We are committed to protecting your personal data.
Saint-Malo Agglomération, whose address is 6 rue de la Ville Jégu, BP11 – 35260 CANCALE, represented by Mr. Gilles LURTON in his capacity as President (“we”, “us”, or “our”), acting as Data Controller, is committed to respecting privacy and applicable data protection laws with regard to users (“you”, “your”) of the service (the “Service”, as more precisely defined in the “Definitions” section).
This privacy policy (the “Policy”) describes our method of collecting and using personal data in the context of your use of the Service, the website (the “Website”), and your interactions with us and with the Operator.
Software on your device may have access to your information. Our products or services may contain links to other websites belonging to companies that have their own privacy policies. We therefore recommend that you read them carefully.
This Policy applies only within the scope of the Service and the Website.
You are not required to provide us with your personal data. However, if you choose not to provide it, we may not be able to provide you with our products or services, all of their features, or respond to your requests.
Definitions:
Application
The free downloadable program that runs on a smartphone or tablet operating system (iOS or Android). The Application allows any Service User to find a nearby bike, unlock it, follow a cyclist-friendly route, check the number of kilometers traveled, subscribe to the Service, contact Customer Service, and report an incident.
Personal Data
Any information relating to an identified or identifiable natural person. This person may be identified directly (first and last name) or indirectly (postal address, phone number, etc.), through a single piece of data or a combination of data.
Data Controller
Legal or natural person, FIFTEEN, who determines the purpose and means of processing.
Vélo MAT
Commercial brand operated by FIFTEEN.
“We”, “our”, or “us”
The data controller FIFTEEN as designated at the beginning of this Policy.
Service
The self-service electric bicycle sharing service provided by FIFTEEN, as defined in the Terms and Conditions of Use of the Vélo MAT Service, to which this Service is subject and which forms an inseparable part of this Policy.
Processor (optional)
Natural or legal person who processes data on behalf of the Organization: RD BREIZH.
Processing
Any operation or set of operations performed on personal data, regardless of the method used. Data processing must have a purpose or objective.
What information do we collect?
We collect your personal data and other information when you fill in online forms as part of your use of the Service and the Website, or when you respond to questions sent to you by email, phone, via the Vélo MAT Application, or through any other means of communication, and when you take part in a campaign or survey or interact with us. This includes the following cases:
Our Applications may regularly connect to our servers, for example to check for updates or to send us information about your use of our Services. In addition, we may invite you to voluntarily join service improvement or research programs in which we collect detailed information such as your socio-professional category, gender, or usage of our services.
Information you provide to us: when you create an account as part of your use of the Service, request our services, participate in campaigns or surveys, or interact with us, we may ask for information such as your name, email address, phone number, postal address, username, password, comments, device-related information, age, gender, and language.
We also retain your consent, preferences, and settings related, for example, to location data, marketing, and personal data sharing.
Your transactions with us: we keep records of your purchases, downloads, content you provide, requests, agreements between you and us, products and services offered to you, payment and delivery details, as well as your interactions with us.
Location and positioning data: location services determine your position using satellite, mobile network, Wi-Fi, or other network methods. These technologies may involve sharing your location data and your device’s unique identifier, Wi-Fi identifiers, or other network identifiers with us. Our products may operate with different platforms, applications, and services which may also collect your location data. We do not use this information to identify you personally without your consent.
Your email address: we may process your email address if you have provided it via our Website. We also collect personal data through cookies and trackers on our Website and Application.
Why do we process your personal data?
We may process your personal data to meet different needs:
Providing the Service: we may use your personal data to provide the Service, maintain it, process your requests, and more generally to perform the contract between you and us, ensure the functionality and security of our products and services, and in particular the Service, identify you in order to provide the Service, and prevent or investigate fraud or other malicious use.
Communicating with you: we may use your personal data to communicate with you, for example to inform you of changes to our services, send you alerts regarding our products and/or services, conduct surveys, and contact you through our Customer Service.
Marketing, advertising, and recommendations: we may contact you to inform you about new products or services and promotional offers, after obtaining your consent, or where permitted by law.
Anonymous statistics: we may aggregate GPS data from all users to produce statistical data on travel patterns, which may be shared with our partners. These aggregated data are anonymized in accordance with applicable data protection regulations.
