Compilation over processing activities

This compilation over processing activities has been produced by Toyota Sweden AB (556041-0010) (“Toyota”, “we” or “us”).The compilation complements our general privacy notice, and describes in more detail the processing activities carried out by us, the legal basis for such processing activities and the retention periods, when you use our car sharing service KINTO SHARE. I förekommande fall gäller nedan sammanställning också den behandling som utförs av Toyota Motor Europe NV/SA (”TME”) ochToyota Connected Europe Limited (”TCEU”), på det sätt som anges i vår allmänna integritetspolicy. As applicable, this compilation also sets out the processing carried out by Toyota Motor Europe NV/SA (”TME”) and Toyota Connected Europe Limited (”TCEU”), in the manner described in our general privacy notice.

Any defined terms shall have the meaning set out in our (privacy notice.)


Application for membership

We process your personal data for the purposes that:

You shall be able to apply for membership,

We shall be able to approve your membership application;

We shall be able to set up a membership account for you; and

We shall be able to initiate the entering into the car sharing contract with you.
 

Personal data

Identity- and contact information: Full name, email-address and phone number.

Legal basis for processing

Performance of contract: The processing is necessary in order to conduct preparatory measures to the car sharing contract you enter into with us.


Access to account: Password of your choice.

Approval of terms of use: Information on that you have accepted the KINTO SHARE terms of use.
 

Retention period

Personal data is processed for the above purpose up and until the car sharing contract has been entered into. The personal data is thereafter processed for the performance of the contract on car sharing up and until termination of the car sharing contract and during such longer time that may be necessary in order to establish, exercise or defend any legal claims.


Creating and activating your KINTO SHARE account

We process your personal data for the purposes that:

You shall be able to create your KINTO SHARE account:

You shall be able to approve of the creating of the account with your electronic signature (BankID);

We shall be able to assess the prerequisites of entering into a car sharing contract, including to be able to ensure that anyone using the service has a driving licence; and

We shall be able to, on your request, cancel your KINTO SHARE account.
 

Personal data

Driving licence data (if you have a Swedish driving licence): your driving licence number, the expiry date of your driving licence and your personal identification number.

Legal basis for processing

Performance of contract: The processing is necessary in order to perform the car sharing contract you enter into with us.

Legitimate interest: When retaining data after the termination of the membership this is for our legitimate interest of establish, exercise or defend any legal claims.


Other data (if you have a Swedish driving licence) Temporary data in connection with accessing to BankID.

Driving licence data (if you have a foreign driving licence): A photo of your face aside the front of your driving licence, a photo of your face aside the back of your driving licence, you driving licence number (depending on which country you driving licence is registered in), and the expiry date of your driving licence.

Other data (if you have a foreign driving licence): your personal identification number and/or date of birth (depending on in which country your driving licence is issued in), and your home address.

Payment data: data regarding payment account and credit card.
 

Retention period

Personal data is processed for the above purpose up and until the car sharing contract has been terminated and during such longer time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims, however for a maximum of 2 years. With the purpose to give you the possibility to reactive your membership with us, your account with its data will be retained for a period of 90 days after the termination of the membership. If you wish to terminate the membership immediately, you may contact our customer service. Thereafter, we will delete your KINTO SHARE account.


Verification of data against the Swedish driving licence register (if you have a Swedish driving licence)

We process your personal data with the purpose to verify your driving licence data against the Swedish Transport Agency’s register of driving licences in order to ensure that you have a valid driving licence. This is done so that we may assess the prerequisites for entering into a car sharing contract. The verification is made when you create your account and also during the time of the contract.
 

Personal data

Driving licence data (if you have a Swedish driving licence): your driving licence number, the expiry date of your driving licence, and your personal identification number.

Legal basis for processing

Legal obligation: The processing is necessary for compliance with legal obligations since rental of vehicles may only be made to persons with valid driving licences.
 

Retention period

Personal data is processed for the above purpose up and until the car sharing contract has been terminated and during such longer time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims as well as respond to requests from public authorities, however for a maximum of 2 years.


