Urban Connect – Privacy Policy

At a glance

Urban Connect AG, Schlieren, is responsible for your personal data. Contact: privacy@urban-connect.ch.
We process your data to run the mobility services your employer or organisation makes available to you: shared e-bikes and e-cars, mobility budgets, parking and charging, and the app and portal around them.
Your employer or organisation can see who has access, reservations (station, times, kilometres) and mobility-budget balances. It cannot see routes, it cannot see when you entered or left a car park and we do not record driving behaviour.
We do not sell personal data, we do not use it for third-party advertising, and we do not make automated decisions about you.
Data is kept while you use the service and deleted or anonymised afterwards, subject to statutory retention (Section 8).
You can ask us at any time what data we hold about you and have it corrected or deleted.

1. Who we are and how to reach us

The controller responsible for the processing described in this Privacy Policy is Urban Connect AG, Zürcherstrasse 39d, 8952 Schlieren, Switzerland (UID CHE-441.864.827) (“Urban Connect”, “we”, “us”). Our German affiliate, Urban Connect GmbH, Gotzinger Str. 52 f, 81371 München, Germany, may be your Organisation’s contracting partner; it does not itself process your personal data.

For any question or request concerning your personal data, write to privacy@urban-connect.ch or to the postal address above.

2. Who this Policy applies to

This Policy applies to you if you use the Urban Connect app, vehicles, mobility budget, parking or charging services, or the client portal (together, the “Services”); visit our website; are a contact person at a client, partner, supplier or prospective client; or apply for a job with us. Our Services are made available to you by your employer, your property manager or another organisation (your “Organisation”) under a contract with us. Your Organisation determines who is eligible; access to cars additionally requires a valid driving licence.

Where we process your data on behalf of your Organisation under a data processing agreement with it, that agreement governs and your Organisation is responsible for the data it provides to us and for how it uses the portal and the reports we provide. Questions about that use should go to your Organisation. This Policy describes how we process your data in our own responsibility.

The processing described here is governed by the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies — in particular for Services contracted through Urban Connect GmbH and for users and website visitors in the EU/EEA — the additional information required by the GDPR is included below.

3. What data we process and where it comes from

We process the following main categories of personal data; the examples are illustrative. Most of it comes from you directly; some comes from your Organisation, from the vehicles you use, or from third parties as indicated.

Account data — name, email address, phone number, password (hashed), app language, user group. Source: you; your Organisation, through the eligibility list or directory integration.
Eligibility data — corporate email, employer, department, employment percentage (to calculate your budget), mobility-budget group. Source: your Organisation.
Driver verification — address, date of birth, driving-licence details and images used for verification. Source: you, via our verification provider.
Booking and usage data — reservations, start and end station and times, vehicle, lock and unlock times, kilometres driven, parking and charging sessions, public-transport tickets. Source: generated when you use the Services.
Parking access data — vehicle licence plate. Source: you; your Organisation; the parking system at the site.
Vehicle data — current position of the vehicle, battery level, lock status, technical status. Source: the vehicle.
Payment data — payment method entered with our payment provider; invoices, amounts owed. Source: you; our payment provider.
Mobility-budget and card data — budget allocations and balance, transactions made with the mobility card (merchant, date, amount). Source: your Organisation; the card issuer.
Support and incident data — your messages to us, incident and accident reports, fines and claims correspondence. Source: you; authorities; insurers; your Organisation.
Technical data — device type, operating system, app version, crash reports, log data. Source: your device.
Website data — cookies and similar identifiers, pages visited, form entries (Section 10). Source: your browser.
Business-contact data — name, role, employer, business contact details, correspondence, meeting notes. Source: you; your employer; public sources and B2B databases.
Applicant data — CV, application documents, interview notes. Source: you; recruiters; references you name.

Where your Organisation uses our parking management, access is controlled by reading the licence plate of your vehicle at the entrance. In normal operation, no images are stored. The system can be switched to recording in individual cases — for example to find out why a plate is not being recognised, or to clarify an incident such as damage or unauthorised parking. Recording is enabled only on the documented instruction of your Organisation, is tied to a specific event and never to a specific person, and every activation is logged. The images are deleted as soon as the matter is resolved, and at the latest after 72 hours.

Some vehicles are equipped with cameras and sensors installed by the vehicle manufacturer (for example dashcams or parking surveillance). Recordings remain in the vehicle within the manufacturer’s system. We do not access them except where necessary to handle an accident, theft, damage or a legal claim. The manufacturer’s own privacy notice applies to its connected-vehicle services.

