Politique de vie privée

Protecting your privacy is important to Groupe Moovea Inc. and its affiliates, doing business as Flexter (collectively, "Flexter" or "we"), and that is why we take the privacy of our users' personal information and compliance with applicable laws very seriously. The purpose of this privacy policy (the "Policy") is to explain and describe how we process your personal information as data controller in the operation of our enterprise. Flexter acknowledges that it is responsible for the protection of personal information and can demonstrate its compliance with applicable legislation when processing personal information.

This Policy is one of the cornerstones of our privacy protection program, that consists of multiple other internal policies, procedures, and security practices that ensure the adequate protection of your personal information.

 

Table of content

We recommend that you read this Policy in full to ensure that you are fully informed about the manner in which we process your personal information before choosing to use our services or otherwise provide personal information to us.

Should you prefer to refer to specific sections of this Policy, the following topics will be covered in the next sections of this Policy

1. Important terms used in this Policy
2. Scope of the Policy
3. Acceptance
4. Types of personal information that we collect
5. How we collect personal information
6. How we use your personal information
7. Who can access your personal information
8. Extraterritorial transfers of your personal information
9. How we obtain your consent
10. How we use automated decision-making tools
11. How we use cookies
12. Security safeguards and security incidents
13. For how long we retain your personal information
14. Your rights concerning your personal information
15. How you can contact us
16. Modifications to the Policy
17. Additional information

1. Important terms used in this Policy

It is important for you to understand the meaning of the following terms when reading this Policy:

• “GDPR” means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data;

• “personal information” is information concerning a natural person that allows this person to be identified, or any other similar definition given to such term in applicable laws;

• “platform” refers to our online platform allowing users to search for rental offers and reserve vehicles and equipment from rental partners;

• “process” or “processing” means generally any operation or set of operations which is performed on personal information or on sets of personal information, whether or not by automated means, such as to collect, use, disclose, transfer, store, adapt, store, etc.

• “rental partner” refers to our partners who operate vehicle and ancillary equipment rental services, and who make their vehicles and equipment available to users through our platform;

• “UK GDPR” means the GDPR as saved into United Kingdom (“UK”) law by virtue of the United Kingdom’s European Union (Withdrawal) Act 2018;

Flexter operates its business in many different jurisdictions throughout the world. This Policy has been constructed to comply with all said jurisdictions. As such, certain concepts and defined terms used in this Policy have been generalized to ensure this Policy remains consistent with all applicable data protection laws. Should you have any questions concerning this Policy, please do not hesitate to contact our Data Protection Officer using the information set out in Section 16 below.

2. Scope of this Policy

The Policy applies to personal information in our possession or control, including information collected when an authorized user or customer utilizes Flexter’s platform or ancillary services, purchases any products from Flexter or browses the Flexter’s website (collectively, the "Services"). The Policy also applies to information we receive from third parties about you while providing our Services.

If you are a candidate applying for a position with us, we refer you to our Applicant and Candidate Privacy Policy. If you are an employee, consultant, director, officer or other representative of Flexter (each, a “Representative”), we refer you to the internal privacy policy of Flexter made available generally to its Representatives. This Policy does not apply to the processing of personal information of candidates and Representatives.

3. Acceptance

By accessing our Services or otherwise providing personal information to us, you agree to be bound by the terms and conditions contained in the Policy. For the sake of clarity, your use of our Services or our website constitutes your consent to Flexter processing your personal information in accordance with the terms of this Policy. If you do not consent, in whole or in part, to Flexter collecting, using, and disclosing your personal information as set out in this Policy, please contact our Data Protection Officer using the information set out in Section 16 below. In such a case, we may not be able to provide our Services to you.

4. Types of personal information that we collect

Personal information that we collect

In application of the data minimisation principle, we collect only your personal information that is necessary to provide you with our Services, to maintain our relationship with you and to meet our legal obligations. If you refuse to provide us with such personal information, we may not be able to deliver our Services to you.

We may collect the following categories of personal information about you:

• Identification information: your first name and last name, your personal email address, your phone number, your address, your country of residence, your age, your driver’s license details, whether or not you are insured for the vehicles and equipment rented on our Platform, etc.
• Payment information: your credit card number and the associated payment information.
• Professional and business information: your business email address, your job function, your employer’s address, your organization name, your work location, etc., when you are placing a reservation on behalf of your employer.
• Personal preferences: your language of preference, your preferences as concerns vehicle and equipment rental, your navigation preferences, your reservations history, etc.
• Technical information: technical and business information about your equipment, your use of our Services, your browsing habits, your geolocalisation, your IP address, your demographics, the operating system you are using, the previous website you visited before navigating on our website, etc.

