Privacy Policy

The data controller under GDPR is: CycleFit Europe Bensheim, Germany Email: info@bikefiteurope.com

We collect and process the following personal data: • Name and email address (for bookings and notifications) • Phone number (optional, for appointment reminders) • Your intake form answers, including health-adjacent information (e.g. complaints or injuries). We process health-adjacent information only with your explicit consent (Art. 9(2)(a) GDPR) and only to prepare and deliver your appointment. • Payment data (processed exclusively via Stripe — we do not store card details) • IP address and device information (server logs, Sentry error reports)

We process your data to: • Manage bookings and send confirmations • Send appointment reminders by email or SMS • Process payments via Stripe • Improve our service (anonymised error reports)

We use the following service providers as processors (Art. 28 GDPR): • 1blu AG, Berlin (hosting of the server and database, data centre in Germany) • Stripe Payments Europe Ltd, Ireland (payment processing) • Google Ireland Ltd (Google Workspace: sending emails via Gmail, appointment calendar; only if enabled: contacts and spreadsheet export). Health-adjacent information is not sent to Google, with one exception: the data export you request yourself (Art. 15 GDPR) contains your intake answers and is emailed to you via Gmail. • Functional Software, Inc. (Sentry, error reports; stored in the EU) Where a provider may process data outside the EU, this is based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Booking data is retained for the legally required retention period of 10 years. Contact data is deleted once there is no longer a legitimate interest or you request deletion.

You have the right to: • Access your stored data (Art. 15 GDPR) • Rectify inaccurate data (Art. 16 GDPR) • Erasure of your data (Art. 17 GDPR) • Restriction of processing (Art. 18 GDPR) • Data portability (Art. 20 GDPR) • Object to processing (Art. 21 GDPR) • Withdraw any consent at any time, with effect for the future (Art. 7(3) GDPR). You withdraw your consent to health-adjacent information directly in your customer account. • Lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the Hessian Commissioner for Data Protection and Freedom of Information To exercise your rights, you can log in to your customer account (/dashboard) at any time or contact us at info@bikefiteurope.com.

We only use cookies that are strictly necessary (§ 25(2) no. 2 TDDDG). These need no consent, which is why there is no cookie banner. We use no analytics, tracking or marketing cookies, and we store nothing else on your device. • cf_session — keeps you signed in to your customer account after you sign in with an email link. Valid for 30 days; deleted when you sign out. • cf_admin — sign-in to the admin area (staff only). Valid for 7 days. • cf_offering_draft, cf_offering_edit_draft — keeps a rejected form entry in the admin area so it does not have to be typed again (staff only). Valid for 5 minutes. All cookies are set by this website itself, sent over HTTPS only, and cannot be read by scripts (HttpOnly). For payment you are redirected to Stripe's own page, where Stripe's privacy and cookie notices apply.

For questions about data protection, please contact us at: info@bikefiteurope.com