Privacy Policy - Oply

Privacy Policy of Oply GmbH

  • General Information
    • Responsible Body & Data Protection Officer

      Below we explain to you which personal data is collected and processed by us when using our services and offers.


      We are:


      Oply GmbH

      Alexanderstrasse 9, 10178 Berlin

      Tel : +49 30 54 44 50 30

      Email : service@oply.com


      Our company data protection officer is:

      Dipl.-Ing. Sven Meyzis

      Schierheisterberg 2b, 21224 Rosengarten

      Tel : +49 40 2109 1514

      Mobile : +49 176 20835488

      Email : S.Meyzis@ITDSB.de

      Web : www.ITDSB.de


      Personal data are individual details about personal or factual circumstances of a specific or identifiable natural person, this means all information that relates to a person.

    • Legal Basis

      As far as a legal basis is mentioned in this Privacy Policy, they relate to the General Data Protection Regulation. This comes into effect from May 25, 2018. Prior to this, the corresponding provisions of the Federal Data Protection Act apply without us naming them.


      We collect and process personal data based on the following statutory regulations:

      • Consent according to Article 6 paragraph 1 (a) General Data Protection Regulation (GDPR). Consent is any voluntary expression of intent, in an informed and unequivocal manner, in the form of a statement or other unambiguous confirmatory act, which indicates that the data subject consents to the processing of his personal data.
      • Necessity to fulfill the contract or carry out preparatory actions in accordance with Article 6 para. 1 (b) GDPR, this means that the data is required so that we can fulfill the contractual obligations to you or we need the data to prepare a contract closure with you.
      • Processing to fulfill legal obligations under Article 6 para. 1 (c) GDPR,, this means that a processing of the data is required by law or other regulations.
      • Processing for the protection of legitimate interests in accordance with Article 6 para. 1 (f) GDPR, this means that processing is necessary to safeguard legitimate interests on our part or by third parties, unless the interests or fundamental rights and freedoms on your part that require the protection of personal data prevail.
    • Rights of affected

      You are entitled to the following rights with regard to the processing of data by us in accordance with the respectively listed articles of the General Data Protection Regulation:

      • Right of access by the data subject to Art. 15 GDPR
      • Right to rectification according to Art. 16 GDPR
      • Right to erasure (“right to be forgotten”) in accordance with Art. 17 GDPR
      • Right to restriction of processing according to Art. 18 GDPR
      • Right to data portability according to Art. 20 GDPR
      • Right to object according to Art. 21 GDPR

      Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of your place of residence, employment or the place of the alleged infringement, if you believe that the processing of the personal data is violating the GDPR.

    • Data Erasure and Storage Duration

      The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage is deleted. In addition, storage may take place if provided for by the European or national legislator in EU regulations, laws or other regulations to which the processor is subject. Blocking or deletion of the data also takes place if a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.

  • Concrete Data Processing
    • Data collection when visiting the website
      • Scope of data processing

        When visiting our website, the following data is collected and stored by our web server:

        • Information about the browser type and version used
        • The operating system of the user
        • The Internet service provider of the user
        • The IP address of the user
        • Date and time of access
        • Websites from which the user’s system accesses our website
        • Websites accessed by the user’s system through our website

        The data is stored in the log files of our system. A storage of this data together with other personal data of the user does not take place.

      • Legal basis

        The legal basis for processing the data is Art. 6 para. 1 (f) GDPR. The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR therefore lies in the functionality of our website and its availability.

      • Purpose of data processing

        The temporary storage of the IP address by the system is necessary to allow delivery of the website to the computer of the user. To do this, the user’s IP address must be kept for the duration of the session.

        The data is stored in order to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

      • Duration of storage

        The logfiles will be deleted after seven days at the latest, unless there is a need to keep the data for the aforementioned purpose due to specific events.

        Storage beyond that is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment to a specific user is no longer possible.

      • Objection and removal possibility

        The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no possibility of objection by the user.

