This is a convenience translation. The German version is legally binding. Read the German original
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
leap42 UG (haftungsbeschränkt)
Managing Director: J. Noll
Wacholderstraße 42
40489 Düsseldorf
Germany
Email: support@bikepass.eu
2. General information on data processing
(1) We process personal data only where this is necessary to provide our services, to perform a contract or because of statutory requirements, or where consent has been given.
(2) Personal data is all information relating to an identified or identifiable natural person.
(3) Processing takes place in compliance with the GDPR, the German Federal Data Protection Act (BDSG) and other applicable data protection rules.
3. Categories of personal data processed
We process in particular the following categories of data:
(1) Order data (shop)
- Name, address, email address
- Invoicing and payment data (via payment service providers)
- Products ordered, order history
(2) Usage data (web app)
- Registration data (email address, name where applicable)
- Bike and component information
- Images, documents, invoices
- Ownership details and serial numbers
- optional: details of the location or last known location of the bike (e.g. for theft reports)
- Log files (IP address, date/time of the request, browser type, operating system)
(3) Device and tracking data
- Cookies and similar technologies
- Analytics and statistics data (e.g. via Google Analytics)
4. Purposes of processing and legal bases
We process personal data for the following purposes and on the basis of the legal bases stated in each case:
(1) Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR)
- Processing orders in the online shop
- Providing a user account for the web app
- Use of the digital bike register's features
- Communication in connection with support requests
(2) Compliance with legal obligations (Art. 6(1)(c) GDPR)
- tax retention obligations
- commercial documentation obligations
(3) Legitimate interest (Art. 6(1)(f) GDPR)
- Ensuring IT security
- Detection of misuse and fraud
- Improvement of our services
- statistical analyses in pseudonymised form
(4) Consent (Art. 6(1)(a) GDPR)
- Use of analytics and marketing cookies
- Use of certain tracking tools (e.g. Google Analytics)
- Sending newsletters or product information (via Brevo)
5. Disclosure of personal data
(1) In principle, we do not pass personal data on to third parties unless this is necessary to perform a contract, required by law or covered by consent.
(2) Possible recipients are in particular:
- Payment service providers (e.g. PayPal, credit card providers)
- Shipping service providers (DHL) for the delivery of physical products
- technical service providers (hosting, automation, email delivery)
- in individual cases, authorities where there is a legal obligation
(3) It is possible for someone who finds a bike to contact the registered owner anonymously via BikePass. In doing so, we do not pass any personal contact details of the owner on to third parties, but merely forward the enquiry through our system.
(4) With all service providers that process data on our behalf (processors), we conclude data processing agreements in accordance with Art. 28 GDPR.
6. Services and tools used
6.1 Google Analytics
(1) We use Google Analytics to measure reach and analyse user behaviour, provided you have consented to its use in the cookie banner.
(2) The provider is Google Ireland Limited.
(3) We use Google Analytics with IP anonymisation enabled, so that your IP address is truncated before being stored.
(4) The legal basis is your consent (Art. 6(1)(a) GDPR).
(5) You can withdraw your consent at any time via the cookie settings.
6.2 Brevo (email delivery)
(1) We use the Brevo service to send system, service and, where applicable, marketing emails.
(2) The provider is Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin, Germany. Brevo processes data exclusively on our behalf; a data processing agreement is in place.
(3) The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(a) GDPR (consent for marketing emails).
6.3 Make.com
(1) We use Make.com for the technical automation of processes (e.g. sending confirmation emails, synchronising systems).
(2) Only the data required for the respective automation is processed.
(3) The legal basis is Art. 6(1)(b) and (f) GDPR.
6.4 Website hosting (ALL-INKL.COM)
(1) Our website bikepass.eu is hosted with ALL-INKL.COM. When the website is accessed, the host processes technically necessary data (e.g. IP address, date and time of access, page accessed, browser identifier) in server log files.
(2) The provider is ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany.
(3) The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6(1)(f) GDPR). A data processing agreement is in place with the provider.
6.5 Vercel (hosting of the web app and the status page)
(1) Our web app (app.bikepass.eu) and our status page (status.bikepass.eu) are delivered via the hosting platform Vercel. In doing so, Vercel processes technically necessary connection data (in particular the IP address) in server log files.
(2) The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. A transfer to the USA is possible in this context; Vercel is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses and a data processing agreement are additionally in place.
