Privacy Statement

Swapfiets B.V. (hereinafter "Swapfiets", "we", "us" or "our") considers the protection of your personal data of esstential importance. Therefore, we process your data with the utmost care. With this Privacy Statement, we would like to inform you about how we handle personal data.

1.Who is responsible for processing your data?

Swapfiets B.V. (Molukkenstraat 200, 1098 TW Amsterdam) is the legal entity responsible for all collection and all processing of your personal data in connection with the products, services and websites of Swapfiets.

Swapfiets B.V. is part of Pon Holdings B.V. its affiliated companies (“Pon”). Swapfiets B.V. and Pon are committed to respecting and safeguarding your privacy and the security of your personal data you share with us.

2.What is personal data?

All information about an identified or identifiable natural person is personal data. This means that information can be traced to you either directly or indirectly.

3.What personal data do we process?

We process personal data from you when you use one of our services, such as purchasing a subscription to use a bicycle, visiting one of our websites, or using the Swapfiets app (hereinafter collectively referred to as the "Services").

A) Data generated by your use of our Services

Which personal data we exactly process, depends on which websites, products or Services you use. We process the following personal data.

• Data necessary to enter into an agreement with you for the use of our Services, such as your contact information, name, address, date of birth, and height;
• Data necessary for financial administration, such as your bank account number,name and address;
• Data necessary to prevent fraud and abuse of the Services, such as your bank account number, name and address;
• Data necessary to provide service to you, such as the desired location for a service appointment with Swapfiets;
• Data necessary to access and use the Swapfiets app, such as password and username.
• Data to communicate with you, such as your contact information and communication preferences;
• Data about your browsing behaviour as identified by cookies or related techniques (see Article 9 of this Privacy Statement for more information);
• Data related to your devices, such as a MAC address or IP address;
• Data to perform market research and improve our business, Services and products or to develop new business, services and products.
• Data to measure and improve our customer satisfaction; and
• Data about your communication with our customer service (hereinafter the "Swapdesk") such as your questions, feedback or complaints. A telephone conversation with the Swapdesk may be recorded for quality and training purposes. You will be informed in advance if the call is being recorded.
• Data to comply with our legal obligations, resolve disputes, or enforce our agreements, such fiscal information, complaints or information about your subscription with Swapfiets;

B) Data processed with an e-bike subscription

Anti-theft, loss and default
If you enter into an e-bike subscription with Swapfiets, the last known location of the bike may be processed to find lost or stolen e-bikes and to retrieve e-bikes in case of nonpayment. In case of non-payment, Swapfiets will retrieve the bike if you repeatedly fail to respond to written requests to return the e-bike. The processing of this data is necessary for our service, and Swapfiets has a legitimate interest in doing so. Only from the moment you declare the bike lost or stolen, or in case of non-payment, will the location data be continuously collected.

Violation of the General Terms and Conditions of Swapfiets

When you enter into an agreement with Swapfiets and take out a subscription for the use of an e-bike, you can choose between a subscription for normal use or for commercial use (e.g., using the e-bike for commercial purposes, see Swapfiets' General Terms and Conditions). To determine if you have chosen the correct subscription and to prevent misuse, Swapfiets may read e-bike data and subsequently attach legal consequences to it in accordance with Swapfiets' General Terms and Conditions and the e-bike subscription agreement you have with Swapfiets. You will be informed by Swapfiets if an upgrade is necessary and about the possibilities to object to it.

4. Processing: principles and legitimate interests

The processing of personal data takes place on the following legal bases

1. Consent;
2. Performance of a contract with you;
3. Legal obligations; and
4. Legitimate interest of Swapfiets or a third party.

Legitimate interests include security, property protection (read: (crime) prevention against theft or abuse), IT management, research and analysis of proprietary products or Services, corporate governance, legal affairs and internal management.

5. Purposes for processing personal data

In processing your personal data, we act with care. We only use data that is necessary for our service. Swapfiets processes your personal data for the purposes listed below. The number behind each purpose corresponds to the legal basis mentioned in article 4 of this Privacy Statement

A) Purposes for the provision of our services

• The collection and delivery of the bike [principle: 2];
• Protecting our services against, amongst others, fraud and non-payment [principle: 2 or 4];
• Swapfiets administration for financial and fiscal obligations, including (collective) invoicing for our services [principle: 2 or 3];
• Recovery of the bicycle in case of loss, theft, or default [principle: 2 or 4];
• Communication with and informing you about our services [principle: 2 or 4];
• Providing service, for example, in case of maintenance, repair, and/or replacement of the bicycle [principle: 2].

