OK MOBILITY GROUP PRIVACY POLICY

1. DATA CONTROLLER

This is the Privacy Policy of the companies belonging to OK MOBILITY GROUP (hereinafter, "OK MOBILITY"). This Privacy Policy provides relevant information about the processing of your personal data by OK MOBILITY companies when you purchase their products and/or services.

The Data Controller is the company that you purchase OK MOBILITY products and/or services from.

If you would like more detailed information on the entities referred to, below is a list of the companies responsible for the processing and the contact details by country:

It is important that you read this Privacy Policy carefully to understand how we process your personal data.

This Privacy Policy also applies to third parties to whom you may provide this information.

• Personal data processing by franchisees and/or affiliates

We hereby inform you that when purchasing our products and/or services, it may be necessary to share personal data with our franchisees and/or affiliates. This Privacy Policy does not apply to OK MOBILITY offices which are owned and/or operated by a franchisee and/or affiliate, i.e. which are not owned or controlled by OK MOBILITY GROUP, S.A.U. or by a subsidiary thereof.

Should you have any further questions or concerns regarding the use of your personal information by our franchisees and affiliates, you may contact us by sending an e-mail to rgpd@okmobility.com.

2. COLLECTING YOUR PERSONAL DATA:

OK MOBILITY can obtain your data through different channels:

• Data provided directly by the customer. Through the OK MOBILITY website, through its App, Customer Services or offices (hereinafter "Stores"), when booking and/or purchasing OK MOBILITY products and/or services, and also throughout the contractual relationship or after the same (for example, through complaints or requests for information sent to OK MOBILITY Customer Services).

• Data provided by third parties: On occasion, OK MOBILITY will combine the personal information that you provide with other information that it receives from other sources and/or third parties. This information may include any kind of information that is relevant for the purposes of providing the service and purchasing products. These third parties may be:

• Travel agencies or external booking services that you use when making your booking;
• Your company or entity if you are using a company/entity account;
• OK MOBILITY franchisees and affiliates, if you make a reservation in a rental service establishment looked after by OK MOBILITY franchisees or affiliates;
• Insurance companies and, where appropriate, insurance intermediaries and actuaries, if required for managing a claim or accident;
• Law enforcement agencies if you are involved in an accident during your rental or you suffer loss, damage or theft of the vehicle; and also in the event of any crimes committed, and
• Public Administrations, if you commit an offence during your rental that leads to the imposition of a sanction, such as a fine for any reason, e.g. speeding, parking, tolls, etc.

We hereby inform you that some of your data may be required to comply with the purposes of the processing, as well as the legal obligations of OK MOBILITY. This data is identifiable in the online forms and App because they are fields marked with an * (asterisk), and they will also be requested if you contact our Customer Services. You are responsible for the accuracy of the data you provide us with and for updating it. If you do not provide us with the personal information that we are requesting and that is necessary, we will not be able to formalise a vehicle rental contract or provide you with the requested service.

3. CATEGORIES OF PERSONAL DATA

• Identification data: processing; name and surname; date and place of birth; data contained in the identification document (including the image on it); data contained in the driving licence (including the image on it) and voice.

• Contact details: e-mail and other written means of communication (including the content of these), temporary address, permanent address, own or third-party landline telephone number, mobile telephone number and proof of permanent address.

• Financial data: payment information (credit or debit card details and bank details).

• Contract and service data: contract number; reservation number; voucher number; type of reservation; reservation status; extras purchased; where and when you rented the vehicle; where and when you returned the vehicle; details of the vehicle actually driven with regard to the registration number, chassis number and any other information relating to the vehicle.

• Telematics data: vehicle status and maintenance data (e.g. mileage, battery status, fuel consumption, warnings and service information), vehicle geolocation and vehicle damage/accident data (e.g. air bag activation, impact intensity).

• Incident data: accident data; mechanical failure; loss, theft or damage of the vehicle during the rental; data related to administrative offences; health data (only in the event of an accident).

• Third-party data: identification details of the additional driver(s) (the same as identified in the "Identification data" section); identification data of passengers in the event of an accident.

• Special categories of data: data relating to special needs (only if shared by the data subject in the purchasing process); customer, passenger or third-party health data (in the event of an accident) and biometric data (in the event of digital identity validation).

• Location data: Data indicating the location of your device when using the OK MOBILITY App or web applications.

• Website and App browsing data: IP address, browsing data.

