Bikewave Fleet Privacy Policy
1. Who is responsible for processing your data?
This Privacy Policy explains how the data of authorised users of Bikewave Fleet is processed. Bikewave Fleet is accessible at www.bikewave-eu.com and through the environments enabled for each municipality or organisation (hereinafter the “Platform”).
Data relating to fleet management
The entity that authorises your access and organises the use of the bikes (hereinafter the “Entity”) is the controller of the data it uses to manage users, bookings, trips and incidents, as well as the reports associated with these purposes.
The identity and contact details of the controller and of its data protection officer must be provided in your Entity’s privacy information. You can ask for help finding these contacts by writing to fleet@bikewave.es.
BIKEWAVE GROUP S.L., with tax ID (NIF) B75857789, European VAT number ESB75857789 and registered address at Avenida de la Reina Victoria, 39, 5D, 28003 Madrid, Spain, acts as processor when it provides the Platform and processes fleet data on the Entity’s instructions. Technical access to this data does not authorise BIKEWAVE to use it for its own purposes outside those instructions.
BIKEWAVE’s own processing
BIKEWAVE acts as controller for enquiries addressed to it about its own activity and for handling claims or legal obligations that apply to it directly. Support requests about an account, a booking or a fleet incident are handled on behalf of the Entity when they form part of the service provided to it.
BIKEWAVE contact email: fleet@bikewave.es.
2. Recommendations
- Read this Policy and the specific information provided by your Entity before using the Platform.
- Keep your device and browser up to date and use the security measures recommended by your organisation.
- Do not share your credentials, and sign out when using a shared device.
- Do not include passwords, medical information or unnecessary personal data in incident reports, notes or support messages.
- If you detect unauthorised access or a possible security incident, report it to your fleet manager or to fleet@bikewave.es.
These recommendations do not replace the security obligations of BIKEWAVE or of the Entity.
3. Data BIKEWAVE collects through the Platform
To provide the Fleet service, the data needed for the enabled features is processed. Data about a bike or a trip is considered personal data when it allows the activity to be linked to an identifiable User.
| Category | Data and scope |
|---|---|
| Identification and affiliation | Full name, work email address, user identifier and the Entity or department the User belongs to. |
| Access and permissions | Information needed to authenticate the User, manage their account and determine their permissions. |
| Bookings | Bike identified by QR or code, booking type, dates, times, status and any recorded changes or cancellations. |
| Bike use | Recorded start and end, bike used, reported distance and indicated battery level, where applicable. |
| Incidents and support | Description of faults or problems, communications and the data needed to handle them. |
Data may come from the User, from the Entity that provides the registration and department details, from actions taken by its administrators and from the records generated when using the Platform. Where the Entity provides the data before the first access, privacy information will be given within the legally required time limits and, at the latest, at the first communication if that takes place earlier.
The data needed to identify the User and manage their booking is essential to enable those features. If it is missing or incorrect, it may not be possible to grant access, confirm the booking or resolve the incident. Optional fields must be marked as such and will not be a condition for features that do not need them.
The Fleet flow described in this Policy does not require individual payments or the publication of rental listings. Bank details and copies of identity documents are therefore not included as ordinary data categories. Do not send these documents through incident fields.
The distance entered when ending a trip does not in itself amount to GPS tracking.
4. For what purposes and on what legal basis is your personal data processed?
Processing managed by the Entity
The data is used for the following purposes:
- Creating and maintaining accounts, verifying access authorisation and managing permissions.
- Managing bookings, pick-ups, returns and trip records.
- Handling incidents and support and sending the necessary operational notices.
- Producing reports on fleet use, distances and environmental indicators.
- Protecting accounts, preventing improper access and investigating technical incidents.
The Entity must identify the legal basis for each purpose. Depending on its regime and the circumstances, a legal obligation (Art. 6(1)(c) GDPR) or a task carried out in the public interest (Art. 6(1)(e) GDPR) may apply, with the corresponding legal grounds. Performance of a contract with the data subject (Art. 6(1)(b) GDPR) will only apply where the processing is objectively necessary for that contract; the Fleet supply contract with the municipality is not in itself sufficient to rely on this basis for its employees.
Legitimate interest will not apply to processing carried out by public authorities in the performance of their tasks. When acting as processor, BIKEWAVE will process the data within the purposes and instructions authorised by the Entity.
BIKEWAVE’s own processing
| Purpose | Legal basis |
|---|---|
| Answering enquiries about BIKEWAVE’s own activity that are not part of the support provided on behalf of the Entity | Art. 6(1)(f) GDPR: legitimate interest in responding to the communication received, after assessing its necessity and the rights of the data subject. Where pre-contractual steps are requested for a contract to which the data subject will be party, Art. 6(1)(b) GDPR. |
| Complying with legal obligations that apply directly to BIKEWAVE | Art. 6(1)(c) GDPR, solely for the applicable data and obligations, which will be identified where appropriate. |
| Establishing, exercising or defending its own legal claims | Art. 6(1)(f) GDPR: legitimate interest in defending its rights, limited to the necessary information and subject to a prior balancing test. |
Signing up to Fleet and booking notices do not authorise sending advertising. Any additional marketing processing will require specific information and the appropriate authorisation; it is not authorised by this Policy.
Fleet reports do not in themselves permit monitoring work performance or taking measures concerning employees. Any additional use must have a legal basis and specific prior information. Aggregated or anonymous data will be preferred where it serves the purpose; pseudonymisation is not the same as anonymisation.
5. Accuracy of the data provided by Users
The User must provide accurate information and report any errors or changes they detect. They may request rectification of their data from their fleet manager or through fleet@bikewave.es, which will forward the request to the appropriate party.