B) General purposes

• Building and maintaining the customer relationship [principle: 2];
• Providing customer service, including service related to the use of products and handling complaints and requests [principle: 2];
• Processing personal data to provide management information [principle: 2 or 4];
• Communicate about future promotional and marketing information including direct marketing purposes and retargeting [principle: 1 or 4].
• Providing app functionality, including providing relevant commercial messages [principle: 1, 2 or 4];
• Conducting market research, including measuring customer satisfaction, to improve our operations, brands, Services, and products [principle: 4];
• The (further) development and improvement of new and existing products and Services [principle: 4];
• Compliance with legal obligations, dispute resolution and enforcement of our rights and agreements [principle: 2, 3, or 4];Analyzing cookies from our website and the Swapfiets app, to ensure that our communication corresponds as much as possible to your personal preferences [principle: 1 of 4].
• Aggregating and/or anonymizing personal data for Swapfiets's own use, such as but not limited to analysis purposes and product and service improvement [principle 4];
• To record incidents [principle 4];

6. No processing of data of persons under 16 years of age

We do not intend to collect data from individuals under the age of 16. We recommend parents to be involved in the (online) activities of their children, in order to prevent Swapfiets from unintentionally processing their personal data.

7. Sharing with third parties

Swapfiets shares your personal data with third parties in, but not limited to, the following situations. The number after each purpose corresponds to the principles mentioned in Article 4 of this Privacy Statement:

• if we are legally obligated or authorized to provide personal data to third parties [principle: 3];
• if we suspect a violation of the rights of third parties, criminal offenses or abuse, we may provide personal data to third parties who have a legitimate interest in doing so or to bodies that serve the public interest. This may include enforcement authorities, such as the Public Prosecutor's Office or supervisory bodies [principle:3 or 4];
• Swapfiets may also share your data with third parties in the context of implementing an agreement with you, or due to justified business interests such as maintaining a central administration or customer service unit, or analysing our Services provided to you [principle: 4];
• with parties that assist Swapfiets in its Services which are not processors (such as accountants and (legal) advisors) [principle: 4];
• For business purposes (such as the divestment of business operations, selling shares, or a reorganization) [principle: 4];

Swapfiets also uses Services of third parties acting as processors on behalf of Swapfiets. Such as suppliers of website hosting providers, research agencies, payment processing, auditing, customer service, email delivery and other services. Swapfiets may also share your personal data to third parties, to permit them to send you marketing communications, consistent with your choices. Swapfiets requires these third parties to process and protect your personal data diligently. Swapfiets will not sell your personal data to third parties.

Swapfiets or Pon might reorganize, merge or in any other way sell or divest (part of) a business company to another company. Where such business relates to Swapfiets, such transfer of ownership may include the transfer of your personal data to the new owner and its advisors.

We will otherwise only disclose your personal data if so required or authorized by law, where necessary for preventing or combating fraud, where necessary for dispute resolution, or for any other pressing legitimate need which under the circumstances must outweigh your privacy interests, such as the security of our business and the safety of our staff.

If personal data is sent to a recipient abroad, it will only be sent to a recipient in a country that the European Commission considers to offer an adequate level of protection or where Swapfiets has taken appropriate security measures to safeguard your privacy. If you wish to receive further information about the transfer of your personal data to countries outside the European Economic Area, please contact Swapfiets's Data Protection Officer (see article 12).

8. Storing your data

We will store your personal data as long as necessary or permitted within the scope of the purposes described in this Privacy Statement and in accordance with the applicable laws and regulations.

9. Mapping website traffic

When you visit or use our website(s), Services or Swapfiets app, we may use cookies, web beacons, and similar technologies. For more details on the use of cookies, please see our cookie statement

10.Your rights, including the right to object

You have the right to know which of your personal data we are processing and to whom we have provided your personal data. If you have consented to the processing of your personal data, you also have the right to withdraw.

If you wish to access, correct, edit, limit or delete any of your personal data processed by us or object to the processing of personal data or (direct) marketing, or wish to receive an electronic copy of your personal data in order to transfer it to another party (to the extent that the applicable legislations permits you transfer such data), you can contact the Swapdesk using the contact details as mentioned under Article 12. Please describe to which personal data your request concerns as clearly as possible. We will respond to your request as soon as possible, but in any event no later than required based on the applicable legislation.

You can exercise your rights in accordance with the law. To ensure that the request is submitted by you, we need to establish and verify your identity through several checks.

Finally, you have the right to file a complaint with the Data Protection Authority.

11. Security

Swapfiets applies appropriate security measures to prevent abuse, loss, unauthorized access, unintentional disclosure and unauthorized modification as much as possible. Swapfiets has taken both technical and organizational measures to secure your personal data, such data encryption. These security measures are periodically reviewed, in the light of threats.

12. Contact

If you have any questions and/or complaints regarding the protection of your personal data or comments or remarks regarding this Privacy Statement, please contact us at info@swapfiets.nl.

Data breach or suspected data breach? Please immediately contact us at security@pon.com.

Our Data Protection Officer can be reached by email at privacy@pon.com.

13. Changes

We may change this Privacy Statement from time to time. Changes to this Privacy Statement will become effective upon posting the revised statement.