Radbonus App Privacy Concept

As of 02/20/2026

Introduction

Purpose and goal of this privacy concept

The Radbonus app lets users track their cycling activities and take part in Challenges. In the GPS-based version documented here, route data is stored on our servers so we can provide users with a route view, give partners aggregated route analytics (heatmaps), and enable Radbonus to run server-side plausibility checks (fraud detection). Since storing GPS data on servers in combination with a stable user identifier creates a link to a person under the GDPR, this version is fully subject to the GDPR’s requirements. This privacy concept documents the legal basis, the technical and organizational measures, and users’ rights.

Scope of the privacy measures

This privacy concept applies to the entire Radbonus app as well as all related server applications and services within the respective Partner World, as long as the GPS version is enabled. It describes how personal data is collected, processed, stored, and protected.The concept is accepted by the user when entering the Partner World and applies for the entire duration of use within that Partner World.

Definitions and terms

• Radbonus app: A mobile app for iOS and Android that lets users track their cycling activity and take part in Challenges.
• User: Any natural person who uses the Radbonus app.
• GDPR: The European Union’s General Data Protection Regulation, which governs the protection of personal data.
• Personal data: Any information relating to an identified or identifiable natural person.
• Pseudonymization: The processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information (Article 4(5) GDPR).
• Identification number (Radbonus ID): A purely technical identifier generated using a random generator that is created when the Radbonus app is installed. The ID is not linked to the device, the person, or any other identifying attributes. It serves as a pseudonymous key for assigning usage data within the system.
• GeoHash: A method for encoding geographic coordinates into short alphanumeric strings. GeoHashes aggregate location data into defined grid cells and enable spatial analyses without revealing exact coordinates or individual routes.
• Heatmap: An aggregated visual representation of usage intensity on route segments, based on GeoHashes.Heatmaps show which routes are used frequently overall — not which user rode which route.
• Fraud Detection: Server-side plausibility checks of reported rides using GPS data to spot unrealistic or manipulated activity (e.g., unrealistic speeds, “teleported” start points, routes on highways).
• Partner World: A partner-specific environment set up inside the Radbonus app where specific Challenges, Battles/Competitions, and Missions are offered.

Our privacy approach

Even in the GPS version, the Radbonus app follows a strict data-minimization approach that’s basically unmatched in the area of employee fitness and cycling incentive apps:

• Pseudonymous use without account data: Users can use the app without registering — no email address, no name, and no phone number. The technical assignment is done exclusively via a Radbonus ID generated by a random generator. Radbonus does not have any mapping table that could link this ID to a natural person.
• GPS data with a clear purpose limitation: Route data is stored server-side and used only for three defined purposes: (1) route view for the user themselves, (2) server-side plausibility checks (Fraud Detection), (3) creation of aggregated geo-hash analyses for partners. Individual routes are never shared with partners or other users.
• Aggregation before sharing: Partners receive only aggregated geo-hash heatmaps and statistics. Individual ride profiles, routes, timestamps, or activity patterns of individual users are not visible to partners.
• Secure server infrastructure: All data is stored on our own bare-metal servers operated in Germany in highly secure data centers certified to ISO/IEC 27001.No data is stored in cloud services.
• Encrypted communication: Data is transmitted between the app and the servers via encrypted connections (SSL/TLS). Even though GPS data is stored on the server in this version, the core principle still applies: Radbonus does not know users’ identities. However, combining a pseudonymous identifier with location data creates a link to a person as defined by the GDPR, and this version fully complies with those requirements.

Responsibilities

Data Protection Officer

Radbonus GmbH’s Data Protection Officer is Johannes Milczewski. He is responsible for monitoring and ensuring compliance with data protection regulations within the company. He is the main point of contact for all data-protection-related questions and concerns.

Tasks of the Data Protection Officer

• Monitoring compliance with data protection rules: Ensuring that all data protection requirements under the GDPR and other relevant laws are met. Regularly reviewing and updating data protection policies and procedures.
• Advice and training: Advising management and employees on all data-protection-related matters. Conducting training sessions and awareness measures.
• Working with the supervisory authority: Acting as the contact point for the data protection supervisory authority and supporting responses to inquiries or audits.
• Monitoring data processing activities: Regularly reviewing data processing activities, especially GPS data processing, geo-hash aggregation, and fraud detection logic.Implementation and monitoring of technical and organizational measures to protect data.
• Documentation and reporting: Maintaining a record of processing activities and preparing reports on the data protection measures and how effective they are.