Manual verification of driving licence data (if you have a foreign driving licence)

We process driving licence data, including photos of you and your driving licence with the purpose to manually being able to verify that the data are correct. Holders of foreign driving licences cannot be verified against the Swedish Transport Agency’s register of driving licences. Instead, we will verify that the photo of you face in the App matches the photo on your driving licence. If we have reason to believe that the person on the photo is not the holder of a valid driving licence, we will process such person’s contact information with the purpose to contact the person through the information given.
 

Personal data

Driving licence data (if you have a foreign driving licence): A photo of your face aside the front of your driving licence, a photo of your face aside the back of your driving licence, you driving licence number (depending on which country you driving licence is registered in), and the expiry date of your driving licence.
 

Legal basis for processing

Legal obligation: The processing is necessary for compliance with legal obligations since rental of vehicles may only be made to persons with valid driving licences.

Contact information: Name, email-address, customer ID (for communication via the App) and phone number.
 

Retention period

Personal data is processed for the above purpose up and until the car sharing contract has been terminated and during such longer time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims as well as respond to requests from public authorities, however for a maximum of 2 years.


Verification of data against information lists

We process certain personal data in relation to the information list of Biluthyrarna Sverige (corporate identification number 802015-0333) (“BURF”), in order to

ensure that you are registered and/or blocked in BURF’s information list, and

report to BURF’s information list if you have violated the Terms of Use in any of the following ways: (i) after the end of the rental period, you do not return the rented object; (ii) you do not pay parking fines; (iii) you do not pay the rent or other remuneration; (iv) you mistreat the vehicle; (v) you are reported to the Swedish Police for unlawful use; or (vi) you leave the vehicle to another driver unlawfully.

Furthermore, the purpose is for BURF to be able to uphold the information list, which is made in the interest of the public and with authorisation from the DPA.
 

Personal data

Verification against the list: vehicle registration number.

Legal basis for processing

Performance of contract: The processing is necessary in order to perform the car sharing contract you enter into with us.

Legitimate interest: The processing is necessary for our legitimate interests of protecting and taking care of our vehicle, as well as to cater our and other lessors’ legitimate interests of establish, exercise or defend any legal claims.

Reporting: The information basis provided when reporting to BURF includes name, personal identification number, driving licence number and reasons for reporting.
 

Retention period

The data is processed to verify if you are blocked solely during the time when your membership is being assessed. If we get a match against the information list, such data is processed for the above purpose up and until the car sharing contract has been terminated and during such longer time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims. The basis for reporting to BURF is retained during a period of three business days in order for us to be able to administrate the reporting.


Verification of data against UC

We process certain personal data in connection with conduction a credit assessment, where we provide information to UC (a Swedish credit reference agency) in order for UC to assess your fulfilment of our creditworthiness requirement.
 

Personal data

Identity- and contact information: Full name, email-address, and phone number as well as personal identification number.

Legal basis for processing

Performance of contract: The processing is necessary in order to perform the car sharing contract you enter into with us.

Legitimate interest: The processing is also necessary for our legitimate interest of ensuring your payment ability.

Credit assessment: Answer (”yes” or ”no) of whether you fulfil our creditworthiness requirement.
 

Retention period

Personal data is processed for the above purpose until the car sharing contract has been entered into and you have been approved. A renewed assessment may be made during the term of the contract and data on the credit assessment is only retained if the assessment renders a negative result. The basis for such negative result is retained during such longer time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims as well as respond to requests from public authorities, however for a maximum of 2 years.


Administration of reservations

We process data that may be connected to your user account, and that thus constitutes personal data with the purpose that:

you shall be able to make reservations matching your preferences,

you shall be able to see your previous reservations;

you shall be able to see for how long you have made a reservation for a vehicle,

we shall be able to avoid fraud (for example, due to non-permissible fuelling, non reported damage or the loss of a vehicle),

we shall be able to see when a vehicle is unlocked (such unlocking is made through the App) so that we may register reservation time and use as well as being able to trace vehicles in case they disappear,

we shall be able to register driving distance and other data needed for us to be able to charge the correct sum,

you shall be able to report damage in the damage log after conducted damage control and we shall be able to follow when such damage is reported.
 

