Privacy Statement

Introduction

Updated 1 March 2023

Bike to Work Ltd protect users personal information and data.

Bike to Work Ltd will only use the information that Bike to Work Ltd collect about users lawfully in accordance with the Data Protection Act 2018 and the EU General Data Protection Regulations (GDPR).

Who Bike to Work Ltd are

The biketowork.co.uk Bike to Work Ltdbsite and all subdomains are owned by Bike to Work Ltd trading as Hubex whom Bike to Work Ltd refer to as “Bike to Work Ltd” in this Privacy Statement, is committed to protecting users privacy. Bike To Work Ltd is a company registered in Ireland (company number 464697) with its registered office at 175 Ivy Exchange, Granby Place, Parnell Square West, Dublin 1.

Users can contact Bike to Work Ltd at the above address of by phone to +353 1 514 3520 or email info@hubex.ie

This Privacy Statement

Please note that use of the Website by users and any Services offered by Bike to Work Ltd (such as Bike to Work Ltd's customer support phone lines) is subject to this privacy statement (the “Privacy Statement“) and to the Website’s terms and conditions of use (“Terms and Conditions“).

Bike to Work Ltd's Privacy Statement explains what information Bike to Work Ltd collect, how Bike to Work Ltd use and/or share this information, and how such information is maintained. By using this Website or any other Services of Bike to Work Ltd, users signify their acceptance of this Privacy Statement. If users do not agree to the terms of this Privacy Statement, in whole or part, users should not use this Website or services of Bike to Work Ltd. Please note that this Privacy Statement applies with respect to the information collected on the Website and through any other contact Bike to Work Ltd have with users.

Bike to Work Privacy Statement ensures that any information users provide Bike to Work Ltd remains private and secure. To reassure users, below Bike to Work Ltd provide details of the information users provide to us, and how it will and, more importantly, will not be used. Bike to Work Ltd will never collect sensitive information about users without users explicit consent. The information Bike to Work Ltd hold will be accurate and up to date. Users can check the information that Bike to Work Ltd hold about users by contacting Bike to Work Ltd (and there may be an administrative fee payable for this). If users find any inaccuracies Bike to Work Ltd will delete or correct them promptly.

Transactional Use of Data

LEGAL BASIS FOR COLLECTING DATA

Bike to Work Ltd may provide administration services to Employers such as administering the Cycle to Work Scheme. In this case the employer is the data controller for the user's data and Bike to Work Ltd are a data processor. Bike to Work Ltd are processing users data on behalf of the user's Employer on the legal basis that users are entering into a contract with their employer in order to process their order. This contract is detailed in the Salary Sacrifice Agreement entered into with the user's Employer and any associated Hire Agreement.

DATA COLLECTED

Bike to Work Ltd will collect the following data for Cycle to Work Scheme orders.

Name
Middle initial
Surname
Employer Name
Work email
Work phone
Work address

Depending on the settings for the user's Employer Bike to Work Ltd may also collect additional information such as employee ID or work location. These will be detailed in the user registration or the order submittal forms.

TRANSACTIONAL PROCESSING OF DATA

Bike to Work Ltd will process user data as follows:

To process orders and renewal or orders
To keep users informed about orders and the renewal of orders
In improving and developing this website and Bike to Work Ltd's related websites.
To respond to any queries users might have and generally provide customer support to users.

Bike to Work Ltd also always reserve the right to disclose data in order to:

comply with applicable laws
respond to governmental enquiries; or enquiries from a legal, governmental or quasi-governmental local authority agency, or Internet protection agency
comply with a valid legal process or procedure
protect Bike to Work Ltd's rights or property, this website, and/or other users of this website

TRANSFER OF DATA TO THIRD PARTIES

For Cycle to Work Scheme orders, Bike to Work Ltd may transfer users' name and surname to the bike shop along with the details of the quote for the bicycle and accessories that the user got from the bike shop.

Users may wish to give the shop additional information to allow them to order their bicycle, arrange collection, or as part of any warranty for the goods. Users are responsible for transferring this data to the bicycle shop and the bicycle shop will be the controller of this data which will be administered using the bicycle shop's systems.

