Responsible party, scope of application

This Privacy Policy provides information about the nature, scope, and purpose of the processing of personal data (hereinafter referred to as “Data”) within our online services. Unless expressly specified otherwise below, the content of this Privacy Policy applies equally to our website, social media channels, and our app (hereinafter collectively referred to asthe “Website”).

Our Data Protection Officer is
heyData GmbH
Schützenstraße 5
10117 Berlin
www.heydata.eu
datenschutz@heydata.eu.

General information on data processing
Scope of the processing of personal data

We only process the personal data of our users insofar as this is necessary to provide a functional online offering and to provide the services we offer.

Legal basis for processing

The processing of our users' personal data is generally carried out in accordance with one of the following principles:

Consent
When we obtain your consent to the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis for the processing.

Contract or Precontractual Measures
If the processing of personal data is necessary for the performance of a contract or precontractual measures, Article 6(1)(b) of the GDPR serves as the legal basis for the processing.

Legal Obligation
If we are required by law to process personal data, Article 6(1)(c) of the GDPR serves as the legal basis for such processing.

Legitimate Interest
If the processing of personal data is necessary to safeguard our legitimate interests or those of a third party, and your interests or fundamental rights and freedoms do not override those interests, Article 6(1)(f) of the GDPR serves as the legal basis for the processing.

If we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time with effect for the future without giving reasons.

Data erasure and storage duration

In principle, and unless otherwise stated, your personal data will only be stored until the purpose for which it was collected and stored no longer applies. In accordance with your consent, data may also be stored for longer as long as you do not revoke your consent.

Data may also be stored if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which we are subject. If data is stored on the basis of such a legal provision, its processing will be restricted accordingly, i.e. the data will no longer be processed for any other purposes for which it was collected.

Use of processors

Where required by law, we conclude agreements with processors on the processing of personal data on our behalf in accordance with Art. 28 GDPR.

When providing the services we offer, we use external service providers who, among other things, also process your personal data exclusively on our behalf. This is the case with payment service providers, newsletter dispatch service providers, as well as CRM and hosting service providers. Where required by law, we have concluded agreements with all such processors on the processing of personal data on our behalf in accordance with Art. 28 GDPR.

Transfer to third countries

Unless otherwise stated, all data processing operations take place within the EU or EEA states.

Data processing operations carried out by third-party providers established outside the aforementioned geographical area may be carried out in part or in full in the countries of the respective branch or in accordance with the respective data protection regulations.

Any transfer of personal data outside the EU or the EEA will only take place on the basis of an adequacy decision by the European Commission or with the application of appropriate safeguards, e.g. standard contractual clauses of the European Commission.

Use of data in general form when providing the website

When you visit our website, we automatically store usage-related data about the usage process, including information about the device you are using and the website from which you accessed our website (referring url). We collect this data to ensure the provision of our website to you. It is also used to analyze, store and evaluate user behavior anonymously and to continuously improve and develop the service. Further details on the systems used can be found in the sections on cookies and social media below. We only store your IP address in the log files for a limited period of time, insofar as this is necessary for security purposes.

Our legitimate interest, which justifies data processing in accordance with Art. 6 Para. 1 lit. f) GDPR, also lies in the aforementioned purposes.

Data processing on our website

Creating a User Account
On our website, you have the option to create a user account. To register, you must provide the following information: first name, last name, email address, and password.

We require the above-mentioned data to ensure that the user account functions as intended and can only be assigned to you. The collection and processing of personal data in this context is justified by the user contract that we conclude with you. If you do not provide us with this data, we will unfortunately not be able to set up a customer account for you and provide our associated services.

The basis for processing is Art. 6 (1) (b) GDPR.

After creating the account, you can enter further personal (and non-personal) details, such as address and payment details.

We require the above-mentioned data in order to provide you with certain functions of our online offer. The collection and processing of personal data in this context is justified by the user contract that we conclude with you. If you do not provide this data, certain functions of our portal may be restricted or not available to you at all.

The basis for processing is Art. 6 (1) (b) GDPR.

Booking Services at
When you use our website, you have the option to order various paid bicycle repair services and other services through the website. In this case, we collect the following personal data during the ordering process: first name, last name, or company name of the person placing the order and the billing recipient (if different), and billing address. You may voluntarily provide us with additional information. If this data is already stored in your user account, you do not need to provide it again.

This information is absolutely necessary in order to execute the contract you have concluded and to enable the associated communication. If you do not provide us with this data, we will unfortunately not be able to enter into a contract with you for a fee.

