Poppy cookies policy

Date of last revision: 28/06/2023

Poppy website (https://www.poppy.be) (the “Website”) is the property of and is managed by Poppy Mobility SA/NV (“Poppy”, “we” or “us”), an environmentally friendly vehicles sharing platform, established at Sanderusstraat 25, 2018 Antwerp, registered in the Register of Legal Entities of Antwerp under number 0681.505.370.

Poppy processes your personal data as controller since it determines the purposes and the means of such processing. 

Poppy can always be contacted at hello@poppy.be. To have access to our policies, please visit the Website or verify the menu of the Poppy mobile application (the “Application”).

1. Scope: to whom does this Cookies Policy apply and what does it cover?

At Poppy, we do our utmost to protect and process the personal data that are entrusted to us in a correct and transparent way, more particularly in accordance with the applicable law, especially with the General Data Protection Regulation 2016/679 of 27 April 2016 (“GDPR”) and the Belgian law of 30 July 2018 on the protection of individuals with regard to the processing of personal data ("Privacy law").

This policy applies to all individuals of whom we process personal data through the use of cookies (“User”, “Users” or “you”). Personal data is any information which allows Poppy to identify you as a natural person.

With this Cookies Policy (the “Policy”), we wish to inform you about how and why we process your personal data through cookies as a data controller when you visit this Website, to whom we transmit this information, what are your rights and who you can contact for more information.

2. How do we obtain personal data? 

We obtain personal data through the use of cookies on our Website. 

Cookies are small pieces of information that are stored by your browser on your computer's or mobile device’s hard drive. Cookies allow  the Website to remember information that changes the way the Website behaves or looks, such as your preferred language. Furthermore, the Website use cookies in order to ease the use of and navigation on the Website (e.g. cookies are used to prevent you from having to log in every time for personalized services by entering your user name and password). 

3. What kind of cookies do we process, for which purposes and on which lawful basis? 

The following cookies are processed when you visit and use the Website, said cookies being set by our Website (directly by us or by our processors acting on our instructions only) (“first-party cookies”) or set by external parties acting as data controllers (“third-party cookies”). The purpose for which each type of cookie is processed and the lawful basis on which we rely to justify that processing are mentioned below. The expiration period of each cookie is also mentioned below (in this regard, see also Section 4).

1. Necessary cookies

These are cookies that are required in order to use our Website. The technical storage or access is either necessary for carrying out the transmission of a communication over an electronic communications network or strictly necessary for the legitimate purpose of enabling the use of a specific service you have explicitly requested. If such cookies were disabled, our Website could not work properly and offer you the services you have explicitly requested. This makes them necessary cookies. 

The processing of necessary cookies is necessary for the performance of the contract to which you are party (Article 6.1, b), of the GDPR). Indeed, there is a contract between you and us by which we commit to provide you with a properly functioning website and with services you have explicitly requested. 

The following cookies are necessary cookies:

1. Preference cookies:

Preference cookies enable us to remember information that changes the way the Website behaves or looks, like your preferred language or the region that you are in. 

The processing of preference cookies is based on your consent (Article 6.1, a), of the GDPR). You can give your consent to the processing of such cookies through the cookie banner displayed on our Website.

The following cookies are functional/preference cookies:

1. Statistics cookies:

Statistic cookies help us to understand how Users interact with the Website by collecting and reporting information anonymously. There are cookies or any other form of local storage that is used exclusively for statistical purposes (analytics cookies). These are also known as “performance cookies”.

The processing of statistics cookies is based on your consent (Article 6.1, a), of the GDPR). You can give your consent to the processing of such cookies through the cookie banner displayed on our Website.

The following cookies are statistics cookies:

1. Marketing cookies:

Marketing cookies or any other form of local storage are required to create user profiles to send advertising, or to track the User on a website or across several websites for similar marketing purposes. They prevent you being bombarded by the same advertisement over and over again and help to personalize publicity, but they also measure the effectiveness of various marketing and publicity actions.

The processing of marketing cookies is based on your consent (Article 6.1, a), of the GDPR). You can give your consent to the processing of such cookies through the cookie banner displayed on our Website.

The following cookies are marketing cookies:

4. How long do we store cookies? 

Temporary cookies (or “session” cookies) are temporarily stored in your browser. As soon as the User closes its browser, these cookies are automatically deleted.