Bike to Work Ltd may use a third party Halfords Limited t/a Cycle2Work to hire bicycles for Cycle to Work Scheme order and for fulfilling Cycle to Work Scheme vouchers. It this applies to an order then:

Halfords Limited t/a Cycle2Work will be the Data Controller for any data collected.
In order to place an order the Employee will review and accept a Privacy Notice with Halfords Limited t/a Cycle2Work as an Annex to the Hire Agreement between the Employee and Halfords Limited t/a Cycle2Work. This Privacy Statement will set out how Halfords Limited t/a Cycle2Work will use data and how Employees can exercise their data rights.
When processing the order Bike to Work Ltd may transfer the Employee's name, employer name, work email, work phone and order details to Halfords Limited t/a Cycle2Work, to fulfil the order and for the purposes set out in the Privacy Notice between the Employee and Halfords Limited.

AGREEING TO THIS USE OF DATA

Users must agree to this use of their data in order to submit an order by checking the checkbox to agree to this Privacy Statement. If users do not agree Bike to Work Ltd will not be able to accept their order as Bike to Work Ltd require this data in order to process the order.

Marketing Use of Data

Bike to Work Ltd may ask users to consent to allow Bike to Work Ltd to use users data for marketing purposes. Users have a choice whether they opt in or not, and users do not have to opt in in order to place an order with Bike to Work Ltd.

If users consent to allow Bike to Work Ltd to use data for marketing data Bike to Work Ltd may use the following data:

Name
Surname
Work email
Work phone
Work address
Employer Name
Details of the orders users place.

Bike to Work Ltd may use and process the data for the following:

To send users news on Bike to Work Ltd's services and other related services and services related to the Cycle to Work Scheme.
To send users special offers and discounts on bikes, accessories and cycling related products.
To let users know about new public transport services or other information on public transport.
To analyse trends and carry out research on Bike to Work Ltd's orders and in cycling and the use of public transport generally.

Bike to Work Ltd will never sell users' data. Bike to Work Ltd will not transfer users' data to third parties other than third parties Bike to Work Ltd use to process the data for Bike to Work Ltd's use as set out below in the section on third parties.

Third Party Processors

In the section above Bike to Work Ltd have described how Bike to Work Ltd may transfer users' data to Bike Shops for Cycle to Work Scheme Orders as part of fulfilling those orders. These Bike Shops and Public Transport Operators become Data Controllers for that data.

Beyond this, Bike to Work Ltd use may third party Sub-Processors to deliver Bike to Work Ltd's services and may securely transfer users' data to them. These may include

Bike to Work Ltd's software developer
Bike to Work Ltd's server hosting company
Third party services for delivery of emails such as SendinBlue, Amazon or Google.
Outsourced service providers
Professional advisers and auditors.

This third party processing is on behalf of Bike to Work Ltd. Bike to Work Ltd will not transfer users' data to third parties for their purposes without users' explicit consent. Bike to Work Ltd will inform Employers of Bike to Work Ltd's current Sub-Processors and of any proposed additions or changes to them.

Personally Identifiable Information collected while browsing Bike to Work Ltd's websites

When using the Website, Bike to Work Ltd may also collect users' IP (Internet Protocol). An IP address is a number that is assigned to users' computers when they use the Internet. Users' IP address are also used to help identify users during a particular session and to gather broad demographic data.

Bike to Work Ltd use users' IP address to:

help Bike to Work Ltd's website function to process users' orders
address to help diagnose problems with Bike to Work Ltd's server
to administer the Website.

Security and retention

The data which Bike to Work Ltd hold, will be held securely within Bike to Work Ltd's systems in accordance with Bike to Work Ltd's internal security policy and the law. Bike to Work Ltd will hold users' data for seven years after users place their last order after which it will be anonymised.

Cookies and Google Analytics

Bike to Work Ltd use “cookies”, technology to store data in users' computer using the functionality of users' browser. The information stored in the cookie is used to identify the user.

When users first view Bike to Work Ltd's website users will get a popup about cookies. At any other time users can click in a Cookies Declaration link in the footer of the website to get information and options for cookies. Bike to Work Ltd will list the different types of cookies Bike to Work Ltd use. Certain cookies are necessary for the proper functioning of the website and cannot be opted out of. Other cookies are optional and users can change users' preferences.