Responsible entity and contact information

Radbonus GmbH, represented by its managing directors Marius-Eugen Gerdan and Katharina Gerdan-Dörenhoff, is the responsible entity for operating the Radbonus app. If you have any questions or concerns about data protection, you can contact the data protection officer, Johannes Milczewski.

Contact details of the data protection officer:

• Johannes Milczewski
• Email: privacy@radbonus.com
• Phone: +49 221 177 32 99 - 0

Data collection and processing

Data protection law classification

The GPS version of the Radbonus app processes pseudonymized personal data within the meaning of Art. 4(1) in conjunction with Art. 4(5) GDPR. Even though Radbonus does not collect identity data (name, email, phone number) and does not have a mapping table, the combination of a stable identifier (Radbonus ID) and GPS route data stored on the server creates a link to a person: movement profiles are highly distinctive and can—especially with regular commuting routes—be theoretically correlated with external data sources to identify a natural person. Radbonus therefore treats the processed data as personal data and applies the GDPR in full and without limitation.At the same time, it must be noted that Radbonus itself has no means of linking the Radbonus-ID to a natural person — pseudonymization is built into the architecture and can’t be reversed without external information that Radbonus does not have.

Types of data collected and how it’s processed

Radbonus-ID

• A purely technical identifier generated by a random generator, created when the app is installed.
• The ID is not linked to the device, phone number, hardware identifiers, or any other identifying characteristics of the user. Radbonus does not have any mapping table.
• The ID serves as a pseudonymous key: it makes it technically possible to link usage data without Radbonus knowing the user’s identity.
• The user can use the ID to transfer their usage data to another device.

GPS route data (key difference vs. the anonymous version)

• When the GPS version is enabled, the geo-coordinates of the routes you ride are transmitted to the Radbonus server and stored there.
• The route data includes: GPS coordinates along the route (latitude, longitude), timestamps for the individual GPS points, calculated distance, and speed.
• Purpose limitation: The route data is processed exclusively for the following purposes:
  • Route view (user): You can view your ridden routes on a map in the app.
  • Fraud Detection (Radbonus): Server-side plausibility checks to detect unrealistic or manipulated rides (e.g., unrealistic speeds >80 km/h, “teleported” start points, routes on closed roads/highways).Fraud detection is rule-based and automated; it doesn’t have any legal effect on the user, but flags suspicious rides for manual review by Radbonus.
  • Geo-hash aggregation (partner heatmaps): GPS coordinates are converted into geo-hashes with a resolution of approx. 150 m × 150 m (geo-hash precision level 7). The resulting heatmaps show aggregated usage intensity on route segments — not individual routes. Aggregation is done across all users of a partner World; it’s not possible to assign individual segments to individual users based on the heatmap data.
• No sharing of individual routes: Individual GPS tracks, ride profiles, or route data of individual users are never shared with partners, other users, or third parties.

Distances ridden

• Information about distances ridden, including start and end time.
• This data is assigned to the relevant Challenges, Battles, and Missions.

Optional: nickname

• Users can optionally set a nickname as their display name in public rankings. If no nickname is set, a heavily shortened fragment of the Radbonus ID is shown as a placeholder. The display name is tied to the partner World and can’t be linked across different partner Worlds.
• Active confirmation before entering: Before the input field is unlocked, the user is informed: *“Your nickname is visible to other participants.”Please pick a name that doesn’t allow anyone to figure out who you are — so no real name, no initials, no department, and no company name.

" The user must actively confirm: “I confirm that my nickname does not contain any personal data and does not allow conclusions to be drawn about my identity.”*

• Automated validation before saving: Every nickname goes through a two-step automated check. Level 1 — rules-based pattern detection: email addresses, phone numbers, date formats/birth years (1940–2015), URLs, social media handles. Level 2 — AI-based semantic analysis (local LLM): A language model running locally on the Radbonus infrastructure checks for: real names, first names with identifying additions, department/role titles, combinations of initials, and location/branch names linked to a person. No nickname entries are sent to external services.

• If a nickname is rejected, the user gets a specific reason. Rejected nicknames are not saved and not logged. The automated check is not an automated decision within the meaning of Article 22 GDPR, because it has no legal effect and does not cause any significant disadvantage. The system is calibrated conservatively (when in doubt: reject). The model used for checking is subject to documented model governance: versioning, validation against an internal test corpus, change logging, and approval by qualified staff.If a user believes their nickname was rejected by mistake, they can request a manual review through the Data Protection Officer — only the nickname text is reviewed.

