Data protection information
for the CITY CYCLING campaign

A. Controller in the sense of GDPR

The body responsible for the processing of your personal data as part of the CITY CYCLING campaign (known as the “controller”) pursuant to Art. 4(7) GDPR is:

Climate Alliance Services (Klima-Bündnis der europäischen Städte mit indigenen Völkern der Regenwälder Services GmbH)
Eschborner Landstraße 42 – 50
60489 Frankfurt am Main
Germany
europe@climatealliance.org
Tel. +49 69 717139-0

As the CITY CYCLING campaign is implemented together with the participating municipalities and the latter may use the processed data for their own purposes (as described below), the processing in this respect takes place in conjunction with your local municipality (i.e. the municipality you registered for) as joint controllers. We have signed an agreement on joint controllership with the participating municipalities in accordance with Art. 26 GDPR.

We have appointed a data protection officer; he can be reached at the following address or via email:

Datenschutz Mittelhessen GbR
Dr. Christian Velten
Bodenstraße 20
35606 Solms
Germany
info@datenschutz-mittelhessen.de
Tel. +49 6442 7085047

B. Which data do we process and for what purposes?

If you register via the CITY CYCLING website or app, use the CITY CYCLING app or RADar! reporting platform (optional), or are active as a local CITY CYCLING coordinator for a participating municipality, we process certain items of your personal data. Which items these are and for what purposes we process them may vary depending on the specific use. In the following, we would like to provide an overview of which uses may arise and which items of your personal data we process in this case. In addition, you will find explanations of the purposes of processing and the respective legal basis for this processing. The explanations essentially follow the typical process of using the various participation options, from your registration to deletion of your data.

I. Data processing during registration via the CITY CYCLING website or app

To participate in CITY CYCLING and use the app, you first need to register. This can be done either in the app or via the CITY CYCLING website.

If you register as a participant in the CITY CYCLING campaign, the following data will be collected from you:

• first name
• last name
• email address
• username
• password (encrypted)
• birth year
• form of address
• municipality
• team

We need to know your birth year to check whether you are able to give lawful consent. Pursuant to the data protection regulations, you are only able to do so from the age of 16 (Art. 8(1) GDPR). The processing would only be lawful otherwise if and insofar as this consent is given or authorised by the holder of parental responsibility over the child. We also need to know your birth year to best tailor the campaign to participants and to enhance the usefulness of the data collected for research purposes and municipal cycling planning.

Processing of the aforementioned personal data takes place on the basis of the declaration of consent that you give voluntarily while registering in the CITY CYCLING app and/or on the CITY CYCLING website pursuant to Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR. Data is collected for the purpose of enabling you to participate in the CITY CYCLING campaign and to use the CITY CYCLING website and app.

If you participate in the campaign as a CYCLE STAR, your telephone number will be processed by us in addition to the aforementioned data. You can moreover optionally provide information on your title, an alternative telephone number, your parliamentary group/institution and your function. You will be listed as a CYCLE STAR if (following consultation with the local coordination) you voluntarily agree to represent the campaign in your municipality to the public. Processing takes place on the basis of the declaration of consent that you gave voluntarily during the registration process within the sense of Art. 6(1)(a) GDPR.

II. Processing of the personal data of local coordinators

If you are involved in the CITY CYCLING campaign as a coordinator for a participating municipality, we will process the following items of personal data:

• first name
• last name
• email address
• username
• password (encrypted)
• birth year
• municipality/institution
• telephone number
• address
• team

In addition, you can optionally enter information regarding a department or specialist area as well as your function.

The data is collected for the purpose of enabling you as coordinator to organise the CITY CYCLING campaign in your municipality and, if necessary, to participate in the campaign yourself as a cyclist. The data processing is carried out on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest is smooth organisation of the CITY CYCLING campaign in the participating municipalities. We need local coordinators for this, who act as contact persons for the participating cyclists and implement the campaign locally. If you actively participate in the campaign as a cyclist, sections III–VI also apply with regard to the processing of your data.

