LedOne Privacy Policy

To show that we care about our Users’ privacy and to manage their relationships with us, at ERUM VIAL, S.L. we process personal data for various purposes, always in accordance with current regulations, respecting your rights and with full transparency.

To this end, we have adopted and inform you of this Personal Data Privacy Policy, which you will access when registering your data on first use of the app. It explains, in clear and simple language, how we collect, store, use, and disclose information regarding the processing of personal data that Users voluntarily provide during registration, access, and use of the service.

The main regulations governing how we handle your personal data are:

(i) Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter GDPR).

(ii) Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPD).

Data Controller: Identification of the Entity Responsible for Processing Personal Data

The data controller is the legal entity that determines the purposes and means of processing personal data. In other words, the controller decides how and for what purposes personal data is processed.

For the purposes of this Data Protection Policy, the data controller is:

Company Name: ERUM VIAL, S.L., Tax ID (NIF) B02815157, registered in the Mercantile Registry of Alicante, Volume 4352, Page 77, Sheet A-173062, Entry 1.

• Registered address: Carretera Banyeres, 1, 03802, Alcoi – Alicante
• Contact phone: +34 965 33 08 17
• Contact email: [email protected]

What Personal Data We Process

Personal data means any information relating to an identified or identifiable natural person.

For the processing and purposes explained in this Privacy Policy, the controller collects and processes the personal data indicated for each type of processing, which will depend on the different services requested or the contractual relationship maintained with ERUM VIAL, S.L.

Not all data we inform you about is used for all data processing activities. We detail the types of data processed for each type of processing.

In the case of processing based on your consent, we will additionally inform you of the specific data used.

The User guarantees and is responsible, in any case, for the truthfulness, accuracy, timeliness, and authenticity of the personal data provided and commits to keeping it properly updated.

Processing of Data from the LedOne Mobile Application

We process the following categories of personal data:

1. a) Personal data provided by the User:

The above personal data, when requested, are necessary for the proper execution of the contract between ERUM VIAL, S.L. and the User, and to allow us to comply with ERUM VIAL, S.L.’s legal obligations, except when we rely on the User’s consent as the legal basis for processing, and for our legitimate interest. Without them, it may not be possible to provide all requested services.

It is important that all personal data provided to us is correct and accurate. This includes, among other things, ensuring that the contact details we have (including the email address) are always correct. The User will be solely responsible for the truthfulness and accuracy of the data they provide.

When installing the LedOne Application, the data provided by the User is stored on the device itself and may be sent and stored on the service servers, as well as sent and stored by the insurance company and/or emergency/assistance services or third parties to provide related services, with whom communication is established to offer the service.

ERUM VIAL may use phone numbers and/or email addresses to locate the User and provide the service for which it was developed, facilitating the task for the insurance company/emergency and/or roadside assistance services or third parties to provide related services. These numbers will only be communicated to third parties for the exclusive and necessary provision of the Application Service and/or to make commercial proposals.

Personal data provided by the User may be communicated to third parties, such as the Application servers, as well as the insurance company/service or emergency or roadside assistance centers or other third parties to provide related services, for the provision of the Application Service. Likewise, and in accordance with the provisions of the LOPD, personal data obtained will also be communicated to other third parties when legally required.

By providing personal data, the User expressly consents to its use and management by ERUM VIAL, S.L., owner of the Application, as well as by the insurance company and/or emergency/assistance services or third parties to provide related services, to whom it may have been sent.

Our services may include optional features that, if used, require us to collect additional information to provide such features. You will be notified of such collection as appropriate. If you choose not to provide the information necessary to use a feature, you will not be able to use that feature.

16. b) Personal data automatically collected through the use of the V16 emergency beacon.

• Location/geolocation data – real-time geographic location of the device where the LedOne Application is installed – in case of breakdown alert, accident, or other vehicle parking reason, so the User accepts and consents to the operations of collection, transmission, maintenance, processing, and use of such location/geolocation data.
• Activation of the alert recorded on the communications operator’s server and integrated in LedOne implies authorization to the insurance company/service or emergency or roadside assistance centers or other third parties to provide related services, for the use, if necessary, of all obtained locations. The User agrees that the insurance company/services or emergency or roadside assistance centers or other third parties providing related services may collect, maintain, process, store, and/or use diagnostic, technical, usage, and other related information.