Payment data is not collected and stored by us, but directly by the payment service provider you have chosen to carry out the payment. We only receive information from the payment service provider as to whether the payment was successful.

The basis for processing is Art. 6 (1) (b) GDPR.

Contacting Us via Our Online Forms
When you contact us via one of our online forms, we only receive the personal data that you provide by entering it into the form. This typically includes: first name, last name, address, email address, phone number (optional), and any additional information you include in the message text.

This information is required in order to process your request and is also processed exclusively for this purpose. This is also our legitimate interest, which justifies the processing pursuant to Art. 6 (1) (f) GDPR.

If you do not provide us with the data marked as "mandatory" in the online form, we may only be able to process your request to a limited extent or not at all.

Further Processing Based on Legal Obligations
We also collect, store, and process personal data in connection with your use of our website and the offering or booking of services to the extent that we are required or authorized to do so by applicable legal provisions. This is the case, for example, with billing data that we need for proper accounting purposes. In such cases, we disclose or transfer data as necessary to tax authorities, advisors (such as tax advisors or auditors), and other billing agencies and payment service providers.

The basis for processing is Art. 6 para. 1 lit. c) GDPR.

Market analyses

In order to operate our business economically and to be able to identify market trends and the wishes of contractual partners and users, we analyze the data we have on business transactions, contracts, inquiries, etc. We process inventory data, communication data, contract data, payment data, usage data, metadata on the basis of Art. 6 para. 1 letter f) GDPR, whereby the data subjects include contractual partners, interested parties, customers, visitors and users of our online offer.

The analyses are carried out for the purpose of business evaluations, marketing and market research. In doing so, we can take into account information about users with details, e.g. on the services used. The analyses help us to increase user-friendliness, optimize our offer and improve business efficiency. The analyses are used solely by us and are not disclosed externally, unless they are anonymous analyses based on aggregated values.

The basis for processing is Art. 6 (1) (f) GDPR.

Use of cookies and other trackers

a) Description and Scope of Data Processing
To make your visit to our website more enjoyable and to enable the use of certain features, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted at the end of the browser session—that is, when you close your browser (so-called session cookies). Other cookies remain on your device and allow us or our partner companies to recognize your browser the next time you visit (persistent cookies).

You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or in general. You can also manually delete cookies from your end device at any time.

If cookies are not accepted, the functionality of our website may be restricted.

We use cookies in accordance with Art. 6 para. 1 lit. c) GDPR, insofar as this is necessary to fulfil a legal obligation to which we are subject, and, pursuant to Art. 6 para. 1 letter f) GDPR, to safeguard our legitimate interests in an optimized presentation of our offer, which predominate in the context of a balancing of interests.

We only set other cookies that allow us to monitor and evaluate user behavior for market analysis purposes if you have given us your consent in accordance with Art. 6 (1) (a) GDPR. These are cookies from third-party providers that are used when you use our services. For details, please refer to the following sections. Unless otherwise stated, the transfer of your data to third parties in the USA whose cookies are used via our website takes place within the framework of the EU-US Privacy Framework.

Unless expressly stated otherwise, we only use the following cookies and trackers with your consent. The basis for processing is therefore Art. 6 (1) (a) GDPR.

GOOGLE SERVICES
GOOGLE ANALYTICS


We use “Google Analytics,” a web analytics service provided by Google Inc. The information generated by the Google Analytics cookie regarding your use of our website is generally transmitted to and stored on a Google server in the United States. IP anonymization has been enabled on our websites, so that the IP addresses of users within member states of the European Union or in other signatory states to the Agreement on the European Economic Area are truncated by Google beforehand. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us with other services related to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. You can prevent the storage of cookies by adjusting the settings in your browser software; however, please note that in this case, you may not be able to use all features of this website to their full extent.

TARGET GROUP FORMATION
We use Google Analytics to display the ads placed by Google and its partners within advertising services only to users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited), which we transmit to Google (so-called "remarketing" or "Google Analytics audiences"). With the help of remarketing audiences, we also want to ensure that our ads correspond to the potential interest of users.

FACEBOOK (META) – SERVICES
META PIXEL
We use the Meta Pixel in connection with the technologies described below from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (“Facebook (by Meta)” or “Meta Platforms Ireland”). The Meta Pixel automatically collects and stores data (IP address, time of visit, device and browser information, as well as information about your use of our website based on events specified by us, such as visiting a webpage or subscribing to a newsletter), from which usage profiles are created using pseudonyms. To this end, when you visit our website, the Meta Pixel automatically sets a cookie that enables your browser to be recognized when you visit other websites via a pseudonymous cookie ID. Facebook (by Meta) will combine this information with other data from your Facebook account and use it to compile reports on website activity and to provide other services related to website usage, in particular personalized and group-based advertising.


