Privacy Policy

1.- Who are we?

We are Bipi MOBILITY UK LIMITED (“BMUK”, “we”, “our” or “us”).  

Address: C/O Langtons, The Plaza, 100 Old Hall Street, Liverpool, United Kingdom, L3 9QJ 

Registered number: 13983581  

Telephone: [phone]

Customer service hours: Monday to Friday, from 8:30 a.m. to 5:30 p.m. 

E-mail: [e-mail] 

VAT number: 418 9533 69 

2. What does this privacy policy do?

This Privacy Policy applies to the personal data we collect and process through your use of our website, the Bipi app, any other online channels Bipi operates (together the "Properties") and any interactions you have with us. You will be referred to as "you", "user" or "users" throughout this Privacy Policy. The term "Services" shall mean the provision of vehicle leasing services by BiPi to the user.

Please carefully read this Privacy Policy, which sets out the personal data we collect, why and how we process your personal data and what your rights are in relation to your personal data.

3.- Obligatory provision of data

The data requested by BIPI through any of the channels provided are, in general, obligatory (unless otherwise specified in the required field) in order to fulfil the purposes for which they are being collected.

Therefore, if they are not provided or are not provided correctly, these requests cannot be met and you may not be able to use the Services, although you may freely view the content of the Website.

4.- For what purposes will BIPI process the user's data?

• Providing the Services you order from us.

BIPI collects and uses your information to manage your use of the Services and the relationship between us, including:

• managing your orders and subscriptions for our Services.
• delivering our Services you have ordered.
• Contacting you to help you complete an order or use the payment process successfully.
• Contacting you to arrange delivery of the car you have ordered.
• Suspend the provision of Services to you and/or immobilize the vehicle in accordance with the Terms of Use
• Contacting you to support the Services and for customer retention for instance to offer you a renewed or modified subscription when you return a car.

When we collect the above noted personal data, we are doing so for the performance of the contract with you and, for customer retention, in pursuing our legitimate interests in extending and renewing subscriptions.

• To assess your financial eligibility

BIPI carries out credit reference and fraud checks to protect our company against the risk of users not paying the subscription fees for the Services.We currently consult Equifax's credit check database for this purpose.

This will involve us creating a profile in relation to your ability to meet the payment obligations and any fraud risk. This result will be obtained on the basis of objective criteria.We do not consider your lifestyle, preferences, or interests in assessing financial eligibility.

We will use a third-party provider to consider your financial suitability of the Services and your risk of non-payment whilst you are a user (for example, if you are late in making payments to BIPI, if your personal circumstances change in ways that make it harder for you to make payments when required, or if you have problems making payment of debts owed to third parties). The third-party will do this by way of an automated process.You can object to the automated processing and require a human assessment of your financial eligibility by exercising your rights as set out in section 10 of this policy.

The lawful basis we rely on when assessing and monitoring the user's financial risks, by consulting the EQUIFAX database, is our legitimate interest in minimizing the financial risks we are exposed to during the provision of our Services.

With your consent, we may also use the information from your principal bank account(s) made available via Open Banking to i) confirm your identity and ii) determine whether you are in a financial position to subscribe to our Services. The consent we obtain from you is valid for 90 days and you are able to revoke this consent at any point.The access would involve our partner Consents Online analyzing the balance of your account over time, payments into and payments out of your account (including details of the payer and recipients), overdraft limit, pending transactions to assess the affordability of any subscription you request.Consents Online will access this information on our behalf and provide it to us.We would analyze this information over the previous 12 months and will retain this information for 6 years from the date that you no longer have a subscription with us.Consents Online would also have access to your account name, number and sort code and other names linked to your account. In exceptional circumstances we may offer a lower cost Service if one is available, or we may deny access to the Services based on the information received. If you do not give us your consent to access the information made available via Open Banking, we may in some circumstances deny access to our Services altogether.

We work with a partner Consents Online Limited, part of the Equifax Group, who provide a secure way to gain real-time access to your bank account(s) in order to transmit the information to us. Consents Online Limited is authorized by the UK Financial Conduct Authority (Firm Reference Number 792642 as a Registered Account Information Service Provider. Their privacy policy which explains how they use your information when accessing your bank account(s) is here: https://consents.online/Privacyand their terms of use are here: https://consents.online/Terms .

