Privacy statement Sjees app

This privacy statement provides information about how the Sjees app handles personal data that is processed in the context of its services.

The Sjees app was developed by Mobidot BV and it is also responsible for the management and processing of all personal data (hereinafter referred to as: "the processor") on behalf of the Brainport Bereikbaar partnership (hereinafter referred to as: “Brainport Accessible”).

Brainport Bereikbaar is a partnership of the 21 municipalities in Southeast Brabant. Together with travelers, employers and educational institutions, Brainport Bereikbaar facilitates and encourages smart mobility solutions in the Brainport region, including the use of bicycles.
In its services to offer a support desk, the processor collaborates with Keijzer BV (hereinafter referred to as: "the subprocessor"), with which the personal data can be shared. Keijzer BV is therefore the sub-processor.

The municipality of Eindhoven acts as secretary for Brainport Bereikbaar. This means that the municipality of Eindhoven is the contact person for the partnership, both for third parties and for all participants within the partnership. The municipality of Eindhoven (hereinafter referred to as: “the responsible") is the client for the development of the Sjees app and therefore the controller.

Contact details
Sjees app
support@sjees-app.nl 

Goal
The Sjees app is part of Brainport Bereikbaar's bicycle impulse project. With this app you gain insight into your daily cycling movements and you can save nice gifts and discounts with those cycling kilometers. The Sjees app on the smartphone automatically measures where and when the bicycle is used and you as a user receive a reward for this. The Sjees app is also used for fun challenges to make cycling even more challenging. Of course linked to great prizes.

To achieve this goal, it is necessary to install the Sjees app, create an account and collect (detailed) data about, among other things, your movements by bicycle. We need this collected data to determine your movements and to award any associated rewards and perhaps to make the traffic light turn green for cyclists more quickly.

The data that the processor collects and processes contains personal data. The data is collected to identify the user and the user shares this data with the Sjees app to make optimal use of it. This privacy statement is a supplement to the general privacy statement from the Sjees app. In the event of any conflict between these or other conditions declared applicable, these conditions shall prevail.

The main points

1. We collect your movements (location data) to give you insight into your own travel behavior and to reward you for your smart travel choice.
2. We automatically determine how and with what you move via the sensors of your phone. We also collect your feedback about your travel experience.
3. In order to identify you as an individual, you must create a user account in the Sjees app. Your email address is used as a unique username. You must also provide your zip code to check whether you meet the participation conditions. (account and profile information).
4. Your personal movements and feedback are not shared with third parties, unless you do this yourself via the sharing options in the Sjees app.
5. We anonymize your travel data and feedback and provide it to Brainport Bereikbaar for traffic policy and make it available for (scientific) research. This information is not being sold.
6. If you cycle near a traffic light equipped for this purpose, you may be able to automatically request an accelerated green light. This request is anonymous
7. When using the Sjees app, we collect log data, such as the smartphone model you use and the amount of data exchanged daily. These are used by us to improve and optimize the service.
8. If you contact the support desk, the contact details you provide (email, telephone number) will be used to provide an answer. This data may be stored by the support desk for training purposes or to improve the Sjees app.
9. You always have control over the data you provide or the measured data. If you would like your user account to be terminated, please contact support@sjees-app.nl and all your personal data will be deleted from our systems. If you have not been active as a user for 24 months, all your data will be automatically deleted from our systems.
10. You have the right to view all data recorded about you. If you believe that data has been recorded incorrectly, you can indicate that it should be changed.
11. We have a complaints procedure. If you have a complaint or believe that we are not handling your data correctly, you can let us know via support@sjees-app.nl.

Complete Privacy Statement
This privacy statement describes the guidelines for the information that the processor or sub-processor as well as the controller (collectively “We”, “Us”) collect and store when you use the Sjees app.
As providers of the Sjees app, we believe it is very important that users can rely on us. This means that we handle data and specific personal data responsibly. The guidelines of these privacy regulations are in accordance with the General Data Protection Regulation (EU2016/679, hereinafter “GDPR”) and the guidelines of the Dutch Data Protection Authority.
The Municipality of Eindhoven, as secretary for Brainport Bereikbaar, is the client of the Sjees app, and within the meaning of the law, responsible for the privacy-sensitive data processed via the Sjees app. The project is carried out by a project organization. Within this project organization, the company Mobidot BV is the processor and responsible for the development, keeping the Sjees app available and the daily processing of the data used within the Sjees app. This means that the processor is, within the meaning of the law, the Processor of the privacy-sensitive data processed via the Sjees app. The processor works closely together and shares information with the project partner and sub-processor Keijzer BV for the purpose of running a support desk. To this end, the parties have concluded a processing agreement with each other.

Collecting information
We collect your data on a voluntary basis by using the Sjees app. By using the Sjees app, you consent to the collection and processing of your personal data in accordance with this privacy statement. If you do not wish this, we request that you do not use the Sjees app (and your account) or immediately stop using the Sjees app and request that we delete your data in the manner stated in this privacy statement. .
The Sjees app is for personal use. You decide which data you want to provide to us and you are always in control of whether or not you provide feedback and whether the Sjees app measures your movements.