Personal data

Identity- and contract information: full name, email-address, and phone number.

Legal basis for processing

Performance of contract: The processing is necessary in order to perform the car sharing contract you enter into with us.

Legitimate interest: The processing is also necessary for our legitimate interest of preventing fraud and to maintain our vehicles.

Legal obligation: We may need to provide GPS location in case the vehicle is reported missing. Your personal data may be shared in connection with this, in case you were the last user.
 

Access to your account: Password of your choice.

Historical customer information: reservation history and historical reservation requests. Vehicle preferences (including vehicle registration number). Historical use of fuel card to identify non-permissible fuelling in order to avoid fraud.

Payment: Data on payment account, payment history and payment information (for example sum and date of payment).

Reservation information: time and date for unlocking through the App. Meter settings of the vehicle before and after the rental. GPS location in order to ensure that the vehicle is returned.

Information regarding damage: Registered damage reports or reports of loss of vehicle, registrations of damage in the damage log after conducted damage control, description of the damage including a photo of the damage in the App.

Geolocation information: Limited geolocation information, for example GPS location on your vehicle in case it is reported missing.
 

Retention period

Personal data is processed for the above purpose up and until termination of the car sharing contract and during such longer time that may be necessary in order to establish, exercise or defend any legal claims, however for a maximum of 2 years.


Support service

We process your personal data in order to communicate with you in an efficient way when you use our support service. We also process your data by sharing them with our support provider H1 Communication AB (556730-0610).
 

Personal data

Identity- and contact information: full name, email-address, and phone number.

Legal basis for processing

Performance of contract: The processing is necessary in order to perform the car sharing contract you enter into with us.

Legitimate interest: The processing is also necessary for our legitimate interest of communicating with you and offer you support in order for us to fulfil our part of the contract in, for us, a cost efficient way.

Driving licence data (if you have a foreign driving licence): A photo of your face aside the front of your driving licence, a photo of your face aside the back of your driving licence, you driving licence number (depending on which country you driving licence is registered in), and the expiry date of your driving licence.

Historical customer information: reservation history and historical reservation requests. Vehicle preferences (including vehicle registration number). Historical use of fuel card in case you believe you have been wrongfully charged for non-permissible fuelling.

Reservation information: time and date for unlocking through the App. Driving distance (read partly through the meter settings).

Payment: Data on payment account, payment history and payment information (for example sum and date of payment).

Information regarding damage: Registered damage reports or reports of loss of vehicle, registrations of damage in the damage log after conducted damage control, description of the damage including a photo of the damage in the App.

Geolocation information: Limited geolocation information, for example GPS location on your vehicle in case it is reported missing.
 

Retention period

Personal data is processed for the above purpose up and until termination of the car sharing contract and during such longer time that may be necessary in order to establish, exercise or defend any legal claims, however for a maximum of 2 years.


Marketing and communication

We process your personal data with the purpose of:

keeping you updated (through mail or so-called push messages) on your use of the App and KINTO SHARE, for example by inform you of coming reservations or completed reservations;

informing you of updates of the Terms of Use and our privacy notice;

responding to any queries you may have relating to the processing of your personal data and ensuring that you may use your rights in relation to your personal data;

assisting you if you wish to change your Account Data;

asking you if you want to share your experience of KINTO SHARE;

being able to send you invitations to attend events, offers and recommendations or requests to participate in marketing surveys; and

asking you if you approve of processing of your personal data for marketing purposes and register your “no” if you do not consent.

We also process your personal data in order to compile aggregated data with the purpose of:

improving the performance of Toyota vehicles, its mobile apps, its existing products and services and in order to develop new ones;

conducting research and development, carry out data analytics and create user group profiles from aggregated data to enhance and improve KINTO SHARE and to develop new mobility services and solutions; and

secure, maintain and support its networks, systems and applications.