If data comes from the Entity or from an automatic record, its origin will be checked so it can be corrected appropriately. An error will not in itself imply fraudulent use or automatic exclusion from the service.
The User must safeguard their credentials and avoid sharing third-party information that is not needed to handle an incident. These obligations do not exclude the liability of BIKEWAVE or the Entity for the processing and security of the data.
6. Data retention
Data will be kept for as long as necessary for each purpose and in accordance with the periods or criteria communicated to the User. Closing an account does not mean that all records must be deleted immediately, nor does it allow them to be kept indefinitely.
| Category or purpose | Retention period or criterion |
|---|---|
| Account, identification and permissions | While access authorisation exists; after the account is closed, only the data needed for pending obligations or liabilities, for their applicable periods. |
| Identifiable bookings and trips | For the period needed to manage the recorded use and resolve related incidents or liabilities. Once identifying the User is no longer necessary, they will be deleted or effectively anonymised. |
| Fleet incidents and support | Until resolved and for the period needed to handle related liabilities. |
| BIKEWAVE’s own enquiries | Until resolved and for the subsequent period strictly necessary for follow-up or claims. |
| Claims or legal obligations | During the proceedings and the retention or limitation periods applicable to the case, with access limited to these purposes. |
As processor, BIKEWAVE will return or delete fleet data in accordance with the Entity’s instructions and the data processing agreement, unless a legal retention obligation applies. Backups must be subject to deletion cycles and controls that prevent the ordinary reuse of data already deleted. If a backup is restored, the relevant deletions must be applied again.
Where legally required, data will be kept blocked or with restricted access for the required periods and deleted once they end. Truly anonymised information may be kept without any reasonable possibility of identifying Users.
7. User rights
You may request access to your data and its rectification, erasure or restriction. You may also object to the processing and request portability where the requirements for each right are met. Portability does not automatically apply to all processing carried out by a public authority.
If processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Where applicable, you may also exercise the safeguards relating to decisions based solely on automated processing that produce legal or similarly significant effects.
For data managed by your Entity, address your request to the privacy contact or data protection officer identified in your Entity’s information. You can also write to fleet@bikewave.es, stating your Entity and the right you wish to exercise; BIKEWAVE will forward the request to the controller when acting on its behalf. For BIKEWAVE’s own processing, use the same email address or its postal address.
There is no general requirement to provide a copy of your identity document. If there are reasonable doubts about your identity, proportionate additional information may be requested to verify it.
The controller will generally respond within one month of receiving the request. In the cases permitted by the GDPR, this may be extended by up to two further months, informing you of the extension and the reasons within the first month.
You may lodge a complaint with the competent data protection authority, in particular that of your habitual residence, place of work or place of the alleged infringement. These include the Spanish Data Protection Agency (AEPD) and, for Austria, the Austrian Data Protection Authority (Datenschutzbehörde). You do not need to complain to BIKEWAVE first before contacting the authority.
8. Data security
Within their respective responsibilities, BIKEWAVE and the Entity will apply technical and organisational measures appropriate to the risk, aimed at protecting the confidentiality, integrity and availability of the data and limiting access to authorised persons.
Access to fleet information must match each person’s role and permissions. Staff involved in the processing will be bound by confidentiality duties and the corresponding instructions.
Possible incidents will be handled according to the applicable procedures. When acting as processor, BIKEWAVE will notify the Entity without undue delay of any personal data breaches it becomes aware of. The controller will notify the authority and the affected persons where legally required.
No system offers absolute security. This does not exclude the legal obligations of prevention, response and liability of BIKEWAVE or the Entity.
9. Transfers and disclosures to third parties
Access within the Entity and service provision
Fleet managers and other authorised staff of the Entity may access the information needed for their duties through the permissions enabled.
Authorised BIKEWAVE staff may access the data when necessary to operate the Platform, provide support or carry out the Entity’s instructions. Hosting, infrastructure, authentication, operational email or support providers may be involved, solely to the extent they are used and are duly authorised and bound by the corresponding obligations.
Where applicable, data may be disclosed to competent authorities or bodies to comply with legal obligations, or to the recipients needed to process claims, with the applicable legal basis and safeguards. This Policy does not provide for any general disclosure to insurers, advertising companies or other entities unrelated to the service.
International transfers
Any international transfers must be covered by an adequacy decision of the European Commission or by valid safeguards under the GDPR, such as standard contractual clauses together with the assessment and supplementary measures that may be necessary. Merely contracting a provider is not a sufficient safeguard.
You may request information about the safeguards applied and a copy of them through fleet@bikewave.es or your Entity’s privacy contact, with any justified redactions needed to protect confidential information.
10. Questions
For any questions about this Policy or the processing of your data, contact fleet@bikewave.es, stating the Entity you belong to so we can help you.
You can also contact the controller or data protection officer of your Entity directly, as indicated in section 1. Do not send passwords or identity documents unless they are requested with good reason through an appropriate channel.
11. Acceptance and consent
This Policy is for information purposes. Reading it, browsing the Platform or accepting the Terms and Conditions does not constitute general consent to the processing of personal data.
Where processing requires consent, it will be requested in a specific, informed and separate way. It may be withdrawn as easily as it was given. Refusing optional processing will not prevent the use of features that do not need it and must not have any detrimental consequences.
In employment relationships and with public authorities, consent may only be used where there is a genuinely free choice. Processing needed to manage the fleet must rely on the appropriate legal basis, identified by your Entity for each purpose.
Relevant changes to this Policy will be communicated in an accessible way, and the date of update will be indicated. Publishing a new version does not in itself authorise incompatible purposes, nor does it replace any additional information or consent that may be legally required.