    • E-Mail contact
      • Scope of data processing

        If you purchase goods or services on our website and deposit your e-mail address, we may subsequently use this information to send you product information by e-mail regarding the booked product or similar products of the processor. In such a case, only direct advertising for our own similar goods or services will be sent by e-mail. We will also send you emails related to your bookings, such as: Reservation confirmations, warnings before the expiration of reservations, changes regarding bookings etc.

        It is possible to subscribe to a free newsletter on our website or in our app, which contains direct advertising for our products or products of our cooperation partners. When you sign up for the newsletter, the data from the input mask will be transmitted to us or the e-mail address already stored will be used. In this case, the date and time of registration for the newsletter and the IP address used are also stored. As part of the confirmation of the newsletter registration, the date and time at which you click on the confirmation link for the newsletter registration as well as the IP address used will also be saved.

        When sending the product information, your e-mail address will be forwarded to the external service provider “Braze Inc.”, who will be responsible for sending the newsletter on our behalf. Any further use is not made by the service provider. The service provider is located outside the European Union in the United States of America.

      • Legal basis

        The legal basis for the processing of the data when sending out the newsletter due to the prior acquisition of goods or services is Article 6 para. 1 sentence 1 (f) GDPR in conjunction with § 7 para. 3 UWG.

        The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR is therefore in direct advertising and the increase in sales to existing customers.

        The legal basis for processing the data when registering directly for the newsletter is Art. 6 para. 1 (a) GDPR.

        The legal basis for contacting in connection with current bookings is Article 6 para. 1 (b) GDPR.

        The legal basis for the transfer of the data to the shipping service provider is Article 28 para. 3, (6 and 7, Article 46 para. 2 (c) GDPR. The standard data protection clauses of the EU Commission are used in contractual relation with the provider.

      • Purpose of data processing

        The purpose of storing the e-mail address is the possibility of electronic contact for advertising purposes. The date and IP address of the registration as well as the confirmation of the registration will be recorded in order to document the consent to the newsletter shipment and to prevent misuse. Furthermore, for information regarding ongoing bookings, the proper execution of the contract is the purpose of the contact.

        The transfer to the service provider is done for the purpose of sending the newsletter as a mass mailing.

      • Duration of storage

        If we have received your e-mail address as part of the purchase of goods or services, it will be used for the delivery of advertising until you object to further use.

        As far as you have expressly consented to the receipt of the newsletter, we will only delete or block the e-mail address for the advertising mailing, if you revoke your consent. The data confirming the order of the newsletter will be stored for the same amount of time.

        The e-mails sent, as far as business letters are concerned, are stored for the duration of retention periods of the Tax Code or the Commercial Code. The further e-mails are deleted as soon as no further response by the user has to be expected.

      • Objection and removal possibility

        You may object or revoke your consent to the use of the e-mail address for advertising purposes at any time, without incurring any costs beyond the charges of your communications tariff. You can object to the use of any advertising mail by clicking on a link provided there with effect for the future. You may also opt-out of advertising for future use by emailing service@oply.com. In the case of opposition by e-mail, the implementation of the cancellation or blocking can take up to 3 working days; In this period, you may still receive advertising emails. You can not contradict the use of the e-mail address for addressing in the context of the performance of the contract or storing of business letters. If you no longer wish this, you would have to delete the account at Oply or have it deleted, otherwise we would not be able to properly fulfil the contract.

    • Contact Form
      • Scope of data processing

        The Oply website has a contact form which can be used for electronic contact. If you enter data in the input mask, these are transmitted to us and stored. This data is: your name, your e-mail address, if necessary your telephone number, the nature of your request and your individual message to us. In addition, the date and time of your message is automatically recorded.

        Alternatively, contact via the provided e-mail address is possible. In this case, the user’s personal data transmitted by e-mail will be stored.

      • Legal basis

        The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 para. 1 (f) and if necessary also (a) GDPR. If the e-mail contact aims to conclude a contract, the additional legal basis for the processing is Art. 6 para. 1 (b) or (c) GDPR.

