Cleanmob offers a solution to create quality data on the environmental impact of mobility in order to better understand and reduce it and guarantees that it will process personal data in accordance with Annex 1 (Personal Data Processing) as well as with the regulations applicable to the processing of personal data, in particular with regard to the confidentiality and security of such personal data.

It is expressly agreed between the Parties that, within the framework of this document, Cleanmob acts only according to the instructions and orders of the Beneficiary, it is therefore the Beneficiary's subcontractor within the meaning of the GDPR.

Location of personal data

Personal data will be hosted and processed exclusively on or from servers located in the European Union.

In the event of transfer of Personal Data to a third country, not belonging to the European Union, or to an international organization, the Service Provider must obtain the prior written consent of the Beneficiary.

Protection — security of personal data

The Service Provider takes all the usual precautions to ensure the protection and regular and frequent backup of personal data.

In addition, it takes all measures to prevent access by third parties to the information and personal data that will be entrusted to it during the execution of the Letter.

APPENDIX 1 — PROCESSING OF PERSONAL DATA

The purpose of this appendix is to ensure that Cleanmob implements the processing (s) of Personal Data in accordance with the legislation in force.

This appendix relates exclusively to the processing of Personal Data implemented by the Service Provider as part of a document. Apart from this document, each Party is responsible for its own processing of Personal Data.

The Service Provider undertakes to take all necessary measures to ensure that it and its staff comply with its obligations and in particular to:

• Process Personal Data only on the instructions of the Beneficiary, including with regard to transfers of Personal Data to a third country or to an international organization, unless required to do so under Union law or the law of the Member State to which the Service Provider is subject; in this case, the Service Provider informs the Beneficiary of this legal obligation prior to Processing, unless the law concerned prohibits such information for reasons important in the public interest;
• not to process or consult the data or files for purposes other than the execution of the Project that it is carrying out for the Beneficiary hereunder;
• do not insert foreign data into the files;
• take into account, with regard to its tools, products, applications or services, the principles of data protection by design and data protection by default;
• take any measures to prevent any misuse, malicious or fraudulent use of data and files;
• Ensure that persons authorized to process Personal Data undertake to respect confidentiality or are subject to an appropriate legal obligation of confidentiality;
• Implement all necessary measures to guarantee the security and integrity of Personal Data and their Processing;
• Inform the Beneficiary and collect any objections in the event of a change of subcontractor using Personal Data;
• Take into account the nature of the Processing, help the Beneficiary, through appropriate technical and organizational measures, as far as possible, to fulfill its obligation to respond to requests submitted to it by the Data Subjects in order to exercise their rights;
• Help the Beneficiary to ensure compliance with security obligations, taking into account the nature of the Treatment and the information at its disposal;
• Immediately notify the Beneficiary of any modification or change that may impact the Processing of Personal Data;
• At the choice of the Beneficiary, delete all Personal Data or return them to the Beneficiary at the end of the provision of services relating to the Processing, and destroy existing copies, unless Union law or Member State law requires the retention of Personal Data;
• Notify the Beneficiary if it receives a request for access or modification or opposition from a User and not to respond to such requests without the prior agreement of the Beneficiary;
• Inform the Beneficiary in the event of a Personal Data breach due to a proven security breach at the Service Provider or the host, as soon as possible as soon as the Service Provider is aware of it;

In addition, the Service Provider is prohibited from:

• the consultation and processing of Personal Data other than those concerned herein, even if access to such Personal Data is technically possible;

• to disclose, in any form whatsoever, all or part of the data used;

• to copy or store, regardless of the form and purpose, all or part of the information or data contained on the media or documents that were entrusted to him or collected by him during the execution of this Letter, except in the cases covered by this Letter, except in the cases covered by this Letter.