All data collected during the registration of cyclists and coordinators is automatically stored on a server of our service provider, Timme Hosting GmbH. We have concluded an order processing agreement with this service provider within the sense of Art. 28 GDPR.

III. Data processing while using the CITY CYCLING app

In addition to our website, we offer a mobile app that you can download to your mobile device. When downloading the mobile app, the required information is transmitted to the app store – in particular, your username, email address and account number, time of download, payment information (where applicable) and the individual device identification number. The app store additionally collects various data independently and provides you with analysis results. We have no influence over this data processing and are not responsible for it. We only process the data insofar as it is necessary for downloading the mobile app to your mobile device.

Using the CITY CYCLING app allows you to record the journeys you complete by bike easily and conveniently using an accurate tracking function. The following data will be collected from you:

• GPS coordinates (longitude and latitude, altitude, date, time, accuracy, speed)
• 3-axis acceleration data
• 3-axis gyroscope data
• 3-axis magnetometer data
• device ID to recognise data from the same smartphone
• smartphone model

The distance cycled including the date and time is determined based on this data. You additionally have the option of commenting on the route(s) cycled.

The responsible body (Climate Alliance) will transfer the data collected and processed to flow.d GmbH, Vision Velo UG and the TU Dresden for further processing exclusively for the purposes of research and municipal cycling planning. The following information is transmitted for this purpose: GPS coordinates, 3-axis acceleration data, 3-axis gyroscope data, 3-axis magnetometer data, user ID, device ID, year of birth, form of address, municipality, smartphone model and operating system, build version of the app components. The processing by flow.d GmbH and Vision Velo UG forms part of the order processing in the sense of Art. 28 GDPR. We have concluded an order processing agreement with these two service providers.

The data processed within the scope of this agreement is based on the consent you give voluntarily during the registration process within the sense of Art. 6(1)(a) GDPR. With regard to processing of the requested content, access status, operating system, device ID and type of smartphone used, there is also a legitimate interest in the data processing, as we need this data to be able to make the app technically available to you and to be able to optimally adapt the display to your smartphone model and operating system as well as to ensure the security of our app. The legal basis in this respect is Art. 6(1)(f) GDPR.

IV. Data processing while using the CITY CYCLING website

As an alternative to using the CITY CYCLING app, you can also record the journeys you cover by bike manually via the CITY CYCLING website (city-cycling.org).

For technical reasons, Climate Alliance automatically collects and saves information in its server log files that has been transmitted by the user’s browser. The following information is collected:

• browser type/version
• operating system used
• referrer URL (page previously visited)
• host name of the accessing computer (IP address)
• date and time of the server query
• files viewed
• data volume sent

Climate Alliance is not able to associate this data with a specific person. This data is not combined with any other data sources; it will moreover be deleted following a statistical analysis.

In order to enhance the functionality of our website and to make the use of our website more convenient for users, we use small text files known as “cookies”. These help to make our offers more user-friendly, effective and secure. Cookies are downloaded on a user’s computer and saved by their browser. Most of the cookies that we use are what is known as “session cookies”, which are automatically deleted when a user’s visit to the website ends. Cookies do not damage the user’s computer or contain any viruses. Users are able to prevent cookies from being stored on their computer by changing the appropriate settings in their browser. However, please note that doing so may limit the functionality of our website.

Tracking and web analytics services

As the provider of this website, we use services of etracker GmbH based in Hamburg, Germany to analyse usage data. Cookies are used to enable a statistical analysis of the use of this website by users. etracker cookies do not contain any information enabling the identification of users.

The data generated in this way is processed and stored by etracker on our behalf exclusively within Germany and is therefore subject to the strict German and European data protection laws and standards. etracker has been independently audited, certified and awarded an ePrivacyseal.

Given that our users’ privacy is particularly important to us, etracker anonymises the IP address as soon as possible and converts login or device IDs into a unique key that is not assigned to a person. etracker does not use the data in any other way, combine it with other data or pass it on to any third parties.

For more information on data protection at etracker, see here.

The following data is collected from you when you enter kilometres manually via the website:

• distance cycled including date
• number of journeys

You also have the option of entering the time and making notes on the routes you cycled.