If you do not expressly consent to the collection, maintenance, processing, storage, and/or use of your location/geolocation data, do not download or use the LedOne Application.

• We collect information related to visits to the Application and its use by the User, such as the device and browser used, IP address or domain names of computers connected to the website, URI addresses of requests made, request time, method used to send the request to the server, size of the file obtained as a response, numerical code indicating the status of the response given by the server (success, error, etc.), and other parameters related to the operating system and computing environment used, date and time of the visit, visit duration, referrer site and navigation path on the website related to the visit, and interactions on the website, including the services and offers in which the User is interested. Please note that we may associate this information with the User’s account.

• To the extent permitted by applicable law, we may receive additional information about the User, such as fraud detection information and alerts from third-party service providers or partners for our fraud prevention activities.

Permissions Required by the App to Function

Since permissions can collect personal data (including sensitive data), we inform Users of the use of any of the following groups of permissions that the app requests and needs to function properly:

The User can manage these permissions through the application settings of their mobile device’s operating system, being able to grant or deny such permissions at any time. However, we inform you that all permissions required by the mobile App are necessary for its proper functioning.

Protection of Processed Data

The Data Controller adopts the necessary physical, technical, and organizational measures to guarantee the security, integrity, and confidentiality of the data according to the regulations on personal data protection.

It is important that the User protects themselves against unauthorized third-party access to their password and their computers, devices, and applications. We recommend the User use a unique password for their LedOne account that is not used for other online accounts.

Notwithstanding the above, the security of information transmitted over the internet cannot be guaranteed. In this regard, ERUM VIAL, S.L. cannot be held responsible for any interception or interruption of communications over the Internet or changes or loss of information. Users of the Application are responsible for maintaining the security of any password, username, or any other form of identification to access password-protected areas of any of our services. To protect both the User and their information, we may suspend the use of any ERUM VIAL, S.L. services without prior notice, pending investigation if a security breach is suspected.

Furthermore, although the Controller, ERUM VIAL, S.L., makes backup copies of the content hosted on its servers, it is not responsible for accidental loss or deletion of data by Users. Similarly, it does not guarantee full restoration of data deleted by Users, as such data may have been deleted and/or modified during the time elapsed since the last backup.

The services provided through the Application, except specific backup services, do not include restoring content kept in backups made by the Data Controller when such loss is attributable to the User; in this case, a fee will be determined according to the complexity and volume of the recovery, always with prior User acceptance. Data restoration is included in the service price only when the loss of content is due to causes attributable to the Controller.

Purposes for Which We Process Personal Data

All personal data provided by the User during registration (requested through the Application) and the location/geolocation data reported to the operator’s servers will be used for the following purposes:

• They are necessary to provide the service for which the Application was downloaded and installed on the respective devices.
• To inform the User’s insurance company, if provided, and/or emergency services/road assistance or other third parties to provide related services, for activation, management, or contracting of services related to the incident.
• Communication with the User: ERUM VIAL, S.L. uses User data to send Service notifications and respond when contacted by the User.
• User personal data may also be processed to send communications related to the activity of ERUM VIAL S.L., aimed at keeping the app updated or informing about other services provided by ERUM VIAL S.L., its collaborators, or the LedOne application, always related to ERUM VIAL S.L. services.
• Improve and develop the Services: the collected information is used to improve and personalize the Services, fix issues, and protect against errors. Statistical error analysis is conducted solely to enhance the Services.

By providing their data, the User declares to have read and understood this Privacy Policy, giving unequivocal and explicit consent for the processing of their personal data according to the purposes and terms expressed herein.

Our organization commits to treat your data with total confidentiality and to apply appropriate physical, technical, and organizational security measures to protect your personal data. Specifically, your data is encrypted both in storage and during communication to maintain confidentiality.

Personal data will be retained as long as the interested party does not request cancellation. If you decide to cancel your personal data, it will be deleted from our database and you will no longer be able to use our application, without prejudice to the provisions in the “Data Retention Periods” section of this Privacy Policy.

Necessary communications made by ERUM VIAL S.L. for the correct provision of services involving data processing by a third party will be backed by a data processing agreement signed by ERUM VIAL S.L. with such companies.

