Privacy policy
Bikekey ApS (hereinafter “we” or “us”) respects your privacy, and we protect your personal data. The purpose of this Privacy Policy is to inform you about how we collect and process your personal data when you buy our products and services, use our services, visit our website, and communicate and otherwise interact with us, and to inform you of your rights.
This Privacy Policy is divided into topics. You can access each topic below by clicking on it.
1. WHO IS THE CONTROLLER?
The data controller for the activities described in this Privacy Policy is:
If you have questions about the Privacy Policy, you are welcome to contact us by email: support@bikekey.com.
If you visit our pages, communicate or otherwise interact with us on social media, such as Facebook or other platforms, we encourage you to read the specific privacy policies that apply to and can be accessed on those media and platforms. You should be aware that we may be joint controllers with the provider of the social media platform in question.
2. WHAT INFORMATION DO WE COLLECT AND HOW?
Below, we have set out the types of personal data we may collect about you and how we collect it. In section 3, we have included an overview explaining for which purposes and on which legal bases we process your personal data.
We may collect, process, store and disclose different types of personal data about you. We have grouped them and given examples as follows:
- A
Identity data
includes name, date of birth, MitID and customer number.
- B
Contact data
includes email, phone number and address.
- C
Transaction data
includes information about products and services you have purchased from us or use, and information about payments to and from you.
- D
Profile data
includes information about your purchase and order history, your interests, preferences, feedback and survey responses, demographic information, your participation in contests and activities on our website and social media platforms such as Facebook.
- E
Technical data
includes your IP address, your login data and time, browser type and version, time zone and location, and other information about the devices you use to access our website and platforms.
- F
Usage data
includes information about how you use and interact with our website and social media platforms such as Facebook.
- G
Marketing and communication data
includes your preferences for receiving marketing from us and our partners, as well as your preferred means of communication.
- H
CPR number
- I
User data
includes information about your bikes, as well as other documents and information registered in connection with your use of our platforms.
In most cases, we receive the information from you directly when you visit our website or interact with us on social media, are registered as a customer, buy our products and services, request to receive marketing from us or otherwise communicate with us. We may also receive information from your insurer.
When you use our website and platforms, we may automatically collect technical data and usage data. We collect this information using cookies and similar technologies. We may also receive Technical Data about you if you visit other websites or social media that use our cookies. We only use cookies – other than technically necessary cookies – if you have given your consent to this. You can find more information in our cookie policy https://www.bikekey.com/cookiepolitik.
3. PROCESSING PURPOSES AND LEGAL BASIS
We only process your personal data when the law allows it. Most often, we will process your personal data in the following cases:
- i.
If it is necessary for the performance of a contract we are about to enter into or have entered into with you, pursuant to GDPR Article 6(1)(b).
- ii.
If it is necessary for compliance with a legal obligation pursuant to GDPR Article 6(1)(c), or if necessary for the establishment, exercise or defense of legal claims pursuant to GDPR Article 9(2)(f).
- iii.
If you have consented pursuant to GDPR Article 6(1)(a) or 9(2)(a) or § 11(2)(2) of the Danish Data Protection Act (databeskyttelsesloven).
- iv.
If it is necessary for the purposes of our (or a third party’s) legitimate interests, and your interests and fundamental rights do not override those interests, pursuant to GDPR Article 6(1)(f).
Below, we have set out an overview of the ways we plan to process your personal data and the legal basis we rely on for the processing. We have also stated what our legitimate interests are, where relevant.
