Privacy Notice

1. About this Privacy Notice

Pedalebikes respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store, share and protect personal information when you:

• apply for an e-cycle subscription;
• rent or use one of our e-cycles;
• communicate with us;
• make payments to us;
• use our website, application or online services;
• visit one of our locations;
• report an accident, theft or damage;
• interact with our customer support team; or
• otherwise use our services.

This Privacy Notice should be read alongside our E-Cycle Rental & Subscription Agreement and any other privacy information we provide to you.

2. Who we are

Pedalebikes Ltd

Company Number: 16974834

Registered Address: 167-169 Great Portland Street, London, United Kingdom, W1W 5PF

Email: Admin@pedalebikes.co.uk

Website: pedalebikes.co.uk

For the purposes of applicable UK data protection law, Pedalebikes is generally the data controller of the personal information described in this Privacy Notice.

This means that we determine why and how your personal information is processed.

3. Personal information we may collect

Depending on how you interact with us, we may collect the following categories of personal information.

A. Identity information

This may include:

• full name;
• date of birth;
• photograph;
• signature;
• customer identification number;
• copies or details of identification documents;
• driving licence information where relevant;
• passport or other identity document information where required; and
• information used to verify your identity.

We will only request identification information that we reasonably consider necessary for providing our services, preventing fraud or complying with legal requirements.

B. Contact information

This may include:

• residential address;
• previous address where necessary for verification;
• email address;
• telephone number; and
• emergency contact details where voluntarily provided or otherwise appropriately collected.

C. Account and subscription information

This may include:

• subscription plan;
• subscription start and end dates;
• customer account information;
• e-cycle allocated to you;
• e-cycle serial or frame number;
• battery and charger information;
• collection and return information;
• maintenance history;
• payment status;
• deposit information;
• outstanding balances;
• suspension history;
• termination information; and
• communications relating to your account.

D. Payment and transaction information

This may include:

• payments made;
• payment dates;
• subscription charges;
• refunds;
• deposits;
• outstanding amounts;
• transaction references; and
• limited payment method information.

Where payments are processed by a third-party payment provider, Pedalebikes may not receive or store your complete debit or credit card details.

Payment providers may process your payment information under their own privacy terms.

E. E-Cycle location and GPS information

Some Pedalebikes e-cycles may contain GPS, telematics, Bluetooth, mobile connectivity or other security and tracking technology.

Where such technology is fitted and activated, we may process information such as:

• the current or last known location of the e-cycle;
• historical e-cycle location information where necessary;
• movement of the e-cycle;
• time and date information;
• security alerts;
• suspected theft information;
• recovery information; and
• technical information generated by the e-cycle or tracking device.

Because an e-cycle may be allocated to a particular customer, this information may constitute personal information.

We do not intend GPS tracking to be used to monitor a rider's private life or delivery productivity.

We may use location information for legitimate operational and security purposes including:

• locating lost or stolen e-cycles;
• preventing and investigating theft or fraud;
• recovering Pedalebikes property;
• fleet management;
• identifying the location of an e-cycle requiring recovery or maintenance;
• investigating suspected serious misuse;
• protecting Pedalebikes' assets; and
• complying with lawful requests from authorities where applicable.

We will seek to collect and retain location information only to the extent reasonably necessary for these purposes.

F. E-Cycle usage and technical information

Depending on the technology fitted to an e-cycle, we may receive information concerning:

• battery status;
• battery condition;
• charging information;
• faults;
• maintenance alerts;
• technical diagnostics;
• mileage or distance travelled;
• security events; and
• other information concerning the operation and condition of the e-cycle.

G. Damage, accident and theft information

If an accident, theft, loss or damage occurs, we may collect:

• photographs and videos;
• accident descriptions;
• date, time and location of the incident;
• police crime reference numbers;
• witness information;
• third-party contact information;
• insurance information;
• details of damage;
• repair information; and
• correspondence concerning the incident.

