Privacy Policy

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

leap42 UG (limited liability)
Managing Director: J. Noll
Wacholderstraße 42
40489 Düsseldorf
Germany
Email: support@bikepass.eu

2. General Information on Data Processing

(1) We process personal data only to the extent necessary to provide our services, to fulfill a contract, or to comply with legal requirements, or where consent has been obtained.

(2) Personal data means any information relating to an identified or identifiable natural person.

(3) Processing is carried out in compliance with the GDPR, the BDSG, and other relevant data protection regulations.

3. Categories of personal data processed

In particular, we process the following categories of data:

(1) Order details (Shop)

• Name, address, email address
• Billing and payment information (via payment service providers)
• Ordered Products, Order History

(2) Usage data (web app)

• Registration information (email address, name if applicable)
• Bicycle and Component Information
• Pictures, documents, invoices
• Ownership and serial number information
• Optional: Information about the bicycle's location or last known location (e.g., for theft reports)
• Log files (IP address, date and time of the request, browser type, operating system)

(3) Device and tracking data

• Cookies and Similar Technologies
• Analytics and statistical data (e.g., via Google Analytics)

4. Purposes of Data Processing and Legal Bases

We process personal data for the following purposes and on the legal grounds specified in each case:

(1) Performance of a contract and pre-contractual measures (Art. 6(1)(b) of the GDPR)

• Processing orders in the online store
• Setting up a user account for the web app
• Using the features of the digital bicycle registry
• Communication regarding support requests

(2) Compliance with legal obligations (Art. 6(1)(c) of the GDPR)

• Tax-related record-keeping requirements
• Commercial law documentation requirements
• Provision of the right of withdrawal pursuant to Section 356a of the German Civil Code (BGB): Processing of your first and last name, email address, and contract or order number, as well as selected order items, if applicable, to process your withdrawal and to send you the legally required confirmation of receipt

(3) Legitimate interest (Art. 6(1)(f) of the GDPR)

• Ensuring IT security
• Fraud and Abuse Detection
• Improving our services
• statistical analyses in pseudonymized form

(4) Consent (Art. 6(1)(a) of the GDPR)

• Use of analytics and marketing cookies
• Use of certain tracking tools (e.g., Google Analytics)
• Sending newsletters or product information (via Brevo)

5. Disclosure of Personal Information

(1) As a general rule, we do not disclose personal data to third parties unless this is necessary to fulfill a contract, required by law, or covered by consent.

(2) Potential recipients include, in particular:

• Payment service providers (e.g., PayPal, credit card companies)
• Shipping provider (DHL) for the delivery of physical products
• technical service providers (hosting, automation, email delivery)
• in specific cases, government agencies when there is a legal obligation

(3) If you find a bicycle, you can use BikePass to contact the registered owner anonymously. We do not share the owner’s personal contact information with third parties; we simply forward the request through our system.

(4) We enter into data processing agreements (DPAs) with all service providers who process data on our behalf (data processors) in accordance with Article 28 of the GDPR.

6. Services and Tools Used

6.1 Google Analytics

(1) We use Google Analytics to measure website traffic and analyze user behavior, provided that you have consented to its use in the cookie banner.

(2) The provider is Google Ireland Limited.

(3) We use Google Analytics with IP anonymization enabled, so your IP address is truncated before being stored.

(4) The legal basis is your consent (Art. 6(1)(a) of the GDPR).

(5) You can withdraw your consent at any time via the cookie settings.

6.2 Brevo (Email Delivery)

(1) We use the Brevo service to send system, service, and, where applicable, marketing emails.

(2) The provider is Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin, Germany. Brevo processes data exclusively on our behalf; a data processing agreement is in place.

(3) The legal basis is Article 6(1)(b) of the GDPR (performance of a contract) or Article 6(1)(a) of the GDPR (consent for marketing emails).

6.3 Make.com

(1) We use Make.com for the technical automation of processes (e.g., sending confirmation emails, synchronizing systems).

(2) Only the data necessary for the specific automation process is processed.

(3) The legal basis is Article 6(1)(b) and (f) of the GDPR.

6.4 Web Hosting for the Website (ALL-INKL.COM)

(1) Our website, bikepass.eu, is hosted by ALL-INKL.COM. When you visit the website, the host processes technically necessary data (e.g., IP address, date and time of access, page accessed, browser identifier) in server log files.

(2) The provider is ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany.

(3) The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6(1)(f) of the GDPR). We have a data processing agreement in place with the service provider.

6.5 Vercel (Hosting the Web App and the Status Page)

(1) Our web app (app.bikepass.eu) and our status page (status.bikepass.eu) are hosted on the Vercel platform. In doing so, Vercel processes technically necessary connection data (in particular, the IP address) in server log files.

(2) The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Data may be transferred to the United States; Vercel is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses and a data processing agreement are also in place.

(3) The legal basis is our legitimate interest in ensuring fast and reliable service (Art. 6(1)(f) of the GDPR).

