Terms and Conditions ("Terms")

Terms of Use

These Terms of Use ("Terms", "Terms of Use") govern the relationship between the application Users and the Travel Companion mobile application (the "Service") utilized within the Shift2Rail Open Calls projects (OCs) (Ride2Rail¹ and IP4MaaS²) and owned by Shift2Rail Call for Members projects (CFMs³).
Please read these Terms of Use carefully before using the Travel Companion mobile application (the "Service").
Your access to and use of the Service is conditioned on your acceptance of and compliance with these Terms. These Terms apply to all who access or use the Service.
The acceptance of these Terms is a binding legal contract between you, the OCs, and the CFMs. The OCs and the CFMs hereby grants you a free of charge, non-exclusive, time-limited, non-transferable, non-sub-licensable, revocable license to use the Service for non-commercial purposes, subject to these Terms. As required by the General Data Protection Regulation, this agreement contains a privacy policy governing the personal data being processed by the Service.
By accessing or using the Service you agree to be bound by these Terms. If you disagree with any part of the terms, then you may not access the Service.

Preamble

The goal of the OCs projects (developed in the framework of Shift2Rail JU) is to develop and test in real-life conditions a set of software components researched within the Shift2Rail Innovation Programme 4 (IP4)⁴ ecosystem through the features of the Travel Companion app. This application results from research projects, it should be used as a Trial service that has no intention of any kind of commercial usage. No legal body is responsible by the management of the Travel Companion application as a product. This trial application is associated with different data processing systems (from CFM and OC partners) in order to provide mobility services to the testers. As the Travel Companion application is part of a research program, its purpose is also to conduct usability tests as well as demo activities and virtual experiments to evaluate some modules and embedded features.

Using Travel Companion App

The Travel Companion application is an outcome of the different Shift2Rail IP4 projects (Co-Active, ATTRACkTIVE, CONNECTIVE, COHESIVE, MaaSive and ExtenSIve). The OC project Ride2Rail has enriched the Travel Companion application with the additional modules: Offer Categorizer, Offer Matcher and Ranker, User Preferences Retriever, Incentives provider, Driver Companion, and the Agreement Ledger. The OCs have received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 881825 (Ride2Rail) and 101015492 (IP4MaaS). The Travel Companion application is being demonstrated in the framework of the demonstration activities organized in the frame of these European projects.
The Travel Companion application is intended for use by users who are 15 years of age or older.
You may use the Travel Companion application solely for private and personal purposes. You may not use it commercially. For example, you may not: (i) offer to third parties a service of your own that uses the Travel Companion application; (ii) resell the Travel Companion application; (iii) offer to rent or lease the Travel Companion application; or (iv) offer the Travel Companion application to the public via communication or integrate it within a service of your own, without the prior written consent of the CFMs. For clarity, the examples listed are made for illustrative purposes only; they do not constitute an exhaustive list of restricted activities involving the Travel Companion application.
If the CFMs discover that you are not a legitimate user of the Travel Companion app, they will terminate this agreement immediately and delete any personal data they might have collected about you at the end of the demo activities or at the end of the projects.

Accounts

When you accept to be part of the demonstration activities developed within the OCs, then the OCs and the CFMs will create an app account for you and register your account in the IP4 ecosystem. You must provide to the project partner leading the demo activities in your city with accurate, current, and complete, information at all times. Failure to do so constitutes a breach of the Terms, which may result in immediate termination of your account on the Service.
Each account is individual and cannot be used by anyone else.
You are responsible for safeguarding the password that the organizers of the demonstration activities will provide you to access the Service as well as for any activities or actions under your password, whether your account is with our Service or a third-party service involved during the registration process.
You must notify to the CFMs immediately upon becoming aware of any breach of security or unauthorized use of your account.

