(1) When you access our Web pages, we process the data necessary to present the website, namely the

• IP address of the requesting computer;

• date and time of the request;

• name and URL of the file requested;

• operating system information and its access status/HTTP status code;

• volume of data transferred in each case;

• website where the request originates; and

• browser, language, and version of the browser software.

If you use our app, we process the following data: 

• customer account data (see below) and

• smartphone location if you allow this.

(2) Where these data constitute personal data, we process them on the basis of our overriding legitimate interests (point (f) of Article 6(1)1 GDPR). Our interests consist in ensuring smooth connectivity for the website and app, analyzing system security and stability, and analyzing impermissible access to and/or attempts to access the systems. We process the smartphone location in the app only when a test ride is ended via the app. This allows us to ensure that the FOCUS Bike is returned in the correct location and the test ride is not ended in a different place.

(3) The above-mentioned data are automatically erased after a period of 30 days. The data within the app are stored as long as the relevant customer account exists (see below).

(1) Where you place an order in our online store, we process the following data (collectively "order data”) concerning you:

• name,

• e-mail address,

• delivery address,

• billing address if different,

• products ordered, and

• payment  status.

If you have a customer account, the information regarding the products ordered is also associated with your customer account.

We also use various third-party service providers to process orders:

(1.1) For payment processing, we use the external payment service provider Adyen N.V. German Branch, Friedrichstrasse 63, Eingang Mohrenstrasse 17, 10117 Berlin (“Adyen”). We have entered into a processing agreement with Adyen pursuant to Article 28 GDPR. The processing of data on our instructions takes place to process payment transactions and associated support services and for purposes of fraud detection, to prevent chargebacks, and for reporting (including Adyen customer area).

To trigger a payment, Adyen may process data such as

• first and last name,

• e-mail address,

• delivery address,

• billing address if different,

• IP address, and

• payment data.

In addition, the payment data may include the following, depending on the payment method chosen:

• Credit/debit card: card information such as CVC, validity month, validity year, cardholder name, card number, issue number;

• Giropay: personal data, contact information, giropay login information, account detailsIf you choose giropay as the payment method, data are automatically transferred to paydirekt GmbH, Stephanstrasse 14-16, 60313 Frankfurt am Main. For further information on paying via giropay, please visit https://www.giropay.de/agb/datenschutzinformationen.pdf.

• PayPal: first name, last name, address, e-mail address, IP address, phone number, mobile phone number, or other data necessary for processing payments (such as the products ordered).If you choose PayPal as the payment method, personal data are automatically transferred to PayPal (PayPal (Europe) S.à r.l. & Cie, S.C.A., 5. Etage, 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg). The personal data exchanged may also be transferred by PayPal to credit rating agencies. The purpose of this transfer is to verify identity and check credit. PayPal additionally discloses the personal data to affiliated companies and service providers or subcontractors where this is necessary in order to fulfill contractual obligations or the data are to be processed on another entity’s behalf. For further information on data processing by PayPal, please see https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

• Pay now with Klarna: name, account number, routing number, subject, amount, and date, where necessary for the performance of the contract.If you choose “Pay now with Klarna” as the payment method, personal data are automatically transferred to SOFORT GmbH, a Klarna Group company having its registered office at Theresienhöhe 12, 80339 Munich (“Sofort”). FOCUS Bikes does not receive access to your account login information or your account. The only information we receive from Sofort is whether the payment has been carried out or refused, along with the account number you used, the routing number, subject, amount, and date. For further information on data processing by Sofort, please see https://www.sofort.com/payment/wizard/getCmsContent/data_protection/DE/0/de.

Where you place an order outside Germany, it is also possible that other payment service providers may be used. In this case, please see the information provided by the relevant payment service providers for the necessary data protection and privacy information. 

For fraud prevention purposes, Adyen may also process the following data:

• payment details,

• first and last name,

• device fingerprint,

• persistent cookies,

• e-mail address,

• IP address,

• buyer’s reference,

• phone number,

• billing address if different,

• delivery address, and

• where applicable, additional information in the individual case, such as information on the shopping cart, browser language, delivery method, buyer’s country, etc.

Adyen collects and stores the data and discloses them to the companies involved in the payment process where this is necessary to process the payment. We do not collect or store the payment data.

You can access further information on data processing by Adyen at https://www.adyen.com/policies-and-disclaimer/privacy-policy.

