Privacy Statement

Swapfiets B.V. considers the protection of personal data of vital importance. Therefore, we process your data with the utmost care. With this Privacy Statement, we would like to inform you about how we handle personal data.

1.Who is responsible for processing your data?

In this Privacy Statement, Swapfiets B.V. (hereinafter"Swapfiets" ,"we, "us" or "our") describes how it handles your personal data in its capacity as data controller.

2.What is personal data?

All information about an identified or identifiable natural person is personal data. This means that information can be traced to you either directly or indirectly.

3.What personal data do we process?

We process personal data about you when you use one of our services, such as purchasing a subscription to use a bicycle, visiting one of our websites, or using the Swapfiets app (hereinafter collectively referred to as the "Services").

A) Data generated by your use of our Services When you use Services of Swapfiets or otherwise interact with us, we process the following (personal) data as part of our services, depending on the specific use you make of them:

• Data required to enter into an agreement with you for the use of our services, such as your contact information, name, address, date of birth, and height;
• Data necessary for financial administration, such as your bank account number, name and address;
• Data necessary to prevent fraud and abuse of the Services, such as your bank account number, name and address;
• Data necessary to provide service to you, such as the desired location for a service appointment with Swapfiets;
• Data necessary to access and use the Swapfiets app, such as password and username.
• Data to communicate with you, such as your contact information and communication preferences;
• Data about your browsing behavior, as identified by our own observations or cookies (see Article 9 of this Privacy Statement for more information);
• Data related to your devices, such as a MAC address or IP address;
• Data to measure customer satisfaction; and
• Data about your use of our customer service (hereinafter the “Swapdesk”).

B) Data processed with an e-bike subscription If you enter into an e-bike subscription at Swapfiets, the last known location of the bicycle may be processed to recover lost or stolen e-bikes and to retrieve e-bikes in case of default. In case of default, Swapfiets is entitled to retrieve the bike, if you have (repeatedly) failed to comply with the written request to return the e-bike to us.

The processing of this data is necessary for our services and Swapfiets has a legitimate interest due to the high replacement costs of the bikes. In this way, Swapfiets aims to be able to offer e-bikes to you at the sharpest possible rate.

Only from the moment you personally declare that the bicycle is lost or stolen, or in case of default, location data is collected on a constant basis.

C) Data processed on the use of the e-bike

When you enter into an agreement with Swapfiets and take out a subscription for the use of an e-bike, you can choose from different types of subscriptions suitable for the specific use of the bicycle. To determine whether you have chosen the right subscription, Swapfiets can process (technical) data of the bicycle. This gives Swapfiets insight into your use of the bicycle, such as the number stops, the average speed, and the average distance you ride per day.

Processing this (technical) data is necessary for our services and to prevent fraud. Swapfiets aims to offer e-bikes at the lowest rate possible. Intensive use leads to higher costs for Swapfiets. You will be informed by Swapfiets if you require an upgrade.

4. Processing: principles and legitimate interests

Personal data is processed based on the following legal principles:

1. Consent;
2. Performance of a contract with you;
3. Legal obligations; and
4. Legitimate interest of Swapfiets or a third party.

Legitimate interests include security, property protection (read: (crime) prevention against theft or abuse), IT management, research and analysis of proprietary products or services, corporate governance, legal affairs and internal management.

5. Purposes for processing personal data

We process your personal data with care. We only use the data necessary to provide our services. Swapfiets processes your personal data for the purposes listed below. The number following each purpose corresponds to the legal principle mentioned in Article 4 of this Privacy Statement.

A) Purposes for the provision of our services

• The collection and delivery of the bike [principle: 2];
• Protecting our services against, amongst others, fraud and non-payment [principle: 2 or 4];
• Swapfiets administration for financial and fiscal obligations, including (collective) invoicing for our services [principle: 2 or 3];
• Recovery of the bicycle in case of loss, theft, or default [principle: 2 or 4];
• Communication with and informing you about our services [principle: 2 or 4];
• Providing service, for example, in case of maintenance, repair, and/or replacement of the bicycle [principle: 2].

