Privacy Policy of CYCLE Mobility Holding GmbH

This privacy policy applies to data processing by CYCLE Mobility Holding GmbH (“CYCLE”, “Controller”, “we” or “us”). CYCLE offers a rental service for e-vehicles (“CYCLE Vehicle”) and related special accessories on the basis of a subscription agreement.

When you use our CYCLE app (“App”) and when you visit our website https://cycle.eco/ or a CYCLE partner site (“Website”), personal data is collected and processed in compliance with the applicable data protection regulations. Personal data is any information relating to an identified or identifiable natural person, e.g. name, address, email address. When processing your personal data, we observe the applicable data protection laws, in particular the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

The following privacy policy explains which personal data we process, for what purposes and on what legal basis. The protection of personal data and your privacy is very important to us and is taken seriously by us. We will only process your data for the purposes clearly set out in this privacy policy. Our data protection declaration does not apply to your activities on the websites of social networks or other providers that you can reach via the links on our websites. Please inform yourself on the websites of these providers about their data protection policies.

1 Name and contact details of the internal data protection officer

The internal data protection contact is CYCLE Mobility Holding GmbH, Blücherstr. 22, 10961 Berlin in Germany, email: datenschutz@cycle.eco.

2 Name and contact details of the external data protection officer(s)

We have appointed an external data protection officer. The contact details of our data protection officer are as follows: PROLIANCE GmbH, email: datenschutzbeauftragter@datenschutzexperte.de, www.datenschutzexperte.de, Leopoldstr. 21, 80802 Munich, Germany.

3 Collection and storage of personal data, type and purpose of their processing, as well as relevant legal basis and storage period

3.1 Downloading the App

When downloading the App, the required information is transferred to the App Store, i.e. in particular username, email address and customer number of your account, time of download, payment information and the individual device identification number. We have no influence on this data collection and are not responsible for it. We only process the data to the extent necessary for downloading the App to your mobile device.

3.2 Use of our Website and App

When you use our website and our App, we automatically collect and store data that your browser transmits to our server (so-called server log files), whereby logging only takes place to the extent that is technically necessary.

The following information is collected:

• Operating system and information on the internet browser used, including installed add-ons;
• IP address (internet protocol address) of the end device from which the online offer is accessed;
• internet address of the website from which the online offer was accessed (so-called origin or referrer URL);
• Name of the service provider via which the online offer is accessed;
• Name of the files or information retrieved;
• Date and time as well as duration of the retrieval.
• The legal basis for the collection of this data is Art. 6 para. 1 lit. f) UK GDPR. Our legitimate interest in collecting this data results from the following purposes:
• Ensuring optimal use of our Website and App,
• Ensuring a smooth connection setup,
• Evaluating system security and stability.

3.3 Data collection when using CYCLE Services

Personal data is collected via our Website and App when you provide it to us, e.g. as part of a registration, by filling out forms, by sending emails or by booking a CYCLE Vehicle. We use this data for the purposes stated in each case or resulting from the request, i.e. for example the booking request to process your booking request.

(a) Registration for Use

On our Website and in our App, we offer users the opportunity to register by providing personal data. Registration is mandatory for the rental of a CYCLE Vehicle. The following personal data is collected during the registration process on the Website and in the App:

• email address
• a password chosen by you
• first and last name
• address
• telephone number
• payment details
• preferred language setting.

To confirm the email address you have provided, we use the so-called double opt-in procedure. This means that after your registration we will send you an email to the email address you have provided, in which we ask you to confirm your email address.

We process your registration data in order to fulfil the rental agreement concluded with you. The legal basis is Art. 6 para. 1 lit. b) UK GDPR. If you use our service as an employee of a company registered with us or as a person authorised to represent such a company, the processing of data for the aforementioned purposes constitutes a legitimate interest on our part, so that we can base the processing of data on Art. 6 (1) sentence 1 lit. f) UK GDPR.

We delete the data collected and stored in connection with your registration at the latest when you inform us that your customer account is to be deleted. However, premature deletion of your personal data is not possible if and to the extent that the data is still required for the processing of a vehicle rental or to the extent that legal obligations oblige us to store the data further.

