Overview of Privacy Policies at MILES
Handling your data in compliance with data protection law is more than just a legal requirement for MILES Mobility GmbH. This Privacy Policy contains the general provisions on the processing of personal data at MILES that apply to all categories of data subjects – regardless of whether you use our mobility services or app, visit our website or our social media pages, deal with us as a business customer, partner or service provider, or apply to us or work for us.Depending on the relationship you have with us, the following specific privacy policies apply in addition and describe the respective processing activities in detail:Privacy Policy for Website Users and Visitors to Our Social Media Pages,Privacy Policy for App and Mobility Services Users,Privacy Policy for Business Customers, Partners and Service Providers,Privacy Policy for Applicants,and our Cookie Policy.
1 General Information on Data Processing
1.1. Who we are
1.1.1. ControllerThe controller within the meaning of the General Data Protection Regulation (GDPR) is:MILES Mobility GmbHLeibnizstraße 4910629 BerlinManaging Directors: Oliver Mackprang, Eyvindur Kristjansson, André FeldhuisEmail: hello@miles-mobility.comWebsite: miles-mobility.com
1.1.1. ControllerThe controller within the meaning of the General Data Protection Regulation (GDPR) is:MILES Mobility GmbHLeibnizstraße 4910629 BerlinManaging Directors: Oliver Mackprang, Eyvindur Kristjansson, André FeldhuisEmail: hello@miles-mobility.comWebsite: miles-mobility.com
1.2. Data Protection Officer
For all questions relating to data protection, you can also contact our Data Protection Officer at any time. The Data Protection Officer can be reached as follows (reference: “attn. Data Protection Officer”):ISiCO GmbHAm Hamburger Bahnhof 410557 BerlinEmail: data-protection@miles-mobility.comWebsite: www.isico-datenschutz.de/en/startWe expressly point out that when the above e-mail address is used, the content is not seen exclusively by our Data Protection Officer; this e-mail address is operated by a data protection team.If you would like to exchange confidential information or establish direct contact with the Data Protection Officer, please first use the above e-mail address to request that our Data Protection Officer contact you directly. They will contact you without undue delay.
1.3. Scope of the processing of personal data
As a matter of principle, we process personal data only to the extent necessary to provide our content and services. Personal data is generally processed only with your consent. An exception applies in cases where, among other things, the processing of the data is permitted by statutory provisions, or we have a legitimate interest in processing the data.
1.4. Legal basis for the processing of personal data
Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary in order to take steps prior to entering into a contract.Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.In the event that vital interests of the data subject or of another natural person make the processing of personal data necessary, Art. 6(1)(d) GDPR serves as the legal basis.If the processing is necessary for the purposes of a legitimate interest pursued by our company or by a third party, and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
1.5. Erasure of data and storage period
As a matter of principle, we store personal data only for as long as is necessary to fulfil the purposes for which we collected the data. We then erase the data without undue delay, unless we still need the data until the expiry of the statutory limitation period for evidentiary purposes in relation to civil law claims, on account of statutory retention obligations, or unless another legal basis under data protection law exists in the specific individual case for the continued processing of your data.For evidentiary purposes, we must in particular retain contract data for three years from the end of the year in which the business relationship with you ends. Any claims become time-barred under the standard statutory limitation period at the earliest at that point in time.Even after that, we must in some cases continue to store your data for accounting reasons. We are obliged to do so on account of statutory documentation obligations, which may arise, for example, from the German Commercial Code, the Fiscal Code, the Banking Act, the Money Laundering Act and the Securities Trading Act, or from further national or European laws and regulations. The retention periods for records set out therein are two to ten years.
1.6. Disclosure of data and engagement of processors
Where, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transmit data to them or otherwise grant them access to the data, this is done only on the basis of a statutory legal basis (e.g. where a transfer of the data to third parties, such as payment service providers, is necessary for the performance of a contract pursuant to Art. 6(1)(b) GDPR), where you have consented, where a legal obligation provides for this, or on the basis of our legitimate interests.Where we commission the processing of data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR. Our service providers may use the data solely to perform their tasks. All service providers have been carefully selected and engaged by us. They have appropriate technical and organisational measures in place to protect the rights of data subjects and are audited by us on a regular basis.In addition, we may transmit your personal data to further recipients who process your personal data under their own responsibility. These may in particular include the following:
- postal service providers;
- credit institutions and payment service providers;
- tax advisers, lawyers or auditors;
- credit reference agencies;
- public bodies such as authorities and courts.
1.7. Rights of data subjects
1.7.1. Overview of your rightsWhere the respective statutory requirements are met, you have the rights set out in Art. 7(3) and Art. 15 – 22 GDPR at any time:
- the right to withdraw your consent (Art. 7(3) GDPR);
- the right to object to the processing of your personal data (Art. 21 GDPR);
- the right of access to your personal data processed by us (Art. 15 GDPR);
- the right to rectification of your personal data stored incorrectly by us (Art. 16 GDPR);
- the right to erasure of your personal data (Art. 17 GDPR);
- the right to restriction of the processing of your personal data (Art. 18 GDPR);
- the right to data portability of your personal data (Art. 20 GDPR);
- the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects you, including, where applicable, the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision (Art. 22 GDPR).
1.8. Obligation to provide data
There is generally no obligation to provide your data.Insofar as the provision of your data is necessary for the conclusion of a contract (for example to register an account), for compliance with legal obligations (for example in the case of notification forms), for contacting us or for the use of other services and functions (for example to subscribe to the newsletter), the corresponding input fields are marked as mandatory information (as a rule by an asterisk (*)). In this case, without the data being provided, a contract cannot be concluded, the specific service cannot be provided and the function cannot be used.All other information not marked as a mandatory field is provided voluntarily. Entering such data is not necessary for the conclusion of a contract, for the provision of the service or for the use of the function, and has no effect on the performance of the contract.
2. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements, or in order to implement changes to our services, for example when introducing new services. Material changes, in particular those requiring consent, will be communicated to you in an appropriate manner. The Privacy Policy applicable at the relevant time shall apply to your further use of the app.Date: July 2026