Purpose/Activity
Types of personal data
Legal basis for processing and our legitimate interests
Purpose/Activity
To manage and perform a contract with you, including to:
- oprette dig som ny kunde,
- give dig adgang til køb af vores produkter og tjenester
- bestille og levere dine produkter og tjenester til dig
- administrere og inddrive betaling for vores produkter og tjenester
- give dig kundefordele, yde kundeservice og support, herunder håndtere klager
- og generelt at overholde vores forpligtelser og udøve vores rettigheder i henhold til vores aftale med dig
Types of personal data
Purpose/Activity
To analyze and improve our business processes and methods
Types of personal data
Legal basis for processing and our legitimate interests
Necessary to pursue our legitimate interest in analyzing and improving our business, including our products and services
Purpose/Activity
To enable you to access and use our website
Types of personal data
Legal basis for processing and our legitimate interests
Necessary to pursue our legitimate interest in giving you access to our website
Purpose/Activity
To enable you to communicate with us on the website, by email, social media or otherwise, and to enable you to take part in contests and surveys
Types of personal data
Legal basis for processing and our legitimate interests
Necessary to pursue our legitimate interest in communicating with you so that you can get any questions answered and take part in the contests and surveys that interest you
Purpose/Activity
To send newsletters or other marketing
Types of personal data
Legal basis for processing and our legitimate interests
Necessary to pursue our legitimate interest in sending you relevant marketing.
We only send marketing by email or SMS if you have given us your consent, or if it is otherwise permitted under the Danish Marketing Practices Act (markedsføringsloven).
Purpose/Activity
To manage and protect our business and website (including troubleshooting, data analysis, testing and system maintenance)
Types of personal data
Legal basis for processing and our legitimate interests
Necessary to pursue our legitimate interest in running our business, providing administration and IT services, network security and preventing fraud
Purpose/Activity
To use data analytics to improve our website, products, services, marketing, customer relationships and experiences
Types of personal data
Legal basis for processing and our legitimate interests
Your consent
We only use cookies – other than necessary cookies – if you have given your consent to this.
Purpose/Activity
To deliver relevant and targeted marketing, ads and website content to you on our and third-party sites, and to measure and understand the effectiveness of the marketing
Types of personal data
Legal basis for processing and our legitimate interests
Your consent.
We only use cookies – other than necessary cookies – if you have given your consent to this.
Purpose/Activity
To share your relevant data with your insurer(s). When you link your profile or a bike to an insurer, we enable the insurer to see relevant data. And to share reports documenting whether the insurers’ members have registered information about their insured items with Bikekey.
Types of personal data
Legal basis for processing and our legitimate interests
Performance of a contract with you, or taking steps at your request prior to entering into a contract.
Purpose/Activity
Settling accounts with your insurer.
Types of personal data
Legal basis for processing and our legitimate interests
Performance of a contract with you, or taking steps at your request prior to entering into a contract.
Purpose/Activity
To collect the information required by the police and disclose it to the police in order to report a bike theft. We only disclose your personal data to the police if you ask Bikekey to report your bike stolen to the police.
Types of personal data
Legal basis for processing and our legitimate interests
Your explicit consent.
Where we have relied on our legitimate interest as the legal basis for processing personal data, we have carried out a balancing test to ensure that your interests or rights and freedoms do not override our legitimate interests. Contact us if you would like to receive more information about our balancing tests.
4. RECIPIENTS OF PERSONAL DATA
We disclose your personal data to the insurers that pay in full or in part for your Bikekey services. If you ask us to file a police report on your behalf, we may also disclose your personal data to the police. In addition, we entrust personal data to our trusted suppliers, who provide services to us and process the data on our behalf in accordance with our instructions. These suppliers may, for example, provide:
Hosting and IT ops
(servers, databases, backups, maintenance)
Payment systems and accounting
(payment processing, invoicing and bookkeeping)
Communication and support
(email delivery, support and ticket systems, customer service)
Marketing and social media
(advertising, campaigns, management of our social media profiles, newsletters)
Analytics and statistics tools
(usage data, behavioral analytics, technical metrics)
Distribution and delivery
(shipping and mail/parcel delivery)
Identity and security solutions
(e.g., MitID validation, mapping of bike location/registration)
These suppliers may have access to your personal data solely in order to provide the agreed services to us. We have entered into data processing agreements with all suppliers, and we ensure that they comply with applicable data protection legislation.
