Cykel Privacy policy
This is a translation. If the language versions differ, the Swedish version applies. Show the Swedish original
Applies to purchases in a physical shop after a free reservation via the website or app, to bicycle service and to the processing of personal data. For partner shops, each shop is the seller and service provider when this is stated at booking.
PART C | PRIVACY POLICY (GDPR)
1. Data controller and contact
Cykel PRO Malmö AB, company reg. no. 559575-2162, Kalendegatan 13, 211 35 Malmö, info@cykelpro.se, +46 79 310 10 44 is the data controller for processing where the company determines the purposes and means, for example its own customer accounts and the operation of the platform. A partner shop may be an independent data controller for its own customers, sales, workshop assignments and staff data. For certain platform services, Cykel PRO may be a data processor or joint controller, depending on how the respective processing is actually set up.
2. What data and sources
Depending on which features you use, the following are processed: name, email, phone, contact address if necessary, language, company name and company registration number, account type and verification status, booking and reservation details, product and service history, receipts and points, support communication, profile and permission details, technical logs, authentication identifiers, notification token and, when you choose the map feature, any location or searched route. Company details for a sole trader may include a personal identity number. Only data needed for the stated purposes is processed.
3. Purposes and legal basis
Account, reservations and service are processed on the basis of a contract or measures taken at your request before a contract, where applicable. Receipts and bookkeeping are processed because of a legal obligation. Security logging and abuse prevention may be based on legitimate interest after a balancing of interests. Marketing messages are only sent with an applicable legal basis and in accordance with the rules on electronic direct marketing, with separate consent where required. Push notifications may also require technical permission in the operating system.
4. Recipients and external services
To operate the service, data may need to be shared with, among others, providers of hosting (Render), email (Resend), push notifications (Expo), AI support and translation (OpenAI) and the relevant map and navigation providers. Payment services in a physical shop are handled by each shop's payment provider. Which recipients are used depends on the feature. Historical payment transactions may need to be processed under law even though online payment for goods is no longer offered. Partner shops only get access to the data needed for the selected shop and service.
5. Transfers outside the EU/EEA
When personal data is transferred to a country outside the EU/EEA, an applicable lawful transfer mechanism is used, for example an adequacy decision or the European Commission's standard contractual clauses and, where necessary, supplementary safeguards.
6. Storage and deletion
Account data is stored for as long as it is needed for the purpose of the account. When account deletion is requested, data is deleted without undue delay when there is no other legal basis. Data that must be kept for bookkeeping, complaints or legal claims may be stored longer to the extent necessary. Accounting records are kept for the statutory period, normally seven years after the end of the calendar year in which the financial year ended. Data for abuse prevention and support is only kept for as long as there is a documented legal need.
7. Security and permissions
Passwords are not stored in plain text. We use appropriate technical and organisational security measures, including role-based access restriction, authentication, protected communication and separation of data for different shops. Access to customer data is limited to staff who need it in their work.
8. AI chat, translation and automated decisions
If AI is used for support or translation, messages may be processed by an AI provider to answer the request or translate text. Do not share unnecessary sensitive information in the chat. You can ask for human help. Automated decisions that may have legal or similarly significant effects are handled in accordance with applicable data protection rules.
9. Your rights and complaints
Under the GDPR, subject to the applicable conditions, you can request access, rectification, erasure, restriction, data portability or object to processing. Consent can be withdrawn without affecting lawful earlier processing. Contact: info@cykelpro.se. You can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. Requests are handled in accordance with the GDPR's time limits and legal exceptions.
10. Children, cookies and changes
Information about age limits and any need for a guardian's involvement is provided when relevant. Information about cookies and similar technology can be found in the website's separate cookie information. In the event of significant changes to this policy, the company informs users in accordance with applicable rules.