        The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR lies in answering a customer inquiry or answering a contact request on other topics.

      • Purpose of data processing

        The purpose of the data storage is the contact at the request of the communication partner.

      • Duration of storage

        The data will be stored for as long as necessary to complete the request. Insofar as these are commercial letters subject to commercial and tax law, these are also stored in accordance with the statutory retention periods.

      • Objection and removal possibility

        You have the option at any time to revoke your consent to the processing of personal data with effect for the future or to object to further use. The contradiction can be explained by email to: service@oply.com. A deletion can only take place, as far as no legal storage period is given; in this case, the data will be locked for another use. In such a case, the conversation cannot continue.

    • Google Analytics
      • Scope of data processing

        The Oply website uses Google Analytics, a web analytics service provided by Google Ireland Ltd. ("Google"). This software collects information about how you use the
        website and compiles various statistics. The increased usage data include in particular the concrete selection of
        links, the length of stay on individual pages and the order of use of the website, the frequency of the page request.
        This data is collected together with your IP address. The IP address provided by Google Analytics as part of Google
        Analytics will not be merged with other Google data.

        Google Analytics uses so-called "cookies", text files that are stored on your computer and that allow an analysis of the use of the website by you. The information generated by cookies about your use of this website is usually
        transmitted to a Google server in the USA and stored there.

        We have activated a so-called IP anonymization on the Oply website, this means that the IP address will be
        shortened beforehand by Google within member states of the European Union or in other contracting states of the
        Agreement on the European Economic Area prior to retransmission to the USA.

        Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there. Google itself describes here https://www.google.com/policies/privacy/ its data processing activity.

      • Legal basis

        The legal basis for the processing of data when using the website is Article 6 para. 1 (f) GDPR.

        The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR is a customer-oriented design of the website, which meets the requirements of the users and takes their user preferences into account.

        The legal basis for the transfer of data to Google are Article 28 para. 3, and in case of any subprocessing by Google Inc. (US) Article 45 para. 3 GDPR. The Google Inc. is certified under the Privacy Shield Framework and is therefore
        subject to the EU Commission's decision on adequacy (Implementing Decision 2016/1250), this means that the
        data protection level of the service provider is recognized as being equivalent to the GDPR, although it is based in the
        USA.

      • Purpose of data processing

        The purpose of the processing is to analyse this website and the usage behaviour of its visitors.

      • Duration of storage

        The data is already anonymized directly after the survey. Personal data is therefore collected only in the context of the transfer and not permanently stored.

      • Objection and removal possibility

        You can prevent the storage of cookies, including the generation and transmission of data to Google, by restricting or prohibiting the use of cookies in your browser software. This may result in the deactivation of non-Google-related cookies as well as the inability to use all functions of this website to the full extent.

        You can prevent the collection of the data generated by the cookie and your use (including your IP address) and their transmission to Google as well as the processing of this data by Google by downloading the browser plugin available under the following link and to install

        [http://tools.google.com/dlpage/gaoptout?hl=en].

    • Call Center
      • Scope of data processing

        Insofar as you use the services of our call center, our employees will collect the information necessary for the fulfilment and answering of your request. This includes in particular your first and last name, e-mail address, telephone number, any reservation number and other information about the booking process.


        If you agree to a recording, we will record and evaluate individual calls for quality assurance purposes.


        The data is collected and processed by a call center service provider based in the European Union Your data may also be transmitted to our parent company, Examotive S.A., based in Luxembourg, and processed there on our behalf.
        Our service providers use an online service called “Zendesk” provided by us to communicate with us. We
        exchange the personal data contained in customer support request as well as those required to solve such requests
        using this online service. Zendesk is operated by Zendesk Inc.that has its place of business in the United States of
        America.

      • Legal basis

        The legal basis for the collection of personal data and your concerns is Art. 6 para. 1 sentence 1(b) and (c) GDPR.


        The legal basis for the record of the talks is Art. 6 para. 1 (a) and (f) GDPR.


