Privacy Policy

Workshop Inquiries

If you submit a workshop inquiry using the 'Book a Repair' form, we process the information you provide: details about your bike, including the frame number if desired, your request, your contact details, and, if it's a leased bike, information about the leasing contract and, if applicable, the details of the damage incident.

Legal Basis is Art. 6 para. 1 lit. b GDPR — the processing serves to carry out pre-contractual measures at your request. We do not need your consent for this; it solely covers contact via your chosen method, including SMS (Art. 6 para. 1 lit. a). You can revoke this consent at any time without affecting the legality of the processing carried out until then.

The inquiry reaches us via email. Additionally, in our analysis log, we record that an inquiry was received, and with which selected information — category, leasing yes or no, provider, desired contact method. Free text fields like your description or the details of the damage incident are expressly not included; only noted there is that a text was provided and its length. Your phone number and the contract number of your leasing agreement are also not stored in this log.

One exception is the frame number, if you provide it. It is not kept with your inquiry but separately, in its own mapping table that links a bike to its service history. This mapping belongs to the bike, not to you as a person — and it therefore remains beyond the six months mentioned below, because a bike’s service history outlasts a change of owner. If you would like us to remove it, let us know; we have a set procedure for that.

If you call us instead, our staff record the same information in the same form.

If your inquiry does not result in an order, we remove it from our inbox six months after receipt and dissolve the link to your person in our analysis log. What remains there is the selected information without personal reference — meaning the fact that someone made an inquiry of this type. Half a year covers a full seasonal cycle: those who inquire in spring often return in autumn. If an order arises, retention is governed by the order itself.

Photo and video consent at events

At events we ask participants whether we may use photos and video footage of them. Anyone who agrees fills in a short form on one of our devices and signs with their finger on the screen.

What we store: first name, surname and email address · phone number and race number, if given — both are optional · your signature as an image · the time of signing · the event concerned · the full wording of the text you agreed to, together with its version number · your reference, which you need to withdraw · whether the confirmation email could be delivered · technical details of the process: the device identifier, the browser identifier and the deviation of the device clock from our server clock. For minors we also record the details of the person who countersigns.

Why we store it: the legal basis is your consent (Art. 6(1)(a) GDPR). We must be able to demonstrate that it was given (Art. 7(1) GDPR) — which is why we keep the signature, the time and the wording you agreed to. That wording cannot be altered afterwards: if we change the text later, the version you read still applies to you. We store the clock deviation separately instead of adding it into the timestamp — that way it remains visible if a clock was wrong.

How long we keep this.

We keep your consent and proof of it for as long as we use the footage, and for three years thereafter. During this period, claims arising from the use may still be asserted, and we must be able to prove for that long that consent was given. If you withdraw your consent, we stop using the footage; proof of the original consent is retained for the same three years because it shows that the use was lawful until you withdrew your consent.

What you receive: after signing we send a confirmation to the address you gave — with your reference, the date and the wording you agreed to. A copy goes to our marketing mailbox.

How to withdraw: you may withdraw your consent at any time and without giving reasons, with effect for the future — via the link in your confirmation email or by an informal message quoting your reference to marketing@bikefactory-hamburg.de. Withdrawing is as easy as giving consent (Art. 7(3) GDPR). From the moment you withdraw we stop using the material. Printed material cannot be recalled — catalogues or posters already distributed stay in circulation. We keep the record of the withdrawal: it proves that and when you withdrew, which also protects you.

Who processes the data besides us is set out in the next section. Beyond that we do not pass it on, do not sell it and do not use it for advertising.

Who processes your data besides us

We use three service providers for the operation of this site, who work on our behalf and according to our instructions:

• Cloudflare delivers this site. This involves technically necessary connection data, including your IP address.
• Microsoft sends the email with your inquiry to our inbox and operates that inbox. The service sees the information you provided in the form.
• Supabase operates our analysis log. The servers are located in Frankfurt am Main.

Beyond this, we do not share your information. If it concerns leasing damage, we need to exchange information with your leasing provider for processing — we will discuss this with you beforehand.

When data leaves the EU

Cloudflare and Microsoft are companies based in the USA. Even though they run this site and our mailbox from European data centres, a transfer to the USA cannot be ruled out entirely. If you want to know on what basis this happens and which contracts we have concluded for it, write to us – you will get an answer.

Our analytics store (Supabase) is located in Frankfurt am Main. Data does not leave the EU there.

News by email

On our website, you can enter your email address to receive news from BikeFactory Hamburg – for example about events, new bikes and in-store promotions. This is voluntary; if you do not sign up, we will not send you emails of this kind.

What we store: your email address · the language in which you used the website · the time you signed up and the time you confirmed your sign-up · the version of the consent text you agreed to · and, if you unsubscribe, the time you unsubscribed. Nothing more: no name, no other details.

How your sign-up becomes valid: After entering your address, you will receive an email containing a link. Your sign-up becomes valid only when you press the button on the page linked to. If someone enters your address without you having done so, nothing happens without your confirmation – and you will not receive any further email from us. The link is valid for seven days; after that, the sign-up expires automatically.

Why we store this: The basis is your consent. We must be able to demonstrate that you gave it and which text you agreed to – for this purpose, we retain the two times and the version of the text. If we change the text later, the version you read will continue to apply to you.

Who receives the data: Your address is stored in our own database. As soon as you have confirmed, our in-store team is notified by email that you have signed up – including your address, language, times and text version. We do not share your address with anyone and do not use a newsletter service provider; emails are sent through our own mailbox.

For how long: until you unsubscribe. After that, we will no longer send you news. We also retain evidence that you gave your consent – your address, the times, the text version and the time you unsubscribed – after you unsubscribe, so that we can document the period before that.

Unsubscribing and withdrawing consent: You can withdraw your consent at any time without affecting the lawfulness of the processing carried out up to that point. To do so, simply write to us at marketing@bikefactory-hamburg.de. In addition, every email from us – starting with the confirmation of your sign-up – contains a link to a page where you can unsubscribe by pressing a button.

Your rights

You decide about your data, and for that you need neither a lawyer nor a reason. An informal message to info@bikefactory-hamburg.de is enough.

Access. You can find out at any time which data we have stored about you, for what purpose, for how long, and who processes it besides us. On request you will receive a copy.

Rectification. If something is wrong or incomplete, we will correct it.

Erasure. You can ask us to delete your data. We do so as soon as we no longer need it and no statutory retention period stands in the way – which ones those are is stated above under the retention periods.

Restriction. Instead of deleting, you can ask us to only store your data and no longer use it – for example while it is being clarified whether it is correct.

Portability. Data you gave us yourself, you will receive in a common file format so that you can use it elsewhere.

Objection. If we process data on the basis of a legitimate interest, you can object. We will then stop using it, unless we have compelling grounds that outweigh yours.

Withdrawing consent. Where you have consented, you can withdraw at any time – with effect for the future, without giving reasons, and just as easily as you consented. What happened until then remains lawful.

Complaint. You can complain to a supervisory authority without contacting us first. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de.

Whether you have to give us the information

All information is voluntary. Without it we cannot do some things: without contact details no answer to your enquiry, without details about the bike no workshop information, without an e-mail address no news. You suffer no disadvantage from this – we do not ask for anything we do not need for the respective purpose.