• Other: company details, tax identification number (if expressly requested) and business address (if a member of a corporate programme); nominative discount codes and promocodes; membership numbers of affiliate programmes at OK MOBILITY's business partners, and details of your flight.

We also inform you that when you purchase a vehicle pick-up or delivery service, OK MOBILITY will process the details of the address where the vehicle will be delivered or picked up, as well as those relating to any additional details that you may provide.

Likewise, OK MOBILITY may process any other additional personal data that may be necessary to rent a vehicle to you and/or provide you with the services purchased, or for any other procedures that may arise from this, as long as this personal data is necessary for the purpose of the processing.

4. PURPOSES OF PERSONAL DATA PROCESSING:

4.1 Booking vehicles:

OK MOBILITY will process your personal data in order to formalise the vehicle rental reservation: for that purpose, it will process identification data (name and surname, identification document type and number), contact details (telephone, e-mail, country), contract details (reservation number, reservation type; reservation status; extras purchased; where and when you rented the vehicle, where and when you are going to return the vehicle).

It will also process your financial data through financial service providers for the payment, where applicable, of the products/services booked. In addition, data to establish the device being used may be recorded for the purpose of ensuring regulatory compliance relating to such transactions, e.g. authentication when making payments.

The lawful basis for these processing operations is the performance of the contract (art. 6.1.b) of the GDPR) and compliance with a legal obligation (art. 6.1.c) of the GDPR).

4.2 Car rental:

When hiring a vehicle, OK MOBILITY will process your personal data for the management of the contract and the provision of the service, as well as the extras purchased. Thus, for example, your data will be processed for verifying the identity of the lessee and the drivers of the vehicle, for purchasing, for sending communications relating to the service, for allocating the vehicle, for the payment of the lease and the extras purchased, and also for invoicing. These processing operations may involve processing the personal data of the additional driver(s) included in the contract.

It will also process your financial data through financial service providers for the payment of the selected products/services and for the provision of the security deposit. In addition, data to establish the device being used may be recorded for the purpose of ensuring regulatory compliance relating to such transactions, e.g. authentication when making payments.

If you purchase medical care via telemedicine, OK MOBILITY will send the service provider your first and last name and contract number, so that it can verify your identity in the event that you contact the provider. OK MOBILITY shall under no circumstances have access to any personal data, in particular sensitive data, which you may provide to the provider.

For the purpose of preventing and investigating criminal conduct, we are required by law to provide the State Security Forces and Corps with our customers’ details when required to do so, e.g. when providing their data in compliance with article 25 of Organic Law 4/2015 of 30 March on the protection of public safety and Royal Decree 933/2021 of 26 October, which establishes the obligations of documentary registration and information of individuals or legal entities engaged in the activities of accommodation and motor vehicle rental.

The lawful basis of these processing operations is the performance of the contract (art. 6.1.b) of the GDPR) and compliance with a legal obligation (art. 6.1.c) of the GDPR).

4.3 Identity registration/validation by means of an ID card and driving licence

Your identification document and driving licence is validated by our employees in OK Mobility "Stores" or digitally (see clause 4.3 "Fast Track" and clause 4.4. "Digital key"), verifying through the data contained in these the identity of the person providing them, registering them and keeping a copy in the OK Mobility management system, to enable compliance with our legal obligations and management processes associated with the contract.

The lawful basis for this processing is the performance of the contract (art. 6.1.b) of the GDPR) and compliance with a legal obligation (art. 6.1.c) of the GDPR).

4.4 Fast Track/"Immediate delivery" option

If you have purchased the "Fast Track" service or have selected a rate that includes the "Immediate Delivery" option, you will be offered the option to activate the service and verify your identity through the image on your identity document and digital driving licence, through a process known as a "liveness check". Once complete, you will be asked to sign the contract. This option facilitates the processing of your rental on the day of purchase, although it is optional, so, if you prefer, your identity and the vehicle driver's documentation, as well as the contract, can be verified in our "Store".

The lawful basis of this processing is the consent you give (art. 6.1.a) of the GDPR).

4.5 Digital Key:

If you have selected the "Digital Key" rate, you will be offered the option to activate the service and verify your identity through the image on your ID card and your digital driving licence. Once complete, you will be asked to sign the contract. OK MOBILITY will process the vehicle location data in order to facilitate the collection and return of the vehicle by digital means.

If you do not activate this option, you will not be able to enjoy the service associated with the "Digital Key" rate and you will have to formalise the rental and delivery of the vehicle directly with the staff in our Store.

The lawful basis of these processing operations is the performance of the contract (art. 6.1.b) of the GDPR).