        The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR is in the quality control of the Call Center.

        The processing of the data by the call center service provider and the Examotive S.A. is based on the legal basis
        of Article 28 para. 1 and para. 3 GDPR.

        The legal basis for the transfer of the data to Zendesk Inc. is Article 28 para. 3, 6 and 7, Article 46 para. 2 (c) GDPR. The standard data protection clauses of the EU Commission are used in contractual relation with the provider.

      • Purpose of data processing

        The purpose of the data processing is the initiation or execution of bookings and reservations, as well as the solutions of any problems in the use of the services of Oply. With regard to the recording of the calls, the purpose is to ensure a consistently high quality of customer service. The sent messages are archived as business letters and stored for the duration of the legal retention period. Data that are not required for the execution of the contractual relationship will be deleted immediately.

      • Objection and removal possibility

        You may withdraw your consent to the recording of the discussions at any time, after which we will promptly delete the recording, as long as there is no other reason for continued storage.

        You have the option at any time to revoke your consent to the processing of personal data from your telephone or to object to further use. You can explain the objection by e-mail to: service@oply.com or call the call center. A deletion can only take place, as far as no legal storage period is given; in this case, the data will be locked for another use. In such a case, the processing of your request can not be continued. You may not revoke or withdraw consent or object to the storage of any business letters.

    • Registration and Ownership of the Oply-Account
      • Scope of data processing

        To use Oply’s car-sharing service, you must first register as a user. To carry out the registration, you will collect and process the following personal data; First name and surname, address, e-mail address, date of birth, if applicable telephone number as well as a user name and a password assigned by you. These data are stored together under a user profile (account). The data are recorded in a database of our parent company, Examotive S.A., based in Luxembourg, and processed there on our behalf. The Examotive S.A. uses the cloud service of Amazon Web Services, Inc. (“Amazon”), headquartered in the United States of America, to store the data.

      • Legal basis

        The legal basis for the aforementioned data is Article 6 para. 1 sentence 1 (b) GDPR. The registration process is the execution of a pre-contractual action, namely the conclusion of the contract with us. The permanent registration as a user enables the fulfilment of the contract, namely the performance of contractual obligations.

        The transfer of the data to the Examotive S.A. and their processing by them takes place on the legal basis of Article 28 para. 1 and para. 3 GDPR.

        The legal basis for the transfer of the data to Amazon are Article 28 para. 3, Article 45 para. 3, and Article 46 para. 2 (c) GDPR. Amazon is certified under the Privacy Shield Framework and is therefore subject to the EU Commission’s decision on adequacy (Implementing Decision 2016/1250), this means that the level of privacy at Amazon is recognized as equivalent to the GDPR, although Amazon is based in the US. In addition, the standard data protection clauses of the EU Commission are used in a contractual relationship with the provider.

      • Purpose of data processing

        The data processing takes place for the purpose of the execution of pre-contractual measures as well as the contract fulfilment. Without receiving this information, we will not be able to contact you as a user to complete a contract and identify the user. Furthermore, we need this information in order to perform our contractual obligations (for example, to provide you personally with the booked rental car).

      • Duration of storage

        Die Speicherung der Daten erfolgt solange der zwischen Ihnen und uns geschlossene Rahmenvertrag besteht. Nach Beendigung des Rahmenvertrages werden die Daten unverzüglich gelöscht.

      • Objection and removal possibility

        There is no right of objection to the processing of data during the registration and during the period of ownership of your Oply account, as the data processing is required to initiate the conclusion of the contract with you or to fulfil the contract. An objection or revocation therefore automatically leads to the termination of the contractual relationship.

    • Registration – Driving License Validation: Jumio
      • Scope of data processing

        The conclusion of single rental agreements with Oply requires that you have provided proof in the course of driving license validation that you hold a valid driving license. To carry out the driving license validation we have commissioned the company Jumio Corporation (“Jumio”). As part of your driving license validation process, Jumio will process data about you at the company’s headquarters in California, USA, including the photograph of you which you have made and sent, and the details printed on the front and back of your driver’s license, such as the validity of the driver’s license, vehicle classes and the photo of you. Jumio only gives us the driving license number, the information about the validity of the driving license and your date of birth.

