Privacy policy

Last updated: 28 August 2026

This notice explains how BikeLock processes personal data through bikelock.app, the waitlist and the testing programme. Ride data from the BikeLock app remains on the device and is not disclosed to BikeLock.

Controller

BikeLock is the controller for the processing described in this notice. Questions about privacy and requests to exercise data protection rights can be sent to join@bikelock.app.

Categories of personal data

Depending on how the website is used, BikeLock may process the following categories of personal data:

• contact data: the email address provided;
• preferences: phone platform and any application to join the testing programme;
• source and campaign data: referring page, campaign parameters, advertising identifiers and page variant;
• pseudonymised usage data: pages viewed, session and event data, browser type, device type and country at a general level;
• technical data temporarily required for security, fraud prevention and error diagnosis, including the IP address;
• the recorded cookie preference and, only after consent, advertising and conversion data.

The waitlist is intended for adults. BikeLock does not request a child's name, location or other identifying information.

Purposes and legal bases

• Waitlist: to record a signup and provide a single launch notification. Processing is necessary to provide the service requested by the data subject and to take pre-contractual steps at their request.
• Testing programme: to record and assess a voluntary application to join the test group. The legal basis is consent, which may be withdrawn at any time.
• Website analytics and campaign attribution: to measure use, improve the website, assess communication channels and prevent duplicate signups. The legal basis is BikeLock's legitimate interest in developing and securing the service effectively. Analytics are configured without analytics cookies and do not track visitors across other websites.
• Security and abuse prevention: to protect the website, limit automated requests and investigate service failures. The legal basis is BikeLock's legitimate interest in maintaining a reliable and secure service.
• Advertising measurement: to set and read advertising cookies and measure conversions. This processing takes place only with prior consent.

Recipients and international transfers

Personal data is accessible only to BikeLock and service providers that supply hosting, data storage, website analytics or technical support. They receive only the data required for their role and, where required, are contractually bound as processors.

After consent, advertising and conversion data may be shared with Google. Service providers may process data outside the European Economic Area. Where this occurs, BikeLock relies on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Further information about these safeguards is available on request. BikeLock does not sell personal data.

Retention

• waitlist and testing programme data: no later than one year after launch, or earlier following a valid deletion request;
• pseudonymised analytics and campaign data: for as long as needed to assess trends and improve the website; this need is reviewed periodically and the data is deleted when it is no longer required for those purposes;
• technical security data: no longer than necessary for security and incident investigation;
• the cookie preference: until the choice is changed or website data is removed from the browser;
• data processed by an advertising service after consent: in accordance with that service's applicable settings and retention periods.

Choice and automated decision-making

An email address and phone platform are required to process a waitlist signup. Participation in the testing programme and consent to advertising cookies are optional. Refusing advertising cookies does not restrict access to the website. BikeLock does not use the data described above for automated decision-making that produces legal or similarly significant effects.

Data protection rights

Where applicable, data subjects may request access to, rectification or erasure of, restriction of processing of, and portability of their personal data. They may also object to processing based on legitimate interests. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Requests can be submitted to join@bikelock.app. BikeLock may request additional information to verify the requester's identity and will generally respond within one month. A complaint may also be lodged with the Dutch Data Protection Authority.