The lawful basis we rely on when accessing bank account information through Open Banking is the taking of steps at your request prior to entering into a contract with you and our legitimate interest in minimizing the financial risks we are exposed to during the provision of our Services.

• Verifying your identity

UK anti-money laundering regulations require us to verify the identity of our users, and this is why we ask for scans of certain ID documents when you apply to become a user.We will check your documents against third party ID verification services. We may need to refresh ID checks while you are a user.

We process your personal data in connection with ID checks because it is necessary to comply with the legal obligations to which we are subject.

• Responding to questions raised in the contact forms or other ways

If you raise any type of question, your data will be processed in order to manage, process and respond to your requests and queries.

The lawful basis we rely on when responding to your requests is our legitimate interest to ensure you are able to use the Properties, Website and Services and to understand how we can improve and for the performance of the contract with you.

• Dealing with incidents or emergencies arising from the activities of users

On the rare occasion that an incident occurs or a compliant is received in connection with the Services and/ or the Properties, we may need to:

• Monitor the user's activity for security and insurance purposes and to ensure compliance with our policies (e.g. geolocation of the vehicle may be communicated to us automatically if the vehicle leaves the permitted area, is placed on unauthorised methods of transport or in case of non-payment of fees by the User).
• Analyse and manage incidents and complaints.
• Communicate with complainants, users and others affected by an incident.

All processing derived from this purpose will be based on our legitimate interest to ensure that the Services and/ or the Properties are not used for illegal purposes or contrary to what has been agreed and, in the event of such use, to manage, process and resolve any illegal conduct carried out by the user and to ensure the safety and security of our users and others.

• Satisfaction surveys, and internal reports and analyses to improve BIPI's Services.

For this purpose, the following actions will be carried out:

• Making enquiries to users regarding the quality of, and their satisfaction with, the goods or Services provided by BIPI.
• Analysis and preparation of internal statistics and reports on the degree of user satisfaction, the success of commercial campaigns, user preferences as a whole, as well as on any other issue considered to be of interest. Always using data obtained directly by BIPI.

All processing derived from this purpose will be based on our legitimate interest, to be able to offer BIPI's services to users with the highest quality and best possible experience, as well as to establish mechanisms to facilitate contact and relations with us.

• Sending personalised marketing

BIPI will send commercial and promotional communications through email, text messaging and phone calls related to the Services.

The processing derived from this purpose will be based on our legitimate interest to grow our business. 

You can unsubscribe from marketing communications form us at any time by clicking on the unsubscribe link in an email or by changing your preferences in your user account or by emailing [e-mail].

Notwithstanding the above, in the event that an individual requests to receive commercial communications from BIPI and is not a user and has not previously expressed interest in our Services, their data will be processed on the basis of consent.

This consent may be revoked at any time by the user, without affecting the previous processing carried out. To revoke such consent, the user may contact BIPI via the following email address: [e-mail].

5.- Categories of personal data processed

A. Data collected directly: Bipi collects the following personal data provided by the user through the channels provided for this purpose or by telephone (broken down by the purpose of collection as set out in section 3 above:

Providing the Services you order from us, addressing your financial eligibility and verifying your identity 

• Identifying data: name of the user and other permitted drivers and driving license.
• Contact details: email, phone number of the user and other permitted drivers.
• Personal characteristics data which includes age, date of birth nationality, address, but will not include any sensitive personal information (for example in relation to your health or religious beliefs).
• Transaction data derived from the Services offered by BIPI.
• Details of the orders and subscriptions made the vehicles you have hired and the payments due and paid.
• Geolocation data relating to the vehicle you have hired
• Telematics data: including the speed at which you are driving, your locations and the distance you have driven
• Credit reference, debtor, and fraud information
• Details of the orders and subscriptions made the vehicles you have hired and the payments due and paid
• ID documents (e.g., passport, driving license)
• ID verification results from third party providers
• Approximate geographic location data (country, city or region)

Respond to questions raised in the contact forms and dealing with incidents or emergencies arising from the activities of the users:

• Identifying data: name.
• Contact details: email, phone number
• Personal characteristics data: name, address, insurance details.
• Details of the orders and subscriptions made, the vehicles you have hired and the payments due and paid. Transaction data derived from the services offered by BIPI.
• Geolocation data relating to the vehicle you have hired
• Other data provided by the users themselves through the forms provided in the established contact channels
• Economic and financial data.
• Geolocation data relating to the vehicle you have hired
• Details of your insurance Policy where not provided through Bipi.