      • Legal basis

        The processing of the data takes place on the legal basis Art. 6 para. 1 (b) GDPR, as the determination of the existence of a driving license is absolutely necessary for the performance of the contract.


        The transfer of the data and its processing by Jumio is based on Articles 28 para. 3, 6 and 7, Art. 46 para. 2 (c) GDPR. The standard data protection clauses of the EU Commission are used in contractual relation with the provider.

      • Purpose of data processing

        The data processing is carried out for the safety of the general public, the driver (renter) and the smooth flow of traffic, as a driver without a valid driving license is a higher risk for road safety – both for themselves and for other road users – and the driver may also cause obstructions to the smooth flow of traffic. Furthermore, the processing of the relevant data serves to limit potential liability risks for Oply.

      • Duration of storage

        The data will be stored by Jumio solely for the duration of the use of the Oply services for the purpose of proving the driving license test.

      • Objection and removal possibility

        You may object to the use of the driver’s license validation data at any time with future effect, without incurring any charges beyond the charges of your communication rate. The objection can be explained by email to: service@oply.com. In case of objection the data will be deleted or blocked. The implementation of the cancellation or blocking can take up to 3 working days; during this period, processing of the driver’s license validation data may still occur. If the driving license validation is not possible due to an objection to the data processing, you cannot conclude any (further) single rental agreements with us before a driving license validation is carried out again.

    • App usage: Booking & Usage
      • Scope of data processing

        When booking a vehicle via the Oply app, we collect the data related to the booking, in particular in the case of the planned booking the time of booking, the desired zone in which the vehicle can be picked up, the desired vehicle type, and the desired booking duration; in the case of Flex -Booking the specific vehicle and reservation duration or the extension of the reservations. Likewise, all declarations and related acts related to the completion or termination of a booking are recorded and stored at the respective time, e.g. the cancellation of a booking, the completion of the journey and locking of the vehicle, opening of the vehicle.


        These data are stored on the IT system of our parent company, Examotive S.A. processed in Luxembourg on our behalf.

      • Legal basis

        The legal basis is Art. 6 para. 1 sentence 1 (b) GDPR.


        The transfer of the data to the Examotive S.A. and their processing by them takes place on the legal basis of Article 28 para. 1 and 3 GDPR.

      • Purpose of data processing

        The purpose of the processing of this data is the completion of individual bookings as well as the technical execution of the bookings and the proof of performance to the customer.

      • Duration of storage

        The billing-relevant data is stored for the duration of the retention periods for business letters in accordance with the Federal Tax Code and the Commercial Code. All other data will only be stored for as long as necessary to fulfill the purpose.

      • Objection and removal possibility

        A right to object to the data processing for the use of the app for bookings and for the execution of the bookings does not exist, since the data processing is required to initiate the conclusion of the contract or to fulfill the contract. Therefore, an objection or revocation automatically leads to the termination of the contractual relationship. Your booking history is stored for at least a term of 4 months after the end of the contractual relationship in order to process possible fines or public offenses. You can not object to the storage of business letters

    • App usage: AppsFlyer
      • Scope of data processing

        We use a service to analyse the use of the app by you. The analysis service is provided by AppsFlyer Ltd. (“AppsFlyer”), a company based in Israel.

        The use of this analysis service is contracted through our parent company, Examotive S.A. based in Luxembourg.

        The analysis services provided by AppsFlyer include tracking of your internal customer number, the country in which you use the app, the city in which you use the app, the zip code in which area you use the app, latitude and longitude at which you use the app, the nearest geographical area in which Oply vehicles are available, the internal number of vehicle you select, the zone in which the selected vehicle is located, the duration of a scheduled booking, the category of the booking (“Flex” / “Plan “), the booked vehicle model, the internal number of the booked vehicle, the booking number, the reasons for cancelling a reservation (cancellation or expiration), the confirmation of the existence of a customer account or of a verified payment method, the cost of the respective booking and your e-mail address.