Other information provided to Flexter or our rental partners: information concerning your interactions with us, such as when you send us emails, make service requests, or contact our customer service, and information concerning your interactions with our rental partners when required to assist with an issue or a complaint.

Please note that we have no control over the categories of personal information that you may provide to us over the course of our interactions or that you may input or publish through our Services. Therefore, it is possible that other types of personal information may be processed by Flexter if you provide them to us on your own initiative.

Sensitive personal information

Flexter will never ask you to share sensitive personal information (also called special categories of personal information) to access and use its Services or as part of its relationship with you. For reference, sensitive personal information is personal information that, due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, entails a high level of reasonable expectation of privacy. Examples of sensitive information may include health information, sexual orientation, morphological, behavioral, or biological characteristics, philosophical or religious beliefs, political opinion or financial status. If you share sensitive personal information to Flexter, you expressly consent to its processing in accordance with the terms and conditions of this Policy.

5. How we collect personal information

Generally, we obtain information directly from you. However, we may also collect personal information about you from outside sources, with your consent or without your consent, if permitted by law.

Among others, here are certain ways we use to collect personal information about you:

• Direct interactions with you: We obtain personal information directly from you when you contact Flexter, when you add information to our Platform in the course of using our Services, when you subscribe to our newsletter, when you respond to a survey, etc.
• Automated collection methods: When you use our Services, we may collect certain technical and business information about your equipment, your use of our Services, your browsing habits, etc. You can find more information about automated collection methods in Sections 5 and 12 of this Policy, and in the cookie consent tool used on our website.
• Rental partners: We collaborate closely with rental partners who are listed on our platform, and we may obtain personal information concerning you from them directly, for example when we manage a booking made by you with this rental partner on our Platform.
• Third-party and public information: We may obtain information from third parties that are authorized to disclose this information or that make this information generally available to the public on their website or in publicly available databases, including, for example, advertising networks, analytics providers, or social media (such as LinkedIn, Facebook, and others).
• Governmental entities: We may obtain, in limited circumstances, information about you from governmental bodies, agencies and registries.

6. How we use of your personal information

We process your personal information for the following purposes, and based on the following legal basis (where applicable):

 

Flexter may also use your personal information to compile statistics, for example to detect trends in the demand for rental services, or to detect trends in the use of its Services and to improve them. However, these statistics do not identify you and have been anonymized. Flexter may also create anonymized datasets from these statistics, for which Flexter will be the sole owner. Information is considered anonymized when it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows for your direct or indirect identification.

Where authorized by law, your personal information may also be used for another purpose than those set out above without your consent. Otherwise, your personal information will not be used for purposes other than those described above, except with your consent.

7. Who can access your personal information

Flexter has business activities in different countries around the world. This includes Canada, the European Economic Area (the “EEA”), the UK and the United-States of America (the “US”). To provide you with the best possible experience, we need to share your personal information with internal and external parties. We acknowledge that, except as described below or as permitted by law, the communication of your personal information to third parties requires your consent. Whenever Flexter is required to disclose your personal information, Flexter will endeavor to disclose no more information than is required under the circumstances.

You have the right to know, upon request, to whom your personal information is disclosed and the circumstances leading up to the disclosure and contact information for making such a request is provided in section 16 of the Policy.

Internal communications

Access to your personal information within our corporate group does not require your consent but is strictly limited to those Representatives for whom such information is necessary to carry out their duties and responsibilities.

External communications (third parties other than rental partners)

We retain the services of providers and we establish partnerships with third parties located around the world to deliver our Services to you. Flexter may share your personal information, without your consent, with third parties who require such information in connection with Flexter’s business or to assist Flexter in administering and delivering its Services. Such third parties will contractually guarantee in writing that they will use your personal information exclusively for specific purposes, that they will keep it confidential and protected in accordance with this Policy and best practices, and that they will comply with all applicable data protection legislation.