(3) The legal basis is our legitimate interest in fast and fail-safe provision (Art. 6(1)(f) GDPR).
6.6 Supabase (database and authentication)
(1) The web app's data (in particular user accounts, sign-in/authentication and the app data described in section 9) is stored and processed in a database of the Supabase service.
(2) The provider is Supabase, Inc. (USA). Our data is stored and processed on servers in the EU (AWS region Frankfurt am Main, Germany); the sub-processor in this respect is Amazon Web Services. A data processing agreement is in place with Supabase; standard contractual clauses are in place for any transfers to third countries.
(3) The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
(4) Data is transmitted exclusively in encrypted form (TLS/HTTPS).
6.7 Mailjet (email delivery)
(1) We use the Mailjet service to send transactional and service emails (e.g. sign-in, order and system notifications from the website and the web app). The data required for delivery (in particular email address, name and email content) is processed in this context.
(2) The provider is Mailjet SAS, 4 Rue Jules Lefebvre, 75009 Paris, France (part of the Sinch group). Mailjet processes the data on our behalf; a data processing agreement is in place.
(3) The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in reliable email delivery (Art. 6(1)(f) GDPR).
7. Cookies
(1) We use cookies and similar technologies to provide and improve our website and web app.
(2) We distinguish between:
- technically necessary cookies (e.g. session cookies, log-in cookies),
- statistics and analytics cookies (e.g. Google Analytics),
- marketing cookies.
(3) Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR.
(4) Statistics and marketing cookies are only set with your consent (Art. 6(1)(a) GDPR).
(5) You can withdraw or adjust your consent at any time via the cookie consent tool.
8. Storage periods
(1) We store personal data only for as long as is necessary for the respective purposes.
(2) Criteria for the storage period are in particular:
- statutory retention periods (e.g. 6–10 years for tax-relevant data),
- the duration of use of a user account,
- the necessity for providing our services.
(3) Once the purpose no longer applies or statutory periods have expired, the data is deleted or anonymised.
9. User account and app data
(1) A user account is required to use BikePass.
(2) The data stored in the account (e.g. bike data, documents, images) is stored for as long as the account exists.
(3) Users can delete their content themselves.
(4) When the account is deleted, personal data is deleted or anonymised, unless statutory retention obligations prevent this.
10. Public dealer directory (/en/dealers/)
(1) On our website, at bikepass.eu/en/dealers/, we operate a public directory of bike dealers, bike workshops and comparable specialist businesses. It shows the company name, address and type of business as well as — where available — opening hours and website. For sole traders and partnerships, these details may constitute personal data.
(2) We did not collect this data from the businesses concerned themselves, but compiled it from publicly accessible sources (information pursuant to Art. 14 GDPR), in particular from the free map project OpenStreetMap (ODbL licence) and from publicly available details published by the businesses (e.g. on their own websites).
(3) The purpose of the processing is to make it easier for cyclists to find local specialist businesses and to increase the visibility of those businesses. The legal basis is our legitimate interest and our users' interest in information (Art. 6(1)(f) GDPR); only business-related details are processed.
(4) Businesses can claim and maintain their entry themselves through our partner programme. They may also object to inclusion in the directory at any time or request the correction or deletion of their entry — an informal email to support@bikepass.eu is sufficient; we will then review and remove the entry promptly.
(5) To display locations, we embed map material from OpenFreeMap (openfreemap.org), a non-profit open-source map service based on OpenStreetMap data (© OpenStreetMap contributors). The map is only loaded after you have actively clicked the map placeholder (two-click solution); only then is a connection to OpenFreeMap's servers established and your IP address transmitted. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR).
11. Rights of data subjects
Under the GDPR you have the following rights:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
To exercise these rights, you can contact us at any time by email at support@bikepass.eu.
12. Right to object under Art. 21 GDPR
(1) You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR.
(2) In the event of an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds that override your interests.
13. Data security
(1) We use technical and organisational security measures to protect your data against loss, manipulation and unauthorised access.
(2) These include in particular:
- TLS/SSL encryption during transmission,
- access restrictions,
- regular backups,
- logging of access.
(3) Our security measures are continuously improved in line with technological developments.
14. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data if you believe that the processing infringes the GDPR.
15. Changes to this privacy policy
(1) We reserve the right to amend this privacy policy if the legal situation, our offering or the data processing changes.
(2) The current version is available on our website.