Irrespective of this, we store your data processed when you use our service until the expiry of the statutory or possible contractual warranty rights. After the expiry of this period, we retain the information of the contractual relationship required under commercial and tax law for the periods determined by law. For this period (regularly ten years from the conclusion of the agreement), the data is processed again solely in the event of an audit by the tax authorities.

(b) Location Data

At CYCLE, we prioritize the protection of your vehicle and the prevention of theft. To achieve this, we store location data to facilitate the tracking and potential prosecution of the bike in the event of theft. This data allows us to monitor the current location of the bike.

The following data is collected for this purpose: Location coordinates, time of theft report, driver name

Access to this location data is restricted to authorized personnel at CYCLE, who will only use it when there is a concrete reason to do so. We anonymize the data after the bicycle has been found or after the theft has been finally investigated. The anonymized location data is then utilized to gain insights into the occurrence of theft of vehicles and to optimize our services for all CYCLE users.

In the case of entering into an e-bike subscription with CYCLE, we may process the last known location of the bicycle (besides recovering lost or stolen e-bikes) to retrieve e-bikes in case of default. CYCLE reserves the right to retrieve the bike if you (repeatedly) fail to comply with written requests to return the e-bike.

Constant collection of location data only occurs from the moment you personally declare the bicycle as lost or stolen or in the case of payment default.

We base data processing on our legitimate interest (art. 6 I f UK GDPR) in investigating theft and locating our bicycles in order to prevent economic damage.

We use the service provider IoT Venture GmbH for the aforementioned data processing. This processing is performed based on data processing agreements pursuant to Art. 28 of the UK GDPR. In these cases, we ensure that the processing of personal data is carried out according to the provisions of the UK GDPR. The data can also be passed on to investigating authorities.

3.4 Data collection when contacting us

If you contact us via the contact form, e-mail or telephone, we will process the information you provide for the purpose of processing the enquiry and for possible follow-up questions. This processing is based on our legitimate interest in being able to answer customer enquiries (Art. 6 para. 1 lit. f UK GDPR). Your data will be deleted as soon as it is no longer required for the purposes of the enquiry or to fulfil legal obligations.

4 Optimisation of Website and App

4.1 Cookies

On our Website, we use cookies that are temporarily stored in the working memory (“session cookie”) or permanently stored on the hard disk (“permanent cookie”). Cookies are small text files that are automatically created by the browser and stored on your end device (laptop, tablet, smartphone or similar) when you visit our Website.

These files allow us to design the App and Website more efficiently. Most of the cookies we use are session cookies, which are only stored in the RAM but not on your hard drive, and which expire when you exit the internet browser and are therefore automatically deleted. Session cookies enable us to recognise that you have already visited individual pages of our Website or that you have already logged into your account. We automatically receive certain data, such as IP address, browser used, operating system about your computer and your connection to the internet.

Cookies cannot be used to launch programs or transfer viruses to a computer. The information contained in cookies allows us to facilitate your navigation and enable the correct display of our Website. Under no circumstances will the data we process be passed on to third parties or linked to other personal data without your consent.

Of course, you can also view our Website without cookies as a matter of principle. Internet browsers are regularly set to automatically accept cookies. You can deactivate the use of cookies at any time via your browser settings. Please use the help functions of your internet browser to find out how to change these settings. Please note that individual functions of our Website may not work if you have deactivated the use of cookies. You can also control and/or delete cookies as you wish. You can find out how here: www.aboutcookies.org.

Since the activation of cookies is necessary for the proper functioning of our Website, we have a legitimate interest in their use. The legal basis for the related data processing is therefore Art. 6 para. 1 sentence 1 lit. f) UK GDPR.

If we use cookies for other purposes (e.g. for analysis or marketing purposes), we will inform you separately in this privacy policy.

4.2 Integration of Google Maps on the Website

We use Google Maps API applications for our Website. This allows us to show you interactive maps on our Website. By integrating Google Maps, we make it easier for you to see available vehicles and the estimated walking distance to the pick-up and drop-off location.

To use the Google Maps functions, your IP address is transmitted to a Google server in the USA and stored there. Data processing in connection with the use of Google Maps is carried out on the legal basis of Art. 6 para. 1 lit. b) UK GDPR. We use Google Maps to fulfil the rental agreement concluded with you.

You can read the Google terms of use here: https://www.google.com/intl/de/policies/terms/.