We communicate personal information to the following categories of recipients and for the following functions:

• Service providers: we may disclose your personal information with service providers with whom we have contracted in order to provide our Services to you. These providers will access and process your personal information only as instructed by us. This may include customer relationship management, infrastructure, money collection, data hosting, marketing, billing, accounting, data analysis, information security, network and systems monitoring, software development and release, technical support, or other similar services.
• Other business partners: we may partner with other companies to support our business or to offer you new products or services. This may include resellers, referral partners, social networks or event sponsors.
• Professional advisers: in some instances, we may share your personal information with professional advisers and consultants, including lawyers, bankers, auditors or accountants.
• Counterparty to a business transaction: subject to applicable law, Flexter may share your personal information when it enters into or negotiates a business transaction involving the sale or transfer of all or part of its business or assets. This could include, for example, a merger, financing, acquisition, transaction, or bankruptcy proceeding implicating the enterprise of Flexter.
• Third-party, where otherwise required: Flexter may, acting in good-faith, communicate your personal information with third-parties, including public authorities, regulatory authorities, government agencies and ministries, (i) to prevent fraud or serious physical harm to any person, (ii) to comply with any court order, law, or judicial proceeding, including to respond to any governmental or regulatory request, in accordance with applicable laws, including in cases of alleged or actual breach of privacy, or (iii) to enforce our terms of use and other agreements or legal rights, including for billing and collection purposes.

Please note that this Policy does not apply to information collected about you by third parties through websites or third-party services that you may access via our website or Platform. We encourage you to review the privacy policy of these third-party sites or services before accessing or using them.

External communications (rental partners)

When you make a booking on our platform with a rental partner, you expressly acknowledge that your personal information will be automatically received by the concerned rental partner to allow it to honor your reservation and provide you with its vehicle and equipment rental services, as if the reservation had been placed directly with the rental partner. When you use the rental partner’s rental services, you understand that the rental partner’s own privacy policy and practices will apply to your personal information shared with such rental partner.

8. Extraterritorial transfers of your personal information

As a result of its international activities, Flexter may from time to time disclose your personal information outside of the province, state, or country in which you normally reside, for example to the service providers and partners identified in Section 8 above.

Where applicable, we will take all appropriate measures to ensure that the recipient of your personal information located in another jurisdiction will protect it with the same standards of protection as Flexter would in your jurisdiction, and that your personal information will not be used for purposes other than those permitted by the collection or by applicable law in your jurisdiction.

If you reside in a member state of the EEA or in the UK, this means that your personal information may be accessed and processed outside of the EEA or the UK by Flexter and/or by one of our trusted partners or service providers. When your personal information is transferred outside the EEA or the UK, we require that an adequate level of protection is in place according to the requirements of applicable privacy laws. We also rely on appropriate transfer mechanisms in accordance with applicable laws.

9. How we obtain your Consent

In certain instances, we may require to obtain your consent to process certain of your personal information. In such a case, Flexter acknowledges that your consent must be manifest, free and informed. Your consent must be requested for specific purposes, in clear and simple language, and requested in a manner which is clearly distinguishable from all other matters.

Depending on the nature and sensitivity of the personal information, your consent may be express or implied (when permitted at law). Generally, Flexter will seek your consent at the time of collection, except where we are required or otherwise permitted by law.

Your consent can be withdrawn at any time, subject to applicable legal restrictions and reasonable notice. We strive to make it as easy to you to withdraw as to give your consent. However, please note that if you choose to withdraw your consent to the processing of your personal information, Flexter may no longer be able to provide certain of its Services to you. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

Without limiting the foregoing, you may change your preference to receive email marketing communications, mobile notifications, SMS messages or participate in surveys at any time by clicking on the unsubscribe link in the concerned message or by contacting us.

10. How we use automated decision-making tools

Your personal information may be used by Flexter to make automated decisions (including profiling) about (i) services that may be of interest or relevance to you, (ii) detection and prevention of fraud, and (iii) personalization in our search engine and algorithms. This automated decision making will have no legal effect on you, nor will it similarly significantly affect you. Upon request, Flexter will provide you with information on the functioning of this automated system.

11. How we use cookies

Our Services use cookies, which are small data files that are stored on your computer when you visit it in order to remember information about you such as your preferences or past actions. These cookies are notably used to provide you with a good experience while browsing our website or using our software solutions and products, as well as for statistical and marketing purposes. When you consent to receiving marketing email communications from us, we also use web beacons (also known as tracking pixels), which are pieces of software code embedded in an email message which allow us to track pages viewed and messages opened.

