PRIVACY STATEMENT Bikecenter Paul van Hal – mountain bike rental Version November 2026 1. Who we are We are Bikecenter Paul van Hal, Nieuweweg 29A, 3765 GA Soest, the Netherlands. We rent out (electric) mountain bikes and bicycles from Soest and at Theehuis 't Hooge Erf in Lage Vuursche. We are responsible for processing your personal data as described in this statement. You can reach us at info@bcpvh.nl or +31 35 888 96 72. 2. What data we process and why a. Booking and renting: your name, email address, phone number (optional), address, postcode and town, and the details of your booking (date, time, location, bikes rented, amount). We use this to carry out your booking, send you a confirmation and a reminder, and get your bike ready. Legal basis: performance of the contract. b. Payment: you pay via Mollie. We do not see or store your bank details or credit card number. We only store whether and how you paid. For a refund we store the amount and the method. Legal basis: performance of the contract. c. Invoices and accounting: we keep invoice data because the law requires it. Legal basis: legal obligation. d. Security and preventing misuse: we store the IP address used to make a booking, to prevent misuse and fraud. Legal basis: legitimate interest. e. After-rental service: after your ride we may send you a short email asking how it went and whether you would like to write a review. Legal basis: legitimate interest. You can always object to this. f. Customer account (optional): if you create an account, we store your details so you don't have to enter them again and can see your bookings. You log in with a link we send by email. If you choose 'stay logged in', we place a cookie for this. Legal basis: performance of the contract and your choice to create an account. You can delete your account yourself at any time. g. Cookies and statistics: we place necessary cookies without consent. We only place cookies for statistics and marketing if you choose to allow them. Read more in our cookie statement. Legal basis: consent. h. News and offers by email: if you have rented from us before, we may occasionally email you about similar services of ours, such as new routes or a discount offer. We only use your name, your email address and the location where you rented. Every email contains an unsubscribe link. You can also unsubscribe via info@bcpvh.nl. After that we will no longer send you offers. Legal basis: legitimate interest (existing customers, Article 11.7 of the Dutch Telecommunications Act). i. Chat assistant on the website: our chat assistant uses artificial intelligence (AI) and answers questions about rentals, routes and availability. If you wish, it can prepare a booking for you. We store the conversation and the details you enter yourself, so that we can help you further and improve the assistant. Please do not share sensitive information in the chat. The assistant does not make decisions about you. If in doubt, it passes the conversation on to a staff member. Legal basis: legitimate interest and, for a booking, performance of the contract. j. WhatsApp, phone and email: if you contact us, we use your details and your message to help you. WhatsApp is a service of WhatsApp/Meta; WhatsApp's own privacy policy also applies. Legal basis: legitimate interest or performance of the contract. k. Self-service rental: if you rent a bike via self-service (without staff present), we ask for a photo of your driving licence or ID card and a deposit. This way we know to whom the bike was handed out and can prevent theft and damage. Preferably cover your citizen service number (BSN) and passport photo when taking the photo; we do not need them. We only use the photo to verify your identity and delete it after 30 days, unless there is damage, theft or a dispute. You pay the deposit via Mollie and get it back after the bike has been checked. Legal basis: legitimate interest and performance of the contract. l. Camera surveillance: there are cameras at our rental points. When a bike is picked up or returned, the system automatically takes a snapshot at the gate. We do this to prevent theft, damage and misuse, and to be able to establish what happened in case of a dispute. A sign on site indicates that camera surveillance is in place. Legal basis: legitimate interest. m. Route app: our route app can use your location to show your position on the map. This only happens on your own phone and only if you allow it. Your location is not sent to us and not stored by us. 3. How long we keep data We keep bookings and invoices for 7 years, because the law requires this for accounting. We keep a customer account until you delete it. We keep proof of your cookie choice for a maximum of 24 months, without your name or email address. Login links are valid for 20 minutes. The IP address is stored together with the booking. After you unsubscribe from our emails, we only keep your email address on a suppression list so that you no longer receive emails from us. We keep chat conversations and messages for a maximum of 12 months. We delete the self-service ID photo after 30 days. We keep camera images and snapshots for a maximum of 30 days. In case of damage, theft or a dispute, we keep the relevant images and data for as long as necessary to settle the matter. 4. Who we share your data with We do not sell your data. We only share it with parties that need it to provide our service: Mollie (payments and deposits), our hosting and email provider, the provider of the AI technology behind our chat assistant, WhatsApp/Meta (if you contact us via WhatsApp), and, only with your consent, Google (statistics and ad measurement). We make agreements with parties that process data on our behalf about security and use. In case of theft or damage we may share data and images with the police or our insurer. Otherwise we only pass on data if the law requires us to. Some of these parties (such as Google, Meta and the provider of the AI technology) may also process data outside the European Union, for example in the United States. This only happens with the safeguards required by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. 5. Security Our website uses a secure connection (https). Staff have their own login with two-factor authentication and only see what they need for their work. ID photos and camera images are only accessible to staff who need them. 6. Do you have to provide your data? To rent a bike we need your name, email address and booking details. Without this data we cannot carry out your booking. For self-service, an ID photo and a deposit are required. If you do not want to provide these, you can rent a bike at a time when staff are present. Your phone number and a customer account are optional. 7. Automated decision-making We do not take decisions about you that are made solely by a computer and that have significant consequences for you. Our chat assistant does not do this either. 8. Your rights You have the right to access, correct or delete your data, to restrict processing, to object and to data portability. You can always object to the use of your data for emails with offers; we will then stop immediately. If you have given consent, you can withdraw it at any time. Email us at info@bcpvh.nl. We respond within one month. Data we are legally required to keep cannot be deleted earlier. Do you disagree with how we handle your data? Please contact us. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl). 9. Changes We may change this statement. The latest version is always on our website. With every booking we record which version you have seen.