An updated list of our current sub-processors can always be requested by contacting us at support@bikekey.com.
5. THIRD-COUNTRY TRANSFERS
If it is necessary to transfer personal data to a third country or international organization located outside the EU/EEA, we ensure, before transferring the personal data to the third country or international organization in question, that the transfer of the personal data takes place in a way that provides sufficient guarantees that the personal data is protected.
In connection with the use of our suppliers and partners, your personal data may be transferred to third countries, including the USA. Such transfers may, for example, take place in connection with Amazon, Google, Microsoft, Active Campaign, Webflow, Freshworks and Meta. The transfer of your personal data takes place either on the basis of the EU-U.S. Data Privacy Framework, if the recipient is certified under it. If the recipient is not certified, the transfer takes place using the European Commission’s standard contractual clauses on data protection. In this connection, we also assess, prior to the transfer, whether supplementary measures must be implemented to ensure that the processing of the personal data continues to be subject to a level of protection equivalent to the level guaranteed in the EU, including under the General Data Protection Regulation, read in conjunction with the EU Charter of Fundamental Rights.
If you would like a copy of our standard contractual clauses, you can contact us at support@bikekey.com.
6. HOW LONG WE KEEP PERSONAL DATA
We store the personal data we collect for as long as we have a legitimate purpose for storing it. When we no longer have a legitimate purpose and a need to process your personal data, we delete or anonymize it.
5
years
Identity, Contact and Transaction Data are stored to document purchases you have made and agreements we have entered into, and to meet bookkeeping and tax obligations, for 5 years after the end of the year to which the purchase or agreement relates.
2
years
Profile, Marketing and Communication Data are kept for up to 2 years. If you have given your consent to receive marketing, we store your information until you withdraw your consent and for up to 2 years after the last time we used your consent to send marketing. If you withdraw your consent, we immediately stop sending marketing to you.
12
months
Technical data and usage data are stored for 12 months from the time of collection.
Information may be stored for a longer period if we are required to do so by law, or if storage is necessary for the establishment, exercise or defense of legal claims.
7. HOW TO EXERCISE YOUR RIGHTS
You have certain rights when it comes to the processing of your personal data. Below is an overview of your rights, how to exercise them, and any limitations on them.
In certain circumstances, you have the right to:
- 1
Request access to your personal data. This enables you to receive a copy of the personal data we have registered about you and to ensure that we process it lawfully.
- 2
Request rectification of personal data we have registered about you. This enables you to have incomplete or inaccurate information about you rectified.
- 3
Request erasure of your personal data. This enables you to ask us to delete or remove personal data if there is not a sufficient legal basis for continuing the processing.
- 4
Object to the processing of your personal data that we carry out on the basis of our legitimate interests (or those of a third party), on grounds relating to your particular situation that give rise to an objection. You also have the right to object at any time to our processing of your personal data for direct marketing purposes.
- 5
Request restriction of the processing of your personal data. This enables you to ask us to restrict the processing of your personal data to storage only, for example if you want us to establish its accuracy or our purpose for processing it.
- 6
Request the transfer of your personal data to another data controller (also known as data portability).
- 7
If our processing is based only on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
If you wish to exercise one or more of your rights, you are welcome to contact us at support@bikekey.com. We will handle your request in accordance with applicable data protection legislation.
You have the right to complain to your local supervisory authority if you are dissatisfied with how we process your personal data. In Denmark, you can complain to the Danish Data Protection Agency (Datatilsynet) – see here: https://www.datatilsynet.dk/borger/klage/saadan-klager-du.
8. CHANGES TO THIS PRIVACY POLICY
This Privacy Policy is updated from time to time to reflect the legal requirements applicable at any given time and our processing of personal data. We encourage you to visit our website regularly, where up-to-date information about our processing of personal data is always available.
If we make material changes to the privacy policy and you are registered as a customer, you will be notified by email before the change takes effect.