The information automatically collected by Facebook (by Meta) technologies about your use of our website is usually transferred to a server of Meta Platforms, Inc, 1 Hacker Way, Menlo Park, California 94025, USA and stored there. There is no adequacy decision by the European Commission for the USA. If we are responsible for the transfer of data to the USA, our cooperation is based on standard data protection clauses of the European Commission. Further information on data processing by Facebook can be found in Facebook's privacy policy (by Meta).

FACEBOOK ANALYSES
As part of the Facebook Business Tools, statistics on visitor activity on our website are created from the data collected with the Meta Pixel about your use of our website. Data processing is carried out on the basis of an agreement on order processing by Facebook (by Meta). Their analysis serves to optimize the presentation and marketing of our website.

The processing of data by Facebook takes place within the framework of Facebook's data usage policy. Accordingly, general information on the display of Facebook ads can be found in Facebook's data usage policy: https://www.facebook.com/policy. Specific information and details about the Facebook pixel and how it works can be found in the Facebook help section: https://www.facebook.com/business/help/651294705016616. You can withdraw your consent to Facebook's data collection at any time. To set which types of advertisements are displayed to you within Facebook, you can also go to the page set up by Facebook and follow the instructions there on the settings for usage-based advertising: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are adopted for all devices, such as desktop computers or mobile devices.You can also object to the use of cookies for reach measurement and advertising purposes via the deactivation page of the network advertising initiative (http://optout.networkadvertising.org/) and also the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

b) Duration of Storage, Right to Object, and Option to Delete
Cookies are stored on the user’s computer and transmitted from there to our website or to the third parties mentioned above. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, you may no longer be able to use all of the website’s features to their full extent. The storage period and lifespan of individual cookies are specified in the respective privacy policies of the third-party providers linked below.

Newsletter

With the following information we inform you about the contents of our newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights of objection. By subscribing to our newsletter (either when creating a user account or separately), you agree to receive it and to the procedures described.

Content of the newsletter: We send newsletters, e-mails and other electronic notifications with advertising information (hereinafter "newsletter") only with the consent of the recipient or on the basis of legal permission.

Double opt-in and logging: Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registering you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that no-one can register with other people's e-mail addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored with the mailing service provider are also logged.

Legal Basis, Withdrawal of Consent, and Objection
The newsletter is sent based on your consent in accordance with Art. 6(1)(a) of the GDPR.

If we have collected your e-mail address as part of a booking on our website, we may send you e-mail messages about similar offers on our website as long as you have not objected to receiving such newsletters. The basis for this under German law is Section 7 (3) UWG.

You can object to receiving newsletters from us or revoke your consent at any time without incurring any costs other than the transmission costs according to the basic rates (i.e. the costs of your Internet provider, for example). We will inform you of your right to object when we collect your email address and in the respective newsletter. You will find a link to unsubscribe from the newsletter at the end of each newsletter.

Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

Right of Access - You have the right to request information about the personal data we process or store. 

Right to Rectification - You have the right to request that we correct or supplement any inaccurate or incomplete data concerning you.

Right to Erasure - Under certain circumstances, you have the right to request that we erase your data.

Right to Restriction of Processing - You have the right to request that we restrict the processing of your data under certain circumstances.

Right to Object - You have the right to object to the processing of your personal data under certain circumstances.

Right to Data Portability – You have the right to request that we transfer your personal data to another data controller or to you under certain circumstances.
Your Right to File a Complaint – Youmay also file a complaint with a data protection authority.

If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time, without giving reasons, to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.

Changes to this privacy policy

Due to the dynamic development of the Internet, new technologies and possibilities are constantly evolving. To ensure that you can also benefit from these possibilities and technologies, we reserve the right to amend this data protection declaration for the future when introducing new or additional services or when changing or expanding existing services or service elements.Insofar as the change to the data protection declaration only affects the use of data in general form and/or the use of data when concluding contracts and not also the use of data within the framework of a user account, the new data protection declaration shall apply from the date of its update on the website.A change to the privacy policy relating to the use of data already collected and stored for the sending of newsletters will only be made if this is reasonable for you. If and insofar as changes to the privacy policy relate to the use of the data already collected and used for sending newsletters, we will notify you in good time by e-mail, on our website or in another form. If no objection is raised within the specified period, you will be deemed to have accepted the amended privacy policy. We will inform you in the notification of your right to object and the significance of the objection period.