The personal information collected through cookies allows Flexter and our service providers to manage and tailor the Services to your preferences, compile statistics and information to improve such Services, analyze trends, gather demographic information about our user base, and identify your areas of interest in order to provide you with relevant content and better target our marketing efforts.

The information we may compile through cookies may include, for example, your computer's Internet Protocol (IP) address, the operating system you are using, your Internet service provider's identity, the date and time you accessed the Services, the content viewed on our Services, and the website from which you accessed our Services.

We use CookieYes as our cookie consent tool, which you can utilize to customize your cookie preferences. When you visit our website for the first time, a cookie consent banner will pop up and ask you to customize your cookie preferences. If you decide to change your preferences at a later date, you can easily do so by re-accessing the CookieYes tool by using the applicable footer on our website. As with most web browsers, you can also delete cookies from your computer's hard drive, block the creation of cookies, or receive a warning before a cookie is stored. We encourage you to visit your browser's instructions or help section for more information on cookies.

However, note that blocking some types of cookies may restrict access to some pages, areas or functionalities of our Services.

12. Security safeguards and security incidents

Security measures that have been implemented by Flexter

Flexter has put in place a series of security safeguards to protect your personal information against loss or theft, as well as unauthorized access, disclosure, copying, use and modification, that are reasonable considering, amongst other things, the sensitivity of the information, its use, quantity, distribution, medium and market standards.

These physical, electronic, and administrative measures include:

• Secure storage: Flexter protects its systems and your data within accredited data centers managed by reputable, industry-leading service providers.
• End-to-end encryption: Your data is encrypted at rest and in transit using strong encryption and communication protocols such as AES-256 and TLS 1.3.
• Zero-trust security: Flexter’s systems are built on the zero-trust security model and internal systems are segregated from publicly accessible systems.
• Access control: Access to information systems is limited to trusted Representatives only and is provided only when strictly necessary while following the principle of least privilege.
• Contractual security and confidentiality: Flexter includes security and confidentiality obligations in all contractual agreements with its customers, vendors, employees and other third-parties, ensuring roles and responsibilities are communicated to everyone and contractually binding.
• Physical security measures: Flexter implements physical security measures, such as restricting access and securely storing any document or file that may contain personal information.
• Administrative security measures: Flexter adopts necessary measures, such as internal policies and procedures, to ensure that all of its Representatives are informed about the contents of the Policy and are aware of its privacy practices. Flexter conducts continuous monitoring of said policies and procedures.

We review these security measures regularly to ensure they are applied properly and continue to be fully effective and appropriate given the evolution of our systems and of information technologies.

However, since no mechanism provides flawless security, there is always some degree of risk. The safety and security of your information also depends on you. Where you have chosen a password for access to certain parts of our Services, you are responsible for keeping this password confidential and to change it regularly.

In the event of a security incident

If a security incident or personal data breach (collectively, an “Incident”) involving personal information occurs, Flexter will, where required by law, disclose to the affected individuals and to the relevant governmental or supervisory authority (such as the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, the UK’s Information Commissioner’s Office, or the appropriate regulatory authority within the European Union) the occurrence of such Incident and take steps to minimize the impact of the Incident on affected individuals. Flexter will also investigate the Incident and adopt methods to reduce the risk of a same nature or similar type of Incident occurring again. Flexter maintains a record of all Incidents involving personal information and, upon request and where required by law, will make such record available to the appropriate privacy authorities.

13. For how long we retain your personal information

Flexter retains your personal information only as long as necessary to fulfill the purposes for which it was collected and to meet legal retention requirements, in compliance with its data retention schedule. As such, the duration of storage depends on the purposes for which the personal information was originally collected, as described in Section 7 of this Policy, and takes into account the recommendations of applicable enforcement authorities. After the conservation period is over, we will either destroy your personal information or anonymize it for serious and legitimate purposes in compliance with Flexter’s internal data retention and disposal policy.

For example, your personal information related to a booking placed on the Platform will be retained to fulfil the specific arrangements you have made with the rental partner. Afterwards, we will keep the information for a period of time which enables us to handle or respond to any complaints, queries, concerns or legal procedures relating to the booking. These deadlines vary according to each situation and must consider the exhaustion of any appeals and applicable limitation periods. As such, we may retain your personal information after your business relationship with us has ended.