H. Communications

We may keep records of communications between you and Pedalebikes, including:

• emails;
• SMS messages;
• WhatsApp or other messaging communications where used;
• telephone call records or notes;
• customer support conversations;
• complaints;
• payment reminders; and
• notices concerning your subscription.

If telephone calls are recorded, we will provide appropriate information about call recording.

I. Website and device information

Where applicable, when you use our website or digital services, we may collect information such as:

• IP address;
• browser type;
• device information;
• website usage;
• login information;
• security information; and
• cookie or similar technology information.

Where required, non-essential cookies or similar technologies will be used in accordance with applicable consent requirements.

4. How we collect your information

We may obtain personal information:

Directly from you

For example when you:

• create an account;
• enter into a rental agreement;
• provide identification;
• contact us;
• make a payment;
• report a problem;
• report an accident or theft; or
• return an e-cycle.

Automatically from our e-cycles or technology

For example through:

• GPS devices;
• security trackers;
• telematics;
• e-cycle diagnostic systems; and
• our website or digital services.

From third parties

Where appropriate and lawful, we may receive information from:

• payment processors;
• identity verification providers;
• fraud prevention services;
• insurers;
• maintenance or recovery providers;
• law enforcement agencies;
• delivery platforms where an appropriate arrangement exists; and
• other service providers acting on our behalf.

5. Why we use your personal information

We may use personal information to:

• determine whether we can provide you with a subscription;
• verify your identity;
• create and manage your account;
• enter into and administer your rental agreement;
• allocate an e-cycle to you;
• collect subscription payments;
• manage deposits and refunds;
• contact you about your subscription;
• provide customer support;
• arrange maintenance and repairs;
• monitor the condition of our fleet;
• prevent theft and fraud;
• locate and recover lost, stolen or unreturned e-cycles;
• investigate accidents, damage and misuse;
• protect our property and legal rights;
• recover legitimate unpaid debts;
• maintain financial and tax records;
• improve our services;
• maintain the security of our systems;
• respond to legal claims;
• comply with applicable legal obligations; and
• communicate with law enforcement or regulators where legally required or otherwise lawful.

6. Our lawful bases for processing

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the circumstances, Pedalebikes may rely on one or more of the following bases.

A. Contract

We may process information where it is necessary to:

• take steps at your request before entering into a rental agreement; or
• perform our rental/subscription contract with you.

For example, we may need your name, contact details, payment information and subscription details to provide an e-cycle subscription.

B. Legal obligation

We may process personal information where necessary to comply with a legal obligation that applies to Pedalebikes.

This may include certain:

• accounting obligations;
• tax requirements;
• regulatory requirements;
• legal disclosure requirements; and
• compliance obligations.

C. Legitimate interests

We may process information where necessary for our legitimate business interests or those of another person, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• protecting our e-cycles and other property;
• preventing theft;
• preventing and detecting fraud;
• recovering stolen or unreturned e-cycles;
• maintaining the safety and security of our fleet;
• managing our business;
• maintaining accurate customer records;
• recovering legitimate debts;
• defending legal claims;
• improving our services;
• preventing misuse of our services; and
• maintaining network and information security.

Where required, we consider the nature and impact of the processing before relying on legitimate interests.

D. Consent

In some circumstances, we may ask for your consent.

For example, consent may be used for certain forms of electronic marketing or optional cookies where required.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawing consent will not affect processing that was lawful before the withdrawal.

7. GPS tracking and e-cycle security

Pedalebikes has a legitimate interest in protecting and recovering e-cycles that it owns.

Where an e-cycle contains a GPS or security tracking device, location information may therefore be processed for purposes such as theft prevention, asset security, recovery, maintenance and investigation of serious misuse.

For example, if:

• an e-cycle is reported stolen;
• a customer fails to return an e-cycle after their agreement ends;
• Pedalebikes reasonably suspects that an e-cycle has been unlawfully transferred;
• a tracking device sends a theft or tampering alert; or
• an e-cycle needs to be recovered,

we may use location information to locate and recover the e-cycle where lawful and proportionate.

