Privacy Policy NOCA
Privacy policy valid from 1st december 2023
General information
Compliance with data protection regulations and the protection of your privacy is very important to NOCA mobility GmbH (“NOCA” – hereinafter “we” or “us”). We treat your personal data confidentially and in accordance with the legal data protection regulations and on the basis of this privacy policy. The legal basis can be found in particular in the General Data Protection Regulation (DS-GVO) as well as in the Federal Data Protection Act (BDSG) and all other relevant data protection regulations.
Personal data is information that relates to an identified or identifiable person (Art. 4 No. 1 DS-GVO). This includes, above all, information that allows conclusions to be drawn about your identity, such as your name, telephone number, address or e-mail address. Statistical data that we collect, for example, during a visit to our website and that cannot be associated with your person do not fall under the concept of personal data. With the following privacy policy, we would like to inform you how, for what purpose and to what extent we process your personal data and what rights you have.
Responsible party:
The responsible party within the meaning of the DS-GVO and the applicable national data protection laws (esp. BDSG) as well as other data protection regulations is:
Robert Teschendorf
Address:
Soorstraße 79
14050 Berlin
E-Mail:
robert@noca-mobility.com
Purpose and legal basis of data processing
1. Access data and hosting
Type: You can visit our websites without providing any personal information. Each time you call up a website, the web server only automatically saves a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of the call, the amount of data transferred and the requesting provider (access data) and documents the call.
Purpose: This access data is evaluated solely for the purpose of ensuring trouble-free operation of the site and improving our offering.
Legal basis: The legal basis for this processing is Art. 6 para. 1 lit. f) DS-GVO. The processing of the aforementioned data is necessary for the provision of a website and thus serves to protect a legitimate interest of our company.
Duration: All access data is deleted no later than 30 days after the end of your visit to the site.
1.1 Rights of users and data subjects
With regard to the data processing described in more detail below, users and data subjects have the right to
- to confirmation as to whether data concerning them are being processed, to information about the data being processed, to further information about the data processing and to copies of the data (cf. also Art. 15 DSGVO);
- to correct or complete incorrect or incomplete data (cf. also Art. 16 DSGVO);
- to the immediate erasure of the data relating to them (cf. also Art. 17 of the GDPR), or, alternatively, insofar as further processing is necessary pursuant to Art. 17(3) of the GDPR, to restriction of processing in accordance with Art. 18 of the GDPR;
- to receive the data concerning them and provided by them and to transfer this data to other providers/controllers (cf. also Art. 20 GDPR);
- to lodge a complaint with the supervisory authority if they are of the opinion that the data concerning them is being processed by the provider in breach of data protection provisions (cf. also Art. 77 of the GDPR).
In addition, the provider is obliged to inform all recipients to whom data has been disclosed by the provider about any correction or deletion of data or restriction of processing that takes place on the basis of Articles 16, 17 (1), 18 DSGVO. However, this obligation does not apply if such notification is impossible or involves a disproportionate effort. Notwithstanding the above, the user has a right to information about these recipients.
Likewise, users and data subjects have the right to object to the future processing of data concerning them in accordance with Art. 21 DSGVO, insofar as the data is processed by the provider in accordance with Art. 6 para. 1 lit. f) DSGVO. In particular, an objection to data processing for the purpose of direct advertising is permitted.
1.2 Hosting via Manitu GmbH
Type: We host our website with Manitu. The provider is Manitu GmbH, Welvertstraße 2, 66606 St. Wendel (hereinafter: “Manitu”).
Manitu works in accordance with the DS-GVO. Further information about the data protection practices of manitu can be found here: https://www.manitu.de/datenschutz/
Purpose: The use of the services is necessary to provide a secure and fast offer of our website as well as of our online shop.
Legal basis: The use of Manitu is based on Art. 6 (1) lit. f DSGVO. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If a corresponding consent was requested, the processing is based exclusively on Art. 6 para. 1 lit. a DSGVO; the consent can be revoked at any time.
Storage period: The storage period of your data depends on the types of processing listed below.
1.3. Server data for the software-as-a-service solution (hereinafter: “NOCA portal”)
Type: We host our portal via bubble. The provider is Bubble Group Inc., 22 W 21st St, Floor 2, New York, NY 10010 (hereinafter: “Bubble”).
We have concluded an order processing contract with Bubble in accordance with §28 DS-GVO.
Purpose: The use of the services is necessary to provide a secure and fast offer of our NOCA portal.
Third country transfers: When you visit our website, your personal data is processed on the servers of Bubble. A transfer of data to the USA and access by US authorities to the data stored by Bubble cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.