Legal basis for data processing

User data processing is based on the following legal grounds that legitimize it:

Request for information and/or contracting the Application services, whose terms and conditions will always be made available to the User beforehand for their express acceptance.

The legal basis for data processing is the User’s free, specific, informed, and unequivocal consent, provided by accepting this Privacy Policy through checking a box when installing the app on their mobile device (Android or iOS), including authorization for location/geolocation reported to the operator’s servers.

If the User does not provide ERUM VIAL S.L. with their data, or provides it erroneously or incompletely, it will not be possible to use the Application.

Additionally, execution of your automobile insurance contract with your insurer also legitimizes the communication of your personal data, including location/geolocation, to the insurer or its collaborators to provide related services in case of breakdown, accident, or other vehicle parking causes to assist you on the road.

Recipients of your data

• Your personal data will not be shared with third parties except when you report via the mobile application the occurrence of a breakdown, accident, or other vehicle parking causes.
• Likewise, such data may be shared with a specialized company to request emergency services through the national emergency number 112.
• Data Processors: ERUM VIAL, S.L. contracts third-party providers to deliver some services (technology providers for app maintenance and development, etc.). These providers may access your personal data as data processors. For App users, main providers include Telefónica España, S.A. and Vodafone España, S.A.
• Your personal data will not be transferred to other entities except by legal obligation. No international data transfers will be carried out.
• Your data will be communicated to the General Directorate of Traffic (DGT) in anonymized form through the beacon, not through LedOne. Only data related to the incident will be communicated, complying with current road safety regulations.
• Company transfers: As we grow, we may buy or sell other companies or services. In such transactions, one asset is usually customer personal information, which will always be subject to existing Privacy Notices commitments unless otherwise authorized by the customer. In the unlikely event ERUM VIAL S.L., or most of its assets, are acquired by a third party, customer personal information will be one of the transferred assets.

Data Retention Periods

Retention for Maintaining Contractual Relationships

We will process the User’s data while the Contractual Relationships established remain in effect.

Retention of authorizations for processing based on consent

We will process data based on the User’s consent until the User revokes it.

If the User cancels their service contract with ERUM VIAL, S.L., but does not revoke the consents previously given, we will automatically consider them revoked from the moment they cease to be a client.

Retention for compliance with legal obligations and for the formulation, exercise, and defense of claims

Once the authorizations for data use have been revoked by withdrawing consent, or after the contractual or business relationships established with ERUM VIAL, S.L. have ended, we will retain your data only to comply with legal obligations and to allow the formulation, exercise, or defense of claims during the statute of limitations period derived from the contractual relationships.

We will process these data applying the necessary technical and organizational measures to ensure that they are used solely for these purposes.

Data destruction

We will destroy your data once the retention periods imposed by the regulations governing ERUM VIAL, S.L.’s activity and the statute of limitations periods for administrative or judicial actions arising from the relationships established between the User and ERUM VIAL, S.L. have elapsed.

Cookies and similar technologies

Cookies are small text files placed on your device to store data that can be read by a web server from the domain that placed the cookie. We use cookies and similar technologies to store and track your preferences and settings, enabling you to log in, provide interest-based advertising, fight fraud, analyze how our products work, and fulfill other legitimate purposes.

In the case of the LedOne app, only session TOKEN cookies are used for user validation and navigation. For this, authorization data is used in the HTTPS header of the app calls.

The User can accept or reject cookies according to their device settings. If you reject or delete cookies, access to some services may not function properly.

Exercise of rights and filing complaints with the Spanish Data Protection Agency (AEPD)

In accordance with applicable data protection regulations, data subjects (Users) have several rights regarding the processing of their personal data. Besides the right to information, they may exercise their rights of access, rectification, deletion, restriction, portability of their personal data, opposition, not to be subject to automated decisions including profiling, to withdraw consent, and to file a complaint with a supervisory authority.

Exercising these rights will be free of charge for the User, except in cases of manifestly unfounded or excessive requests, especially if repetitive.

ERUM VIAL, S.L. will respond promptly to the User’s exercise of rights and provide the requested information within a maximum period of one month from receipt of the request. This period may be extended by another two months if necessary, considering the complexity and number of requests.

You can exercise the aforementioned rights by sending an email to [email protected], attaching proof of identity and providing the necessary details to process your request.

