Privacy policy APCOA FLOW

Privacy policy for the use of the APCOA FLOW digital service

These are the data protection and cookie provisions for the use of the digital services and for online purchases of

APCOA PARKING Austria GmbH

Landstraßer Hauptstraße 146/13A

1030 Vienna

+43 171716-0

office@apcoa.at

FN 249499 k

as controller within the meaning of the GDPR, hereinafter referred to as "APCOA".

Purpose of data collection, storage and/or processing

Your data is processed in particular to fulfil our contractual obligations towards our users. In these cases, the processing is based on Art. 6 I lit. b GDPR. The same applies to such processing operations that are necessary for the implementation of pre-contractual measures, for example in cases of enquiries about our products or services.

With the mobile app, you have the option of booking your parking ticket online at selected locations with unrestricted parking spaces. There is no need to go to the parking ticket machine. At selected locations with barrier systems, the licence plate number you have registered is read as a parking ticket. There is no need to go to the pay machine (legal basis Art. 6 para. 1 lit. a, b, f GDPR).

We store your data in order to settle the parking transactions you have used. The parking transaction (debit or credit card - use of the debit or credit card number) is settled via a payment service provider. APCOA has no further personal data about this, as the entire payment process takes place via the payment service provider's hardware and software. We only receive the payment ID and the last four digits of your credit card number from the payment service provider. This is used for authentication and allocation of your parking transactions and therefore for your security.

Our mobile app offers you the option of being informed by push notification for individual areas, for example about the start and end of a parking process or about a failed payment transaction (legal basis Art. 6 lit. f GDPR).

You can configure this function via the menu settings of your end device and activate/deactivate the notifications. The delivery of the messages requires the storage of a push token of your mobile device with us.

Data that you send us under "Send feedback" will only be used to answer your enquiry or to improve our services.

As part of the fulfilment of our contractual obligations to our users, we always try to adapt our services to the needs of our users. Personalisation plays an important role here. This involves creating interest and usage profiles. To determine these interests, we use the information that you provide to us, but also implicit feedback, i.e. information that we receive automatically based on your use of APCOA FLOW (through so-called "tracking"). In such cases, processing is based on Art. 6 I lit. d GDPR and is permitted if it is necessary to safeguard a legitimate interest of our company or a third party, provided that the interests, fundamental rights and freedoms of the data subject do not prevail.

In the event of your express consent, APCOA will use the data provided by you during and after the existence of contractual relationships to contact you about offers and promotions for marketing purposes by post, email, telephone/SMS, social media channels or apps. You can revoke or deactivate your consent to the processing of your personal data for marketing purposes at any time in your profile ("Settings").

In some cases, APCOA is legally obliged to process data, e.g. to hand over data to investigating authorities (Art. 6 I lit. c GDPR).

In addition, your personal data will only be used by APCOA if you have given your prior consent (Art. 6 I lit. a GDPR).

Type of data collected by the app (metadata, content data, personal data)

a.) Downloading the mobile app

When the mobile app is downloaded, the required information is transferred to the App Store, in particular the user name, email address and customer number of your account, time of download and the individual device identification number. We have no influence on this data collection and are not responsible for it. We only process the data to the extent necessary for downloading the mobile app to your mobile device.

b.) Use of the mobile app

When using the mobile app, we collect the personal data described below to enable convenient use of the functions. If you wish to use our mobile app, we collect the following data, which is technically necessary for us to offer you the functions of our mobile app and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):

  • IP address
  • Date and time of the enquiry
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code
  • Amount of data transferred in each case
  • Website from which the request originates
  • browser
  • Operating system and its interface
  • Language and version of the browser software.

We also need your device identification, unique number of the end device (IMEI = International Mobile Equipment Identity), unique number of the network subscriber (IMSI = International Mobile Subscriber Identity), mobile phone number (MSISDN), MAC address for WLAN use, name of your mobile end device, e-mail address and vehicle registration number. We also collect your location data during use of the app with your express consent. You can revoke this consent at any time.

Cookies

We use cookies on our website (www.apcoa.at) and the APCOA FLOW mobile app.