        The data will be collected anonymously until the completion of your registration, this means that the IP address is only recorded in a shortened way, or it is shortened immediately after transmission. The personal reference results only from the storage to your account data after completion of the registration.

      • Legal basis

        The legal basis for the processing of data for the analysis of user behaviour is based on Art. 6 para. 1 sentence 1 (f) GDPR. The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR lies in improving the usability, security and stability of the Oply app for users as well as the prevention of fraudulent registrations.

        In addition, the legal basis is also your consent to the processing pursuant to Art. 6 para. 1 sentence 1 (a) GDPR in the scope of special data usage conditions.

        The transfer of the data to the Examotive S.A. and the data processing by them takes place on the legal basis of Article 28 para. 1 and 3 GDPR.

        The transfer of the data to AppsFlyer by Examotive S.A. and their processing by AppsFlyer is based on the legal basis of Article 28 para. 1 and 3, Article 45 para. 1, 3 and 9 GDPR, since the place of processing by AppsFlyer is Israel and Israel is a safe third country within the meaning of the General Data Protection Regulation. The European Commission has already stated, prior to the adoption of the General Data Protection Regulation pursuant to Article 25 para. 6 of the Data Protection Directive 95/46 / EC, that Israel guarantees an adequate level of protection with regard to the protection of privacy and the freedoms and fundamental rights of individuals.

      • Purpose of data processing

        The processing of this data serves to analyse and understand users’ usage of the Oply app, user recovery analysis, and to generate lifetime value reports (ie, reports on sales to users from different sources for the use of Oply Services), to quantify the costs, to estimate the return on investment (ie the profit achieved by ads compared to the expenses for the ads), to draw up retention reports (ie reports on the durable and efficient retention of users), to create cohort reports (reports on subdividing users into specific users and audiences), to create performance reports (ie technical performance reports for the Oply app), to create activity reports (ie frequency reports, the manner of using the Oply app), and to analyse in which places the establishment of an Oply-offer would be useful. Furthermore, the analysis serves the purpose to control Oply marketing campaigns and to prevent or discover fraudulent registrations.

        The transfer of the data to AppsFlyer and the processing of the data made by AppsFlyer takes place for the purpose of evaluating the large volumes of user data.

        There is no further transfer of data to third parties except AppsFlyer and Examotive S.A..

      • Duration of storage

        The data is aggregated into cumulative reports during processing. A reference to individual users is not established in the evaluation of the data. We store the user behaviour for the above purpose until the account with Oply is terminated.

      • Objection and removal possibility

        You may object to the use of data for purposes of the usage analysis at any time, with future effect, without incurring any costs beyond the charges of your communications plan. The objection can be sent by email to: service@oply.com or use the appropriate setting in the app. In the event of opposition or revocation, the data will be deleted or blocked, but this is associated with a general blocking of the data analysis by Appsflyer in other applications. The implementation of the cancellation or blocking can take up to 3 working days; during this period, usage analysis may still be executed.

    • App usage: Braze
      • Scope of data processing

        We use a service to analyse the app usage or to send emails or other messages, e.g. via push message, based on your use of Oply services.

        The service is provided by Braze Inc., located in the United States of America.

        The use of this analysis service is contracted through our parent company, Examotive S.A. based in Luxembourg. Accordingly, Examotive S.A. has access to this data.

        In particular, we provide the supplier “Braze” with stock data which is required as part of the e-mail address. This includes data such as the customer number, name and surname, date of birth, e-mail address, country of residence and city, the last vehicle model booked, the zone in which the last vehicle was booked and its internal number, as well as the name and number of the zone in which you are on the phone when you open the app.