The data that the processor collects from you:

1. Account information
   • Collection goal: provide access to the Sjees app. Filtering appropriate challenges. Personalizing the Sjees app.
   • Data: first and last name, e-mail address, home address zip code; interests (sustainability, travel time, health or cost aspect); setting preferences.
2. Contact details (only if you approach the support desk):
   • Collection goal: to provide support for specific questions or problems with the Sjees app.
   • Data: e-mail address and/or telephone number
   • Subprocessor: Keijzer BV
3. Address data
   • Collection purpose: to be able to send a reward such as an entrance ticket or other prizes by post.
   • Data: postal address
   • Subprocessor: Keijzer BV
4. Mobility data
   • Collection purpose: collecting information about your travel behavior and travel experience. Supporting the issuing of rewards for demonstrated travel behavior. Providing insight into travel behavior and effects. Providing travel advice. In order to show all your journeys on a map, the Sjees app needs permission to always use your location. The Sjees app uses location in the background to passively register journeys, including when you start or stop moving, even when you are outside the Sjees app.
   • Core data: smartphone sensor (GPS, WiFi and Accelerometer) tracks linked to times (“trips”), collected feedback on questions in the Sjees app and via surveys about travel behavior, motivation, demographic data and travel experience.
5. Log data
   • Collection goal: analyze and improve the performance and use of the Sjees app.
   • Core data: usage data/analytical data Sjees app and phone (smartphone type, operating system and version, battery level, sensing events, log data on Sjees app performance).

Processing information
If you use the Sjees app, we collect your trips in a personal overview (“your trips”). The information we derive concerns:

• Start and end time of each ride;
• Start and end point, route and infrastructure used during each trip;
• Distance travelled, journey time and average speed;
• Means of transport for every journey;
• Purpose of the ride;
• Frequently visited places;
• Frequently chosen routes;
• Mutual relationship of means of transport used;
• Weather conditions during the ride;
• Estimation of costs, CO2 savings and calories burned per trip;
• Any feedback given.

In addition, we ask for additional demographic background information, bicycle use for using the Sjees app and motivation via the Sjees app. This measures and evaluates the effects of the Sjees app.
The processing of the journey data takes place in a well-secured data center in the Netherlands. Only a limited group of designated administrators has access to the data processing systems and the data. We use this data to offer the Sjees app to you, in accordance with the applicable terms of use. We will not change this purpose in the meantime without your permission.
We do not knowingly process personal data of children under the age of 16. If it turns out that we have collected personal data from someone under the age of 16 and no consent has been given by parents or guardians, the account in question will be closed without delay and all personal data will be deleted.
We anonymize all your processed travel data and feedback you provide about your travel experience by aggregating and randomizing it. After this, the data can no longer be traced back to you.
Anonymization is achieved by taking information from multiple users together and randomizing the information. Randomization includes:

• Cutting away 0-200 meters at the start and end of measured routes;
• Removing user information so that, for example, it can no longer be traced back to the fact that the bicycle ride from A to B on Tuesday was carried out by the same person as the ride from C to D on Friday;
• Shift data in time with a randomly determined offset of random -30 and +30 minutes.

We use a number of reward partners to use our Sjees app and to carry out our obligations. These rewards partners help us provide rewards or additional services. These rewards partners do not have access to your personal information or account.
'Third party' services from Google and Apple provide supporting services such as availability of the Sjees app in the app stores and the interaction of the Sjees app with the iOS or Android operating systems on your phone, respectively. These services are not part of our privacy policy and you must separately agree to the relevant terms and conditions of these parties.

Changes in services
We may contract additional third parties to provide or expand the Sjees app or to carry out our obligations, but will never provide your personal data to these third parties without your prior approval. These third parties will always be obliged to protect your personal data in accordance with this privacy statement.
In the event that one of the executing parties is sold or transferred, or in the event that substantially all assets of one of the executing parties are sold or transferred to a third party, you will be informed of this in advance and you have the right to account and all your personal data deleted. The third party is in any case obliged to take over your rights with regard to your personal data as described in this privacy statement.

Retention of information
The municipality of Eindhoven does not store any personal data. The processor only stores the personal data for as long as necessary for the purpose of the project and as determined by the municipality of Eindhoven, unless it is required by law to keep certain personal data for longer. After the end of the project, all collected and derived personal data will be deleted from the processor's systems within 3 months.

Deletion of the Sjees account and associated data
If you want to terminate your Sjees account, you must do so via support@sjees-app.nl to indicate that they no longer wish to use the Sjees app. We will then close your account within ten working days and delete all your collected and derived personal data from our systems within four working weeks, unless the law requires us to retain certain data for longer. If the latter is the case, we will inform you of this.

