DATA PROTECTION AND LEGAL NOTICES
General information
Name and address of the controller
The controller within the meaning of the GDPR and other applicable data protection laws is: Smettly GmbH, Betriebsstraße 21, A-4224 Wartberg ob der Aist, Tel.: +43 7236 218 218 218, Email: info@bikecitizens.net, Website: www.bikecitizens.net.
Processors
We sometimes use external service providers to process personal data. They have been carefully selected and commissioned, are bound by our instructions and are regularly monitored.
Transfer outside the EEA
In certain cases, we transfer data to recipients outside the European Economic Area. Google LLC processes device identifiers and information about the frequency of app use on our behalf. The legal basis is legitimate interest for analytics and contract performance for communication purposes.
Important: all other data, such as recorded GPS tracks or stored start-destination routes, is not transferred to Google LLC.
Newsletter
Purpose
Bike Citizens processes the email address you provide in order to send the subscribed newsletter. Voluntary information may be used to provide targeted information, such as personalised address or segmentation. We also measure newsletter performance, including openings, clicks and technical deliverability.
Legal basis
Processing of your email address is based on your consent pursuant to § 107 Telecommunications Act and Art. 6 para. 1 lit. a GDPR. Voluntary information and performance data are processed on the basis of legitimate interests for marketing purposes.
Storage / deletion
Your unsubscription is automatically recorded. Bike Citizens deletes personal data immediately unless legal obligations or legal claims require further storage. Performance data is stored for 3 months and then anonymised.
Recipients
The data is processed via our server infrastructure provider, our email provider and a specialised newsletter service provider.
Contact requests by form, email or telephone
Purpose
If you contact us by form, email or telephone, we process your name, contact details, request and any attached documents in order to respond to your request.
Legal basis
Processing is based on Bike Citizens’ legitimate interest in communicating with website and app users.
Storage / deletion
Data is deleted or anonymised when no longer needed, unless legal retention duties or legal claims require further storage.
Recipients
The data is processed via our server infrastructure provider and email provider.
Basic app functions
Scope of processing
The following data is collected and processed:
- device identifier
- device information including model, operating system version, installed app version and language
- connection data including IP address
- location data
- data regarding activated features
Purpose
Data is collected to enable the basic app functionality, establish a technical connection to our servers, improve our services and protect against misuse. Data is also used in aggregated form to promote cycling.
Legal basis
The legal basis is contract performance for necessary services and legitimate interest for service improvement and protection against misuse.
Storage period
Data is deleted or anonymised when our services are no longer used. Logfile data is deleted after 180 days. You can prevent GPS location processing by disabling location in the app, although some services may then be unavailable.
Recipients
The data is processed via our server infrastructure provider. An installation-related device identifier is processed via Google Firebase Cloud Messaging for push notifications.
Analytics services
Purpose
To improve our services and for statistical purposes, we use Google Analytics for Firebase and Firebase Crashlytics in addition to direct data processing. Data includes frequency and type of use of app screens and functions and is transmitted in pseudonymised form. IP addresses are shortened in direct processing.
Legal basis
The legal basis is legitimate interest.
Storage / deletion
Device identifiers are stored for 14 months and then deleted.
Recipients
The data is processed via our server infrastructure provider and/or Google.
Setup of a user account
Purpose
Bike Citizens collects and processes the data entered during registration to create a user profile. A user profile allows you to:
- restore in-app purchases and activated features on multiple devices
- access your data, such as recorded GPS tracks or stored routes, on multiple devices and online
- have a contact option so we can inform you about relevant aspects of the app; this is not used for marketing
- participate in campaigns and challenges, create your own challenges if enabled and accept or manage invitations
Legal basis
The legal basis is the provision of our services as part of contract performance. After unsubscribing, data may continue to be stored on the basis of legitimate interests for documentation purposes.
Storage / deletion
Data is deleted or anonymised when no longer needed unless legal retention obligations or legal claims require further storage.
Recipients
The data is processed via our server infrastructure provider and email provider.
In-app purchases
Purpose
Bike Citizens processes data provided when ordering in-app products, such as invoice and payment data, together with a device identifier or user profile, to enable and allocate purchases.
Legal basis
Processing is necessary for the conclusion and fulfilment of online purchase contracts and for compliance with statutory retention obligations.
Storage / deletion
Data is deleted or anonymised when no longer needed. Order and transaction data is stored according to statutory retention obligations and in any case for seven years.
Recipients
Data is collected with the relevant in-app marketplaces and processed via our server infrastructure provider.
Campaigns and challenges
Campaigns and challenges
Our apps allow users to voluntarily join campaigns and challenges. Campaigns may be offered by Bike Citizens alone or together with contractual partners. Challenges may also be created and managed by premium users if this function is enabled.
We process personal data to enable participation, implementation, display, evaluation and traceability, including username or nickname, participation, time of joining, points, kilometres, rankings, results and winner information.
If you join a campaign or challenge, your username or nickname and result, ranking and winner data may be visible to other participants. If you participate in a challenge created by a premium user, that user may see your participation, time of joining, nickname, results, points, kilometres, ranking and whether you have won. Your email address will not be disclosed.
The challenge creator may send challenge-related messages. This function is not intended for advertising or non-challenge communication. External persons may be invited to certain challenges and can participate only after registration and acceptance of the Terms and Conditions and this Privacy Policy.
The legal basis is your consent when joining. Technical processing for security, prevention of misuse, message delivery and traceability is based on legitimate interests. Recipients may include other participants, contractual partners and, for premium challenges, the respective premium user.
Unless otherwise stated, data is processed via our server infrastructure provider, email provider and technical service providers.
Competitions, prizes and winners
In campaigns and challenges, you may participate in competitions, rankings or other promotions and win prizes or benefits. Processing or transmission to partners may be necessary to implement, evaluate and handle these promotions. Your username or nickname is generally used to display winners.
The legal basis is contract performance; publication or disclosure of winner data is based on your consent or, where required, implementation of the promotion.
Storage / deletion
Data is deleted or anonymised when no longer needed unless retention obligations or legal claims require further storage.
Recipients
Unless otherwise stated, data is processed via our server infrastructure provider and email provider.
Aggregated information
We use data collected through the basic app functions, including location coordinates, to perform statistical calculations and produce aggregated data that cannot identify individuals. These data support cooperation with public and private bodies to promote cycling and improve cycling infrastructure.
Your rights in relation to data processing
The GDPR grants you certain rights.
Withdrawal of consent
You may withdraw consent at any time without affecting prior lawful processing.
Right of access
You may request information about origin, categories, storage period, recipients, purpose and type of processing.
Rectification and deletion
You may request correction, completion or deletion of your data, subject to legal duties or claims.
Restriction
You may request restriction of processing pending clarification.
Objection
You may object in specific justified situations.
Portability
You may receive your data in a machine-readable format or request transfer to a third party where technically possible.
Complaint
You may lodge a complaint with the data protection authority.
Contact
To exercise your rights, contact us in writing or at info@bikecitizens.net.
General
We reserve the right to amend this Privacy Policy in accordance with applicable law. Please visit this page regularly. For questions, contact info@bikecitizens.net.
Use of non-personal data
We use non-personal data for research, statistics and improvement of user experience, as well as metadata technically associated with use of our goods or services.
Third-party websites
This Privacy Policy does not apply to third-party websites not operated by us. We recommend reading their privacy notices.