        The Braze software collects the following data: the nearest geographical area where Oply offers its services, the city where a vehicle was currently being used, the duration of the booking, whether it was a Flex or Plan booking, the Vehicle model which has been used, whether the customer is registered with Oply and whether a verified payment method is deposited or not, the price of the current booking, the end reason of a reservation (cancellation or expiration) and if a booking has been cancelled, a reservation has expired or a booking has been successfully completed.

        This data is used in combination to send you messages by email, in the app or as a push message in certain situations, e.g. to inform you about the expiration of a reservation, to congratulate you on your birthday or to point out alternative booking options.

      • Legal basis

        The legal basis for the processing of data for the analysis of user behaviour is based on Art. 6 para. 1 sentence 1 (f) GDPR. The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR lies in improving the usability, security and stability of the Oply app for users.

        In addition, the legal basis is also your consent to the processing pursuant to Art. 6 para. 1 sentence 1 (a) GDPR in the context of special data usage conditions.

        The transfer of the data to the Examotive S.A. and their processing by them takes place on the legal basis of Article 28 para. 1 and 3 GDPR.

        The legal basis for the transfer of the data to Braze are Article 28 para. 3, Article 45 para. 3, Article 46 para. 2 (c) GDPR. Braze is certified under the Privacy Shield Framework and is therefore subject to the EU Commission’s decision on adequacy (Implementing Decision 2016/1250), this means that the data protection level at Braze is recognized as equivalent to the GDPR, although Braze is based in the USA. In addition, the standard data protection clauses of the EU Commission are used in a contractual relationship with the provider.

      • Purpose of data processing

        The processing of this data serves the purposeful addressing of the users depending on their usage behaviour for advertising purposes or for the proper execution of the contract, as far as the user is to be notified on a contractual basis.

        There is no further transfer of the data to third parties with the exception of Braze and the Examotive S.A..

      • Duration of storage

        The collected data will be deleted within 18 months if no e-mail is sent, as they will no longer be required for contact. In the case of sending a message to the customer, this message is archived as part of the customer communication. Additionally, cumulative reports on usage behavior are compiled from the data, but they are used anonymously and unlimited in time.

      • Objection and removal possibility

        You may object or revoke your consent to the use of the usage analysis data at any time, without incurring any costs beyond the charges of your communications plan. The objection can be sent by email to: service@oply.com. In case of objection the data will be deleted or blocked. The implementation of the cancellation or blocking can take up to 3 working days; during this period, usage analysis may still be executed.

    • App- Push and email Messages: Firebase
      • Scope of data processing

        We use a service to send contract-related emails or other messages, e.g. via push message in connection with your
        use of the Oply app. These are, in particular, booking confirmations, reservation confirmations, driving test
        certificates or other contractually relevant messages. The Firebase service is provided by Google Ireland Ltd..,
        based in the European Union but may be transferred to the United States of America for processing.

        The use of this analysis service we have contracted through our parent company, the Examotive S.A. with headquarters in Luxemburg.

        In particular, we provide the provider of “Firebase” with inventory data that is required in the context of addressing by e-mail, push message or SMS. This includes data such as the customer number, first name and last name, date of birth, e-mail address, country of residence, last vehicle model booked, the zone in which the last vehicle was booked and its internal number, and the name and number of the zone in which you are when you open the app, the status (start time, end time, cancellation, etc.) of a current booking or reservation, the status of a driver’s license check.

        The software of “Firebase” captures the following data: your geographical location, the geographical location of the booked vehicle, your customer number, booking numbers, the booked vehicle model, time, and notification of the service provider regarding the validity of the driver’s license.

        This data is used in combination in order to send you messages via email, in the app, or as push messages in certain situations.

      • Legal basis

        The legal basis is Article 6 para. 1 (b) and (c) GDPR, the latter as far as such emails are to be archived under mandatory law, e.g. tax law.

        The transfer of the data to the Examotive S.A. and the data processing by Examotive S.A. takes place on the legal basis of Article 28 para. 1 and 3 GDPR.