B) General purposes

• Building and maintaining the customer relationship [principle: 2];
• Providing customer service, including service related to the use of products and handling complaints and requests [principle: 2];
• Processing personal data to provide management information [principle: 2 or 4];
• Conducting market research, including measuring customer satisfaction, to improve our operations, brands, services, and products [principle: 4];
• The (further) development and improvement of new and existing products and services [principle: 4];
• Compliance with legal obligations, dispute resolution and enforcement of our rights and agreements [principle: 2, 3, or 4];
• Analyzing cookies from our website and the Swapfiets app, to ensure that our communication corresponds as much as possible to your personal preferences [principle: 1 of 4].

6. No processing of data of persons under 16 years of age

We do not intend to collect data from individuals under the age of 16. We recommend parents to be involved in the (online) activities of their children, in order to prevent Swapfiets from unintentionally processing their personal data.

7. Sharing with third parties

Swapfiets shares your personal data with third parties in, but not limited to, the following situations. The number after each purpose corresponds to the principles mentioned in Article 4 of this Privacy Statement:

• if we are legally obligated or authorized to provide personal data to third parties [principle: 3];
• if we suspect a violation of the rights of third parties, criminal offenses or abuse, we may provide personal data to third parties who have a legitimate interest in doing so or to bodies that serve the public interest. This may include enforcement authorities, such as the Public Prosecutor's Office or supervisory bodies [principle: 3 or 4];
• Swapfiets may also share your data with third parties in the context of implementing an agreement with you, or due to justified business interests such as maintaining a central administration or customer service unit, or analysing our services provided to you [principle: 4];
• with parties that assist Swapfiets in its services which are not processors (such as accountants and (legal) advisors) [principle: 4];
• For business purposes (such as the divestment of business operations, selling shares, or a reorganization) [principle: 4];

Swapfiets also uses services of third parties acting as 'processors' on behalf of Swapfiets, e.g. hosting service providers and research agencies conducting market research or customer satisfaction surveys. If these third parties are designated as processors in accordance with applicable data protection laws, Swapfiets will enter into written agreements with these third parties. These service providers will only process personal data in accordance with the instructions and under the supervision of Swapfiets.

If personal data is sent to a recipient abroad, it will only be sent to a recipient in a country that the European Commission considers to offer an adequate level of protection or where Swapfiets has taken appropriate security measures to safeguard your privacy. If you wish to receive further information about the transfer of your personal data to countries outside the European Economic Area, please contact Swapfiets's Data Protection Officer (see article 12).

8. Storing your data

We will store your personal data as long as necessary or permitted within the scope of the purposes described in this Privacy Statement and in accordance with the applicable laws and regulations.

9. Mapping website traffic

When you visit or use our website(s), services or Swapfiets app, we may use cookies, web beacons, and similar technologies. For more details on the use of cookies, please see our cookie statement (https://swapfiets.nl/nl/cookies/).

10.Your rights, including the right to object

You have the right to know which of your personal data we are processing and to whom we have provided your personal data. If you have consented to the processing of your personal data, you also have the right to withdraw.

If you wish to access, correct, edit, limit or delete any of your personal data processed by us or object to the processing of personal data or (direct) marketing, or wish to receive an electronic copy of your personal data in order to transfer it to another party (to the extent that the applicable legislations permits you transfer such data), you can contact the Swapdesk using the contact details as mentioned under Article 12. Please describe to which personal data your request concerns as clearly as possible. We will respond to your request as soon as possible, but in any event no later than required based on the applicable legislation.

You can exercise your rights in accordance with the law. To ensure that the request is submitted by you, we need to establish and verify your identity through several checks.

Finally, you have the right to file a complaint with the Data Protection Authority.

11. Security

Swapfiets applies appropriate security measures to prevent abuse, loss, unauthorized access, unintentional disclosure and unauthorized modification as much as possible. Swapfiets has taken both technical and organizational measures to secure your personal data, such data encryption. These security measures are periodically reviewed, in the light of threats.

12. Contact

If you have any questions and/or complaints regarding the protection of your personal data or comments or remarks regarding this Privacy Statement, please contact us at info@swapfiets.nl.

Data breach or suspected data breach? Please immediately contact us at security@pon.com.

Our Data Protection Officer can be reached by email at privacy@pon.com.

13. Changes

We may change this Privacy Statement from time to time. Changes to this Privacy Statement will become effective upon posting the revised statement.