This data is processed for the purpose of determining the kilometres you cycled for your team and municipality. The data processed within the scope of this agreement is based on the consent you give voluntarily during the registration process within the sense of Art. 6(1)(a) GDPR.

V. RADar! reporting platform

Participating municipalities have the option of offering the RADar! reporting platform and you also have the option of using it. We would like to point out that participation in CITY CYCLING is also possible without using the RADar! reporting platform.

We collect the following information from you when you submit RADar! reports:

• time of the report (date, time)
• time of the last change (date, time)
• address
• report category / reason for report
• report coordinates (longitude and latitude)
• report status (not yet processed, currently being processed, processed, neutral, positive)
• first name of the reporting person
• last name of the reporting person
• email of the reporting person
• municipal/regional key (AGS/ARS)

You additionally have the option of providing the following information:

• comments on the report
• up to 3 photos for the report
• comments from other cyclists who also reported this issue
• photos from other cyclists who also reported this issue
• comments from coordinators on the report

We collect the following information when comments are submitted about a particular RADar! report:

• user ID of the commenting person
• email of the commenting person
• time of the comment

This data is collected when you submit a report and automatically stored on servers of Timme Hosting GmbH & Co. KG and Hetzner Online GmbH . We have concluded an order processing agreement with this service provider within the sense of Art. 28 GDPR. The purpose of processing this data is to provide you with a simple way to alert your municipality of issues, in particular hazards or opportunities for improvement in the local cycle network. Your contact information is collected to enable your municipality to contact you directly regarding your report.

For RADar! reports submitted in Hesse:

Since many municipalities in Hesse use the RADar! reporting platform and the Meldeplattform Radverkehr (MPR) in parallel, reports submitted via RADar! can optionally also be managed by specialist MPR users or the RADar! reports can be forwarded to the MPR. The MPR is operated by ivm GmbH (Integrated Traffic and Mobility Management Frankfurt Rhine Main Region).

The RADar! coordinators’ contact details are only passed on to the specialist MPR users in these two cases. The reports submitted by users of the RADar! reporting platform, including their contact details, are also transmitted to the specialist MPR users as part of processing in the aforementioned cases.

OpenStreetMap

If a municipality participating in CITY CYCLING also uses the RADar! reporting platform, an interactive map will be displayed on the municipality's subpage. We use the open source map service "OpenStreetMaps" (= "OSM") to display this map. The provider is the company OpenStreetMap Foundation CLG, 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom. OSM is used to provide an interactive map on the subpages of the municipalities, which shows you where in the municipality there are reports from cyclists regarding the cycling infrastructure or which enables you to submit reports yourself (set Pin in map). To use OSM, it is necessary to save the IP address of your device and, if you submit a report, also the longitude and latitude of the position where the pin was placed.

The use of OSM is in the interest of an appealing presentation and easy use of our online offers; this constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR (legitimate interest in data processing).
You can find the data protection information of OpenStreetMaps here.

The data processed within the scope of this agreement is based on the consent you give voluntarily during the registration process within the sense of Art. 6(1)(a) GDPR.

VI. Sending of newsletters and automated emails

Climate Alliance uses Mailjet to send:

• newsletters relating to the CITY CYCLING campaign
• mass emails with specific information about the campaign to participating cyclists as well as to the local coordinators in the municipalities
• automated emails (e.g. registration confirmation, forgotten password, etc.)

For this, we use the service of the provider Mailjet SAS (Global HQ) with the office and postal address in Paris: 13, rue de l’Aubrac, 75012 Paris, France. Mailjet is a service that among others enables organisation and analysis of the sending of newsletters; the data collected for the purpose of sending newsletters is stored on Mailjet’s servers. Using Mailjet allows us to analyse whether an email has been opened and which links, if any, have been clicked. The email address we have stored will only be used to send emails containing important information about the CITY CYCLING campaign.

We provide a link in each newsletter to unsubscribe. Alternatively, you can request to cancel your subscription via email (info@city-cycling.org).

Click here to view Mailjet’s privacy policy.