Necessary Cookies

Bike to Work Ltd use cookies which enables Bike to Work Ltd to operate an efficient service and to track the patterns of behaviour of visitors to the website. These are necessary and are not optional.

Optional Statistics and Marketing Cookies

Bike to Work Ltd may ask users to accept other cookies to help Bike to Work Ltd understand how visitors use Bike to Work Ltd's website, for analytics, to provide instant messaging chat, to help Bike to Work Ltd's marketing and to display ads. These cookies are optional.

This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on users' computer to help the website analyse how users use the site. The information generated by the cookie about users' use of the website (including users' IP address) may be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating users' use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate users' IP address with any other data held by Google.

Note that the use of cookies by third party advertisers or ad servers such as Google is not subject to this Privacy Statement, but is subject to their own respective Privacy Statements.

Users' Rights

Users have the followings rights which can be exercised as follows:

RIGHT TO BE INFORMED

This Privacy Statement informs users about their data.

RIGHT OF ACCESS

In the footer of Bike to Work Ltd's websites users can access information on cookies used.

If users login to www.biketowork.co.uk and click My Account users can access the data that Bike to Work Ltd hold on them.

RIGHT OF RECTIFICATION

When users login to www.biketowork.co.uk and click My Account users can immediately edit certain data fields that Bike to Work Ltd hold on them. For other fields Bike to Work Ltd cannot allow users to edit the data immediately as it may be in use for active orders. Users can raise a support request to request a data amendment.

Users can also opt-in or opt-out of the use of users' data for marketing purposes.

RIGHT OF ERASURE

See the section above on Bike to Work Ltd's general data retention policy.

Users can request that Bike to Work Ltd erase the data Bike to Work Ltd hold on users by logging in at www.biketowork.co.uk, clicking My Account and creating a support request. Bike to Work Ltd are processing the data on behalf of the users's Employer, who is the data controller. Bike to Work Ltd will discuss the erasure request with with Employer. Bike to Work Ltd will erase or anonymise as much data as possible. Bike to Work Ltd or the user's Employer may need to retain certain amounts of data. For example if an order is processed for a Cycle to Work Scheme bike the Employee will get tax relief on that order and the Employer may need to retain the data for audit purposes. Bike to Work Ltd will communicate the response to the data request to the user.

RIGHT TO RESTRICT PROCESSING

Bike to Work Ltd have outlined above what data Bike to Work Ltd require in order to process orders.

Users can login to www.biketowork.co.uk and go to My Account and request that Bike to Work Ltd restrict processing by opting out of consenting to the use of users' data for marketing purposes (if the user had previously consented).

RIGHT TO DATA PORTABILITY

Orders can only be processed through the user's employer who is the data controller. The user's Employer can request copies of the data if required to ensure data portability.

RIGHT TO OBJECT

When Bike to Work Ltd reply to any data rectification request Bike to Work Ltd will inform the user about their right to object and include details on how to object.

RIGHTS ASSOCIATION WITH AUTOMATED DECISION MAKING INCLUDING PROFILING

Bike to Work Ltd don't have automated decision making processes.

Changes to this Statement

Please note that this Statement forms part of the Terms and Conditions for use of the biketowork.co.uk website and all associated subdomains, and Bike to Work Ltd, and associated brands and services, and forms part of the Agreement between the user and Bike to Work Ltd. Users can determine when this Privacy Statement was last revised by referring to the last updated date at the top. Bike to Work Ltd may, from time to time, amend this Privacy Statement, in whole or part, in Bike to Work Ltd's sole discretion. If Bike to Work Ltd make major changes Bike to Work Ltd will ask users to accept the revised Privacy Statement before users place any new orders.

Revisions

Revised 1 March 2023: Data Protection Act 2018 referenced. Reference to Halfords Ltd t/a Cycle2Work added to section on Transfer of Data to Third Parties. References to ticket benefit removed.
Revised: 16th May 2018: Full update to reflect the GDPR
Revised: 6th October 2016: Reference to Data Protection Act 1998 updated to Data Protection Acts, 1988 and 2003
Published: 4th March 2015