You can find the additional terms of use for Google Maps/Google Earth here: https://www.google.com/help/terms_maps.html.

You can find Google’s privacy policy here: https://www.google.com/intl/de/policies/privacy/.

4.3 Analysis and advertising services

We use the following analytics and advertising services to track your behaviour on our Website, to improve our service and/or to display interest-based ads to you. You can object to the data processing as described in the following sections. Data processing in connection with the following analysis and advertising services is based on your express consent pursuant to Art. 6 (1) a) UK GDPR.

(a) Google Analytics

Our Website uses the analysis tool Google Analytics (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses cookies. The information generated by cookies (including your IP address) about your use of the Website is generally transmitted to a Google server in the USA and stored there. However, due to the activation of IP anonymisation on our Websites, your IP address will be shortened beforehand by Google within Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information on our behalf for the purpose of evaluating your use of the Website, compiling reports on Website activity and providing other services relating to Website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent the further storage of cookies by setting your browser software accordingly.

You can also prevent the collection of data generated by the cookie and related to your use of the Website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de. However, please note that if you do this you may not be able to use the full functionality of this Website.

Overview of data protection at Google: http://www.google.com/intl/de/analytics/learn/privacy.html and the privacy policy: http://www.google.de/intl/de/policies/privacy.

(b) Facebook Custom Audiences Pixel

The pixel version of Facebook Custom Audiences (without the so-called advanced matching function) is used on our Website. This tool is provided by Facebook Inc, 1601 S. California Ave, Palo Alto, CA 94304, USA. With the help of the Facebook pixel, technical data about your use of our Website can be sent to Facebook. If you are registered with Facebook, Facebook can assign the data sent to you by means of an automated comparison of hash values and show you interest-based advertising. Such advertising may, for example, be special offers on CYCLE. In the Custom Audience terms of use, Facebook guarantees to process the collected data exclusively for this advertising purpose in our Custom Audience.

Due to the marketing tools used, your browser automatically establishes a direct connection with the Facebook server. We have no influence on the scope and further use of the data collected by Facebook through the use of this tool and therefore inform you according to our state of knowledge: Through the integration of Facebook Custom Audiences, Facebook receives the information that you have called up the corresponding web page of our Website or clicked on an advertisement from us. If you are registered with a Facebook service, Facebook can assign the visit to your account. Even if you are not registered with Facebook or have not logged in, it is possible that the provider will learn and store your IP address and other identifying features.

In doing so, we process your data as joint controllers with Facebook. For information about Facebook’s data processing, including the legal basis on which Facebook relies and how data subjects can exercise their rights against Facebook, please refer to Facebook’s privacy notices. On processing as joint controllers, we have entered into an agreement with Facebook to determine the respective responsibilities for compliance with the obligations under the UK GDPR in relation to joint processing (https://www.facebook.com/legal/controller_addendum); according to this, Facebook Ireland in particular is responsible between the parties for enabling the rights of data subjects under Art. 15-20 UK GDPR in relation to the personal data stored by Facebook after joint processing.

You can find out more about data protection with Facebook Custom Audience at: https://www.facebook.com/legal/terms/dataprocessing

(c) Doubleclick

Doubleclick is a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. When you visit our Website, Doubleclick sets a cookie in your browser. This cookie is used to collect information about your click behaviour and the technical characteristics of your device, which is then analysed by DoubleClick. The collected data is transferred to Google servers in the USA and stored there. Based on the data, DoubleClick can display ads to you that correspond to the interests you have shown on various websites you have visited. You can prevent the collection and analysis of your data for the future by making the appropriate settings on this page to deactivate the use of Doubleclick by Google. In addition, you can install a plugin on the website https://www.google.com/settings/ads/plugin that deactivates personalised advertising. For more information on Google-controlled ads, please visit https://support.google.com/ads/answer/1634057. The Google privacy policy can be found at https://www.google.de/intl/de/policies/privacy/.

4.4 Google Fonts

We use “Google Fonts” on our website, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as: “Google”). Google Fonts enables us to use external fonts. For this purpose, the required Google Fonts are loaded into your browser cache by our web server when you access our website. This is necessary so that your browser can display a visually improved representation of our texts. If your browser does not support this function, a standard font will be used by your computer for display.