Limitation of liability and warranty

CFMs provide the Travel Companion application (enriched with Ride2Rail components) and content included therein for use on an “as is” and “as available” basis. They cannot be customized to fulfill the needs of each and every user.
The CFMs hereby disclaim all warranties and representations, either express or implied, with respect to the service, including, without limitation, any warranties of merchantability, and fitness for a particular purpose, features, quality, non-infringement, title, compatibility, performance, security, or accuracy. Information may not always be accurate.
The CFMs try to make sure that the data is correct and up-to-date, but they cannot guarantee that it will always be. Journey times are only estimates, as actual timings depend on many factors outside CFMs and OCs control. Accordingly, CFMs and OCs do not accept any liability for any error or omission in the information available or the recommendations made through the Service, and they exclude all liability for any action you may take or loss or injury you may suffer (direct or indirect including loss of income, profit, opportunity or time) as a result of relying on any information available through the Travel Companion application.
CFMs effort is to provide you with a high quality and satisfactory service. However, they do not warrant that the Service will operate in an uninterrupted or error-free manner, or that it will always be available or free from all harmful components, immune from damages, free of malfunctions, bugs or failures, including, but not limited to hardware failures, software failures and software communication failures.
You agree and acknowledge that you assume full, exclusive and sole responsibility for the use of and reliance on the Travel Companion application, and you further agree and acknowledge that your use of or reliance on the Service is made entirely at your own risk. You further acknowledge that it is your responsibility to comply with all applicable laws while using the Service.

Behavior of Travel Companion app user

As Travel Companion application user you undertake:

• to respect all laws and regulations applicable in the country where the Service is used, with special reference to use of public transport services
• to avoid improper use of the Service
• to conduct yourself in an appropriate manner, avoiding any kind of unlawful, harmful, threatening, abusive, harassing, defamatory, or otherwise objectionable behavior.

In the event of violation of the above, the CFMs reserve the right to limit access and the use of the Service and/or temporarily or permanently suspend your account.

Property Rights

All intellectual property rights related to the Travel Companion application, its components, and its database, including copyrights, trademarks, industrial designs, logos, patents and trade secrets, are the exclusive property of the Shift2Rail JU.
You may not use such parts or elements for any purpose that is not expressly authorized in these Terms without the prior written consent of the CFMs.

Governing Law

These Terms shall be governed and construed in accordance with the laws of Belgium, without regard to its conflict of law provisions.
The failure of the Shift2Rail OCs or Shift2Rail CFMs to enforce any right or provision of these Terms will not be considered a waiver of those rights. If any provision of these Terms is held to be invalid or unenforceable by a court, the remaining provisions of these Terms will remain in effect. These Terms constitute the entire agreement between the app providers regarding the Service and supersede and replace any prior agreements they might have between them regarding the Service.

Travel Companion app data collected:

• User login
• Usual trip purpose and frequency of usual trips carried out (when available)
• Information about your profile type and preferences (when available)
• Itineraries shopped
• Group creation and invitation (when available)
• Add/remove favorite places (when available)
• Add/remove favorite itineraries (when available)
• User tracking during the itinerary (when available)
• User geofencing during the itinerary (when available)
• Experiences and points of interest showed to the user (when available)
• User behavior (clicks of the user in different screens of the app)
• Itineraries booked (when available)
• Itineraries issued (when available)
• Alternative itineraries shopped (when available)
• Alternative itineraries booked (when available)
• Alternative itineraries issued (when available)
• User feedbacks provided (when available)
• Trips shared (when available)
• Trips shared invitations (when available)
• Recipients of the trips shared
• Trips arranged for other users (when available)
• Mobility packages purchased (when available)
• Tickets validated and inspected (when available)
• Group travelling created by users (when available)
• Group travelling membership (when available)
• Number of accesses to the Travel companion Web-Portal (when available)
• Feedback provided by users (when available)

During the pilot execution Personal data will anonymized through the usage of fake credentials provided by the CFMs. This will guarantee that the data collected by “data processing systems”, cannot be associated to individuals. All data collected by those systems will be deleted after the pilot’s execution, in a period no longer than 3 months.

Data retention period

Personal data will be erased at the end of the OC projects after the collected data has been analyzed for research purposes.