(1.2) When performing a contract, we work with dealers to which we ship our products for pick-up by you (“click & collect”). You can use the “Which dealer has the bike” search function to enter your postal code and have the site display dealers near you that have the FOCUS Bike in stock. For this function, we work with service provider BIDEX GmbH, Talsperrenweg 72, 58256 Ennepetal, which provides us with the Bidex BikeLocal online tool. We disclose your order data to the selected dealers where this is necessary to ship the products ordered and provide services. We also use the service provider business unicorns GmbH, Bahnhofsallee 87, 46342 Velen, to transmit the customer data securely to a dealer via a dealer portal. We have entered into a processing agreement with business unicorns GmbH pursuant to Article 28 GDPR.

(1.3) We utilize the services of external logistics service providers for contract fulfillment. In individual cases, we may also disclose your delivery address to these service providers where this is necessary in order to deliver the products ordered.

(2) The legal basis for the processing of your order and payment data is point (b) of Article 6(1)1 GDPR. According to this provision, we are permitted to process your data where this is necessary in order to perform a contract with you or in order to take steps prior to entering into a contract. We process your order and payment data on this legal basis to process your purchases, including financial and logistical processing. We also base the involvement of external IT service providers, payment service providers, and logistics service providers on point (b) of Article 6(1)1 GDPR where the processing is absolutely necessary in order to perform a contract (such as in the case of payment processing and delivery). 

In all other respects, we base this involvement on our overriding legitimate interests (point (f) of Article 6(1)1 GDPR). To implement secure and convenient solutions, for example for automated invoicing, we rely on the support of external specialists. The same applies to the processing of your order data for the establishment, exercise or defense of legal claims. To this end, it may also be necessary in the individual case for us to disclose the data to courts, other government agencies, or other parties to a legal dispute.

We also process your e-mail address to send an order confirmation and invoice on the basis of point (c) of Article 6(1)1 GDPR, as we are obligated to send you an electronic order confirmation and/or invoice.

(3) We store the order data collected for purposes of performing a contract until the statutory warranty and guarantee rights and/or any such rights existing under a contract have expired. After this time limit elapses, we will erase your data unless we are obligated pursuant to the specifications of commercial and/or tax law (such as Sec. 257 of the German Commercial Code (HGB) or Sec. 147 of the German Fiscal Code (AO)) to retain your data for the period stipulated by law (for billing-related data, typically ten years from the time when the contract is entered into). In this case, the data will be processed exclusively for the purposes stipulated by law (e.g., verification by the fiscal authorities) until they are erased.

(1) Where you participate in a promotional event, competition, or other event organized by us or a Pon company, depending on the event, we may process your name, address, email address, other contact details, and further event-specific information ("Event Data").

Where you participate in a competition and the participation conditions require registration for a newsletter or other promotional measures, we will obtain your consent for the distribution of the newsletter or the other promotional measures. The promotional opportunity via the newsletter enables us to provide the competition. Subscribing to our newsletter or other promotional measures constitutes your consideration for participating in our competition. Occasionally, we conduct competitions jointly with other partner companies. In this case, you will be separately informed when registering for the newsletter or other promotional measure. If these partner companies send you their own newsletters, you will find further information about their data processing in their data privacy information, which we link to during registration.

If you do not agree to receive promotional measures or if you revoke the subscription during the promotion period, you may not or will no longer be able to participate in the respective competition. You can find more information about newsletter distribution in the data privacy information under "Direct Marketing" below. The legal basis for processing your data for the purpose of participation, execution, and handling of a competition is Art. 6 para. 1 sentence 1 lit. b GDPR (participation agreement of the competition).

(1) We reserve the right to use your name and address, where we collect these through a form upon registration for a customer account in the online store or via an app or through a different form, to transmit information about our products and services by postal mail as well. If you create a customer account with us, purchase a product, and/or enter into a warranty agreement, we also reserve the right to send you information regarding similar goods or services via e-mail, in the future. We engage very sparingly in direct marketing measures without consent.

(2) The legal basis for data processing to carry out direct marketing measures is point (f) of Article 6(1)1 GDPR, in the case of e-mail marketing in conjunction with Sec. 7 (3) of the German Act against Unfair Competition (UWG). Our overriding legitimate interests lie in the necessity of carrying out direct marketing measures through direct outreach to test customers for our products and services. These interests override your interests, as we restrict the direct marketing measures to a reasonable scope and you can object to receiving these materials at any time.

(3) You can object to the processing of your data for purposes of direct marketing by postal mail and e-mail at any time by sending a message to the contact details mentioned in Sec. 1 above. You will not incur any cost for this other than the transmission costs at the base rates. Where you object to the processing of your data for purposes of direct marketing by postal mail and e-mail, we will no longer carry out the aforementioned direct marketing measures toward you on the basis of overriding legitimate interests.