14. Your rights concerning your personal information

You have certain rights relating to your personal information that are subject to applicable law, in addition to the other rights set out in this Policy. The availability to you of such rights depends on the privacy legislation applicable to you. Note that after exercising certain of these rights, we may no longer be able to provide certain of our Services to you.

Should you wish to exercise any of these rights, please refer to the procedure set out in Section 16. Note that the law provides certain restrictions on your exercise of these rights. We will advise you in such situations.

Your rights may include:

Right to access

You have the right to request access to your personal information held by Flexter. You also have the right to obtain confirmation that we hold personal information about you.

Right to withdrawal

When we process your information based on consent you have previously given, you may withdraw said consent at any time. More details are provided as concerns consent in Section 10.

Right of rectification

Flexter recognizes that it is important to keep personal information accurate, complete, and up-to-date, and takes reasonable steps to ensure the accuracy and completeness of the information it uses or discloses. However, you are responsible to inform Flexter of any significant changes to your personal information that may occur after it has been provided to Flexter. If you believe that we hold personal information about you that is inaccurate, incomplete or ambiguous, you have the right to request that we correct your information. Any rectification of your personal information will be communicated to third parties to whom the information has been disclosed.

Right to erasure

You may ask that we erase your personal information in certain limited circumstances, for example when said personal information is no longer necessary in relation to the purpose for which it was collected. In the event of a request for erasure, note that Flexter may retain all or a portion of the personal information that has been the subject of the request for as long as necessary to allow you to exhaust any recourse provided by law. Any deletion of your personal information will be communicated to third parties to whom the information has been disclosed.

Right to restrict or object to processing

You may impose certain restrictions on Flexter’s processing of your personal information in certain limited instances, for example when its processing is unlawful, and you oppose its erasure. You may also object to its processing (including profiling) in certain limited circumstances, such as when the processing is based on the legitimate interests of Flexter that you dispute or when your personal information is processed for direct marketing purposes.

Right to data portability

You may ask that we provide you with your personal information in a structured, commonly used and machine-readable format, and that we transmit the same to another controller without hindrance.

Right to formulate a complaint

You have the right to make a complaint at any time to the supervisory authority/privacy regulator of your own country of residence.

 

15. How you can contact us

Question, concerns or requests generally

All questions, concerns or requests regarding this Policy or about the processing of your personal information, including requests concerning the exercise of your rights set out in Section 15 above, should be made in writing to Flexter’s Data Protection Officer, as person in charge of the protection of personal information at Flexter.

Groupe Moovea Inc. (Flexter)
Data Protection Officer
33, Prince Street, Suite 310
Montreal, Quebec, H3C 2M7
Email: legal@flexter.com

Flexter will respond to any valid request made by you within the delays provided for in applicable law. If we refuse to comply with your request, Flexter will inform you of the reasons for the refusal and the sections of the applicable law that support the refusal, subject to the limitations of the law, and inform you of your potential recourses.

Note that if you submit a request to us, we may require that you identify yourself and provide proof of identification so that we may verify the request.

Where permitted at law, we may charge reasonable fees to you to answer your request. In such a case, we will inform you of the applicable fees beforehand.

United Kingdom

Questions or concerns originating from the UK may also be addressed to Flexter’s representative in said jurisdiction. Pursuant to Article 27 of the UK GDPR, Flexter has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR in the following manner:

• by using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/ ; or
• by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom. 

16. Modifications to the Policy

We occasionally update this Policy and reserve the right to change the content of this Policy at any time. Any changes made will be communicated to you through our website or our Platform. Notice of changes may also be given to you by email, if you have provided us this information as part of our business relationship. Flexter also reserves itself the right to make administrative or clerical modifications to this Policy that do not affect your rights or obligations without sending you any communication or notice. The date of the latest version of this Policy appears at the bottom of the page. We recommend that you print a copy of this Policy for your records and review this section of our Services periodically. You are considered to have accepted any modifications to this Policy if you continue to use our Services following a modification.

17. Additional information

For more information about your privacy and your rights, you may consult the following resources made available by law enforcement authorities:

• In Quebec: Commission d’accès à l’information du Québec https://www.cai.gouv.qc.ca/
• In Canada: Office of the Privacy Commissioner of Canada priv.gc.ca (or the applicable Provincial authority)
• In the European Union: European Commission https://commission.europa.eu/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en (or the applicable member state’s supervisory authority)
• In the United Kingdom: Information Commissioner’s Office https://ico.org.uk/