Recipients and third parties who process your data

INDRA Sistemas S.A. and HaCon Ingenieurgesellschaft mbH, host the data processing systems guaranteeing the Travel Companion functionalities, , on behalf of the OC projects and of the CFMs the data will be processed also by OLTIS GROUP, INLECOM, EURECAT and POLITECNICO DI MILANO for the operability of the Ride2Rail components.
The data stored in the Travel Companion application environment is provided to the members of the OCs in accordance with the aforementioned list. These processors may only process the transferred data for research purposes in the context of the OCs.

• Based on the user accounts creation procedure and on the user engagement strategy adopted, the information and personal data collected will always be anonymized wherever possible.
• Data processors will elaborate data in a way to aggregate and combine them for research and analysis purposes only.

Modification to the software

The OCs and the CFMs may, either partially or in its entirety, modify, adapt, or change the software of the Travel Companion application, its features, the user interface and design, the extent and availability of the contents in the application and any other aspect related to the service.
Users will have no claim, complaint, or demand against Ride2Rail consortium or Shift2Rail JU for applying such changes or for failures incidental to such changes. However, Ride2Rail consortium or Shift2Rail JU will provide prior information to users if changes impact the processing of personal data described in these Terms.

User rights

• Users have the right to withdraw their consent
• Users have the right to access information OCs and CFMs hold about them
• Users have the right to make OCs and CFMs correct any inaccurate personal data about them
• Users have the right to restriction of processing
• Users have the right to port their data to another service
• Users have the right to be ‘forgotten’ by OCs and CFMs
• Users have the right to lodge a complaint regarding our use of their data. This can be done by contacting the EDPS (European Data Protection Supervisor).

Termination of use of the service

Users may terminate their use of the Travel Companion application at any time and for whatever reason. Users are not obligated to advise OCs and CFMs of such termination. However, if users would also like for CFMs to delete their account and their personal information contained in the account, they have to contact the CFMs. The database with app users’ data is deleted upon request at the end of the demo activities or at the end of the OCs.
CFMs retain the right to block users access to the Travel Companion application and discontinue their use of the service, at any time and for any reason CFMs deem appropriate, at their sole and absolute discretion.

---

¹ Ride2Rail project partners: UITP, FIT Consulting, OLTIS Group, Trenitalia, CERFIEL, CERTH, EURNEX, EURECAT, Politecnico di Milano, University of Newcastle, UNIFE, UIC, University of Ziline, ATTIKO METRO, INLECOM, Forum Virium Helsinki, METROPOLIA
² IP4MaaS project partners: UITP FIT Consulting, AETHON, OLTIS Group, Politecnico di Milano, AITEC, UNIFE, CERFIEL, FS Technology, MIASTO WARSZAWA, KORID, OASA, MIRAKLIO, SPARSITY, MOSAIC, CERTH, TMB, BUSUP, AMTU, Gradski prijevoz putnika, DYVOLVE, TAXIWAY, BRAIN BOX, University of Ziline, TRAM WARSAW, MZA
³ THALES PORTUGAL, THALES SIX, THALES RCS, BOMBARDIER, PKP. HITACHI RAIL, NETWORK RAIL, CS GROUP, HACON, AMADEUS, INDRA
⁴ https://shift2rail.org/research-development/ip4/

Privacy and personal data protection policy

We take your privacy seriously and want to be transparent with our processing of your personal data. We respect your privacy rights and recognize the importance of protecting the information collected about you. This Privacy and Personal Data Protection Policy is compliant with the General European Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereafter ‘GDPR’) and Greek Legislation (Law 4624/2019) and aims to inform you about how we collect and process your personal information when you register in the Athens Pilot Ride2Rail = Registration System. In the following terms, you will find important information regarding the type, purpose of personal data processing, data protection, and your rights as data subjects.

Preamble

The research Project Ride2Rail is funded in the framework of the Shift2Rail Project of the EC. It comprises the final project of the program and aims to utilize the results of previous projects funded under the specific thematic area. Its main goal is to design, develop, monitor, and assess an application that will provide the users with the opportunity to use multiple modes while travelling in 6 European cities. The specific app allows the user to plan a trip using Public Transport modes in combination with micromobility and other types of modes, such as taxis, while at the same time the user can reserve, book, and pay all the different tickets and tariffs. To achieve the efficient design of this system, the project aims to bring together all stakeholders, Transport Service Providers, and users in a fruitful dialogue. It is noted that this Privacy and Personal Data Protection Policy applies only to the Athens Pilot Ride2Rail = Registration System and does not refer to the aforementioned app of the project.