(1) Where you communicate with us via e-mail, a contact form, or another channel, we process your personal data to process your inquiry; this may include but is not limited to the following:

• contact details, such as name, address, e-mail address, phone number; 

• contract data, such as product and/or date of purchase; and

• other data relating to the content of the communication, such as the subject and message. 

Where you use the WATT-SON chatbot on our website, we process your IP address and the answers that you enter within the chatbot (e.g., information on your role and question or concern). To be able to offer you this service, we useHubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (“HubSpot”).

(2) The legal basis for the processing of the data is point (b) of Article 6(1)1 GDPR. According to this provision, we are permitted to process your data where this is necessary for the performance of a contract to which you are party or in order to take steps prior to entering into a contract. We base our actions on this legal basis if and when we process customer services such as inquiries, product purchases, services, or complaints, meet our warranty obligations, or carry out recall actions for services or products of ours or related companies. 

Where, in an isolated instance, our communications are not associated with a concrete service for customers, we base the data processing on our overriding legitimate interests (point (f) of Article 6(1)1 GDPR). In these cases, our interests lie in enabling the making of contact and in the processing of your questions or concerns. 

Please note that as a general rule, data cannot always be transferred securely on the Internet. Especially in e-mail traffic, it is not possible to guarantee protection for the exchange of data. Please do not transmit any sensitive data to us by e-mail.

(3) The data are erased after your inquiry has been processed after the processing of your data has been concluded unless we are under a statutory or contractual obligation to retain the data beyond that or we can base the storage thereof on another purpose explained elsewhere in this data protection and

(1) Where you wish to lease a FOCUS Bike via the service provider Jobrad, Heinrich-von-Stephan-Str. 13, 79100 Freiburg (“Jobrad”), we receive from Jobrad the data concerning you that are necessary in order to process the Jobrad contracts, i.e., your name and address and the product ordered. We have entered into a processing agreement with Jobrad concerning the delivery of the FOCUS Bikes.

(2) The legal basis for the processing of these data is point (b) of Article 6(1)1 GDPR. According to this provision, we are permitted to process your data where this is necessary in order to perform the Jobrad contracts or in order to take steps prior to entering into a contract. We use these data exclusively to prepare quotes and perform the contract in conjunction with the Jobrad concept and to fulfill our own accounting and documentation obligations.

(3) We store the data collected for purposes of processing a contract until the statutory warranty and guarantee rights and/or any such rights existing under a contract have expired. After this time limit elapses, we will erase your data unless we are obligated pursuant to the specifications of commercial and/or tax law (such as Sec. 257 of the German Commercial Code (HGB) or Sec. 147 of the German Fiscal Code (AO)) to retain your data for the period stipulated by law (for billing-related data, typically ten years from the time when the contract is entered into). In this case, the data will be processed exclusively for the purposes stipulated by law (e.g., verification by the fiscal authorities) until they are erased.

For further information on the processing of data by Jobrad on its own responsibility, please see https://www.jobrad.org/datenschutz.html.

(1) Where you wish to lease a FOCUS Bike via the service provider Lease a Bike the service of, Bike Mobility Services GmbH, Mühlenstraße 28, 49661 Cloppenburg (“Lease a Bike”), we receive from Lease a Bike the data concerning you that are necessary in order to process the Lease a Bike contracts, i.e., your name and address and the product ordered. We have entered into a processing agreement with Lease a Bike concerning the delivery of the FOCUS Bikes.

(2) The legal basis for the processing of these data is point (b) of Article 6(1)1 GDPR. According to this provision, we are permitted to process your data where this is necessary in order to perform the Lease a Bike contracts or in order to take steps prior to entering into a contract. We use these data exclusively to prepare quotes and perform the contract in conjunction with the Lease a Bike concept and to fulfill our own accounting and documentation obligations.

(3) We store the data collected for purposes of processing a contract until the statutory warranty and guarantee rights and/or any such rights existing under a contract have expired. After this time limit elapses, we will erase your data unless we are obligated pursuant to the specifications of commercial and/or tax law (such as Sec. 257 of the German Commercial Code (HGB) or Sec. 147 of the German Fiscal Code (AO)) to retain your data for the period stipulated by law (for billing-related data, typically ten years from the time when the contract is entered into). In this case, the data will be processed exclusively for the purposes stipulated by law (e.g., verification by the fiscal authorities) until they are erased.

For further information on the processing of data by Lease a Bike on its own responsibility, please see https://www.lease-a-bike.de/en/privacy-policy.

