Privacy statement

Controller and contact

The controller is:

Website delivery and security logs

UpCloud Oy hosts the website for the operator in its Frankfurt, Germany data centre. Using the website necessarily processes network and request data such as the IP address, request time, method, response status, and basic client information.

Operator-controlled application and reverse-proxy logs support reliable delivery, fault diagnosis, and abuse or security investigations. They are deleted after seven days. Full URLs, query parameters, cookies, and authorisation data are omitted or redacted from application HTTP logs. This retention period does not automatically govern provider-controlled records covered by UpCloud’s own contract and privacy information.

The legal basis for operator-controlled processing is Article 6(1)(f) GDPR: the legitimate interest in providing and protecting a reliable Bikes Local website.

Delivery of Bike images

All displayed Bike images are hosted by OVHcloud in its Frankfurt data centre. OVHcloud is part of OVH Groupe SA. Your browser requests an image directly from OVHcloud when a view displays a Bike with an image. OVHcloud consequently processes technically necessary network and request data, particularly the IP address, request time, requested object key, client information and, depending on the browser's referrer policy, referrer information.

The purpose and legal basis under Article 6(1)(f) GDPR are reliable and efficient delivery of the requested Bike images. Bikes Local does not use image requests for tracking or profiling and sets no cookies for them. Records controlled by OVHcloud are governed by OVHcloud's contractual and privacy information; the seven-day period for operator-controlled application logs does not automatically apply to those records.

Location selection and local browser storage

You may use your browser's location functionality to determine your current position. Browser permission is requested only after that action. Accepted coordinates, their source, and a visible place label are stored in the first-party preference cookie offer-search.location for no more than 24 hours.

The cookie is functionally necessary to retain the search centre across page loads. It is limited to the site, protected in transit over HTTPS, and not sent with cross-site requests. Bikes Local browser code can read it to restore the search centre; you can remove it through your browser's website-data controls. It contains neither the raw address query nor selected Bikes, Offers, radius, or match mode. Search radius and match mode may also be kept in tab-scoped session storage and disappear with the browser session.

Storage in the browser is used under the necessity exception in German telecommunications data-protection law and does not require a consent banner. Processing your browser-determined position is based on your explicit permission under Article 6(1)(a) GDPR. You can withdraw that permission in your browser settings and remove the retained location by clearing the website’s data. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Rejecting necessary storage may prevent the affected feature from resuming correctly. Processing a place query and accepted search centre needed for the explicitly requested search is otherwise described under Article 6(1)(f) GDPR.

Address geocoding

An address or place query submitted to the Bikes Local website is sent through its API to Photon, operated by komoot GmbH in Germany, and matched against OpenStreetMap data. The submitted query and requested result language are sent from the Bikes Local server to Photon; your browser does not connect directly to Photon. Bikes Local does not forward the visitor browser IP; Photon sees the Bikes Local server connection instead.

The Bikes Local API stores normalized search queries, language keys, and returned geocoding responses in memory for up to 24 hours. The 24-hour period starts when an entry is inserted into the cache; a cache hit refreshes recency without extending that period. Neither the submitted address or place queries nor the returned coordinates are logged. The upstream URLs called and the content returned by Photon are also not logged. The purpose is to return selectable location candidates. The legal basis is Article 6(1)(f) GDPR: the operator’s and user’s aligned interest in performing the explicitly requested place search.

Map tiles

Wide offer-search layouts display and load the map immediately. Narrow layouts load tiles when the map view is opened. The Bikes Local website's default tile source is https://tile.openstreetmap.de/{z}/{x}/{y}.png, operated by FOSSGIS e.V., the German OpenStreetMap association. Your browser connects directly to that tile service and transmits technically necessary request data, including your IP address, request and referrer information, and the tile coordinates representing the viewed map area and zoom level.

The map retains visible OpenStreetMap and FOSSGIS attribution and a link to the provider's current privacy information. The purpose and Article 6(1)(f) GDPR basis is supplying the displayed or requested map view.

Recommendation session

The guided recommendation uses a pseudonymous session cookie. The cookie is limited to the site, protected in transit over HTTPS, not readable by browser scripts, and not sent with cross-site requests. It contains a random session token, not your answers. A one-way token hash and your answers are stored server-side for up to 14 days.

The first-party preference cookie recommendation_intro_acknowledged records whether you acknowledged the introduction for 365 days from the last acknowledgment. It prevents the introduction from appearing again before the first question of a new recommendation. Resetting a recommendation does not remove the cookie. If you remove the cookie, the introduction may appear at the beginning of a new recommendation; an ongoing recommendation is not interrupted.

Answers describe bike-use preferences such as intended use, carrying needs, and required surfaces. They do not include an account identity or special-category data. A deterministic recommendation algorithm evaluates those preferences to produce informational Recommendation Category suggestions and, after category selection, recommends specific Bikes with preview images and counts. Recommendations sort or suggest results and do not determine availability, price, access, or contract formation.

You can delete the session and answers through the existing restart/delete action. The legal basis is Article 6(1)(f) GDPR: providing the explicitly requested recommendation and preserving progress for a limited period. See the »Right to object« section. The feature cannot operate without processing the answers it needs.

Contact by email

Messages to hello@bikeslocal.eu process the sender’s address, message content, metadata, and any information voluntarily included by the sender so the operator can answer and manage the enquiry.

Infomaniak provides the mailbox and processes correspondence in Switzerland. Switzerland is outside the EEA; transmission to Switzerland is based on the EU adequacy decision for Switzerland. See Infomaniak’s privacy information and Infomaniak’s GDPR information.

Ordinary correspondence is deleted no later than six months after the enquiry is resolved. Information may be retained longer only when required by law or necessary to establish, exercise, or defend legal claims. The ordinary legal basis is Article 6(1)(f) GDPR for responding to the exchange sought by the sender. Article 6(1)(b) applies only when a message genuinely concerns steps requested before a contract or an existing contract.

No tracking and no further processing

The Bikes Local website does not use visitor accounts, advertising, marketing pixels, behavioural analytics, social embeds, externally hosted fonts, or non-essential tracking cookies.

Your rights and complaints

Subject to the legal requirements, you have rights of access, rectification, erasure, and restriction. Where applicable, you may request data portability. If processing is based on consent, you may withdraw consent at any time with effect for the future; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You may contact any competent supervisory authority. The operator’s locally competent German authority is Bayerisches Landesamt für Datenschutzaufsicht.

No statutory or contractual obligation requires you to provide location, recommendation, or contact data. Without the data a requested feature or response needs, it cannot be supplied.

Right to object

You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR (legitimate interests). After an objection, the operator no longer processes the affected data unless compelling legitimate grounds for the processing override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If you object to processing data that a feature you requested needs, that feature cannot be provided.