The presence of tracking technology does not authorise Pedalebikes or anyone acting on our behalf to enter private property unlawfully.

Where GPS or other tracking creates information relating to an identifiable customer, we will treat that information as personal information and process it in accordance with applicable data protection law.

8. Who we may share information with

Where necessary and lawful, we may share personal information with appropriate third parties, including:

• payment processors;
• banks and payment service providers;
• identity verification providers;
• fraud prevention providers;
• IT and cloud service providers;
• GPS and telematics providers;
• e-cycle maintenance providers;
• recovery companies;
• professional advisers such as accountants and lawyers;
• insurers and insurance service providers;
• debt recovery providers;
• law enforcement agencies;
• courts;
• regulators;
• government authorities; and
• other suppliers necessary for operating Pedalebikes.

We do not sell customers' personal information.

Where another organisation processes personal information on our behalf, we will take appropriate steps to ensure that the information is handled securely and in accordance with applicable data protection requirements.

9. Police and law enforcement

Pedalebikes may disclose personal information to the police or another competent authority where:

• we are legally required to do so;
• disclosure is necessary and lawful for the prevention or detection of crime;
• we need to report suspected theft, fraud or other criminal activity;
• disclosure is necessary in connection with legal proceedings; or
• another lawful basis permits the disclosure.

We will not routinely provide customer information to third parties merely because it has been requested.

We will consider whether disclosure is lawful and appropriate in the circumstances.

10. International data transfers

Some service providers used by Pedalebikes may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps required by applicable data protection law to protect that information.

Where required, this may include relying on:

• applicable adequacy regulations;
• approved contractual safeguards; or
• another lawful international transfer mechanism.

Information about relevant safeguards may be requested using the contact details contained in this Privacy Notice.

11. How long we keep personal information

We will not keep personal information for longer than reasonably necessary for the purposes for which it was collected, subject to legal, accounting, tax, fraud prevention and dispute-resolution requirements.

Our retention periods may vary depending on the type of information.

As a general framework:

Customer account and rental records:

Normally retained for up to 6 years after the end of the customer relationship where reasonably necessary for contractual, accounting or legal purposes.

Invoices and financial records:

Retained for the period required under applicable accounting and tax law.

Identity verification information:

Retained only for as long as reasonably necessary for identity verification, fraud prevention, contractual or legal purposes.

GPS/location information:

Normally retained for 90 days, unless a longer period is reasonably necessary because of theft, non-return, fraud, an accident, legal proceedings or another investigation.

Customer support communications:

Normally retained for 1 year depending on the nature of the communication.

Accident, theft and damage records:

May be retained for up to 6 years or longer where reasonably necessary in connection with an active claim, investigation or legal requirement.

Marketing information:

Retained until you unsubscribe, withdraw consent where consent applies, or we otherwise determine that it should no longer be retained.

We may retain certain information for longer where required by law or reasonably necessary to establish, exercise or defend legal claims.

When information is no longer required, we will delete, anonymise or securely dispose of it as appropriate.

12. Data security

Pedalebikes takes appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• unlawful disclosure;
• alteration;
• misuse; and
• destruction.

Depending on our systems and the nature of the information, measures may include:

• access controls;
• passwords and authentication;
• encryption;
• secure cloud storage;
• restricted staff access;
• security monitoring;
• backups; and
• appropriate contractual requirements for service providers.

Access to personal information should be limited to people who reasonably need it for their work.

13. Your data protection rights

Depending on the circumstances and the lawful basis on which we process your information, you may have rights under UK data protection law.

These may include:

Right of access

You may ask us for confirmation of whether we process your personal information and request a copy of information we hold about you.

Right to rectification

You may ask us to correct inaccurate or incomplete personal information.

Right to erasure

In certain circumstances, you may ask us to delete your personal information.

This right is not absolute. We may need to retain information where we have a lawful reason or legal obligation to do so.

Right to restriction

In certain circumstances, you may ask us to restrict how your information is processed.