        The legal basis for the transfer of data to Google Ireland Ltd.. are in case of a subprocessing by Google Inc. Article 28 para. 3, Article 45 para. 3, Article 46 para. 2 (c) GDPR. Google Inc. is certified under the Privacy Shield Framework
        and is therefore subject to the European Commission's decision on adequacy (Implementing Decision 2016/1250),
        this means that the level of privacy at Google is recognized as equivalent to the GDPR, although Google is based in the
        United States. In addition, the standard data protection clauses of the EU Commission are used in contractual
        relation with the provider.

      • Purpose of data processing

        The processing of this data serves the targeted addressing of the users for advertising purposes depending on their usage behaviour, or for the proper execution of the contract, as far as the user is to be informed on a contractual basis. Furthermore the purpose is the archiving of tax relevant business letters.

        The data is not transferred to third parties with the exception of Google Inc. and the Examotive S.A..

      • Duration of storage

        The sent messages are archived as business letters and stored for the duration of the legal retention period. Data that are not required for the execution of the contractual relationship will be deleted immediately.

      • Objection and removal possibility

        An objection is only possible in the context of the termination of the contractual relationship, since the dispatch of contract-related messages is mandatory for a proper execution of the contract. You can’t object to the storage of business letters.

    • Vehicle usage Use: Location
      • Scope of data processing

        We record the position of our vehicles. Only the position at the start of the journey and the end of the journey will be saved for your booking.


        The current location of the vehicle is determined only in case of damage or unauthorized use. This serves the safety of vehicle and user within the scope of the contract execution as well as the possibility of fast assistance by Oply.

      • Legal basis

        The legal basis is Art. 6 para. 1 sentence 1 (b) GDPR.

        In addition, the legal basis is also your consent to the processing pursuant to Art. 6 para. 1 sentence 1 (a) GDPR in the context of the special data usage conditions, in particular with regard to the storage of the start and end points of your bookings.

      • Purpose of data processing

        The purpose of the data processing is the implementation of the Oply offer. For the billing of trips, start and end locations as well as the usage duration are necessary parameters. The collection of the location data in case of damage or unauthorized use serves the safety of vehicle and user in the context of the contract execution as well as the quick possibility of the assistance by Oply.

      • Duration of storage

        The billing-relevant data are kept for the duration of the retention periods according to the Tax Code and the Commercial Code for business letters. The other data will be deleted as soon as it is no longer needed for contract execution.

      • Objection and removal possibility

        There is no right of objection to the data processing in the context of the usage of the vehicle, since the data processing is necessary for the fulfillment of the contract. An objection or revocation automatically leads to the termination of the contractual relationship, since a storage of the start and end points of the bookings without personal reference is not possible without disproportionate effort.

    • Payment: PayOne
      • Scope of data processing

        Oply works with an external payment service provider to process the payments for the Oply services. As part of the app usage the data you entered for payment (name, first name, bank, IBAN, BIC, credit card number, Paypal account, etc.) is transmitted to the payment service provider. Oply only stores the payment method and the last 4 digits of a credit card as well as their validity period or the IBAN.


        The processing of payment data and settlement takes place solely through PayOne. PayOne also informs Oply whether a payment was successful or not.

      • Legal basis

        The legal basis for the processing of data when using the Oply services is Article 6 para. 1 (b) GDPR.

        PayOne is not working as an order data processor, but is itself responsible for the payment processing.

      • Purpose of data processing

        The purpose is the settlement of payments for the Oply services as well as the identifiability of the payment method by the user.

      • Duration of storage

        The data stored at Oply will be deleted as soon as your account is deactivated or deleted.

      • Objection and removal possibility

        You may object to the usage of data by Oply at any time. The objection or revocation of consent can be e-mailed to: service@oply.com; Alternatively, you can also delete the respective payment method in the app or at the website. In the case of opposition or revocation of consent, the data will be deleted or blocked. The implementation of the cancellation or blocking can take up to 3 working days; during this period, data may still be processed.

Berlin, 28.01.2019