Optional: Device tokens (push notifications)

• Used to send push notifications if the user explicitly wants this.
• Technical setup: Delivery is handled via Firebase Cloud Messaging (FCM). Device tokens are encrypted on Radbonus servers and stored separately from other usage data. Push payloads contain only generic notifications that are identical for all recipients — no user-specific content, Radbonus IDs, performance data, or profile information. Compliance is enforced server-side using predefined message templates.
• Legal basis: Art. 6(1)(a) GDPR (explicit consent via the OS permission dialog).
• Processing: Google acts as a processor under Art. 28 GDPR based on the Firebase Data Processing and Security Terms.
• International data transfer: SCCs under Art. 46(2)(c) GDPR and the EU-U.S. Data Privacy Framework under Art. 45 GDPR. A TIA was carried out.
• Storage period: If deactivated or consent is withdrawn, tokens are deleted immediately. Inactive tokens are cleaned up regularly.

App and operating system information

• App version, operating system, and OS version. Used for troubleshooting and optimization.

Bike type

• The type of bike used (e.g., MTB, BMX). Used to analyze and adapt app features.

Optional: Team membership

• If participating in team activities.No Team Battles are offered with fewer than 15 participants.

Membership in a Partner World, favorites, prize winnings

• Same as in the anonymous version: no identifying data involved.

Data that isn’t stored

Even in the GPS version, the Radbonus app deliberately does not store any identity data:

• No account data: Name, address, email, phone numbers aren’t collected.
• No device IDs: No IDFA/GAID, no MAC addresses, no hardware identifiers.
• IP address: Radbonus does not store, log, or analyze IP addresses of app users at any time.Layer 1 — Transport route (telecom provider): Processing by network operators under their own responsibility.Layer 2 — Load balancer (Hetzner Online GmbH): The load balancer processes IP addresses at the network level (TCP/IP communication). Radbonus has no access to connection data. A data processing agreement pursuant to Art. 28 GDPR is in place.Layer 3 — Radbonus application server: X-Forwarded-For is disabled. The IP address is technically not available at the application level.There is no code path that accesses IP information.

Purpose of data collection and processing

Balancing of interests under Art. 6(1)(f) GDPR:

• Fraud detection: The legitimate interest of Radbonus GmbH and its partners in the integrity of the competition system outweighs users’ interests, because the check is based solely on technical plausibility checks (no manual route analysis), does not involve automated decision-making with legal effect, and users are informed about the processing.
• Geo-hash heatmaps: Partners’ legitimate interest in analyzing the most-used routes (e.g., for bike infrastructure planning and traffic safety) outweighs users’ interests, because the data is irreversibly aggregated before being shared and it’s not possible to attribute the heatmap data to individual users.Aggregation at the geo-hash level (approx. 150m × 150m) ensures that no individual start/end points (home address, workplace) can be identified.

Prize winnings

As with the anonymous version: prize fulfillment is handled entirely outside the Radbonus app, and Radbonus does not collect any personal data for this purpose.

Legal basis and classification of the data processing

Classification of the processed data

The GPS version of the Radbonus app processes pseudonymized personal data. This pseudonymization is achieved through the following architecture:

• The Radbonus ID is generated using a random generator and has no connection to a device, a person, or any other identifiers.
• Radbonus does not maintain a mapping table, and there is no technical path for re-identification.
• The pseudonymization cannot be reversed by Radbonus alone — de-pseudonymization would require external information that Radbonus does not have. Even so, the combination of a stable identifier and GPS route data must be considered personal data, because movement profiles can be highly identifying and, in theory, could be linked to a natural person by using external data sources (Recital 26 GDPR). Radbonus therefore applies the GDPR in full.

Classification under §25 TTDSG (device access)

Storing the Radbonus ID on the end device is strictly necessary within the meaning of §25(2) No. 2 TTDSG. Location data is collected via the operating system’s built-in location permission and is actively granted by the user. Device tokens for push notifications are stored on the basis of explicit consent (§25(1) TTDSG in conjunction with …)Art. 6(1)(a) GDPR).

Data Protection Impact Assessment (DPIA)

Because the GPS version stores location data on the server side and links it to a persistent identifier, Radbonus GmbH has carried out a Data Protection Impact Assessment in accordance with Art. 35 GDPR. Triggering criteria: systematic processing of location data (Art. 35(3)(a) in conjunction with the DSK positive list).

DPIA result: The technical and organizational measures in place — especially pseudonymization without a mapping table, aggregation into geo-hashes before sharing with partners, limited GPS retention, and encrypted storage — reduce the identified risks to an acceptable level.The biggest residual risk is a leak scenario; we mitigate this with encryption, access controls, and regular penetration tests.