Satisfaction surveys, and internal reports and analyses to improve BIPI's Services and sending personalised marketing.

• Identifying data: name.
• Contact details: email, phone number.
• Personal characteristics data including age, name, address and insurance details
• Details of the orders and subscriptions made the vehicles you have hired and the payments due and paid
• Economic and financial data.
• Approximate geolocation data (country, city or region).
• Navigation data.

In the event that the User provides data of third parties, he/she declares that he/she has their consent and undertakes to pass on the information contained in the Privacy Policy, exempting BIPI from any liability in this regard. However, BIPI may carry out periodic checks to verify this fact, adopting the corresponding due diligence measures, in accordance with data protection regulations.

B. Data collected through third parties:

To assess your financial eligibility: from the EQUIFAX credit reference (or other equivalent providers we may subsequently use) system, which provides information on the existence of unpaid debts, creditworthiness and any suspected fraudulent activity with other companies.

• Identifying data: including name, residential address(es).
• Economic and financial data (including those related to third parties)

To assess your right to drive: we will check the DVLA database to ensure your driving license is current and valid

C. Data collected automatically through your interaction with the Properties and/or the Services

• Analytics services to improve BIPI's Services
• Technical information such as the Internet protocol (IP) address used to connect your device to the Internet, browser type and version, browser plug-in types and versions, operating system, your device make and model, an App ID, App version and platform version. As well as the content of a request we also receive information associated with the request such as time zone setting and date and time.
• Interaction information about your use of the Properties and the Services including the full Uniform Resource Locators (URL), clickstream to, through and from the Properties (including date and time), products and content you viewed or searched for, content response times, download errors, length of visits to certain content, interaction information (such as scrolling, clicks, and hover-overs), time and date of orders and methods used to browse away from content.

We use cookies and other similar technologies to collect and store certain information about you which includes personal data. These typically involve pieces of information or code transferred to or accessed from your device to store and sometimes track information about you.

Cookies and similar technologies enable you to be remembered when using that device to interact with online services and can be used to manage a range of features and content. They allow us to distinguish you from other users of our Properties which helps us to provide you with a good experience and also allows us to improve our Properties and see how they are performing. Cookies also allow us to secure areas of our Properties.For full details of the cookies and equivalent technologies we use, please refer to our Cookies Policy: https://help.bipicar.com/hc/en-gb/articles/4420974103185-Cookies-policy.

6.- Who do we share your personal data with?

The user's data may be communicated to:

• public authorities, police and other law enforcement agencies where required by law or where in our opinion it is appropriate for the safety or security of our Users, their passengers, other road users and/or others, for the reporting of potential illegal activity or the safe return of our vehicles.
• Insurance companies when a new user sign up or a new subscription or rental is ordered.If there is a claim on the insurance relating to a vehicle, we will provide details of the claim to the insurers.

• Our service providers such as organizations who support the Properties we offer through our website and only process your personal data on our behalf, following our instructions and in accordance with data protection laws, such as analytics providers, marketing platforms and hosting providers.
• Potential investors, or if we sell or buy any business or assets then a potential seller or buyer.
• Our auditors, legal advisers and other professional advisers.
• The companies of the business group to which BIPI belongs, for instance our parent company Bipi Mobility Sociedad Limitada.
• Our partners (companies that own the leased vehicles) so that they can manage their fleet, for which it is necessary to share the data of the lessees and drivers of the vehicles, as well as related to any accident or circumstance that could affect the correct use of the vehicle.

Likewise, in the event that certain vehicles are contracted, BIPI will communicate to the Partners the result of the risk analysis carried out, so that they can be aware of the financial and other risks existing on their fleet.

• We will share personal data relating to your financial eligibility, payment history and unpaid fees to credit reference agencies (currently Equifax), who will add the information to their records. They share this information with lenders and guarantors of credit and other companies who may use it to assess an application for loans, banking, hire facilities or insurance which you or a member of your household may make in the future.For more Information, see Equifax.