For the USA, there is no adequacy decision of the European Commission and no appropriate safeguards according to Art. 46 DS-GVO are used by Bubble. It is not excluded that American authorities can access the data stored at Bubble.
For more information, please refer to the privacy policy of Bubble: https://bubble.io/privacy.
Legal basis: The use of Bubble is based on Art. 6 (1) lit. f DSGVO. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If a corresponding consent was requested, the processing is based exclusively on Art. 6 para. 1 lit. a DSGVO; the consent can be revoked at any time.
2. Information on data processing
Your data processed when using our website will be deleted or blocked as soon as the purpose of the storage no longer applies, the deletion of the data does not conflict with any statutory retention obligations and no other information is provided below on individual processing procedures.
2.1 Processing when opening a customer account
Type: We collect personal data when you voluntarily provide it to us as part of your order, when contacting us (e.g. via contact form or e-mail) or when opening a customer account. Mandatory fields are marked as such, because in these cases we need the data to process the contract, or to process your contact or opening a customer account and without their information you can not complete the order and / or the account opening, or the contact can not be sent. Which data is collected can be seen from the respective input forms.
Purpose: The data is processed for contract processing; for processing your contact, opening the customer account and processing your order.
Legal basis: We use the data provided by you in accordance with Art. 6 para. 1 p. 1 lit. b DSGVO for contract processing and processing your requests.
Storage period: Your data will be deleted by us after deletion of your customer account, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.2 Data processing for contract processing
Type and purpose: We use the following data: Name, address, e-mail address, telephone number, order details (value and content), address to compile and deliver the order after you have placed it.
Legal basis: Art. 6 para. 1 lit. b) DS-GVO
2.3 Data processing by service providers
2.3.1 Digital contract signing software Dropbox sign
Purpose: To sign contract digitally we use the service Dropbox Sign provided by Dropbox International Unlimited Company, One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland
Type: Company name, first name, last name, address, email address, phone number, bank account information
Legal basis: By consenting to the use of NOCA’ services and this privacy policy, you consent to the processing of the above data by Dropbox International Unlimited Company GmbH pursuant to Art. 6 para. 1 lit. b) DS-GVO.
The privacy policy of Dropbox International Unlimited Company can be found here: https://www.dropbox.com/terms
Storage period: Your data will be deleted after a storage period of at least 2 years. On your request the deletion of your data is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.3.2 Customer relationship management Notion
Purpose: To manage and track customer activities as well as activities with potential customers we use a customer relationship management template in Notion. Notion is a product of Notion Labs Inc., 548 Market Street Suite 74567 San Francisco, CA 94104.
Type: Company name, first name, last name, address, email address, phone number, bank account information, industry, position
Third Country Transfer: Notion Labs Inc. is headquartered in San Francisco. San Francisco HQ 548 Market Street Suite 74567 San Francisco, CA 94104.
A transfer of data to the USA and access by US authorities to the data stored by Notion Labs Inc. cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to legal remedies against access by authorities.
For the USA, there is no adequacy decision of the European Commission and Formagrid does not use appropriate safeguards according to Art. 46 DS-GVO. It is not excluded that American authorities can access the data stored by Notion Labs Inc.
The privacy policy of Notion Labs can be found here: https://www.notion.so/Privacy-Policy-3468d120cf614d4c9014c09f6adc9091
Legal basis: For the transfer of data, your consent to this privacy policy and the processing set out here is the legal basis according to Art. 6 para. 1 lit. a and Art. 49 para. 1 lit. a DS-GVO.
Storage period: Your data will be deleted by us after deletion of your customer account, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.3.3 Accounting Buchhaltungsbutler
Purpose: For the completion of the accounting we use the service of the cloud-based accounting software BuchhaltungsButler GmbH, Ausbau 1, 15910 Unterspreewald. BuchhaltungsButler processes incoming and outgoing invoices as well as bank transactions of our company, if applicable, in order to automatically record invoices, match them to transactions and create the financial accounting from this in a partially automated process.
Type: Company name, address, email address, phone number, bank account information
Legal basis: By consenting to the use of NOCA’ services and this privacy policy, you consent to the processing of the above data by BuchhaltungsButler GmbH pursuant to Art. 6 para. 1 lit. a) DS-GVO.
