Privacy policy

Latest update 8 September, 2026

1.0 – Introduction

1.1 This personal data policy describes how GreenMobility A/S processes your personal information.

As part of our business, we register and use information about you (personal information). We do this to offer you the best guidance, to comply with our agreements with you, and to meet various legal requirements.

We take all appropriate precautions to protect your personal information in accordance with the existing law.

1.2 The legal unit that is responsible for the processing of your personal data is:

GreenMobility A/S is responsible for the processing of the personal information we have received about you. You will find our contact information below.

GreenMobility A/S
Landgreven 3, 4.
DK-1301 København K
VAT No.: 35521585
Phone number: + 45 7077 8888

Email: dpo@greenmobility.com

All inquiries to us regarding your personal data can be made via the contact information listed in point 1.2

2.0 – General regulations on personal data

2.1 Why do we process your personal information?

We process personal data when:

  • You have entered into or are considering entering into an agreement with us to drive in our fleet of cars, cf. the General Data Protection Regulation, Article 6, (1)(b). It can be, for example
    • Customer Service
    • Counseling
    • Administration
    • Credit rating
    • Recovery of unresolved debt
    • Identification and approval of you as a customer, etc.
    • Identity verification during sign-up, including automated biometric face matching between a selfie/liveness capture and your driving licence or, for holders of a non-Scandinavian licence, an additional government-issued ID document (e.g. passport or national ID card), to confirm you are the legitimate holder of the document 
    • Management of rental accounts for users aged under 18, including age verification and curfew enforcement
  • You have given us consent to use your personal information for a specific purpose, cf. the General Data Protection Regulation, Article 6, (1)(a). It can be, for example, marketing purposes, including:
    • Sending out newsletters and in-app messages
    • Segmenting and personalizing offers based on your usage behaviour (e.g. trip patterns and app interaction)
    • Retargeting: showing you advertisements on third-party platforms (e.g. Meta and Google) based on your prior interaction with our website and app
    • Developing new products
    • Preparing analyses
  • We are legally obliged to do so, cf. the General Data Protection Regulation, Article 6, (1)(c). It may, for example, be in accordance with:
    • The Money Laundering Law
    • The Tax Control Act
    • The Bookkeeping Law
    • The Rental Law
    • The Data Protection Act
    • The CPR Law
  • We use video surveillance in some vehicles to strengthen operational security and document incidents (GDPR, Article 6(1)(f)).
  • It is necessary to pursue our legitimate interests, cf. the GDPR, Article 6, (1)(f). It can be, for example:
    • To prevent abuse or loss and to strengthen IT and payment security. In this context, we only process your personal data if our interest clearly outweighs your interest in us not processing your personal data.
    • Verifying parental consent and enforcing platform restrictions for users aged under 18, including logging in-app acknowledgments of driving restrictions.

2.2 What personal information do we process about you?

We process different types of ordinary personal data, depending on the purpose for which they are processed, including

  • Basic personal information, such as your name, gender, address, contact information and CPR number
  • For users aged under 18: date of birth, parental consent records including the parent or guardian’s full name, MitID-verified identity, email address, relationship to the minor, and signed declaration submitted via a form.
  • ID documentation, e.g. a copy of your driving licence and, for holders of a non-Scandinavian licence, an additional government-issued ID document (e.g. passport or national ID card).
  • Information about location on your trips in our cars and interaction with our app.
  • Information about the services and products we provide to you, including how you use them and your preferences in this regard – we do this in order to improve our and our partners’ products, services and technologies.
  • Biometric data collected during identity verification: your facial image and/or video (selfie or liveness capture), and biometric templates (face embeddings) derived from comparing this to the photo on your driving licence/ID document. This data is processed on our behalf by our identity verification provider, Veriff. See Section 2.9 for full details.

We process one category of special category (sensitive) personal data: biometric data, collected solely for the purpose of identity verification as described in Section 2.9. We do not otherwise process special category data.

2.3 Where do we collect your personal information from?

We collect your personal information from:

  • Yourself, when you, for example, fill in a profile, submit certain documents to us, you call us or you communicate with us electronically or similar
  • Cookies, see more about this in our cookie policy
  • Third parties, such as public authorities and your bank, as well as publicly available databases such as the CPR register, OIS or the registration system
  • The actual use of the cars generates data

2.4 How long do we store personal information?

We store the personal information you provide to us for as long as is permitted by law and we delete it when it is no longer necessary to fulfill the purpose for which it was collected.

Parental consent records for users aged under 18 are retained for the duration of the minor’s account and for a period thereafter sufficient to enable GreenMobility to defend any claims arising from rentals made during that time. In-app acknowledgment logs (curfew and restriction confirmations) are retained for the same period.