Right to data portability

Where applicable, you may have the right to receive certain personal information in a structured, commonly used and machine-readable format or ask for it to be transferred to another organisation.

Right to object

You may have the right to object to processing based on legitimate interests.

If you object, we will consider your request and whether we have compelling legitimate grounds to continue processing the information.

You have the right to object at any time to the use of your personal information for direct marketing.

Rights relating to consent

Where we rely on your consent, you may withdraw that consent at any time.

Automated decision-making

Where applicable, you may have rights concerning decisions made solely through automated processing that produce legal or similarly significant effects.

Pedalebikes does not intend to make significant decisions concerning rental customers solely through automated processing unless we provide appropriate information and safeguards.

14. How to exercise your rights

To exercise a data protection right, contact:

Pedalebikes Privacy Team

Email: Admin@pedalebikes.co.uk

Address: 167-169 Great Portland Street, London, United Kingdom, W1W 5PF

We may need to verify your identity before responding to certain requests.

We aim to respond within the period required by applicable data protection law.

15. Direct marketing

Where permitted, we may contact customers about Pedalebikes services, offers or updates.

Where consent is legally required, we will obtain consent before sending the relevant marketing communication.

You can opt out of direct marketing at any time by:

• using the unsubscribe mechanism provided in the communication; or
• contacting us at Admin@pedalebikes.co.uk.

Opting out of marketing will not prevent us from sending important service communications relating to your subscription, payments, maintenance, security, safety or rental agreement.

16. Cookies and website technology

Our website may use cookies and similar technologies.

Some cookies may be necessary for the operation and security of the website.

Where required by law, we will request consent before placing non-essential cookies or similar technologies on your device.

Further information should be provided in our Cookie Notice or cookie management tool where applicable.

17. Age restrictions

Pedalebikes' subscription services are intended for customers aged 21 or over, unless otherwise agreed by Pedalebikes in writing.

We do not knowingly offer standard rider subscriptions to children.

If we discover that we have collected personal information from a child in circumstances where we should not have done so, we will take appropriate steps.

18. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes to our services;
• new technology;
• changes to our suppliers;
• changes to our data processing activities; or
• changes to applicable law.

Where a change is significant, we will take reasonable steps to bring the updated Privacy Notice to customers' attention.

The latest version will be available at: PEDALEBIKES.co.uk

19. Complaints

If you have concerns about how Pedalebikes uses your personal information, please contact us first so that we can investigate the matter.

Pedalebikes

Email: Admin@pedalebikes.co.uk

Address: 167-169 Great Portland Street, London, United Kingdom, W1W 5PF

You also have the right to make a complaint to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Information about making a complaint is available through the ICO's official website.

20. Applicable data protection law

Pedalebikes will process personal information in accordance with applicable UK data protection and privacy legislation, as amended or replaced from time to time.

This includes, where applicable:

• the UK General Data Protection Regulation ("UK GDPR");
• the Data Protection Act 2018;
• the Data (Use and Access) Act 2025/2026 amendments and other legislation modifying the UK data protection framework;
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), where applicable to electronic communications, cookies and direct marketing; and
• other applicable UK privacy and data protection legislation.

Nothing in this Privacy Notice is intended to limit any rights that individuals have under applicable data protection law.

21. Customer reviews

If you submit a review, we process your rating, review text, the related completed rental, and moderation records so that we can verify the review and decide whether to publish it.

Reviews are moderated by our Office or Admin team. Approved reviews may be published anonymously on our website; we do not publish your name, contact details, rental reference, or other identifying information.

We retain reviews while they are needed for moderation, publication, legal, or security purposes. Rejected reviews may be retained internally and deleted when no longer needed. You may contact us to exercise your data protection rights.

22. Contact us

Questions concerning this Privacy Notice or Pedalebikes' handling of personal information should be sent to:

Pedalebikes Ltd

Data Protection / Privacy Contact: Manager

Email: Admin@pedalebikes.co.uk

Registered Address: 167-169 Great Portland Street, London, United Kingdom, W1W 5PF

Company Number: 16974834