Privacy Policy

The controller within the meaning of Article 4(7) GDPR for the Velohood platform is:

No data protection officer has currently been appointed. We regularly review whether the statutory appointment criteria are met. Privacy requests may be sent directly to the email address above.

We process personal data lawfully, fairly and transparently and observe purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. Depending on the operation, processing is based on:

• Article 6(1)(a) GDPR for voluntary consent, particularly optional analytics, performance measurement and web push;
• Article 6(1)(b) GDPR for registration, platform use, initiating and performing bookings, workshop orders and related support;
• Article 6(1)(c) GDPR for statutory retention, evidence and disclosure duties;
• Article 6(1)(f) GDPR for IT security, fraud and abuse prevention, moderation, legal defence, internal aggregate listing and business statistics and reliable platform operation.

Where interests are balanced, we consider the nature, scope and foreseeability of processing, our relationship with the person and possible effects. We do not intentionally request special-category data under Article 9 GDPR; users should not place such data in free-text fields, chats or uploads.

Data generally comes from users, their devices, interactions with other users or the services identified below. We may process:

• identity and account data: name, email, optional phone number, profile image, role and account status;
• business data: company or workshop name, addresses, contact and billing email, phone, website, VAT ID, opening hours, services, staff and inventory;
• listing and location data: bicycle description, model, category, price, deposit, availability, city, postcode, address, coordinates and images;
• transaction data: booking period, prices, accessories, status, cancellation, frozen contract text, contract version, SHA-256 integrity value, acceptance times, handover and condition records; IP addresses may be logged for handover and condition confirmations;
• workshop data: problem description, bicycle and serial number, photos, appointment, pickup address, job card, parts, estimate, invoice, payment status, pickup code and collector name;
• communications and content: chats, support messages, reports, reviews, posts, comments, likes, favourites and event participation;
• interaction and statistics data: aggregate bicycle and workshop page-view counts and transaction-specific business statistics derived from platform activity;
• payment and accounting data to the extent described in section 8;
• technical data: IP address, timestamps, request and correlation IDs, browser, operating system, device, referrer, URL, error and security events;
• consent and preference data: language, theme, business view, push endpoint and privacy choice.

When the platform is accessed, web servers and hosting providers process technically necessary connection data, including IP address, date and time, requested resource, referrer, browser and device information, response status, transferred volume, errors and security events. This is necessary to deliver content, prevent attacks, diagnose errors and maintain availability under Article 6(1)(f) GDPR.

For selected public authentication and geocoding endpoints, the IP address and requested path are processed in a short-lived, in-memory rate-limit counter. Behind the deployment proxy, the transmitted first client IP may be used. Counters are not stored permanently and are removed after the security window.

Rate limits, CSRF protection, role- and process-based access checks, timing-aligned responses for verification and password-reset requests and audit entries protect accounts and transactions. Request IDs can trace an operation across technical components. These records are not combined for advertising.

Registration uses name, email and password; phone and profile image are optional. Business accounts may additionally provide company name, type and address. Passwords are stored only as irreversible BCrypt hashes. Verification and reset tokens expire; password-reset tokens are stored only in hashed form.

Each successful new login increments the account token version, invalidating previously issued session tokens. Signing in on another device may therefore end the earlier session. Processing supports account creation, login, email verification, sessions, access recovery and revocation of compromised tokens under Article 6(1)(b) GDPR, supplemented by Article 6(1)(f) GDPR for security.

Public profiles and bicycle or workshop listings are published so users can find, compare and contact providers. Visible information may include a name or business name, images, description, city, prices, availability, services, ratings and public community content. A workshop's business address may form part of its public profile. The public search map shows only a position rounded to approximately one kilometre. A bicycle's exact pickup address and stored exact GPS coordinates remain hidden in public search and detail views.

Bicycle and workshop page views are counted for internal listing and business statistics only when a signed-in user views another provider's offer. Anonymous requests, technical metadata requests and the provider's own views do not increase the count. Only the aggregate count is retained, not a list of viewers. Favourites remain account-linked to provide the requested saved list.

The legal bases are Article 6(1)(b) GDPR and, for reputation, listing quality and trust, Article 6(1)(f) GDPR. Search engines may index public pages, and their cached copies may take time to update after removal.