In certain cases only aggregated data will be used. If the aggregated information cannot be connected to you as a person, it does not constitute personal data.


Personal data

Identity- and contact information: full name, email-address, and phone number.

Legal basis for processing

Legitimate interest: The processing is necessary for our legitimate interest of communicating with you, address certain marketing to you and provide you with relevant service in relation to your use of KINTO SHARE.

Consent: Regarding direct marketing (e.g. through phone, email and text messages), where such marketing are invitations to attend events, offers and recommendations or requests to participate in marketing surveys we will only use your personal data where you have given your express consent for each type of marketing communication.

Historical customer- and reservation data: reservation history and historical reservation requests. Vehicle preferences (including vehicle registration number). Time and date for unlocking through the App. Driving distance (partly read through the meter settings).

Information regarding damage: Registered damage reports or reports of loss of vehicle, registrations of damage in the damage log after conducted damage control, description of the damage including a photo of the damage in the App.
 

Retention period

Personal data is processed for the above purpose during the time your car sharing contract is in force and you have an active membership with us and during such longer time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims as well as respond to requests from public authorities. Processing based on your consent is made until you withdraw such consent. Where your personal data is processed in order to compile aggregated data, the data will only be processed during the limited period of time required in order to transform the personal data into aggregated data. Thereafter, only aggregated data that is either anonymised or pseudonomised will be processed.


Sharing your personal data

We process your personal data by sharing it to the following parties and for the following purposes:

H1 Communication so that they can provide KINTO SHARE support to you;

Companies within the Toyota group, including Toyota Motor Europe NV/SA and Toyota Connected Europe Limited, for sales and marketing activities in accordance with your marketing preferences;

Facebook and other advertisement networks (only email-address) in order to communicate with our existing customers and to block advertisements from us on your social media or to exclude other non-relevant information, in case you have chosen this;

public authorities (for example law enforcement authorities such as the Swedish Enforcement Authority and supervisory authorities such as the Swedish Transport Agency and the Swedish Tax Office) and courts if needed in order to comply with legal obligations according to law, legal proceedings or decisions;

counterparties or third parties, for example a collection agency, within the framework of a dispute;

BURF in order to conduct certain reporting to BURF’s information list;

external service providers in connection with the development, marketing and provision of KINTO SHARE, for example in order to support and maintain the IT systems, platforms and applications within the services of KINTO SHARE.
 

Personal data

Identity- and contact information: full name, email-address, and phone number.

Legal basis for processing

Legitimate interest: The processing is necessary for our legitimate interest of providing you with relevant services and in order to develop our services.

Legal obligation: When sharing personal data to public authorities, courts and certain counterparties, this is made because we have a legal obligation to conduct such processing.

Historical customer- and reservation data: reservation history and historical reservation requests. Vehicle preferences (including vehicle registration number). Time and date for unlocking through the App. Driving distance (partly read through the meter settings).
 

Retention period

Personal data is processed for the above purpose until sharing has been made.
 

Processing to comply with legal obligations

We process you personal data in order to comply with legal obligations. This includes sharing your personal data with public authorities and court in accordance with the above, but also to process your personal data during a certain time in order to fulfil such obligations.
 

Personal data

Identity- and contact information: full name, email-address, and phone number.

Legal basis for processing

Legitimate interest: The processing is necessary for our legitimate interest of providing you with relevant services and in order to develop our services.

Legal obligation: When sharing personal data to public authorities, courts and certain counterparties, this is made because we have a legal obligation to conduct such processing.

Payment: Data on payment account, payment history and payment information (for example sum and date of payment).

Historical customer- and reservation data: reservation history and historical reservation requests. Payment history and payment information.
 

Retention period

Personal data is processed for the above purpose during the time that may be necessary to cater our legitimate interest of establish, exercise or defend any legal claims or for such time that is stipulated in relevant legislation, for example 7 years for bookkeeping purposes.