The privacy policy of BuchhaltungsButler GmbH can be found here: https://www.buchhaltungsbutler.de/datenschutzbestimmungen/
Storage period: Your data will be deleted by us after deletion of your customer account, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.3.4 Administration Google Workspace
Purpose: To send mails, plan meetings, create and edit documents and sheets which may contain customer information we use the Google Workspace. The service will be provided by Google LLC. The responsible entity for users in the EU/ EEA and Switzerland is:
Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter: “Google”).
Third-country transfer: Insofar as data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish an appropriate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. It cannot be ruled out that US authorities will access the data stored by Google. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.
Storage period: The data sent by us and linked to cookies are automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.
Legal basis: The legal basis for this data processing is your consent pursuant to Art.6 para.1 p.1 lit.a DSGVO and Art. 49 para. 1 lit a) DS-GVO.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.3.5 Marketingautomation with Brieflink
Purpose: To provide presentations and pitch decks we use the software Brieflink provided by NFX Capital Management LLC.
Type: first name, last name, address, email
Third Country Transfer: NFX Capital Management LLC. is headquartered in 34 Page Street, San Francisco, CA 94102.
A transfer of data to the USA and access by US authorities to the data stored by Notion Labs Inc. cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to legal remedies against access by authorities.
For the USA, there is no adequacy decision of the European Commission and Formagrid does not use appropriate safeguards according to Art. 46 DS-GVO. It is not excluded that American authorities can access the data stored by NFX Capital Management LLC..
The privacy policy of NFX can be found here: https://www.nfx.com/privacy
Legal basis: For the transfer of data, your consent to this privacy policy and the processing set out here is the legal basis according to Art. 6 para. 1 lit. a and Art. 49 para. 1 lit. a DS-GVO.
Storage period: Your data will be deleted after 10 years of storage.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.3.6 Meeting booking with Brevo
Purpose: Manage meeting coordination with customers and partners we use Brevo Inc, 1402 Third Avenue, #301 Seattle, WA 98101
Type: Company name, first name, last name, email address
A transfer of data to the USA and access by US authorities to the data stored by Notion Labs Inc. cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to legal remedies against access by authorities.
For the USA, there is no adequacy decision of the European Commission and Formagrid does not use appropriate safeguards according to Art. 46 DS-GVO. It is not excluded that American authorities can access the data stored by Brevo Inc..
Legal basis: By consenting to the use of NOCA’ services and this privacy policy, you consent to the processing of the above data by Sendinblue GmbH pursuant to Art. 6 para. 1 lit. a) DS-GVO.
The privacy policy of Brevo GmbH can be found here: https://www.brevo.com/legal/privacypolicy/
Storage period: Your data will be deleted after 2 years.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
2.3.7 Website Analytics with HotJar Ltd.
Purpose: To analyse our website visitors’ behaviour we use the website analytics software HotJar. We only use this data to improve the structure of our webpages. HotJar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta
Type: None
HotJar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta
Legal basis: By consenting to the use of NOCA’ services and this privacy policy, you consent to the processing of the above data by Sendinblue GmbH pursuant to Art. 6 para. 1 lit. a) DS-GVO.
The privacy policy of Notion Labs can be found here: https://www.hotjar.com/legal/policies/privacy/
Storage period: Your data will be deleted after 2 years.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
3. Cookies and web analysis
Purpose: In order to make the visit to our website attractive and to enable the use of certain functions, to display suitable products or for market research, we use so-called cookies on various pages.
Type and duration: Cookies are small text files that are automatically stored on your terminal device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and allow us to recognize your browser the next time you visit (persistent cookies). The duration of storage can be found in the overview in the cookie settings of your web browser. You can set your browser so that you are informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. This can be found for each browser at the following links:
Internet Explorer™: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Safari™:
https://support.apple.com/de-de/guide/safari/sfri11471/12.0/mac/10.14
Chrome™:
https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Firefox™:
https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Opera™:
https://help.opera.com/de/latest/web-preferences/#cookies
Legal basis: This serves to protect our legitimate interests in an optimized presentation of our offer, which prevail in the context of a balancing of interests, in accordance with Art. 6 (1) p. 1 lit. f DS-GVO.
If cookies are not accepted, the functionality of our website may be limited.
3.1 Use of Google (Universal) Analytics for Web Analysis
Insofar as you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The responsible entity for users in the EU/ EEA and Switzerland is:
Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).
Scope and nature of processing: Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.
[OPTIONAL: We use the User ID function. With the help of the User ID, we can assign a unique, permanent ID to one or more sessions (and the activities within these sessions) and analyze user behavior across devices].