Rental requests use the parties, bicycle, period, price, deposit, accessories, status, messages, cancellation reasons, handover and return times and one-time codes. When a request is accepted, an immutable contract record is created. It may contain party names and emails, provider status and business contact details, bicycle title, model, category, serial/frame number, asset code, frame size, gears, e-bike battery and stated range, included and booked accessories, full pickup location, period, total price, deposit, payment method and, for business lessors, the rental and cancellation policies frozen before acceptance. The complete bilingual contract text, version, SHA-256 integrity value and both parties' acceptance times are also stored. We do not store an IP address for the contract-acceptance click.

The renter sees the full bicycle pickup location, including address and GPS coordinates, only after the request is accepted. It remains hidden while a request is pending or rejected and where cancellation occurs before acceptance. Once accepted, the exact address remains part of the protected contract snapshot and may remain accessible to the parties after a later cancellation for the applicable retention period. The owner can continue to access the location entered in their protected area.

Condition records may include mileage, damage, notes, checkpoints, photos, signature times and IP addresses of confirming parties. Confirmation of physical pickup and return may also record the confirming party's time and IP address. They support contract performance, evidence, damage clarification and legal defence under Article 6(1)(b) and (f) GDPR; Article 6(1)(c) GDPR also applies where retention is legally required.

Velohood facilitates the transaction. Each party receives data needed to perform it and may become independently responsible when processing that data outside the platform for its own purposes.

For bicycle bookings we process the selected payment method (cash, direct PayPal or card on site), payment status, confirmation times and an optional PayPal receipt uploaded by the renter. PayPal payments occur outside Velohood directly between the parties; PayPal acts as an independent controller under its privacy statement.

An uploaded receipt may contain a name, PayPal identifier or email, amount, date, transaction ID and anything the user did not redact. Remove irrelevant balances, private messages and complete payment-instrument details. Cloudinary stores the receipt; only authorised booking parties and, in a dispute, authorised administrators can access it.

Workshops can create estimates and invoices containing invoice number, line items, net, tax and gross totals, issue and due dates, method, payment status and date. The bases are Article 6(1)(b), (c) and (f) GDPR together with commercial and tax duties.

Repair requests may use customer, workshop, requested service, problem description, photos, preferred date, collection option and address, bicycle data and chat. Diagnosis, labour, assigned staff, parts, stock movements, estimate, customer decision, invoice, payment, pickup code and pickup confirmation may follow.

Workshop owners and authorised staff receive role- and job-specific access. Processing relies on Article 6(1)(b) GDPR, with Article 6(1)(f) for security, capacity planning, evidence and legal defence, and Article 6(1)(c) for invoice retention.

In-app chats and support messages are stored and shown to authorised parties. Resend sends transactional emails such as verification, password reset and important process notices and processes recipient, subject, content and delivery metadata. The bases are Article 6(1)(b) GDPR and Article 6(1)(f) for security notices.

Workshop chats are loaded in pages and older messages can be fetched incrementally. Support views currently return the latest 100 messages in a case. These display limits do not alter the retention and deletion periods in section 18.

Web push is activated only after browser permission. We store endpoint, encryption key, authentication secret and optionally user agent. Delivery uses the browser or operating-system push provider, such as Apple, Google, Microsoft or Mozilla. The bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent can be withdrawn in profile and browser settings.

Posts, comments, likes, event details, attendance and reviews provide community and trust functions. Depending on the feature, content is public or visible to signed-in users; organiser and participant names and profile images may be shown to other participants.

Reviews are tied to completed transactions to discourage manipulation. After account deletion they may remain attached to an anonymised profile where necessary for integrity, trust and legal defence. The bases are Article 6(1)(b) and (f) GDPR.

Support cases and reports include contact data, subject, category, description, messages, status, priority, assignment, deadlines and affected users, listings or content. Administrators may document approvals, restrictions, suspension, deletion or dispute handling. Audit logs contain actor, action, target, timestamp, reason, metadata and request ID.

This supports requests, security, abuse prevention, accountability, legal obligations and defence under Article 6(1)(b), (c) and (f) GDPR. Reports remain confidential unless investigation or law requires disclosure.

The backend first uses the OpenStreetMap Foundation's Nominatim service to convert places and addresses to coordinates. If Nominatim is unavailable or has no match, the backend uses the Photon public geocoder operated by komoot GmbH as a low-volume fallback and sends only city and postal code, not the street address. Search place, time, server IP and user agent are transmitted to OSMF or komoot under Article 6(1)(b) and (f) GDPR. For the public search map, stored bicycle coordinates are rounded server-side to two decimal places; exact values are not delivered.