Identity verification data (your driving licence/ID document image, selfie/liveness capture, and derived biometric templates) is retained for 90 days in active systems and then archived for up to 3 years, after which it is permanently deleted. See Section 2.9. 

2.5 To whom do we pass on your personal information?

In some cases, we share your personal information with third parties, eg:

  • We pass on information about you to public authorities, where this is required of us in accordance with the existing law.
  • We share your personal information with credit bureaus. If you breach your obligations to us, we may report you to credit rating agencies and/or warning notice registers in accordance with the existing law.
  • We share your personal information with the parking company if we receive a fine where it can be attributed to you are the last user of the car.
  • With references to IT development, hosting and support, we transfer personal data to data processors located either within the EU/EEA or in a third country, provided that there is a sufficient level of protection.
  • We may share your personal information with our advisers, such as law firms or insurance companies, if needed.
  • We share video recordings with our processor Traffitech ApS for secure storage and with authorities (e.g. police, insurance) when legally required.
  • In connection with the use of our service in other cities, we may share your information with local franchise partners.
  • We share parental consent data with Penneo ApS, our e-signature processor, solely for the purpose of facilitating and storing the digital signing process. Penneo processes this data as a data processor under a Data Processing Agreement with GreenMobility.
  • We share your driving licence/ID document image, selfie/liveness capture, and derived biometric data with our identity verification provider, Veriff OÜ, acting as our data processor, and its authorized sub-processors located in the EEA, UK, US, Brazil, and India. A current list of Veriff’s sub-processors is available at veriff.com. See Section 2.9. 

2.6 Profiling and automated decisions

Profiling

Profiling is a kind of automatic processing of your personal data. We use profiling and data modeling for the following purposes:

  • To offer you specific services and products that meet your preferences
  • To prevent money laundering
  • To set prices for services and products
  • To detect fraud and the risk of fraud
  • To assess the likelihood of a violation of our Terms & Conditions

These purposes are based on our legitimate interest or a legal obligation, as described in Section 2.1 above.

We also use profiling for marketing purposes, based on your consent (see Section 2.1). This includes segmenting users based on their use of our services in order to target newsletters and in-app messages, and showing you relevant advertisements on third-party platforms (e.g. Meta and Google) based on your prior interaction with our website and app (retargeting).

Automated decisions

With automated decisions, we use our systems to make decisions based on the information we have about you. We use e.g. automated decisions to prevent fraud. Automated decisions enable us to ensure that our decisions are fast, fair, efficient, and correct based on the information we have.

In connection with identity verification (Section 2.9), the outcome of the automated biometric face-matching check may be determined without human review by default. Where this produces a legal or similarly significant effect on you, such as rejection of your account application, you have the right to obtain human intervention, to express your point of view, and to contest the decision, cf. Article 22 GDPR, by contacting dpo@greenmobility.com. 

2.7 How do we store your information?

We have taken technical and organizational restrictions against your personal data being accidentally or illegally deleted, published, lost, debased, or becoming knowledge to an unauthorized person, misused or otherwise processed in violation of the law.

For example, we store personal information on computers with limited access, which are located in controlled facilities. The internal security measures are monitored on an ongoing basis.

Personal data is stored within the EU/EEA, but can also be transferred to and used in a country outside the EU/EEA. Such transfer of your personal information is carried out in accordance with the existing law. Only employees, with a relevant need for insight, will have access to your personal information.

In‑vehicle video recordings are stored within the EU, securely hosted via Traffitech ApS, and only accessed under strict conditions. Footage is deleted after 30 days (unless linked to a valid claim).

Identity verification data, including biometric data, is stored and processed as described in Section 2.9. 

2.8 Event-based Video Surveillance in Vehicles

This section describes only the in-vehicle dashcam surveillance and the related manual staff comparison used for post-rental incident investigation. It does not describe the automated biometric identity verification performed at sign-up — see Section 2.9 below.

Some of our vehicles are equipped with event-based video surveillance (dashcams). These cameras are installed in the cabin and are triggered only by predefined events while the ignition is on. These include (but are not limited to) suspected collisions, smoking or vaping, over speeding, harsh braking or turning, carrying unauthorized animals, or leaving excessive trash. These cameras do not record audio.

In rare and defined situations (e.g., fraud detection or safety checks), authorized GreenMobility staff may request a video extract from the camera. These streams are not recorded unless they coincide with a triggered event.

Purpose and legal basis
The purpose of this surveillance is to help GreenMobility:

  • Document and investigate damage to vehicles
  • Enforce our Terms & Conditions
  • Prevent vehicle misuse and account sharing
  • Improve fleet safety and operational accountability

The legal basis for this processing is GreenMobility’s legitimate interest under Article 6(1)(f) of the General Data Protection Regulation (GDPR).