We use your personal data with your consent or when necessary for the proper performance of the contractual relationship between us. We may also use your personal data when required by law or when we have a legitimate interest, for example to protect our customers, ensure the security of our products and services, and protect our rights and property.
Do we share your personal data?
We do not sell, rent, or disclose your personal data to third parties except in the cases mentioned below:
Your consent and social media buttons: we may share your personal data if you have given your consent. Some of our products and services may allow you to share your personal data with social networks. We encourage you to review the privacy policies of these networks to understand what data is collected and how it is used, including for advertising purposes.
Authorized third parties: we may share your personal data with authorized third parties processing data on behalf of Vélo MAT in accordance with this Policy. This may include, for example, billing through your network operator, delivery of personal batteries, or services such as customer support, consumer data analysis, surveys, or business management.
We may carry out marketing campaigns and other communication activities in collaboration with authorized third-party partners. To avoid duplicate or unnecessary communications and to send you more relevant messages, we may combine data collected by Vélo MAT with data collected by partners where legally permitted.
These third parties authorized by FIFTEEN are not permitted to use your personal data for any other purpose. We require them to comply with this Policy and applicable data protection regulations and to implement appropriate security measures to protect your personal data.
International data transfers: our products and services may be provided using resources and servers located in various countries around the world. Your personal data may therefore be transferred outside the country where you use our services, including countries outside the European Economic Area that may not have specific data protection laws or may apply different data protection rules. In the case of transfers to a third country outside the EEA, FIFTEEN commits to informing users in advance and obtaining prior consent where required; and to comply with the GDPR by using adequate safeguards such as adequacy decisions, standard contractual clauses, or binding corporate rules with partners or subcontractors.
Mandatory disclosures: we may be legally required to disclose your personal data to certain authorities or third parties, for example law enforcement agencies in countries where we or third parties acting on our behalf operate. We may also disclose and process your personal data to protect our legitimate interests, for example in civil or criminal proceedings.
Mergers and acquisitions: if we decide to sell, buy, merge, or reorganize our business in certain countries, this may involve disclosing personal data to potential or actual buyers and their advisors, or receiving personal data from sellers and their advisors.
How do we ensure data quality?
We take all reasonable measures to ensure that the personal data we hold is kept up to date and to delete it if it is found to be inaccurate or no longer necessary. We will retain your personal data only for as long as necessary to fulfil the purposes described in this Policy or as otherwise communicated to you, unless a longer retention period is required by law.
We encourage you to regularly access your account to review your personal data and help us keep it up to date.
What measures are taken to protect your personal data?
Confidentiality and security are of critical importance in how we design and deliver our products and services. We assign specific responsibilities to address security and privacy issues. We enforce our internal policies and guidelines through a range of appropriate measures, including proactive and reactive risk management, security and privacy engineering, training, and assessments.
We take appropriate measures to address risks related to online security, physical security, data loss, and other risks, taking into account the nature and sensitivity of the data being protected.
We also restrict access to databases containing personal data to authorized personnel who have a legitimate need to access such information.
How do we use cookies?
We may collect certain information from you through cookies, web beacons, and other tracking technologies to operate and improve our Website and Application. A “cookie” is a small text file containing data stored on a device (computer, tablet, smartphone, etc.) when you browse a website.
The different types of cookies we use:
Strictly necessary cookies: these cookies allow you to browse the Website and are essential for its proper functioning. Disabling them will cause difficulties in using the Website and may prevent access to certain features.
Functionality cookies: these cookies collect information about how Users use the Website (number of visits, number of pages viewed, visitor activity). They also allow us to identify and resolve performance issues and improve the Website.
Our Website may also contain cookies from third parties (advertising agencies, analytics providers, etc.) allowing them to collect browsing information on your devices. Third-party cookies are subject to the privacy policies of those third parties. We inform you here of their purpose and, where possible, how you can manage them.
Which cookies do we use?
| Name | Purpose | Lifetime | Domain/Platform |
|---|---|---|---|
| Session | Keeps the user logged into their account to ensure authenticated and secure browsing | 7 days | velomat.stmalo-agglomeration.fr |
| Locale | Manages the visitor’s language preference | 12 months | velomat.stmalo-agglomeration.fr |
| Stripe | Fraud prevention | 12 months | velomat.stmalo-agglomeration.fr |
How can you manage cookie settings in your browser?