Permanent cookies (or “persistent” cookies) remain on your computer or mobile device, even after you close the browser. They make it possible to recognize the User during a subsequent visit to a website or an application. They remain on the User’s device until their expiration date is reached, a new version of the cookie is installed, or the User deletes them manually.

The expiration date of such cookies is mentioned in Section 3.

5. To whom may we transfer your personal data?

Your personal data may be processed by our processors which process such data for the purposes strictly necessary to comply with the instructions we send them. Those processors are IT service providers such as providers of cookie management tools. With a view to the optimal protection of the personal data of Users, we have made the necessary contractual arrangements with those processors to ensure that they apply the highest privacy standards. In any event, data processors shall be required to ensure the security and confidentiality of the personal data. Therefore, a data processing agreement is signed according to article 28 GDPR.

In addition, some third parties may collect and process personal data through the cookies they implement on the Website (“third-party cookies”) (see  Section 3 and Cookie Banner). In such a case, those third parties act as separate data controllers. You can find more information on the processing carried out by those third parties in their respective cookies policies.

6. Where is your personal data stored?

In principle, your data is only stored on servers located in the European Economic Area.

If necessary, your data may be only transferred to a country outside the European Economic Area. In such cases, if there is no adequacy decision of the European Commission with the third country concerned, we will ensure that the recipients are obliged to comply with the same data protection standards as in the European Economic Area by means of standard contractual clauses as edited by the European Commission, with supplementary security measures where required. You can obtain a copy of these guarantees upon request.

7. Your rights

You have several rights regarding the personal data that we process. In particular, you have the right:

• Right to information: you have the right to obtain information about the processing of your personal data. Thus, you have the right to know the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom the personal data is transmitted, the criteria used to determine the data retention period, and the rights that you can exercise on your personal data. This right is exercised through this document. 
• Right to access: you have the right to access your personal data and to receive a copy of it.
• Right to rectification: you have the right to ask us to update or correct your personal data, if you think it is incorrect or incomplete. You can request us to do so.
• Right to erasure: you have the right to ask us to delete your personal data, or to limit the way in which we use those data, if you think that we do not (or no longer) have any legitimate basis to process it.
• Right to withdraw your consent: you have the right to withdraw your consent regarding the processing of your personal data based on such consent at any time. You can do so by using the tool available on our Website, by clicking on the icon available at the bottom left of all the different pages of our Website. You can also do so by adjusting the parameters of your browser. It is also possible to refuse the marketing cookies on the following website:  http://www.youronlinechoices.com/. For your information, such withdrawal will not affect the lawfulness of the processing based on consent before the withdrawal.
• Right to portability: you have the right to receive your personal data in a structured, conventional and machine-readable form and to transfer it to another party.
• Right to object: you have the right to object against the processing of personal data for which we use legitimate interests as a legal basis unless we have overriding compelling justified grounds for the processing.
• Right to restriction: you have the right to restrict the processing of your personal data in certain circumstances listed in article 18 of the GDPR. 

For more information about your rights: https://www.autoriteprotectiondonnees.be/citoyen/vie-privee/quels-sont-mes-droits-

You can exercise the above-mentioned rights by sending an e-mail to privacy@poppy.be. 

Furthermore, if you think that Poppy did not act in accordance with the legislation concerning the processing of personal data, you can file a complaint with the Belgian Data Protection Authority ( Data Protection Authority, Drukpersstraat 35, 1000 Brussel, Tel: +32 (0)2 274 48 00, E-mail: contact@apd-gba.be). 

8. How can you contact us?

If you have any questions regarding this Policy, you can contact our data protection officer (DPO):

• by e-mail: privacy@poppy.be;
• by letter: Poppy NV, to the attention of the DPO, Sanderusstraat 25, 2018 Antwerpen, Belgium.

9. Modifications to this Policy

We can modify this Policy at all times. In order to keep you informed of the latest modification of this Policy, we shall adapt the revision date each time it is modified. The modified Policy shall enter into force as of that date.

Please consult this page regularly to keep informed of any modifications and/or additions. 

We will also proactively inform you about important changes to the Policy, through a pop-up on our Website.

This Policy is available in several languages. In the event of any differences in content between the versions, the English version shall prevail. 

10. Applicable law and competent courts

This Policy is governed by and construed in accordance with the Belgian legislation that is exclusively applicable to any potential dispute. 

In the event of a dispute, the parties will attempt to resolve it amicably or through an approved mediator or arbitrator. In the event of failure to resolve the dispute amicably, the competent courts will be settled exclusively by the competent courts of Brussels, Belgium.