What is recorded and when:

  • Cameras are triggered only during specific events.
  • No audio is ever recorded.
  • The dashcam captures limited footage of the cabin and road during the event.

Manual driver identity verification
In cases where damage, fraud, or misuse is suspected, GreenMobility staff may manually compare the driver’s appearance in the footage to the driving licence, passport/national ID, or profile photo provided during account creation. This process is carried out solely by trained personnel. No facial recognition or biometric technology is used for this specific dashcam-comparison process. 

Storage, retention, and access

  • Video footage is securely stored on a system operated by our processor, Traffitech ApS, within the EU/EEA.
  • Footage is retained for a maximum of 30 days unless it is linked to a specific damage claim or investigation.
  • Only specific GreenMobility employees may access this footage.

Your rights
You have the right to:

  • Request access to any personal data (including video footage) that relates to you, such as:
    • Your account information (name, contact details, driver’s licence)
    • Booking and trip history (dates, vehicles, times, locations)
    • Payment and billing records
    • Vehicle telematics and event data linked to your use of the car
    • Copies of communications between you and our support team
    • Video footage recorded inside the vehicle during your trips (to the extent you appear and are identifiable)
  • Request correction or deletion of inaccurate or unnecessary data
  • Object to the processing of your data under certain circumstances

To exercise any of these rights, or if you have questions about this processing, please contact our Data Protection Officer at dpo@greenmobility.com. We respond to all valid requests within one month.

2.9 Identity Verification 

Identity verification at sign-up involves two separate processes, described separately below because they involve different data, different processors, and different safeguards. 

2.9.1 Driving Licence Verification (via Veriff) 

To confirm you are the legitimate holder of your driving licence, we use an automated identity verification process provided by our processor, Veriff OÜ (“Veriff”). 

What is collected 

  • A photo/scan of your driving licence
  • A selfie and/or short liveness video captured during the verification session 
  • Biometric data derived from the above: a facial biometric template (face embedding) used to compare your selfie to the photo on your driving licence 

Purpose and legal basis 

This processing is necessary to confirm your identity before you can use our service, cf. Article 6(1)(b) GDPR. Because it involves biometric data used to uniquely identify you, it also requires a basis under Article 9(2) GDPR. 

Controller and processor 

GreenMobility A/S is the controller. Veriff processes this data solely as our processor, on our documented instructions, and does not use it for its own purposes (such as training its own AI models) unless separately authorized under our Data Processing Agreement. 

Automated decision-making 

The outcome of the verification check may be produced automatically, without human review, by default. If this results in a decision with a legal or similarly significant effect on you (e.g. your account application is rejected), you have the right to request human review, express your point of view, and contest the decision. Contact dpo@greenmobility.com to exercise this right. 

Storage location and international transfers 

Your data is primarily stored in Ireland (EEA). Processing may also take place in the UK, US, Brazil, and India by Veriff’s authorized sub-processors. 

Sharing 

This data is shared only with Veriff and its listed sub-processors, solely for the purpose of providing the identity verification service. It is never sold, and never used for advertising or marketing. 

Retention 

Retained for 90 days in active systems and then archived for up to 3 years, after which it is permanently and automatically deleted. 

2.9.2 Additional ID Document for Non-Scandinavian Licence Holders 

If you hold a driving licence issued outside Scandinavia, we also require an additional government-issued ID document (such as a passport or national ID card) to confirm your identity. 

What is collected 

  • A copy of your passport or national ID card, which you send to us by email 

How this differs from Section 2.9.1 

This document is NOT sent to or processed by Veriff, and is NOT used for automated biometric face matching. It is reviewed manually by trained GreenMobility staff and then manually uploaded to your customer profile in our CRM system. 

Purpose and legal basis 

This processing is necessary to confirm your identity before you can use our service, cf. Article 6(1)(b) GDPR. This document does not involve biometric processing, so no Article 9 basis is required for this part of the verification. 

Controller and processor 

GreenMobility A/S is the controller and processes this data directly; no external processor is involved in this step. 

Storage location 

Stored within GreenMobility’s customer profile/CRM system, accessed only by authorized staff with a relevant need for insight. 

Transmission channel

Your ID document is submitted to a dedicated email mailbox operated by GreenMobility. Access to this mailbox is restricted to authorized personnel involved in identity verification. 

Retention 

Documents submitted to this mailbox are retained for as long as your account remains active, and are deleted when your account is closed. 

Your rights (applies to both 2.9.1 and 2.9.2) 

The rights described in Section 3.0 below, including access, correction, erasure, objection, and the right to complain to the Danish Data Protection Agency, apply fully to both categories of data described in this section, including your biometric data. 