The Service Provider undertakes to take all useful measures to ensure that natural persons acting under its authority and having access to Personal Data do not process them, except on the instruction of the Beneficiary, unless obliged to do so by an imperative provision resulting from European Union law or from the law of a member state of the European Union applicable to the Treatments covered herein. The Service Provider ensures that persons authorized to process Personal Data:

— undertake to respect the confidentiality of the data or are subject to an appropriate legal obligation of confidentiality;

— receive the necessary training in the protection of Personal Data;

The parties agree to define the concept of instruction as acquired when the Service Provider acts in accordance with the provisions of this Agreement.

1.1. Purpose of the Treatments

Collection, recording, use, hosting and deletion of Personal Data.

1.2. Data retention period

Until the end of the Project and a maximum of 3 months from the end of the Project, except in the case of a request for deletion by a User.

In the event that European Union law or the law of a Member State requires the storage of Personal Data, the Service Provider will inform the Beneficiary of this obligation.

1.3. Nature and purpose of the Treatments

• Our services are in no way intended to use the data collected for commercial purposes. All data is used in order to create quality data on the environmental impact of mobility in order to better understand and reduce it.

1.4. Personal data processed

1. On the web application

For each User:

• Name, first name
• Email

2. On the mobile application

For each User:

• Enrollment:
  • Name, first name
  • Email
• During use:
  • While traveling:
    • Geolocation: Used to finely assess mobility, driving style, CO2 emissions and other externalities, real conditions are decisive in creating quality data.

1.5. Categories of persons concerned

Collaborators/Employees of the Beneficiary.

Legal basis for the treatment: execution of the Letter.

Recipients: Khalil EL HAJJI (khalil.elhajji@cleanmob.eu)

• SUBCONTRACTING

Subsequent processors of personal data are:

Name or name of the subsequent subcontractor

Treatment carried out by the subsequent subcontractor

Location/country where personal data is processed by the subcontractor (including possible remote access)

Google Cloud Platform

Data hosting

Frankfurt (Germany)

The Service Provider is expressly authorized by the Beneficiary to collect, process and generate anonymized statistics arising from the personal data collected as part of the Project in order to feed its statistical database and to exploit them for all purposes and conditions within the framework of its activities.

1.6. Deleting User Data

1.6.1. Generalities

As part of our commitment to privacy and compliance with current regulations, we offer users the ability to delete their data and account through a simple and transparent process.

1.6.2. How to delete your account

Users can delete their account and all associated data in two ways:

a. Through the Profile Page : Go to the profile page, click on the “Account Delete” button and follow the instructions on the screen.

b. Via e-mail : Send an account deletion request to help@cleanmob.eu from the email address associated with the account. Our team will review the request and proceed with the removal in accordance with our internal procedures.

1.6.3. What That EnTAILS

Deleting your account will result in the permanent removal of all data associated with your account, including profile information, order histories, preferences, etc. This action is irreversible, and once the account is deleted, it cannot be recovered.

1.7. Retrieving User Data

1.7.1. Right to Data Recovery

In line with our commitment to transparency and compliance with data protection regulations, we offer users the ability to recover their personal data.

1.7.2. How to Recover Your Data

If you want to retrieve the data associated with your account, you can request it by sending an email to help@cleanmob.eu from the email address associated with your account. Please include any relevant information that could help us process your request quickly and accurately.

3. Recovery Format

We will provide your data in a structured format (.CSV), which is commonly used and machine-readable, in accordance with applicable regulations. This will allow, if you wish, to transfer this data to another service or simply to keep it for your own use.

1.74. Recovery time

We strive to process all data recovery requests within a reasonable time and in accordance with legal deadlines. The time required to respond to your request may vary depending on the complexity of the request and the volume of data involved.

1.8 Change of Email Address Associated with the Account

1.8.1. Generalities

We understand that your information may change over time. To ensure continuous and secure communication with our users, we offer the option of updating the email address associated with your account.

1.8.2. How to change your email address

To change the email address associated with your account, please send a request to help@cleanmob.eu from the email address currently associated with your account. Your request should include the old email address, the new email address you want to use, and any other information that could help us verify your identity.

‍