We do not store or use position data to analyse routes or driving behaviour, and we do not create movement profiles. Vehicle position is used to locate a vehicle and in connection with your booking, for example to confirm that it has been returned.

4. Why we process your data and on what legal basis

Providing the Services — creating and managing your account; verifying your eligibility and driving licence; reservations; unlocking vehicles; mobility budget, parking, charging and tickets; billing and payment. Legal basis: performance of the user terms you accept in the app.
Safety, security and fleet operations — locating vehicles; preventing and investigating theft, damage, misuse or use outside permitted areas; handling accidents, fines and insurance claims. Legal basis: legitimate interest; legal obligation.
Reporting to your Organisation — access management, reservations, mobility-budget administration, aggregated and anonymised usage statistics. Legal basis: performance of the contract with your Organisation; legitimate interest.
Support and communication — answering your requests; service notices, for example booking problems, fleet or price changes and changes to this Policy; voluntary feedback and surveys. Legal basis: performance of the user terms; legitimate interest; consent for surveys.
Improving the Services — analysing usage and technical data to fix issues and develop features, using aggregated or pseudonymised data where possible. Legal basis: legitimate interest.
Website and marketing — running the website; measuring its use; newsletters and information about our services to business contacts. Legal basis: consent for non-essential cookies and newsletters; legitimate interest for B2B communication.
Recruiting — assessing applications. Legal basis: pre-contractual measures; consent for the talent pool.
Legal compliance and protection of rights — accounting and tax retention; responding to authorities; establishing, exercising or defending legal claims. Legal basis: legal obligation; legitimate interest.

The legal bases above are stated for the purposes of the GDPR; under Swiss law, processing is justified where it is necessary for our contracts, our statutory duties or our overriding interests. Where we rely on legitimate interest, our interest is to operate, secure and improve a shared-mobility service on behalf of your Organisation, to protect our vehicles and other users, and to run our business. Where processing is based on your consent, you may withdraw it at any time with effect for the future. Providing the account, eligibility and — for cars — driver-verification data is necessary to use the respective Services; without it we cannot give you access.

We do not make decisions that have legal or similarly significant effects for you solely by automated means; automated tools may support our staff, but a person remains responsible for the outcome.

5. Who receives your data

Your Organisation

The contact person(s) designated by your Organisation (typically HR, mobility or facility management) can see in the client portal: who has access to the Services; reservations with vehicle, station, start and end times, lock and unlock times and kilometres driven; your phone number (so they can reach you about a booking); and, for the mobility budget, your group, allocations, current balance and app language. Your Organisation uses this to manage access, make reservations on behalf of users and administer the budget, and may use it only for these purposes — not to monitor your performance or attendance.

We additionally inform your Organisation, after review by our staff, where this is necessary to handle a breach of the terms of use, an accident or incident, a lost or damaged vehicle, a fine, suspected misuse of the mobility card, or bookings you have marked as business use, and to confirm your eligibility. Information about fines or proceedings is disclosed only to the extent needed to identify the driver, allocate the cost or comply with the law, and we tell you when we do so. In a suspected card-misuse case we disclose the transactions concerned.

Service providers

We use service providers that process personal data on our behalf under data processing agreements and our instructions. Categories: cloud hosting and infrastructure; software development and support; vehicle telematics, lock and charging systems; driver-verification services; payment processing and mobility-card issuing; customer-support, email and communication tools; CRM and marketing tools (for example HubSpot); office, collaboration and standard business software including its AI-assisted features (for example Microsoft 365), used under contracts that exclude the use of your data to train AI models; analytics and crash-reporting tools; insurers and claims handlers; auditors and advisers.

AI assistants

We use AI assistants to support our own work — for example to analyse usage data, prepare reports and drafts, and answer support questions faster.

We use these assistants only under a data processing agreement and on our instructions, under contracts that exclude the use of our inputs and outputs to train the provider’s models. Where an assistant is operated from outside Switzerland or the EEA, the transfer safeguards described in Section 6 apply.

AI assistants support our staff; they do not make decisions about you. A person remains responsible for any outcome that affects you (see Section 4).

Other recipients

We disclose personal data to insurers to handle claims; to authorities, courts and law-enforcement where we are legally obliged or where it is necessary to identify the driver responsible for a fine or to protect our rights, other users or the public; to public-transport and parking operators as needed to provide those services; and, if Urban Connect or part of its business is sold or merged, to the acquirer, who may continue to use your data for the purposes described here; we will inform you of any change of controller. We do not sell personal data and we do not share it with third parties for their advertising.