6.6 Supabase (Database and Authentication)

(1) The web app's data (in particular, user accounts, login/authentication, and the app data described in Section 9) is stored and processed in a Supabase database.

(2) The provider is Supabase, Inc. (U.S.). Our data is stored and processed on servers in the EU (AWS region: Frankfurt am Main, Germany); Amazon Web Services acts as a subprocessor in this regard. We have a data processing agreement with Supabase; standard contractual clauses are in place for any transfers to third countries.

(3) The legal basis is the performance of a contract (Art. 6(1)(b) of the GDPR) and our legitimate interest in ensuring secure operations (Art. 6(1)(f) of the GDPR).

(4) Data is transmitted exclusively in encrypted form (TLS/HTTPS).

6.7 Mailjet (Email Delivery)

(1) We use the Mailjet service to send transactional and service emails (e.g., registration, order, and system notifications from the website and the web app). In doing so, we process the data required for sending these emails (in particular, email address, name, and email content).

(2) The service provider is Mailjet SAS, 4 Rue Jules Lefebvre, 75009 Paris, France (part of the Sinch Group). Mailjet processes the data on our behalf; a data processing agreement is in place.

(3) The legal basis is the performance of a contract (Art. 6(1)(b) of the GDPR) or our legitimate interest in reliable email delivery (Art. 6(1)(f) of the GDPR).

7. Cookies

(1) We use cookies and similar technologies to provide and improve our website and web app.

(2) We distinguish between:

• technically necessary cookies (e.g., session cookies, login cookies),
• Statistics and analytics cookies (e.g., Google Analytics),
• Marketing cookies.

(3) Technically necessary cookies are used on the basis of Article 6(1)(f) of the GDPR.

(4) Statistics and marketing cookies are only set with your consent (Art. 6(1)(a) of the GDPR).

(5) You can withdraw or modify your consent at any time using the cookie consent tool.

8. Retention period

(1) We retain personal data only for as long as is necessary for the respective purposes.

(2) The criteria for the retention period include, in particular:

• statutory retention periods (e.g., 6–10 years for tax-related data),
• Duration of use of a user account,
• Necessary for the provision of our services.

(3) Once the purpose no longer applies or the statutory retention periods have expired, the data will be deleted or anonymized.

9. User Account and App Data

(1) A user account is required to use the BikePass.

(2) The data stored in the account (e.g., bicycle information, documents, images) will be retained for as long as the account remains active.

(3) Users can delete their own content.

(4) Upon deletion of the account, personal data will be deleted or anonymized, provided that no legal retention requirements prevent this.

10. Public Dealer Directory (/haendler/)

(1) On our website, at bikepass.eu/haendler/, we maintain a public directory of bicycle retailers, bicycle repair shops, and similar specialty businesses. The directory lists the company name, address, type of business, and—where available—opening hours and website. For sole proprietorships and partnerships, this information may constitute personal data.

(2) We did not collect the data directly from the businesses in question, but rather compiled it from publicly available sources (information pursuant to Art. 14 of the GDPR), in particular from the open-source mapping project OpenStreetMap (ODbL license) and from publicly available information provided by the businesses (e.g., their own websites).

(3) The purpose of the processing is to make it easier for cyclists to find local specialty shops and to increase the visibility of these businesses. The legal basis is our legitimate interest as well as our users’ interest in obtaining information (Art. 6(1)(f) GDPR); only business-related information is processed.

(4) Businesses can add their own listings through our partner program and manage them themselves. They may also object to being included in the directory at any time or request that their listing be corrected or deleted—a simple email to support@bikepass.eu is sufficient; we will then review and remove the listing promptly.

(5) To display locations, we incorporate map data from OpenFreeMap (openfreemap.org), a nonprofit, open-source mapping service based on OpenStreetMap data (© OpenStreetMap contributors). The map is loaded only after you have actively clicked on the map placeholder (two-click solution); only then is a connection established to the OpenFreeMap servers, and your IP address is transmitted in the process. The legal basis is your consent, which you provide by clicking (Art. 6(1)(a) GDPR).

11. Rights of Data Subjects

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) of the GDPR)

To exercise these rights, you can contact us at any time by email at support@bikepass.eu.

12. Right to Object under Article 21 of the GDPR

(1) You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) of the GDPR.

(2) If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests.

13. Data Security

(1) We use technical and organizational security measures to protect your data against loss, tampering, and unauthorized access.

(2) These include, in particular:

• TLS/SSL encryption during transmission,
• Access restrictions,
• regular backups,
• Logging of accesses.

(3) We continuously improve our security measures in line with technological advancements.

14. Right to File a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data if you believe that such processing violates the GDPR.

15. Changes to This Privacy Policy

(1) We reserve the right to update this Privacy Policy if there are changes to the legal landscape, our services, or our data processing practices.

(2) The current version is available on our website.