order, a request by a regulator or any other legal proceedings which concerns us.
The personal data we acquire is not disclosed to third parties with the exception of the cases mentioned above.
User rights
As a user of the Olympic App you have various rights regarding the information concerning your person that we process. You have the right:
- To obtain confirmation that we process your personal information and to receive a copy of the personal information that we hold concerning your person (right of access);
- To request the correction of your personal information should you consider it to be incorrect or incomplete (right of correction);
- To request the deletion of your personal information, or to restrict the way in which we use this information should you be of the opinion that it is no longer strictly necessary for the purposes for which it is processed. We reserve the right to determine whether your request is justified or not (right to be forgotten or right of deletion and right to restrict processing);
- To retract your consent to the processing of your personal information (to the extent the processing is based on your consent) (right of retraction of consent);
- To receive your personal information in a structured, current and machine-readable form and to transmit such to another party (to the extent the processing is based on consent or the performance of a contract);
- To object to the processing of personal information for which we use justifiable interest as the legal basis, upon which we shall stop the processing unless we have pre-eminent, compelling and justified reasons for the processing (right of objection).
You also have the right to object at all times to the processing of the personal information for the purposes of direct marketing. Should you no longer wish to receive direct marketing from us you make contact us (see below) or click on the unsubscribe button. Should you do so your personal information shall no longer be used for such purposes.
You may contact us in the ways mentioned in Article 17.7 Contacts and Complaints for the exercise of your rights accompanied by a description of your request.
In order to protect your rights adequately we may request you to furnish proof of your identity before we respond to the aforementioned requests (submission of a copy of the identity card, passport, driving licence, etc.).
Retention Period
Upon the termination of the contract between us and the Business Customer which gives the Indirect User access to the Olympus App, the personal information of the Users concerned are deleted within the period of one year. This period is necessary for dealing with claims concerning problems related to the use of the Mobility Services, with respect to both the Users and our Business Users and the MRPs.
An exception is made regarding purely accounting documents (primarily invoices) which are subject to a retention period of 7 years. Documents that serve as proof in respect of third parties must, in the context the applicable tax and accounting legislation, after all be retained for a period of 7 years after the closure of the financial period or the accounts. The personal information that is retained is limited to the contact details and names of those contact persons who may be mentioned in the accounting documents.
Contact and Complaints
If you wish to exercise your rights, you may send us a request free of charge as follows:
- By sending your request by ordinary post to Olympus Mobility NV, Theresianenstraat 7/A – 1000 Brussels, or
- By sending an email to privacy@olympus-mobility.com
Make sure that it is always clear what right you wish to exercise and remember that in certain cases we may need more information. You may for example be asked to supply copy of your identity card, passport, or driving licence, etc. We want to be sure that we are helping the right person.
You may also use the aforementioned addresses to contact us if you wish to make a complaint relating to the processing of your information.
We also kindly remind you that you can consult the information available via the Olympus App in the App itself and where necessary correct it where such is permitted. You may also correct same (or cause same to be corrected) via the Business Client that gave you access to the Olympus App.
Should you exercise rights relating to information relating either wholly or in part to the mobility account provided by Attentia, we shall transmit your request to the controller, who shall then give the necessary attention to same, either alone or together with Olympia Mobility.
Should you not be satisfied with the way we process your personal information or how we have handled your complaint to us, you have the right to submit a complaint to the Data Protection Authority (GDA) in your legal jurisdiction. You can find the contact address of the Belgian Data Protection Authority on its website
Right of complaint
The European Data Protection Regulation entitles every User to submit a complaint where the need arises to the supervisory authority, namely the Data Protection Authority, the contact details for which can be found at the website https://www.dataprotectionauthority.be/.