If you do not want our Website to place cookies on your computer or mobile device, you can easily restrict or delete them by adjusting your browser or mobile device settings (iOS or Android).
Below are links to manage cookies depending on your browser:
Firefox: https://support.mozilla.org/fr/kb/desactiver-cookies-tiers
Safari: https://support.apple.com/fr-fr/guide/safari/sfri11471/mac
Google Chrome: https://support.google.com/chrome/answer/95647?hl=fr&co=GENIE.Platform=Desktop
Microsoft Edge: https://support.microsoft.com/fr-fr/windows/supprimer-et-g%C3%A9rer-les-cookies-168dab11-0753-043d-7c16-ede5947fc64d
For more information about deleting cookies, visit:
https://www.cnil.fr/fr/cookies-et-autres-traceurs/comment-se-proteger/maitriser-votre-navigateur
However, disabling certain cookies may reduce or prevent access to some features.
We inform all new Users via a banner that cookies are used on our Website. You can accept or reject them at that time. The cookie consent banner will be displayed again at your next login.
What are your rights?
You have the following rights regarding the personal data we process about you:
Withdrawal of consent (Article 13(2)(c) GDPR): you have the right to withdraw the consent you previously gave for the use of your personal data.
Access (Article 15 GDPR): you have the right to know what personal data we hold about you and to obtain a copy of it.
Rectification (Article 16 GDPR): you have the right to request that any incomplete, inaccurate, or outdated personal data concerning you be corrected.
Erasure (Article 17 GDPR): you have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you have withdrawn your consent, when you have objected to its processing in accordance with data protection regulations, when the processing is unlawful, or when legal obligations require it.
Restriction (Article 18 GDPR): you have the right to request restriction of processing when you contest the accuracy of your data, when the processing is unlawful and you oppose deletion, when you need the data for legal claims, or while we verify legitimate grounds for processing after an objection.
Data portability (Article 20 GDPR): subject to legal conditions, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format.
Objection (Article 21 GDPR): you have the right to object to the processing of your personal data when it is based on public interest, official authority, or legitimate interest, for reasons related to your particular situation. You may also object at any time to processing for direct marketing purposes.
Post-mortem directives (learn more): you also have the right to define instructions regarding the storage, deletion, and communication of your personal data after your death.
If you wish to exercise any of your rights, you can contact us at: support@velomat.fifteen.eu. To help us process your request efficiently, please remember to:
specify the processing(s) concerned by your request
specify the right(s) you wish to exercise
provide any information allowing us to verify your identity
If you are still not satisfied, you also have the right to lodge a complaint with a supervisory authority, in France the CNIL (Commission Nationale de l’Informatique et des Libertés).
How long do we keep your personal data?
Your data will be retained for no longer than is necessary to fulfil the purposes described in this Policy.
When your data is no longer needed for those purposes, it will be regularly deleted or anonymized unless a longer retention period is required:
10 years to comply with legal, accounting, and tax obligations
5 years for evidence preservation within applicable limitation periods
3 years for marketing purposes from the end of your contractual relationship or last contact with you
In addition, if we find that your user account has been inactive for more than 2 years, we will delete your personal data.
FIFTEEN may also retain certain personal data beyond these periods in order to comply with legal or regulatory obligations.
What access permissions are required by the Application?
You must grant the following permissions to the Application to allow us to collect the data necessary for your registration and use of the Vélo MAT Service:
Camera: permission required to scan the QR code identifying the bike.
Location: permission required to locate you on the map (Mapbox), show nearby bikes, and guide you to them.
Bluetooth: permission required to establish and maintain the connection between your phone and the bike, enabling proper use of the Vélo MAT Service.
Changes to the Policy
Our Privacy Policy may change depending on how we process your information. We reserve the right to modify this Policy at any time, with or without notice. However, we will ensure that you are informed of any changes by email or push notification, and we will publish an updated version of the Policy on our Website.
This Policy, issued on 29/04/2024, was last updated on 30/04/2024.
Contact
If you have any questions or requests regarding this Policy, or more generally about how we process your data, you can contact us at: support@velomat.fifteen.eu