Interactive maps primarily load tiles from CARTO and use OpenStreetMap as fallback. The browser connects directly and transmits IP, browser/device details, time, referrer and requested tiles to CartoDB Inc., USA, or OSMF, United Kingdom. See the CARTO Privacy Notice, OSMF Privacy Policy and komoot Privacy Policy.

Vercel Web Analytics and Speed Insights load only after your explicit selection. Without consent neither component runs.

• Web Analytics: aggregated page views, timestamp, path, filtered query parameters, referrer, approximate region, browser, operating system and device. Vercel uses no third-party cookies and discards the request-derived visitor hash after 24 hours.
• Speed Insights: real-world loading, rendering and interaction metrics, URL, device, browser and technical context used to improve the site.

Vercel Inc., USA, is the provider. The bases are Article 6(1)(a) GDPR and, for device access, Section 25(1) TDDDG. Change your choice through “Privacy settings” in the footer. See Vercel Analytics Privacy and the Vercel Privacy Notice.

Strictly necessary storage is based on Section 25(2)(2) TDDDG and Article 6(1)(b) or (f) GDPR. Optional storage starts only after consent.

We do not sell or rent personal data. Access is limited to those needing it for the stated purposes:

Where Article 28 GDPR applies, processors are bound by data processing agreements. Authorities, courts, tax or legal advisers receive data only where legally required or necessary to establish, exercise or defend claims.

Some providers process data outside the EU/EEA, particularly in the USA, Israel or the United Kingdom. Transfers under Articles 44 et seq. GDPR rely on an adequacy decision, valid EU-US Data Privacy Framework certification, EU Standard Contractual Clauses with transfer assessment, or a statutory derogation. UK and Israel adequacy and provider status are reviewed regularly.

Residual government-access risks may remain. Where possible, data is minimised, encrypted or stored in European regions.

Data is kept only while the purpose, law or protection of claims requires it, then deleted or effectively anonymised. The principal periods and criteria are:

A legal duty, authority order, evidence hold or concrete claim can extend a period; processing is then restricted to that purpose.

Delete an account in profile settings. Deletion is temporarily blocked while an active rental, open dispute or ongoing workshop job exists; it can be requested again after closure.

Deletion anonymises email, name, phone, profile image, company name and business address; revokes sessions; deactivates listings and workshop profiles; and releases the original email for registration. Transaction, contract, invoice, dispute and audit records remain only where legal duties or legitimate evidence needs require it and are separated from direct profile identifiers or anonymised where possible.

Subject to statutory conditions, you have rights to access and a copy (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), recipient notification (Article 19), portability (Article 20), objection (Article 21), withdrawal of consent (Article 7(3)) and complaint to a supervisory authority (Article 77 GDPR).

Send requests to support@velohood.de. We may request proportionate identity evidence to prevent unauthorised disclosure. We normally respond within one month, subject to Article 12(3) GDPR.

Consent can be withdrawn prospectively at any time without affecting prior lawfulness. Change analytics and performance in the footer; disable push in profile and browser settings.

You may complain to a data protection authority. The authority normally responsible for the controller's location is:

You may alternatively complain where you habitually reside or work, or where the alleged infringement occurred.

Fields marked mandatory are necessary for the account, booking, contract or workshop job. Without them, that function or contract cannot be provided. Optional information can generally be omitted.

There is no solely automated decision-making, including profiling, producing legal or similarly significant effects under Article 22 GDPR. Sorting, filters, status automation and security limits are not such decisions.

The platform is not directed at children. Rental, payment and workshop contracts require legal capacity. Minors may use Velohood only where legally permitted and, when required, with guardian consent. If child data is identified without a sufficient basis, we promptly investigate and delete or restrict it.

Measures under Article 32 GDPR include TLS transmission, encrypted database connections, BCrypt password hashes, HttpOnly/Secure cookies, CSRF protection, role- and process-based access, gates for private pickup and booking data, token revocation on new login or detected refresh-token reuse, rate limits, security logging, minimisation and separated access areas.

No internet transmission or storage is risk-free, so controls are reviewed as risks, technology and the system change. Reportable breaches are notified under Articles 33 and 34 GDPR.

We update this policy when functions, providers, law or processing materially change. The version and date published here apply; registered users may also receive in-platform or email notice of material changes.

Send questions and privacy requests to support@velohood.de or the postal address in section 1.