4.6 Connected Vehicle:

Our vehicles can be fitted with electronic control units that are interconnected through the vehicle's internal network and also with connectivity services that allow you to share information with other devices both inside and outside the vehicle, enabling data to be collected about the vehicle and its use.

We process contract and telematics data (e.g. geolocation) for the maintenance and management of our vehicle fleet, ensuring that vehicles are in good working order and suitable for leasing.

We also process telematics data in connection with any damage/accidents the vehicle may have suffered. In the European Union, our vehicles are required to be fitted with "eCall" emergency call technology, which is activated if the vehicle is involved in an accident. The eCall system will automatically call the emergency services and provide them with information about the accident. We will also use, disclose and access this information.

Your telematic data (e.g. geolocation) and contract data will also be processed in order to check compliance with the contract regarding the territory in which the vehicle may be driven or in connection with border crossings, to locate the vehicle if it is not returned within the agreed period or to take action in the event of suspected theft or misappropriation.

We hereby inform you that some of our vehicles have a geolocation system, so the vehicle location data may be processed in the cases indicated above.

The lawful basis of this processing is the performance of the contract (art. 6.1.b) of the GDPR) and the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.6.1 Infotainment system:

When you connect a mobile phone or other device to the infotainment system of a connected vehicle, its data may be stored in the vehicle. OK MOBILITY does not collect or process this data. To prevent the next driver of the vehicle from accessing said data you should ensure that you delete said data before returning the vehicle by disconnecting the device and deleting any personal information that may be stored in the vehicle's infotainment system. Information on how to do this can be found in the vehicle’s user manual.

4.7 Breach of contract and law

OK MOBILITY will process your data for purposes linked to the potential breach of contract and the law, such as, for example, the unauthorised use of the vehicle, subletting the vehicle, leaving the territory permitted for driving the vehicle or crossing borders, locating the vehicle if it is not returned within the agreed period or taking measures in the event of suspected theft or misappropriation. In the event of a border crossing, the vehicle may be blocked.

Along the same lines, personal data is processed for the purpose of preventing, detecting or investigating the unauthorised use of OK MOBILITY vehicles and managing any disputes and accidents, as well as receiving legal or professional advice for the defence of its legitimate interests.

We hereby inform you that some of our vehicles have a geolocation system, so the location data of the vehicle may be processed in these cases and sent to the Authorities and State Security Forces and Corps.

The lawful basis of this processing is the performance of the contract (art. 6.1.b) of the GDPR) and the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.8 Management of enquiries and complaints received

You can contact OK MOBILITY by e-mail, post and telephone for answers to questions and to submit claims relating to the services and/or products purchased. As such, if you submit a query or complaint, OK MOBILITY will process your personal data to manage and resolve these.

Telephone calls made to customer services or the department handling your query or complaint may be recorded for quality control, service improvement and internal training purposes.

The lawful basis of this processing is the performance of the contract (art. 6.1.b) of the GDPR) and the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.9 Incident management:

4.9.1 Management of traffic offences and penalties:

OK MOBILITY will process your personal data in the event that you receive a traffic offence, e.g. a fine or penalty issued by the Authorities or other third parties in relation to non-compliance with the regulations in force.

If you are notified of a penalising record for traffic offences committed during your rental from OK MOBILITY, OK MOBILITY will process your personal data in order to comply with the obligation to identify the driver who has committed the offence. We hereby inform you that this is managed through the external provider Gestorías Asociadas Gesthispania, S.L., which manages driver identification before the bodies that generate penalising proceedings.

We also inform you that through the GESTORÍAS ASOCIADAS GESTHISPANIA S.L. platform, we offer you the option to pay the fine, as long as this is permitted by the specific penalising record. If you voluntarily choose to use this service, you can do so directly with GESTORÍAS ASOCIADAS GESTHISPANIA S.L.

The lawful basis of these processing operations is compliance with a legal obligation (art. 6.1.c) of the GDPR) and the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.9.2 Damages and accidents:

In the event of damage or an accident in which the vehicle is involved, OK MOBILITY will process your personal data for the purposes of customer services, processing the claim and related matters, including our right to defend ourselves against claims, both legal and otherwise, and/or to present such claims. We will also process your data if you require roadside assistance in order to provide you with this service. In the event of personal injury in this context, OK MOBILITY may process the health data of individuals affected by the damages of the accident.