Data Controller

The data controller of this data processing is the Hellenic Institute of Transport (HIT) of the Centre for Research and Technology Hellas (CERTH), based in Thessaloniki (Greece), 6th Km Charilaou - Thermi Road, 57001.

Personal data processed

In order to be registered in the Athens Pilot Ride2Rail = Registration System, you are requested to provide your email address and, optionally, your mobile number. It is highlighted that this online registration system is not intended for minors under 15 years old. In case a minor under 15 years old gets in contact with us, through the registration system, his/her personal data will be deleted immediately.

Purpose and principles of personal data processing

The data processing is limited to personal data that is necessary and appropriate for the fulfillment of the project’s purposes and Athens Pilot = Registration System’s operation. The collection of the aforementioned personal data is necessary for your proper registration and communication purposes. In any case, the processing is subject to the rules and fundamental data protection principles of the General Data Protection Regulation, the Greek legislation, and the relevant international treaties and conventions.

Legal basis for the processing

One of the main data protection principles is the lawfulness of personal data processing. We only rely on your explicit consent as a legal basis for processing your personal data. You have the right to withdraw consent at any time and we will cease to process data after consent is withdrawn.

The retention period for personal data

Your personal data is kept only for the reasonable period of time required by the nature of the processing and only for as long as it is required to achieve the above purposes of processing unless a longer retention period is required by law or for the establishment, exercise or defense of legal claims. The longest we will normally hold your personal data is five (5) years.

Recipients/Transfers of data

The collected personal data may be disclosed to third parties, if this is required for the fulfillment of our legal obligations or is necessary for the fulfillment of the above data processing purposes, in compliance with the applicable legal framework. Such disclosure could be made to official government and supervising bodies, public authorities, organizations, and courts. We will never pass on, sell, rent, or swap your data to other organizations for marketing purposes. It is also highlighted that we do not transfer your personal data outside the European Union (EU) or the European Economic Area (EEA).

Data security

We implement appropriate technical and organisational measures to ensure an appropriate level of protection against the risks arising from processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures include the usage of the TLS 1.2 encryption protocol encryption with 256-bit on the Athens Pilot Ride2Rail Registration System’s website (“data protection on the move”), the strong encryption of the database where the system’s data are stored (“data protection at rest”) and the proper configuration of security audits from external attacks and unauthorized access. The computer systems (servers) hosting the Athens Pilot Ride2Rail Registration System software are parts of the HIT-CERTH’s computer domain which is governed by several internal policies setting out a data security and integrity.

Your legal rights

• Right to access: You have the right to request access to your personal data. By exercising this right, you can be informed if we process your personal data, about the purpose and way of their processing, their security, as well as about your rights.
• Right to rectification: If you believe that your personal data is inaccurate or needs an update, you have the right to request the rectification of the inaccurate information and the completion of the incomplete data.
• Right to erasure (“right to be forgotten”): When you no longer wish the processing and retention of your personal data, you have the right to obtain their erasure, unless the processing is necessary for a specific legal purpose.
• Right to restriction of processing: If you consider that your data is inaccurate, or that the processing is unlawful, or that we no longer need your data, or that you have objections to automated processing, you have the right to request the restriction of processing.
• Right to portability: you have the right to get a copy of your data in a structured, commonly used and machine-readable format transferred to you or to another party.
• Right to object to processing: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise, or defense of legal claims.
• Right to withdraw your consent: You have the right to withdraw your consent at any time. Please note that the withdrawal of your consent shall not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of your personal data infringes the data protection framework.

If you wish to exercise any of the above rights, please contact us using the below contact details.

Contact Information

For any question that may arise regarding this policy or if you believe that there are ambiguities and incompatibility of HIT/CERTH with this policy, you may contact the CERTH’s Data Protection Officer at dpo@certh.gr.