The fonts are hosted by us and therefore are not loaded by an external provider. This requires the processing of your IP address.

We use Google Fonts for optimization purposes, in particular to improve the use of our website for you and to make its design more user-friendly. The legal basis for the data processing is our legitimate interest (Art. 6 para. 1 lit. f UK GDPR).

5 Newsletter

If you give us your express consent we will send you information about our services and offers by email. For this purpose, we process your name and email address. When you register for our newsletter, we use the so-called double opt-in procedure. This means that after you have registered with your e-mail address, we will send you an email to the specified email address in which we ask you to confirm that you actually wish to receive the newsletter.

The legal basis for sending our information is Art. 6 para. 1 lit. a) UK GDPR.

You can send your objection to the receipt of product and advertising mails or revoke your consent regarding our newsletter by e-mail to datenschutz@cycle.eco or by mail to CYCLE Mobility Holding GmbH, Blücherstr. 22, 10961 Berlin in Germany.

6 Transfer of personal data to third parties

Data will only be transferred to third parties if there is an explicit legal basis for this or if you have consented to the transfer.

In addition to the service providers mentioned above under section 4, we have involved processors for the following processing activities in accordance with Art. 28 UK GDPR:

• information technology service providers, such as web servers, e-mail servers, storage servers, cloud management systems, cloud storage.
• email service providers
• payment system providers

These service providers process your personal data on our behalf, in accordance with our instructions and our supervision, solely for the purposes set out in this privacy policy.

In addition, your personal data may be transferred to the following recipients:

• If the vehicle you have rented requires repair or maintenance, we may use our group companies CYCLE Mobility Service GmbH, CMA Service GmbH, GetHenry Italy S.r.l. or GetHenry Netherlands BV for this service, depending on the country in which you have concluded your agreement. The legal basis for the transmission is Art. 6 para. 1 lit. b) UK GDPR. The transmission takes place for the fulfilment of the rental and service agreement concluded with you. CYCLE Mobility Service GmbH processes your data solely for the purpose of repairing and/or servicing the vehicle.
• If the lessee has received a discount code, promo code or similar from a cooperation partner, the following categories of data will be passed on to the cooperation partner for billing and performance tracking purposes: Name, phone number, e-mail address and rental period. If we use the data for the purpose of billing your discount code with the cooperation partner, the legal basis for this processing is Art. 6 (1) lit. b) UK GDPR. The transmission of your data for the purpose of performance tracking is based on Art. 6 para. 1 lit. f) UK GDPR. Both the cooperation partner and we have a legitimate interest in being able to measure the success of the discount programme.
• If the lessee is in arrears with the contractually stipulated rental payments, CYCLE reserves the right to pass on payment claims to a collection service provider. In this case, the following data will be forwarded to the collection service provider for the purpose of fulfilling these payment demands: Name, address, e-mail address and outstanding payment claim. CYCLE has a legitimate interest in ensuring that outstanding claims are settled. The legal basis for the data transfer is Art. 6 para. 1 lit. f) UK GDPR.

7 Data transfer to third countries

In the course of our business relationships, your personal data may be passed on or disclosed to third party companies. These may also be located outside the United Kingdom, i.e. in third countries. This concerns the use of the following services:

• Google: Google Analytics, Google Maps and Doubleclick are services of companies belonging to the Google LLC group, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
• Facebook: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland, which regularly transmits data to other companies of the Facebook group in the USA.
• Cycle Mobility Holding GmbH: our parent company and operator of the cycle.eco store, located at Blücherstr. 22, 10961 Berlin, Germany.

Transfers of personal data to countries within the European Economic Area (EEA), including Germany, are permitted under the UK GDPR on the basis of regulations made by the UK Secretary of State recognising those countries as providing an adequate level of protection for personal data.

To the extent that data is transferred to other third countries for which no UK adequacy regulation is in force, in particular the USA, we ensure that appropriate safeguards are in place pursuant to Art. 46 UK GDPR. Such safeguards may include the use of the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational measures to protect your data.

Further information on the transfer safeguards used can be obtained from the respective websites of the service providers we use:

• Google: https://privacy.google.com/businesses/processorterms/mccs/
• Facebook: https://www.facebook.com/help/566994660333381?ref=dp

8 Data protection

We use technical and organisational security measures to protect your data that we manage against manipulation, loss, destruction and against access by unauthorised persons. We continuously improve our security measures in line with technological developments.