The lawful bases for this processing are the performance of the contract (art. 6.1.b) of the GDPR), compliance with a legal obligation (art. 6.1.c) of the GDPR), the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR) and art. 9.2.e) of the GDPR regarding the processing of special category data.

4.9.3 Automatic damage detection system:

OK Mobility uses automatic damage detection arches at certain facilities by means of multiple cameras installed in these devices. When the vehicle passes through this damage detection system, it takes high-resolution photographs of the vehicle and can thus establish recognisable damage to the vehicle.

Contract data, vehicle data and photographs will be processed.

The lawful basis of this processing is the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.10Sending out satisfaction surveys:

OK MOBILITY sends satisfaction surveys to its customers for an assessment of their experience in relation to the products and services purchased, as well as the attention received, in order to improve our processes, products and services.

The lawful basis of this processing is the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.11Marketing:

OK MOBILITY may process your data to send commercial communications, for example, commercial discounts applicable to OK MOBILITY products and/or services, invitations to follow OK MOBILITY on social networks, the organisation of competitions, prize draws and other promotions, as well as the sending of promotional communications. These communications may be sent by email, SMS, push notifications or to your postal address. To send commercial actions, OK MOBILITY may use database segmentation of interested parties in order to adapt and personalise the promotions and benefits offered to its customers.

OK MOBILITY may send you:

• Commercial information on new rates, promotions and offers from OK MOBILITY applicable to the service purchased or which are similar and may be of interest to you. The lawful basis of this processing is the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR) and in accordance with art. 21.2 of the LSSI.

• Commercial information, by any channel, concerning offers and promotions on other products and services from OK MOBILITY and OK GROUP companies. The lawful basis of this processing is the consent you give (art. 6.1.a) of the GDPR).

• Commercial information, by any channel, concerning offers and promotions on other products and services from OK MOBILITY business partners. The lawful basis of this processing is the consent you give (art. 6.1.a) of the GDPR).

You may object at any time to this processing of your personal data by contacting OK MOBILITY by post at the address Avda. Gran Vía Asima, 36-A, 07009 Palma de Mallorca (Spain) or at the address of any of our offices (you can find more details in clause 1. "Data controllers" of this Policy, as well as by e-mail to the address rgpd@okmobility.com. You can also do so by selecting the "Unsubscribe" option included in the communications sent to you.

4.12 CLUB OK

OK Mobility may process your personal data for the management of its "Club OK" loyalty programme. If you wish to view the privacy policy of the "Club OK" loyalty programme, you can find it on XXX

4.13 Management processes at OK MOBILITY

OK MOBILITY may process your personal data to ensure the efficient administration and management of the company in its relationship with customers.

OK MOBILITY also takes action to protect its business against fraud (e.g. verifying the existence of fraud) and non-payment, among other things, actions which may require the processing of personal data.

In the event of non-payment, non-compliance with the law or the contract and improper conduct towards customers and/or employees, OK MOBILITY reserves the right to refuse rental, in this case processing your personal data in the exercise of the freedom of contract and the right of admission.

In line with the above, to protect and defend its rights as a Group and its employees, OK MOBILITY may process your data in order to protect its facilities and systems.

The lawful basis of this processing is the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.14 Fulfilment of OK MOBILITY's legal obligations

Personal data processing may be necessary in order to comply with any legal obligation incumbent upon OK MOBILITY. For example, to respond to requests for information from authorities or law enforcement agencies; to disclose the incident to the competent authorities as required by law, and to establish, exercise or defend legal claims arising as a result of such an incident.

In addition, OK MOBILITY has a legal obligation to communicate the personal data of its customers to Authorities, as well as to State Security Forces and Bodies, in order to prevent and investigate criminal conduct (see section 4 "Vehicle rental").

The lawful basis for this processing is compliance with a legal obligation applicable to OK MOBILITY (art. 6.1.a) of the GDPR).

4.15 Creating an account on the App:

To create an account through the OK MOBILITY App, we will ask for your contact and identification details.

An account can be created using our App or by logging in on other selected platforms, such as Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), Apple (Apple Inc., Apple Park Way, Cupertino, California 95014, USA) or Facebook (Meta-1601 Willow Road, Menlo Park, California, 94025, USA). The password you use on these platforms will not be shared with OK MOBILITY and you can disable the use of the platform login through the platform settings.

The lawful basis of this processing is your consent (art. 6.1. a) of the GDPR) and the performance of the contract (art. 6.1.b) of the GDPR).