Access and change your personal data
You always have control over your personal data. We offer you choices within the Sjees app regarding the collection, use and sharing of your data. This choice may have consequences for the services, functionality and information that we can provide you. Via the Sjees app you can largely view your travel behavior and change, correct or revise a number of parts yourself.
You have the right to know what personal data is recorded about you and with whom we share it. Do you want to view them? Then send an email to support@sjees-app.nl. We will provide you with this information within four working weeks. In addition, we can:

• change your personal data if you rightly indicate that they are incorrect;
• delete your personal data (under conditions);

You can only view, change or delete your own personal data. We ask you to identify yourself. You are not allowed to view data of other people.
An unreasonable number of requests by an individual may result in costs associated with this provision.

Providing and disclosing information
The anonymized mobility data and impact reports are shared by the processor with Brainport Bereikbaar with the aim of gaining statistical insight into travel movements at regional level in order to improve accessibility, monitor and evaluate current mobility policy and stimulate sustainable transport.
Anonymized mobility data is further used for (scientific) research and for communication and promotion of the results and effects of the application of the Sjees app to a broader audience.
We will never provide, distribute or disclose your personal data and non-anonymised mobility data to third parties unless we are required to do so to:

• to comply with legal regulations or case law;
• to prevent serious prohibited or illegal activities;
• take actions to protect the interests of you or other users;
• defend the rights or property of Brainport Bereikbaar, the municipality of Eindhoven, Mobidot or other third parties;
• to implement this privacy statement.

You are responsible for sharing or showing information that you obtain from the Sjees app. We can never be responsible for the use, misuse, collection or disclosure of information outside of the Sjees app.
The information collected will not be transferred outside the European Union.

Information security
To protect personal data, we have taken measures in accordance with Article 32 GDPR. We take administrative, procedural, technical and physical measures to protect personal data against misuse, as well as unauthorized access, disclosure, modification and destruction. We carry out a Data Protection Impact Assessment (DPIA) on a regular basis.

• All Personal Data is stored and processed in a reliable, well-secured Data Center in the Netherlands with physical and logical access security including organizational controls. the processor uses Datacenter facilities of the Dutch company Previder (www.previder.nl). This data center is ISO 27001, 14001 and 9001 certified. In the context of privacy and data protection, the processor (Mobidot) has concluded appropriate contracts with Previder.
• Logical and physical access control to the ICT systems. The processor has digitally secured its system environment with a hardware firewall and monitors its system environment for unauthorized access and intrusion. We will do everything reasonably expected to prevent unauthorized physical and digital access to our system environments and the data by unauthorized persons. We do this, among other things, by equipping our system environments with recent operating systems and the latest (security) patches, which are recommended and supported by suppliers for use in our system environments. We also strive for the optimal combination of all software components used in order to ensure reliable use of the software used.
• Communication between apps, data processing infrastructure and websites takes place via secure connections.
• We undertake to process your personal data properly and carefully. We guarantee that our staff and anyone else engaged by us complies with the regulations of the GDPR, or with the provisions of the Exemption Decree and with the provisions of the municipality of Eindhoven, if and insofar as they are in any way involved in the processing of personal data. Management of our system environments is carried out and monitored by authorized administrators employed by the companies involved, bound by an integrity contract and confidentiality statement;
• Only a limited group of administrators designated within the project organization has access to the system environment. These administrators, who are authorized by administrators of the processor to change certain settings, implement changes and/or generate certain statistical overviews within the Sjees app, each receive their own unique user ID and associated password.
• We proactively report data leaks to the controller and the Dutch Data Protection Authority.
• Security incidents can be reported at any time support@sjees-app.nl.

Questions or complaints regarding privacy
If you feel that the use of your personal information is not in accordance with the purpose for which you provided it to us, as described in this privacy statement, or if you have any questions or suggestions regarding this privacy statement, you may contact us at  support@sjees-app.nl. If desired, you can also contact us via privacy@eindhoven.nl.
If you believe that we are not dealing with your complaint correctly, you can always exercise your right to file a complaint with the Dutch Data Protection Authority or to appeal to a competent court.
Mobidot's systems have been put together as carefully as possible and follow the current safety requirements. Yet there may be a vulnerability that is not yet known to us. We ask users, researchers or ethical hackers to help prevent abuse and increase the security of our IT systems. If a security problem is encountered on Mobidot's systems or unsecured information is found, please report this first and only via privacy@mobidot.nl. We will keep the reporter informed about how the report will be handled.

Changes to the privacy statement
We reserve the right to change this privacy statement from time to time. We do not limit your rights under this privacy statement without your consent. This also means that the rules for existing data cannot be changed and an amended privacy statement only applies to newly collected data. We will post changes to this privacy statement on this website and, if the changes are significant, we will provide a more prominent notice to you.

Contact
Do you have any questions after reading this privacy statement? Or do you have questions about how we handle your personal data? Please feel free to contact us at:

• Mobidot BV (the processor): support@sjees-app.nl
• Municipality of Eindhoven (the person responsible): privacy@eindhoven.nl.

Do you have questions about the application and compliance with privacy legislation? Or do you have a complaint about the way in which the municipality of Eindhoven handles your personal data? Please feel free to contact the Data Protection Officer at fg@eindhoven.nl.

Last modified: March 15, 2023