9 Your rights

9.1 Right to information pursuant to Art. 15 UK GDPR

You have the right to request information from us at any time about the data we have stored about you, as well as about its origin, recipients or categories of recipients to whom this data is passed on, and the type and purpose of the processing. In addition, we can provide you with a copy of this data.

9.2 Right to revocation pursuant to Art. 7 UK GDPR

If you have given your consent to the use of data, you can revoke this at any time without giving reasons with effect for the future.

9.3 Right to rectification pursuant to Art. 16 UK GDPR

If your data stored with us is incorrect or incomplete, you can correct or complete it at any time in your customer account or have it corrected or completed by us. If required by law, we will also inform third parties about this correction if we have passed on your personal data to them.

9.4 Right to erasure pursuant to Art. 17 UK GDPR

Under certain circumstances, you have the right to block or delete the data we hold about you if one of the following cases applies:

• your data is no longer necessary for the purposes for which it was collected or otherwise processed or the purpose has been achieved;
• you withdraw your consent and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds for the processing; in the case of the use of personal data for direct marketing, a mere objection by you to the processing is sufficient;
• your personal data have been processed unlawfully;
• the erasure of your personal data is necessary for compliance with a legal obligation under UK law to which we are subject.

The deletion or blocking of your personal data will take place as soon as we have checked the conditions for the legality of your request. If legal, contractual or tax law or company law retention obligations or other legally anchored reasons contradict the deletion, only the blocking of your data can be carried out instead of the deletion.

After the deletion of your data, it is no longer possible to provide information.

9.5 Right to data portability pursuant to Art. 20 UK GDPR

You may receive the data we process relating to you, if we have received it from you ourselves, in a machine-readable format determined by us or instruct us to transfer this data directly to a third party of your choice, provided that this recipient enables us to do so from a technical point of view and the transfer of the data is not prevented by unjustifiable expense or by legal or other obligations of secrecy or confidentiality considerations on our part or on the part of third parties.

9.6 Right to object pursuant to Art. 21 UK GDPR

You have the right to object to the processing of your data at any time on grounds relating to your particular situation, if we base this processing on legitimate interests pursuant to Art. 6 para. 1 (f) UK GDPR. If you object, we will no longer process your personal data, except in two cases:

• we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or
• the processing serves the assertion, exercise or defence of legal claims.

In particular, if we process your personal data for direct marketing, you have the right to object at any time to the processing of your data for the purpose of such marketing. If you object to the processing of your data for direct marketing purposes, we will no longer use your personal data for this purpose.

9.7 Right to restrict processing pursuant to Art. 18 UK GDPR

You have the right to request us to restrict the processing of your personal data if one of the following grounds applies:

• you dispute the correctness of your personal data for a period of time that allows us to verify the correctness of the personal data;
• the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of your personal data;
• we no longer need your personal data for the purposes of processing; however, you need it to assert, exercise or defend legal claims; or
• you have objected to the processing as long as it has not yet been determined whether our legitimate grounds outweigh yours.
• If you have obtained a restriction on processing under the above list, we will inform you before the restriction is lifted.

9.8 Contact for the assertion of data subject rights

To assert your data protection rights, you can contact us by e-mail at: datenschutz@cycle.eco or in writing at: CYCLE Mobility Holding GmbH, Blücherstr. 22, 10961 Berlin. For all your requests, we always ask you to provide proof of your identity, for example by sending an electronic copy of your ID card.

9.9 Right to complaint to the supervisory authority

You have the right to file a complaint with the competent supervisory authority against the processing of your personal data if you feel that your rights under the UK GDPR have been violated. The competent supervisory authority for data subjects in the United Kingdom is the:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF

Phone: 0303 123 1113
Website: https://ico.org.uk

Report a concern: https://ico.org.uk/make-a-complaint/

10 Amendments to the privacy policy

We reserve the right to amend this privacy policy from time to time so that it always complies with the current legal requirements or in order to implement changes to our services in the privacy policy, e.g. when introducing new services. We recommend that you regularly check the privacy policy for possible changes. If your prior consent is required for a change to our services or for the introduction of a new service, we will inform you accordingly in good time and ask for your consent.

Status: March 2024