In addition, BIPI will rely on the collaboration of third-party service providers who may have access to user´s personal data and who will process the data on behalf of and for the account of BIPI in connection with the provision of services. BIPI has strict procedures for the selection of suppliers in order to comply with its data protection obligations, including the subscription of the corresponding data processing agreement according to art. 28 of the GDPR. Specifically, BIPI will rely on the provision of services by third party suppliers who carry out their activity, including but not limited to, in the following sectors of activity: legal advice and technological and computer services, as well as management and support services.

7.- International data transfers

BIPI does not plan to transfer data outside the UK and European Economic Area (EEA). However, if we do decide to transfer users' personal data to third parties located outside the UK and EEA, we will, in the cases where there is no adequacy decision in force, ensure that transfer of data will be carried out in compliance with the applicable data protection regulations. In particular, by subscribing standard contractual clauses approved by the European Commission.

8.- Data retention

The user's data will be kept for the following periods:

Data provided to complete a purchase:

• The data provided to manage, process, send and follow up the purchases made will be kept during the contractual relationship and, once the contractual relationship has ended, during the period of limitation of the legal actions that may arise.
• The data used to contact the user to finalize the order or to make the payment will be kept for up to 6 months following theend of the subscription .
• The bank card details in the case of telephone purchases will only be processed at the time when the purchase is completed, after which the data will be deleted immediately.

Data provided through contact formsshall be kept for the necessary period to process and reply to the request and, once this period has expired, for the prescription period of the legal actions arising from the aforementioned request. 

Data used for profiling purposes: will be kept for the necessary period to process and reply to your request and, once this period has expired, for the prescription period of the legal actions arising from the aforementioned request.

Vehicle location data: will be kept for 6 months after the termination of the subscription

This information will be retained for a period of 6 months and deleted thereafter except where we require to retain this information for the purposes of dealing with an ongoing issue related to:

• Non-payment;
• theft;
• a criminal investigation;
• a law enforcement request; or
• a missing vehicle.

Preparation of quality and satisfaction surveys data shall be kept for as long as the user does not revoke the consent given for this purpose.

Bank Account Information:we will delete your bank account information 6 months after the termination of the subscription. 

Data used for sending commercial communications will be processed until the users opposes or revokes their consent.

9.- User Responsibility

The user:

• confirms that he/she is over eighteen (18) years of age and that the data provided to BIPI are true, accurate, complete and updated. For these purposes, the user is responsible for the accuracy of all the data provided and shall keep the information provided suitably updated, in such a way that it corresponds to the user´s real situation.
• confirms that he/she has informed the third parties from whom provided data and of the aspects contained in this Privacy Policy (for instance other permitted drivers). Likewise, the user confirms that he/she has obtained their authorization to disclose their data for the above purposes to BIPI.
• is responsible for any false or inaccurate information provided through the contact channels enabled and rentals and subscriptions may be refused or cancelled if any false or inaccurate information is given.

10.- Exercise of rights

You can send a letter to BIPI, at the address indicated in the heading of this Privacy Policy, or you can e-mail us at the following address: [e-mail] at any time and free of charge, in order to:

• Revoke consents granted.
• Obtain confirmation as to whether or not BIPI is processing personal data concerning the user.
• Access to personal data.
• Rectify inaccurate or incomplete data.
• Request the deletion of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• Obtain from BIPI the limitation of data processing when any of the conditions provided for in the data protection regulations are met.
• Request the portability of the data provided by the user in those cases provided for in the regulations.
• Object to any decision made solely through automated processing (for instance in relation to your financial eligibility to become a user of the Services.

Where the data subject considers that BIPI has infringed the rights recognized by the applicable data protection regulations, the user may lodge a complaint regarding the protection of his or her personal data to the relevant supervisory authority or other regulator by contacting them via contact details indicated on their website. In the UK, the supervisory authority is the Information Commissioner's Office (ICO). You can visit their website at www.ico.org.uk.

11.- Security measures

BIPI will treat the user's data at all times in an absolutely confidential manner and will keep the mandatory duty of confidentiality with regard to the same, in accordance with the provisions of the applicable regulations, adopting for this purpose the necessary technical and organizational measures to guarantee the security of your data and prevent its alteration, loss, processing or unauthorized access, taking into account the state of the technology, the nature of the data stored and the risks to which they are exposed.

12.- Changes

BIPI reserves the right to revise its Privacy Policy at any time it deems appropriate, in which case it will be communicated to users. For this reason, please check this privacy statement regularly to read the most recent version of BIPI's Privacy Policy.

Last update: November 2022.