PRIVACY NOTICE

Eagle Etsp Micromobility Service – Shared E-bikes and E-scooters

Notice provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

1. Who processes your data

The data controller is Eagle Electric Transport of Shared Passengers Srl, with registered office at Piazza Giovanni Bovio 22, 80133 Naples, Italy, Italian Tax Code and VAT No. IT 09782321211, owner of the platform and of the service operated under the Eagle turismo brand. Privacy contact: [email protected].

If a Data Protection Officer (DPO) has been formally appointed, their contact details are provided in the App or on the website. The legal representative does not automatically hold this role.

2. Who this notice applies to

This notice applies to users of the App and the shared e-bike rental service, as well as to anyone who contacts customer support or uses the related website. The actual processing activities depend on the features used.

3. Personal data processed

• Identity and contact data: first name, surname, email address, telephone number and, where necessary, address and billing details.
• Account and service data: login credentials, bookings, rental start and end times, e-bike used, pick-up and return areas, transaction history and communications with customer support.
• Payment data: transaction outcome and reference details. Full payment card details are normally processed by the payment service provider and not by Eagle turismo.
• Location data: the location of the e-bike and, when enabled on the device, the user’s location, as required to display available vehicles, start or end a rental, manage operating areas, ensure security and recover vehicles.
• Technical data: IP address, device and App identifiers, operating system, access logs, events, errors and security data.
• User-submitted content: photographs, reports, support requests, formal complaints and documents relating to accidents or disputes.
• Special categories of personal data, particularly health data, only where indispensable in connection with accidents or insurance claims and on the basis of an appropriate condition under Article 9 GDPR.

4. Purposes, legal bases and retention

Purpose	Legal basis	Retention period
Registration, booking, rental, invoicing, payments and customer support.	Performance of a contract and steps taken before entering into a contract.	For the life of the account and, after closure, for as long as necessary to manage legal obligations and disputes.
Operational geolocation of the e-bike and user while using features that require it; prevention of theft, misuse and unauthorised use.	Contract; legitimate interest in security; device permission or consent where required.	For the period strictly necessary for the ride and security purposes; aggregated or anonymised data may be retained for longer.
Tax, accounting and insurance obligations, and requests from public authorities.	Legal obligation; establishment, exercise or defence of legal claims.	As a rule, 10 years for accounting records, unless a different period applies or litigation is pending.
Cybersecurity, fraud prevention, complaint handling and protection of vehicles and users.	The controller’s legitimate interests and, where applicable, a legal obligation.	For a period proportionate to the risk and until any disputes have been resolved.
Promotional communications and market research not necessary for the service.	Consent, which may be withdrawn at any time.	Until consent is withdrawn and, in any event, for the period stated in the preference settings.
Statistics and service improvement.	Legitimate interests, using aggregated or anonymised data where possible; consent where required for tracking tools.	For the period necessary to carry out the analysis; anonymised data is no longer personal data.

The periods indicated must be implemented through an internal retention policy. Where data is required for litigation, an audit or a legal obligation, it may be retained until the relevant need has ended.

5. Whether providing data is mandatory

Data marked as mandatory is required to create an account and provide the rental service. If it is not provided, certain features or the service may not be available. Data requested for marketing, optional analytics or additional features is optional.

6. How we use location data

Location data is used only for the purposes described in the App. Users can manage permissions in their device settings; disabling them may prevent users from finding, unlocking or properly returning an e-bike. The vehicle’s location may continue to be detected through devices installed on the e-bike for security, fleet management and recovery purposes.

7. Recipients of personal data

To the extent necessary, personal data may be processed by authorised personnel and by service providers appointed as processors, including providers of the platform and cloud infrastructure, customer support, maintenance, payments, communications, analytics and insurance services, as well as professional advisers. Data may also be disclosed to public authorities, law enforcement agencies or other parties where required by law or necessary to protect a legal right.

Personal data is not made publicly available. It is not shared with partners for their own promotional purposes without a specific legal basis and appropriate information being provided to the user.

8. Transfers outside the European Economic Area

If a service provider processes personal data outside the European Economic Area, the transfer takes place on the basis of an adequacy decision or safeguards provided for under the GDPR, such as standard contractual clauses, together with any necessary supplementary measures. Information on the safeguards applied may be requested from the controller.

9. Security

Technical and organisational measures appropriate to the level of risk are implemented to protect personal data against loss, alteration, unauthorised access or disclosure. No system is completely secure; any personal data breach is handled in accordance with applicable legal requirements.

10. Your rights

Where provided for by the GDPR, users may request access to, rectification or erasure of their personal data, restriction of processing, data portability and may object to processing. Users may also withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be sent to [email protected]. To protect the account, identity verification may be required. Users may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the competent supervisory authority in their Member State.

11. Children

The service and independent registration are not intended for persons under the age of 18. If the controller becomes aware that personal data has been collected in breach of this age restriction, it will take the necessary steps to delete the data or otherwise bring the processing into compliance.

12. Cookies, SDKs and third-party services

The website and App may use cookies, SDKs or similar technologies. Strictly necessary tools operate without consent; non-exempt analytics, advertising or profiling tools are activated only after the user has made a choice, which may be changed at any time. The type, provider, duration and purpose of the tools actually used must be described in the Cookie Policy and preference panel.

The App may contain links to or integrate third-party services, which process personal data in accordance with their own privacy notices. Eagle turismo does not control processing independently carried out by those parties.

13. Changes to this notice

This notice may be updated. Users will be informed of material changes through the App, the website or by email. If a new purpose requires consent, consent will be requested before the relevant processing begins. The date of the current version is stated in this document.