Cookies are text files that are placed and stored on your end device via an internet browser. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that can be used to assign websites and servers to the specific internet browser in which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other Internet browsers that contain other cookies. A specific Internet browser can be recognised and identified via the unique cookie ID.

By using cookies, we can provide users of our website and our mobile app with more user-friendly services that would not be possible without cookies. Cookies also protect the security of your user account.

You can prevent the setting of cookies by our website at any time by means of a corresponding setting of the Internet browser used and thus permanently object to the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an Internet browser or other software programmes. This is possible in all common Internet browsers. If you deactivate the setting of cookies in the Internet browser you are using, you may not be able to use all the functions of our website to their full extent.

Personal data may be stored in cookies if you have given your consent or if this is technically absolutely necessary, e.g. to enable a protected login.

By using the APCOA FLOW app, you consent to the use and storage of cookies on your end device. Consent to the use and storage of cookies can be revoked at any time by uninstalling the app.

If you use the web offers of APCOA FLOW integrated or referenced in the APCOA FLOW app, you consent to the use and storage of cookies on your end device. you can revoke your consent to the use and storage of cookies at any time by uninstalling the app.

Duration of storage

Your personal data will only be stored by us for as long as is necessary to fulfil the contract:

  • The user profile you have entered can be changed at any time. The deletion will take place after your request for deletion to the following e-mail address office@apcoa.at. After clarification of all open business cases, deletion will take place 8 weeks after receipt of payment.
  • The remaining data will be deleted after the tax retention period of seven years has expired.

Naming of authorised third parties

For the above-mentioned purposes, your personal data will be transmitted to the following recipients - if necessary:

  • Processors (e.g. IT service providers, call centres, complaint management)
  • Billing platforms (fuel cards, mobility cards, etc.)
  • Insurance companies (e.g. in the event of damage)
  • Debt collection agency, lawyer, courts
  • Authorities within the scope of their remit
  • Client of the car park operator as operator

Some of the above-mentioned recipients of your personal data are located outside your country or outside the EU/EEA and process your personal data there. The level of data protection in other countries may not be the same as in Austria. If the transfer of data to a third country does not serve to fulfil our contract with you, we do not have your consent, the transfer is not necessary for the assertion, exercise or defence of legal claims and no other exception applies, we will only transfer your data to a third country if an adequacy decision pursuant to Art. 45 EU GDPR or suitable guarantees pursuant to Art. 46 EU GDPR exist.

One of these adequacy decisions is the so-called "Privacy Shield" for the USA. For transfers to companies certified under the Privacy Shield, the level of data protection is generally considered adequate within the meaning of Art. 45 EU GDPR.

Data protection provisions about the application and use of

All sections are already expanded

All sections are already collapsed

Information on the right to information, cancellation and deletion of data

You have the right to information, rectification, erasure, restriction, data portability and objection. Please contact us for this purpose.

If you believe that the processing of your data violates data protection law or your data protection rights have been violated in any other way, you can lodge a complaint with the data protection authority.

If the processing is based on your consent, you can revoke this at any time.

With regard to image processing, data subjects are not entitled to receive photographs from the garage operator, without prejudice to the right to information pursuant to Art. 15 GDPR, if this would adversely affect the rights and freedoms of other persons. Instead, the data subject will receive a description of their behaviour. However, the garage operator is entitled to transmit image recordings to the competent authority (e.g. a security authority as part of an investigation initiated by a complaint) because the garage operator has reasonable grounds to suspect that the data could document a criminal offence to be prosecuted ex officio. Such a suspicion may also arise from a tip-off from a customer.

Data security

APCOA takes appropriate technical and organisational measures to protect your personal data and prevent unauthorised access.

Links to other websites

Our website also contains links to other websites. However, the privacy policy described here does not apply to these websites. We therefore ask you to visit these websites directly in order to obtain the data protection information for the respective websites there. APCOA cannot be held liable for measures emanating from these websites or for their content.

We reserve the right to amend this privacy policy at any time due to legal or technical developments. The version published on www.apcoa.at applies.

Status: July 2019