4.16 Operation of the website and the App:

OK MOBILITY uses analytical software, such as AB Tasty, Clarity, Google Analytics and others, to better understand the functionality of the software on its websites and Apps on your device. These software tools record technical information including, but not limited to, information about your device along with usage information, such as how often you use our website or App, which features you do or do not use on the website, which pages you visit on the website, aggregate usage, performance data, when you downloaded the App and information about your visit to the site, including details of your click history on a uniform resource locator (URL) to, through and from our website. Please see our Cookie Policy for more information about these tools.

In short, the purpose of this processing is to understand how users use OK MOBILITY's websites and applications so as to detect any problems that arise in relation to how the websites and applications are used and to understand how to improve the user experience.

Accordingly, when you use the OK MOBILITY website and App, technical information about your devices will be collected where permitted.

The lawful basis for this processing is the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

4.17 Mobility Wallet

If you are a member of the OK MOBILITY Club, you can purchase mobility days by purchasing a voucher that acts as a digital wallet, called "Mobility Wallet". OK MOBILITY will process your personal data to manage the digital wallet where you can accumulate the selected rental days. You will be able to give mobility days to a third party via "Mobility Wallet". OK MOBILITY will process the personal data of this third party for the purpose of offering the selected mobility days.

If you select mobility days for a third party, you undertake to authorise this transfer of data.

More information about Mobility Wallet can be found at https://okmobility.com/en/help/club-ok/mobility-wallet on the OK MOBILITY website.

The lawful basis for the processing of your personal data is the performance of the contract (art. 6.1.b) of the GDPR).

4.18 Recognition of registration

OK MOBILITY may, in certain circumstances, use automated number plate recognition systems. In this regard, the registration number of OK MOBILITY vehicles is processed so that they can enter and leave the car parks without having to use a ticket, thereby also recording the date and time to establish the correct time of return.

The lawful basis of this processing is the performance of the contract (art. 6.1.b) of the GDPR) and the satisfaction of the legitimate interests of OK MOBILITY (art. 6.1.f) of the GDPR).

5. RECIPIENTS OF THE DATA

The personal data processed by OK MOBILITY may be shared with the following recipients:

• OK MOBILITY GROUP, S.A.U., for the paperwork needed to provide the purchased services, the fulfilment of the contract, fleet management and any paperwork that may be needed for the activity of OK MOBILITY.
• Other OK MOBILITY companies, if needed to provide the services purchased by you or with your consent.
• Independent franchisees and affiliates if you purchase a service and/or product in the destinations in which they operate and this transfer is needed for the fulfilment of the contractual obligations assumed or by legal requirement.
• Transport companies, if it is necessary to travel to OK MOBILITY's facilities.
• Companies providing roadside assistance services.
• Travel agencies if you have purchased a product or service of OK MOBILITY through a travel agency, for the management of the contract.
• Financial service providers to process payment transactions.
• Service providers relating to damage detection systems.
• Technological and geolocation service providers.
• Service providers for validating your identity and driving licence.
• Parking management companies.
• Default management service providers.
• Lawyers, if defending our interests and lodging complaints, for example.
• In compliance with legal obligations, your data may be shared with State, regional and local Public Administrations; State Security Forces and Corps; Courts and Tribunals and/or; the Public Prosecutor's Office.
• Insurance companies and, where appropriate, insurance intermediaries and actuaries, if needed for the handling of a claim, claims relating to accidents and/or injuries.
• If you are renting a vehicle with a corporate account, partnership account or an account for another similar business entity, we may share personal information with the organisation managing the account for their own purposes. We recommend that you review their privacy policy to learn more about their privacy practices.
• If an OK Club member has been assigned a mobility voucher via the Mobility Wallet.

OK MOBILITY has suppliers who provide services and, in their capacity as data processors, they may have access to and may process your personal data. OK MOBILITY has formalised contracts with these suppliers as required by law, in order to provide due protection for your personal data and protect its confidentiality.

6. INTERNATIONAL TRANSFERS

Depending on where you rent OK MOBILITY vehicles, your data may be subject to international transfers. Thus, if you rent a vehicle in a third country (as defined in the data protection regulations), your personal data will be transferred to the OK MOBILITY company or, where applicable, to the relevant franchisee or affiliate, and will be the object of an international personal data transfer. These transfers are carried out insofar as they are necessary for the performance of a contract to which you are a party or as pre-contractual measures.

In order to protect personal data in international transfers, OK MOBILITY adopts the relevant guarantees, as set out in the current data protection regulations.