Google Analytics 4 has IP address anonymization enabled by default. Due to IP anonymization, your IP address will be truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
During your website visit, your user behavior is recorded in the form of “events”. Events can be:
Page views
First visit to the website
Start of session
Your “click path”, interaction with the website
Scrolls (whenever a user scrolls to the bottom of the page (90%))
clicks on external links
internal search queries
interaction with videos
file downloads
seen / clicked ads
language setting
Also recorded:
Your approximate location (region)
your IP address (in shortened form)
technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
your internet service provider
the referrer URL (via which website/ via which advertising medium you came to this website)
Purpose: On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, and compiling reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website.
Recipients: Recipients of the data are/may be.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor according to Art. 28 DSGVO).
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Third-country transfer: Insofar as data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish an appropriate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. It cannot be ruled out that US authorities will access the data stored by Google. You do not have the same rights there as within the EU/EEA. You may not have any legal remedies against access by authorities.
Storage period: The data sent by us and linked to cookies are automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.
Legal basis: The legal basis for this data processing is your consent pursuant to Art.6 para.1 p.1 lit.a DSGVO and Art. 49 para. 1 lit a) DS-GVO.
Revocation: You can revoke your consent at any time with effect for the future by calling up the cookie settings [SET THE LINK TO CONSENT TOOL SETTINGS HERE] and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.
You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. In addition, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google, by
a. Not giving your consent to the setting of the cookie or
b. downloading and installing the browser add-on to disable Google Analytics HERE.
For more information on Google Analytics’ terms of use and Google’s privacy policy, please visit
https://marketingplatform.google.com/about/analytics/terms/de/ and
https://policies.google.com/?hl=de.
4. Email newsletter with registration for the newsletter.
Purpose: If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to send you our e-mail newsletter on a regular basis. We use the software mailchimp provided by The Rocket Science Group LLC d/b/a Mailchimp 675 Ponce De Leon Ave NE, Atlanta, GA 30308 (hereinafter: “Mailchimp”). Type: Specified data are your e-mail address and possibly your postal code.
Third Country Transfer: The Rocket Science Group LLC is headquartered in 675 Ponce De Leon Ave NE, Atlanta, GA 30308.
Legal basis: The processing of your data is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a DSGVO.
With your consent to receive our newsletter, you agree that we pass on the necessary data, your e-mail address, to the service provider The Rocket Science Group LLC.
A transfer of data to the USA and access by US authorities to the data stored by Notion Labs Inc. cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to legal remedies against access by authorities.
For the USA, there is no adequacy decision of the European Commission and Formagrid does not use appropriate safeguards according to Art. 46 DS-GVO. It is not excluded that American authorities can access the data stored by The Rocket Science Group LLC
The privacy policy of Mailchimp can be found here: https://www.intuit.com/privacy/statement/
Storage period: Unsubscribing from the newsletter is possible at any time and can be done via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this statement.
Contact option: privacy@noca-mobility.com / privacy@noca-mobility.com
5. Contact options and your rights
As a data subject, you have the following rights:
Right to information: pursuant to Art. 15 DS-GVO, the right to request information about your personal data processed by us to the extent specified therein;
Right of correction: pursuant to Art. 16 DS-GVO, the right to demand the correction of incorrect or completion of your personal data stored by us without delay;
Right to erasure: pursuant to Art. 17 DS.GVO, the right to request the erasure of your personal data stored by us, unless the further processing is
– to exercise the right to freedom of expression and information; – to comply with a legal obligation; – for reasons of public interest or – to assert, exercise or defend legal claims.
is necessary;
Right to restriction of processing: pursuant to Art. 18 DSGVO, the right to request the restriction of the processing of your personal data insofar as
– the accuracy of the data is disputed by you;
– the processing is unlawful, but you object to its erasure;
– we no longer need the data, but you require it for the assertion, exercise or defense of legal claims; or
– you have objected to the processing in accordance with Art. 21 DSGVO;
Right to data portability: in accordance with Art. 20 DSGVO, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another data controller
Right to complain to a supervisory authority: pursuant to Art. 77 DSGVO, the right to complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.
Right of objection:
Insofar as we process personal data as explained above in order to protect our legitimate interests that prevail in the context of a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If the processing is carried out for other purposes, you will only have the right to object if there are grounds arising from your particular situation.
After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves to assert, exercise or defend legal claims.
This does not apply if the processing is for direct marketing purposes. Then we will not further process your personal data for this purpose.
If you have any questions about the collection, processing or use of your personal data, for information, correction, restriction or deletion of data, as well as revocation of consent given or objection to a particular use of data, please contact us directly via the contact details in our imprint.
01.12.2023