(1) Where you use products of ours that are equipped with sensors, we must process the data from these sensors in some cases in order to offer you certain services. Examples of sensors include GPS receivers, Wi-Fi or Bluetooth receivers, cameras, and touchscreens. In keeping with the purposes of processing of personal data and the devices used, which have been logged using the sensors, the data may be sent for further processing to FOCUS Bikes and other third parties that require the data in order to provide the agreed services to FOCUS Bikes (such as GPS or video recordings that are accessible digitally).

(2) As a basic principle, the legal basis for the processing of your sensor data is point (b) of Article 6(1)1 GDPR. According to this provision, we are permitted to process your data where this is necessary in order to perform a contract with you or in order to take steps prior to entering into a contract. We process your sensor data on this legal basis in order to allow you to use functions such as digital access and analyses of your data records. Where the processing is not necessary for the performance of a contract in the individual case, we obtain your consent thereto separately. 

(3) We store the sensor data collected to perform the contract for as long as we need them to perform the relevant services (including maintaining the retrievability thereof for you). Afterward, we store your data until the statutory warranty and guarantee rights and/or any such rights existing under a contract have expired (typically three years after the service relationship has terminated). After this time limit elapses, we will erase your data unless we are obligated pursuant to the specifications of commercial and/or tax law (such as Sec. 257 of the German Commercial Code (HGB) or Sec. 147 of the German Fiscal Code (AO)) to retain your data for the period stipulated by law (for billing-related data, typically ten years from the time when the contract is entered into).

FOCUS Bikes GmbH belongs to Pon Holding B.V. and its affiliates and subsidiaries (“Pon”). Certain departments within Pon, such as marketing and IT, work together. As a result, it is possible that your personal data may be shared worldwide with the other business group companies or other Pon corporate units and/or transferred to the latter. For a listing, including the locations of our business operations and our partner companies, please visit http://www.pon.com/nl-nl/our-business/bedrijven. Where it is necessary to transfer your personal data to perform a contract, we base the transfer thereof on point (b) of Article 6(1)1 GDPR. This is the case, for example, where we cannot perform a purchase or service agreement except with the participation of another company or you directly utilize a service from such company. In all other respects, we base the possible transfer on our overriding legitimate interests (point (f) of Article 6(1)1 GDPR) in procedures involving division of labor within a group of affiliated companies and with partner companies. 

It is also possible for FOCUS Bikes GmbH or Pon to carry out a restructuring or merger or otherwise sell or spin off a company (or part of a company) to another business. If such company is an affiliate of FOCUS Bikes, such a transfer of ownership may also encompass the transfer of your personal data to the new owner and its consultants or advisors. We base such data processing on our overriding legitimate interests (point (f) of Article 6(1)1 GDPR), in this case meaning our interest in cost-effective restructuring of individual companies.

(1) To have the following rights toward us with regard to the personal data concerning you:

• Right of access to information: You can request information on whether we process personal data concerning you. If this is the case, you have the right of access to information concerning these personal data and the right to further information associated with the processing (see Article 15 GDPR). 

• Right to rectification: In the event that personal data concerning you are not (or no longer) accurate or are incomplete, you can request rectification and, where applicable, completion of these data (see Article 16 GDPR).

• Right to erasure or restriction: If the statutory prerequisites are met, you can request the erasure of your personal data (see Article 17 GDPR) or the restriction of processing of these data (Article 18 GDPR), for example if the processing of these personal data is no longer necessary for the purposes for which we collected them.

• Right to data portability: Under certain conditions, you have the right to receive the personal data concerning you that you have provided to us in a certain format or to have these data transferred to another controller (see Article 20 GDPR).

Certain legal prerequisites must be met in order to exercise your rights as enumerated above. if you have any questions, please feel free to contact us using the contact details mentioned in Sec. 1.

When making your request, please describe the personal data to which your request refers as clearly as possible. In the interest of your own security, we can only process requests in relation to the personal data associated with the same e-mail address you use to send your request in each case; we may also ask you to prove your identity before we accommodate your request. 

(2) RIGHT TO OBJECT (ARTICLE 21 GDPR)You also have the right to object at any time to our processing of your personal data, specifically: 

(i) in the case of direct marketing, at any time; and 

(ii) in all other cases on grounds relating to your particular situation, where we process your personal data for the purposes of our legitimate interests on the basis of point (f) of Article 6(1)1 GDPR (Article 21(1) and (2) GDPR). 

Where you have filed an objection, we will discontinue processing of your personal data for direct marketing in all cases and data processing for other reasons as a general rule unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing serves for the assertion, exercise, or defense of legal claims.

(3) You can lodge a complaint regarding our processing of your personal data with a data protection authority, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement of applicable data protection and privacy laws (see Article 77 GDPR).

(4) We do not engage in automated decision-making, including profiling, as provided in Article 22(1) and (4) GDPR.