Interested parties can obtain additional information about their rights on the website of the Spanish Data Protection Agency.

Details of these rights are as follows:

Right to information:

The User has the right to be informed concisely, transparently, intelligibly, and accessibly, using clear and simple language, about the use and processing of their personal data.

Right of access:

The User has the right to request confirmation at any time whether we are processing their personal data, to access the information about their processing, and to obtain a copy of such data. The copy provided to the User will be free of charge, though additional copies may incur a reasonable fee based on administrative costs. We may ask the User to prove their identity or provide additional information necessary to process their request.

Right of rectification:

The User has the right to request correction of inaccurate, outdated, or incomplete personal data concerning them. They may also request completion of incomplete data, including by submitting an additional statement.

Right of deletion:

The User has the right to request deletion of their personal data when, among other reasons, the data is no longer necessary for the purposes for which it was collected. However, this right is not absolute, and ERUM VIAL, S.L. may continue to keep data blocked as provided by applicable law.

Right to restrict processing:

The User has the right to request that we limit the processing of their personal data, which means we may continue storing it, but not continue processing it if any of the following conditions apply:

• The User disputes the accuracy of the data, during a period that allows the Controller to verify the accuracy of the data.
• The processing is unlawful, and the User objects to the deletion of the data and requests the restriction of its use instead.
• ERUM VIAL, S.L. no longer needs the data for the processing purposes, but the User requires them for the establishment, exercise, or defense of claims.
• The User has objected to the processing while it is verified whether the legitimate grounds of ERUM VIAL, S.L. prevail over those of the User.

Right to data portability:

The User has the right to have their data transmitted to another Controller in a structured, commonly used, and machine-readable format. This right applies when the processing of their personal data is based on consent or on the execution of a contract and the processing is carried out by automated means.

Right to object:

This right allows the User to object to the processing of their personal data, including profiling. We will only refuse the User’s right when we demonstrate legitimate grounds for the processing or for the establishment, exercise, or defense of claims.

Right not to be subject to automated decisions, including profiling:

This right allows the User not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them—unless such decision is necessary for entering into or performing a contract, authorized by law, or based on consent.

Right to withdraw consent:

In cases where we have obtained the User’s consent for processing their personal data for certain activities (e.g., to send commercial communications), they may withdraw it at any time. Accordingly, we will stop performing that specific activity for which consent was previously given unless there is another legal basis justifying continued processing for those purposes, in which case we will notify the User.

Right to file a complaint with a supervisory authority:

The User is informed, pursuant to applicable personal data protection regulations and based on Articles 63 and following of Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights, of their right to seek protection from the Spanish Data Protection Agency or, where applicable, from the supervisory authorities of the Autonomous Communities.

Therefore, if you have any complaints related to the processing of your data, you can direct them to the Spanish Data Protection Agency at www.aepd.es (c/ Jorge Juan, 6, 28001 Madrid, Tel. 900 293 183) or to the supervisory authorities of the Autonomous Communities.

Transfers of data outside the European Economic Area

At ERUM VIAL, S.L., we process your data within the European Economic Area and, as a general rule, contract service providers also located within the European Economic Area or in countries deemed to have an adequate level of protection.

ERUM VIAL, S.L. does not foresee making international transfers in the course of processing your personal data.

However, if for the processing of your data for the indicated purposes these need to be transferred outside the European Economic Area (“EEA”), such transfers would be carried out based on the signature with those companies located outside the EEA of the European Commission’s standard data protection clauses for international transfers.

If we need to use service providers who process data outside the European Economic Area or in countries not declared to have an adequate level of protection, we will ensure the security and legitimacy of the processing of your data.

To this end, we require appropriate guarantees from those service providers in accordance with the GDPR, so that they have, for example, binding corporate rules that guarantee protection of information similarly to European standards or have signed the EU standard contractual clauses.

Review

ERUM VIAL, S.L. may modify this Privacy Policy to adapt it to legislative, jurisprudential, or interpretative developments by the Spanish Data Protection Agency. These privacy terms may be complemented by the General Terms of Use, Legal Notice, Cookie Policy, and Specific Conditions that may apply to certain products or services, if such access entails any particularities regarding personal data protection.

We will also review this Privacy Policy whenever necessary to keep you duly informed in connection with new processing activities.