3.0 – What rights do you have?

As a private individual, you have the following rights:

3.1 Insight into your personal information

You can gain insight into the personal information we process, including where it comes from and what we use it for. You can find out how long we store your information and who receives information about you, to the extent that we pass on your personal information. However, your right of insight may be restricted by law or may be exempt from the right of access.

3.2 Manuel processing

You can gain insight into how an automated decision is made as well as the effects of the decision, and you are entitled to manual processing of any automated assessment.

3.3 Right to object

In certain cases, you have the right to object to our processing of your personal data. This applies, for instance when the processing takes place on the basis of our legitimate interest.

3.4 Objection to direct marketing

You have the right to object to our use of your personal information for direct marketing purposes, including profiling in connection with such a purpose.

3.5 Correction or erasing of your personal information

If the personal data processed about you is incorrect, incomplete or irrelevant, you have the right to have the data corrected or deleted with the restrictions according to the existing law or rights to process your personal data. These rights are referred to as “the right to rectification”, “the right to erasure” and “the right to be forgotten”.

3.6 Limited use

If you believe that the information we have recorded about you is incorrect, or if you have objected to our use of the information, you may demand that we limit the use of the information for storage. The use is only limited until the validation of the information can be verified or until it can be verified whether our legitimate interests outweigh your interests.

If you are entitled to ask us to delete the information we have collected about you, you may instead ask us to limit the use of this information for storage. If we only need to use the information we have collected about you to assess a legal claim, you can also demand that other uses of the information is limited to storage. However, we may be entitled to use the information for other uses, including to assess a legal claim, or if you have given your consent to it.

3.7 Withdrawal of consent

You can at any time withdraw your consent. If you withdraw your consent, please note that we may not be able to offer you certain services or products. Please note that we continue to use your personal information, e.g. to abide by an agreement we have made with you or if we have a statutory right to do so.

Where processing of your biometric data relies on your consent (see Section 2.9), you may withdraw this consent at any time. Please note that we may not be able to provide you with the rental service without completing identity verification. 

3.8 Data portability

If we use information based on your consent or agreement and the processing of the information is automated, you have the right to receive a copy of the information you have provided, in an electronic machine-readable format.

3.9 Exercising rights on behalf of a minor

Where a user is under 18, data subject rights requests (access, erasure, rectification) may be exercised by the minor’s parent or legal guardian on their behalf, subject to verification of parental authority.

4.0 Other

4.1 Updates

We regularly update this information about our processing of personal data. In matter of change, the “updated” date will change.

Any changes to this information about our processing of personal data apply immediately to you and your personal data. If changes affect how your personal information is processed, we will take reasonable notice to let you know about the changes.

4.2 Complain

If you are dissatisfied with how we process your personal information, you can always write to us by using the contact information in section 1.2.

You can also complain to the Danish Data Protection Agency, Borgergade 28, 5, 1300 København K, tlf. no. +45 33 19 32 00 or via email to dt@datatilsynet.dk. You can also read more on their website www.datatilsynet.dk.

COOKIE POLICY

GreenMobility A/S use cookies on our websites.

What are cookies?

A cookie is a small text file that is placed on your computer or other IT equipment. It makes your computer recognizable and gathers information about which pages and features are visited on your browser. But cookies cannot see who you are, what your name is, where you live, or whether the computer is used by one or more people. It also cannot spread computer viruses or other harmful programs.

The law states that we may store cookies on your device if they are strictly necessary to ensure the delivery of the service you have expressly requested to use. For all other types of cookies, we must obtain your consent.

What cookies do we use and why?

We use the following cookies:

  • Necessary cookies to make the website usable by activating basic functions, such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies
  • Preference cookies that enable our website to remember information, eg language or the region you are in
  • Statistics cookies that help us improve the user experience on our website and adapt the experience to your needs
  • Marketing cookies used to track visitors across websites. The intention is to show ads that are relevant to the individual user

Third-party cookies on our website

Some of the marketing cookies that are activated on your device when you visit our website and have accepted the cookies are owned by third parties who process the data to which those cookies provide access.

For how long are the cookies stored?

It varies how long cookies are stored on your equipment. Some cookies remain on your computer after you close the browser, while others are deleted after 30 minutes or when the browser closes.

How are cookies deleted?

You can always reject cookies on your computer by changing the settings in your browser. Where you find the settings depends on which browser you are using. However, you should be aware that if you do, there are many features and services on the internet that you cannot use.

All browsers allow you to delete your cookies collectively or individually. How you do this depends on which browser you are using. Remember that if you use several browsers, you must delete cookies in all of them.

On https://minecookies.org/cookiehandtering you can read more about cookies and get instructions on how to delete cookies on different browsers.