In addition, and given the global nature of OK MOBILITY, your personal data may be subject to international transfers, to the extent that it is transferred to OK MOBILITY companies located in a third country, considering the corporate activities and functions carried out by the different companies that make up OK MOBILITY.

7. DATA RETENTION PERIOD

We hereby inform you that the personal data processed by OK MOBILITY will be kept for as long as needed for the purpose for which it was collected. We also inform you that, once this period has elapsed, OK MOBILITY will keep the personal data you provide in order to comply with all OK MOBILITY's legal obligations.

In this respect, the books and documentation to be deposited in the Commercial Register will be kept for six years and the documentation related to the offsetting of tax bases for 10 years.

In the event that, once it is no longer necessary for the purpose for which it was collected, if you decide to request its erasure, the data will be blocked in accordance with data protection regulations, and will be available only at the request of Judges and Courts, the Public Prosecutor's Office or the relevant Public Administrations during the period of limitation of the actions that may arise.

In any case, if at the end of the contractual relationship there is ongoing litigation arising from the exercise of actions challenging the invoice or aimed at obtaining collection of the same, the data may be kept during the processing of the same, until a final decision is reached - at which time it will be blocked and subsequently erased - although it may only be used for evidentiary purposes.

8. AUTOMATED DECISION-MAKING

Data processing at OK MOBILITY does not include automated decision-making in accordance with art. 22 of the GDPR.

9. PROFILING

On certain occasions, OK MOBILITY processes your data in an automated way, analysing certain personal aspects in order to improve its websites and customer relations, and it may also provide specific information about products.

10. YOUR DATA PROTECTION RIGHTS

Under applicable data protection legislation you have the following rights regarding the processing of your personal information:

• Right of access: you have the right to request a copy of the personal information OK MOBILITY holds about you and to request explanatory information about how your personal information is used.
• Right of rectification: you have the right to request that OK MOBILITY rectify any inaccurate personal information concerning you.
• Right of erasure: you have the right to request that OK MOBILITY erases personal information concerning you.
• Right to restriction of processing: in some situations, you have the right to request that OK MOBILITY does not use the personal information you have provided (for example, if you believe it to be inaccurate).
• Right to data portability: you have the right to receive certain personal information about you in a structured, commonly used and machine-readable form so that it can be transferred to another data controller.
• Right to withdraw consent: where OK MOBILITY processes your personal information on the basis of consent (including direct marketing consents) you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the consent-based processing prior to its withdrawal. Furthermore, even in the event of a withdrawal of consent, OK MOBILITY may continue to use your personal information to the extent permitted or required by law.
• Right to object: in addition, where OK MOBILITY is processing personal information about you on the basis of a legitimate interest (or that of a third party) you will have the right to object. However, OK MOBILITY will retain the right to process your personal information where it is for legitimate interests or where it is relevant to legal claims. You will also have the right to object where OK MOBILITY is processing your personal information for direct marketing purposes.
• Right not to be subject to automated decisions: You have the right not to be subject to a decision based solely on the processing of your data, including profiling, which has legal effects concerning you or significantly affects you in a similar way.

If you wish to exercise any of these rights or if you have any queries about how OK MOBILITY processes your personal information, you can contact OK MOBILITY by post at the address Avda. Gran Vía Asima, 36-A, 07009 Palma de Mallorca (Spain) or at the address of any of our offices (you can find this information in the list in clause 1. "Data controller" of this Policy) or by e-mail to the address rgpd@okmobility.com.

In addition, if you are not satisfied with our processing of your personal data, you may lodge a complaint with the relevant supervisory authority.

11. RIGHT TO LODGE COMPLAINTS

You have the right to lodge a complaint with a supervisory authority in the Member State where you reside, where your workplace is located or where the alleged infringement has been committed.

12. DATA PROTECTION OFFICER

You can contact the Data Protection Officer by post at the address Avda. Gran Vía Asima, 36-A, 07009 Palma de Mallorca (Spain) or at the address of any of our offices (you can find this information in the list in clause 1. "Data Controller" of this Policy), as well as by e-mail to the address rgpd@okmobility.com.

13. PRIVACY POLICY UPDATES

OK MOBILITY may change parts of this Privacy Policy from time to time, so please check back periodically. If OK MOBILITY makes a change that significantly affects your rights or, to the extent it is authorised to do so, OK MOBILITY makes significant changes to how it uses your personal information, it will notify you by posting it in a prominent position on OK MOBILITY's websites and App, email and/or post before the change takes effect.

Version updated in October 2024.