Climate Alliance uses Sendinblue to send:

• automated emails (e.g. registration confirmation, forgotten password, etc.)

The provider in Germany is SendinBlue GmbH, Köpenicker Straße 126, 10179 Berlin, which is a subsidiary of the French parent company SendinBlue SAS, 55, rue d’Amsterdam, 75008 Paris, France.

See here for Sendinblue’s privacy policy.

We have concluded an order processing agreement with SendinBlue and Mailjet within the sense of Art. 28 GDPR. The data processed within the scope of this agreement is based on the consent you give voluntarily during the registration process within the sense of Art. 6(1)(a) GDPR.

Please note:

Municipalities can also use external service providers to send municipality-specific newsletters relating to the campaign itself. Municipalities are obliged to conclude a processing agreement within the sense of Art. 28 for this, as part of the joint controllership agreement.

C. Who can access the data collected?

Climate Alliance and those involved in the campaign (local and state coordinators, team captains, RADar!! coordinators) will use the data detailed in Section B for campaign communication and the associated RADar! and RiDE – Radverkehr in Deutschland projects. This includes for the following uses:

• account maintenance and management (creation, deletion, adjustment) of the coordinator accounts in the participating municipalities/federal states
• account maintenance and management (creation, deletion, adjustment) of the cyclists in the participating municipalities
• national awards for municipalities by population size in two winning categories
• awards (e.g. raffling off of prizes) for teams and/or participants within the participating municipalities by the local coordination/state coordination/national coordination (download/evaluation of Excel lists)
• newsletters from Climate Alliance to the local/state/national coordinators
• emails from Climate Alliance to cyclists
• newsletters and municipality-specific information from local, state and national coordinators to participants in their respective municipalities
• emails from team captains to team members
• emails between RADar! coordinators (or those commissioned by the municipality) and the reporting persons (e.g. in the event of specific queries/concerns regarding reports submitted)
• team chat messages in cyclists’ login area and the app
• sending of materials (posters/flyers/merchandise) to local and state coordinators

If the RADar! reporting platform is used in addition to CITY CYCLING:

• account maintenance and management (creation, deletion, adjustment) of RADar! coordinator accounts in the participating municipalities
• account maintenance and management (creation, deletion, adjustment) of the cyclists in the participating municipalities
• management by the municipality of the reports submitted by cyclists

The user will moreover only be shown the data for their team (first and last names, total kilometres). The team captains who enter a statement under “Settings” are the exception here. Their statements (including their full name, team name and photo) will be published on the subpage of the municipality that they are cycling for. When the according privacy settings are selected, the user’s team will only be able to see the user’s initials; the total kilometres cycled can also be hidden if desired. As a general rule, personal data will not be published or passed on to any other third parties. The exception here is those participating in the special CYCLE STAR category whose title, first and last names, municipality and kilometres cycled per week will be listed on city-cycling.org/results.

State coordinators

In Baden-Württemberg, as part of the RadKULTUR initiative of the Ministry of Transport of Baden-Württemberg (represented by NVBW – Nahverkehrsgesellschaft Baden-Württemberg mbH), managed by the following consortium:

IFOK GmbH
Berliner Ring 89
64625 Bensheim

die wegmeister GmbH
Hallstraße 25
70376 Stuttgart

In Bavaria, on behalf of the Bavarian State Ministry for Housing, Construction and Transport and the AGFK Bavaria:

Green City Experience GmbH
Albert-Roßhaupter-Str. 32
81369 Munich

In Hesse, on behalf of the Hessian Ministry of Economics, Energy, Transport and Housing:

ivm GmbH
Bessie-Coleman-Straße 7
60528 Frankfurt am Main

In Lower Saxony:

Niedersächsisches Kultusministerium
(Ministry of Education and Cultural Affairs of Lower Saxony)
Referat 23
Hans-Böckler-Allee 5
30173 Hanover

As well as the affiliated regional state offices for schools and education in Osnabrück and Braunschweig

In North Rhine-Westphalia, on behalf of the Ministry of Transport of North Rhine-Westphalia:

Verkehrsverbund Rhein-Sieg GmbH
Zukunftsnetz Mobilität NRW
Glockengasse 37-39
50667 Cologne

In Rhineland-Palatinate:

Ministerium für Klimaschutz, Umwelt, Energie und Mobilität Rheinland-Pfalz
(Ministry for Climate Protection, Environment, Energy and Mobility of Rhineland-Palatinate)
Kaiser-Friedrich-Straße 1
55116 Mainz

In Saarland:

Ministerium für Wirtschaft, Arbeit, Energie und Verkehr Saarland
(Ministry for Economic Affairs, Labour, Energy and Transport)
Franz-Josef-Röder-Straße 17
66119 Saarbrücken

In Thuringia:

Thüringer Ministerium für Infrastruktur und Landwirtschaft
(Thuringian Ministry for Infrastructure and Agriculture)

Referat 44 | Straßenbau, Straßenrecht und Radverkehr

Werner-Seelenbinder-Str. 8

99096 Erfurt

The contact details of the local CITY CYCLING coordinators can only be passed on to the responsible state ministry by the state coordinators for the CITY CYCLING campaign (e.g. for thank-you letters, invitations to CITY CYCLING events, etc.).

The purpose of data processing by the parties listed in Section C is to provide editorial, organisational and communications support for implementation of the CITY CYCLING campaign and the associated RADar! and RiDE – Radverkehr in Deutschland projects. Processing or use for other or commercial purposes is not permitted. The transfer of the data to those involved in the campaign is based on your voluntary consent within the sense of Art. 6(1)(a) GDPR. As already mentioned in the introduction, we have concluded an agreement on joint controllership with the municipalities.

D. Storage and deletion of your personal data

All personal data that is stored will be deleted irretrievably as soon as it is no longer required for the purposes for which it was collected or as soon as a user requests this and no other legal basis for its storage exists.

In order to facilitate participation in the CITY CYCLING campaign, participants’ access details (username and password) will remain valid for a maximum of two further years. This means that they will not need to re-register if they participate in CITY CYCLING again in the following year or the year after that. To ensure the efficient use of storage capacities, user accounts that have not been accessed for two years will be deleted. The same applies for inactive accounts for which registration has not been confirmed.

Climate Alliance, the local, state and national coordinators, and the team captains may store the data of the cyclists listed in Section B (only the first and last names and email address) for a maximum of two (2) years. The local, state and national coordinators can use the contact details to contact the participants from the previous year via email and encourage them to participate in the campaign again in the following year.

The report data from the RADar! reporting platform is available to the responsible parties in the respective municipality for different periods of time, depending on the licence model booked. The report processing period – so the period during which the local coordinators in the municipalities are able to process and manage reports – is one or three years as standard. In principle, the participating municipalities are able to extend this period as often as desired. In order to protect your right to privacy, the reporting data will be anonymised after five (5) years at the latest, i.e. it can no longer be no associated with a specific person. Only the report itself and its status (not yet processed, currently being processed, processed, neutral, positive) will be retained.

E. Withdrawal of consent

As explained above, we largely process your personal data based on the voluntary consent you give during the various registration options within the sense of Art. 6(1)(a) GDPR. Please note that you have the right to withdraw your consent at any time. The withdrawal of your consent is effective for the future. This means that processing operations remain lawful in the period prior to receipt of your notice of withdrawal. To exercise your right of withdrawal, send an email to datenschutz@stadtradeln.de or the postal address provided at the start of this privacy policy.

F. Information on the right to object

You have the right to object at any time to the processing of your personal data for direct marketing purposes. You also have the right to object at any time to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

G. Data transfer to countries outside the EU or EEA

We do not transfer your personal data to any countries outside the European Union or European Economic Area.

H. Further rights

Provided that the legal requirements for this are met, you also have the following further rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)

You moreover have the right to lodge a complaint with the respective supervisory authority, for example the supervisory authority at our organisation’s headquarters, the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden (datenschutz.hessen.de).

If you have any questions about this privacy policy or our data processing practices, then please do not hesitate to contact us at datenschutz@stadtradeln.de.

Last updated: 13 March 2024