6. International transfers

Your data is processed mainly in Switzerland and the EU/EEA. Some of our service providers are located in, or access data from, other countries — currently the United Kingdom, which the Swiss Federal Council recognises as providing adequate data protection, and the United States, Serbia and Kazakhstan. We will update this list if it changes.

Where a country does not provide adequate protection, we transfer data only under safeguards appropriate to the risk of the transfer: the EU standard contractual clauses supplemented for Swiss law, a documented transfer risk assessment, and additional technical and organisational measures where needed; for US providers we may instead rely on their certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework. In such countries, local authorities may in some cases have access to data under local law. You can obtain a copy of the safeguards for a specific transfer by contacting us.

7. How we keep your data secure

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, logging, backups, contractual obligations on our providers and staff training. If a security incident affects your personal data, we notify the competent authority and, where required, you, as the law requires, and we inform your Organisation of incidents affecting its users. Please report any suspected incident to privacy@urban-connect.ch.

8. How long we keep your data

We keep personal data for as long as needed for the purposes above and for as long as the law requires. In practice:

When your Organisation ends its contract with us, we delete or anonymise user data within six months of the end of the service.
If your account is inactive for two years, it is irreversibly anonymised, even if your Organisation still uses our Services.
When you ask us to delete your account, we do so unless and for as long as an open matter (for example a fine, damage claim or unpaid invoice) requires the data, or a statutory retention duty applies.
Booking, invoicing and payment records are kept for the period required by applicable accounting law (in Switzerland, ten years). Incident, fine and claims files are kept until the matter is closed and any limitation period has expired.
Website analytics data is kept in aggregated form; identifiers are deleted within the periods set in the cookie settings. Unsuccessful job applications are deleted within six months unless you agree to stay in our talent pool.

9. Your rights

You have the right to ask us for access to your personal data and a copy of it; to have inaccurate data corrected; to have data deleted; to receive data you provided in a common electronic format; to withdraw consent; and, where the GDPR applies, to restrict processing. These rights may be limited where we must keep data to comply with a legal obligation or to establish, exercise or defend legal claims.

Right to object: you may object at any time to processing based on our legitimate interests, including direct marketing, by writing to us.

To exercise your rights, or for any question about your data — including which service providers process it and which safeguards apply to transfers abroad — write to privacy@urban-connect.ch. We may ask you to verify your identity. We respond within one month; if we need longer, we tell you within that month and explain why. You may also report a suspected violation to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, lodge a complaint with a supervisory authority, in particular in the country where you live or work.

10. Website and cookies

Our website uses cookies and similar technologies in three categories: essential (needed for the site to work, such as language selection and security); analytics (to measure how the site is used, for example Google Analytics with IP anonymisation and HubSpot analytics); and marketing (to measure the effectiveness of our campaigns and, if you have consented, to show relevant content on other platforms). The current list of tools and their retention periods, and your choices, are in the cookie settings on the website. Analytics and marketing cookies are set only with your consent; you can change your choice at any time in the cookie settings or by blocking cookies in your browser. If you fill in a form on the website, we use your details to answer you and, for business contacts, to stay in touch about our services.

11. Business contacts and applicants

If you are a contact person at a client, partner, supplier or prospective client, we process your business contact details and our correspondence in our CRM to manage the relationship and to inform you about our services. We obtain such details from you, your employer, publicly available sources or business databases; where we did not receive them from you, we tell you the source in our first contact. You can object to marketing communication at any time using the unsubscribe link or by writing to us. If you apply for a job, we use your application only for the recruitment process and delete it as set out in Section 8.

12. Communications

We contact you about the Services when needed: for example if a booking seems to have a problem or exceeds the maximum time, about changes to the fleet, prices or this Policy, and, for pilot programmes, to ask for your feedback. You can opt out of non-essential communication at any time. If we invite you to a survey, the invitation explains what the answers are used for.

13. Changes to this Policy and languages

We may update this Policy to reflect changes in our Services, our providers or the law. The version on our website and in the app is the current one; we will inform you in the app or by email of material changes. This Policy is written in English; German and French versions are translations for your convenience. In case of any discrepancy, the English version prevails.

Version 2.2 · 9.10.2026 · replaces the version of 22 March 2024