Information duties — Privacy Notice (Art. 13 GDPR)

Data sharing

The Radbonus app follows a strict principle of data sovereignty.

No sharing of individual data

Individual GPS tracks, ride profiles, routes, or any other user-related data are never shared with partners, other users, or third parties.

Geo-hash heatmaps for partners

Partners receive aggregated heatmaps based on geo-hashes. These show usage intensity on route segments and allow analyses for cycling infrastructure planning. Aggregation ensures:

• Minimum aggregation level: geo-hash cells are only included in the heatmap once a minimum of 50 rides has been recorded in the respective cell.Cells with lower usage are suppressed to prevent drawing conclusions about individual routes.
• No timestamps: The heatmaps don’t include any time information — you can’t tell when a route was ridden.
• No user linkage: The heatmap data contains no Radbonus IDs, advertising identifiers, or any other user-related info. It’s not possible to trace the aggregated data back to individual rides or users.
• Irreversible aggregation: Geo-hash aggregation is a one-way process — the original GPS coordinates can’t be reconstructed from the aggregated counts.

Display identifier in rankings

Same as in the anonymous version: rankings only start once there are 15 active users, kilometers are rounded, updates are delayed, and nicknames are validated by a local LLM. Neither partners nor other users can see routes, individual events, timestamps, or GPS data.

Access model (who can see what)

• User (their own app): Sees their own routes on a map, start times, end times, ride duration, individual events, and total kilometers.
• Other users (ranking): See — only once there are 15 active users — the display identifier and the rounded total kilometers only. No routes, no times, no GPS data.
• Partners: Receive aggregated geo-hash heatmaps (from 50 rides per cell), aggregated stats (total kilometers, participant counts, challenge completion rates). No individual routes, no identifiers, no timestamps.
• Radbonus (ops/admin): Processes the data to provide the service and for fraud detection. Does not have any identity data.Radbonus doesn’t know who individual users are, and it doesn’t know the internal structures of partner companies.

Access matrix (detailed overview):

What the matrix shows: no external party gets access to individual GPS routes. The “Identity data” row consistently says “No”.Partners only receive aggregated geo-hash heatmaps — no information that would allow data to be linked back to individual users.

Partners’ role under data protection law

For data protection purposes, partners are neither joint controllers (Art. 26 GDPR) nor processors (Art. 28 GDPR). Setting up a Partner World (Challenges, goals, visual design) is about shaping the content — not about deciding the purposes and means of data processing. Partners only receive aggregated, non-personal heatmap data and statistics.encryption at rest).

Technical and organizational security measures

• Encryption: SSL/TLS in transit, Encryption at rest for GPS data and device tokens.
• Access controls: Multi-factor authentication, strict password policies, least-privilege principle.
• Backups: Encrypted backups, rolling for 6 months, RTO 4h / RPO 24h.
• Monitoring and logging: Database access, authentication attempts, system resource metrics, application errors.Retention: 90 days, automatic deletion. Access only for administrators secured with MFA. No IP addresses in logs (X-Forwarded-For disabled).
• Key management: Internal, qualified staff, restrictive access rights, defined rotation schedule.
• Roles and permissions concept: Least privilege, regular reviews.
• Penetration tests: Quarterly, performed externally.
• Secure SDLC: Code reviews, SAST/DAST, release procedure before deployment.
• GPS access control: Access to individual GPS routes is limited to the fraud detection system and authorized administrators. Routine employee access to GPS data is not intended and is logged.

Measures in the event of security incidents

• Reporting obligation: If personal data is compromised (especially GPS route data), an assessment will be carried out and, where applicable, reported to the supervisory authority in accordance with Art. 33 GDPR (72-hour deadline), and affected users will be notified in accordance with Art. 34 GDPR if there is a high risk.
• Immediate actions: Isolation of affected systems, invalidation of compromised tokens, forensic analysis.
• Transparency: Information about the incident, its scope, and countermeasures.

Users’ rights

The GDPR applies in full to the GPS variant. Radbonus GmbH grants users all data subject rights:

Authentication when exercising rights

Since Radbonus does not store identity data, authentication is done via possession of the Radbonus ID on the end device. The ID is stored locally and cannot be viewed from the outside. Guessing it is practically impossible due to the random generator and key length. Data access is exclusively via the app — no external API.If you email the DPO, you’ll be asked to provide your Radbonus ID.

Right of access (Art. 15 GDPR)

Users can request information about all data stored for their Radbonus ID: distances, timestamps, GPS route data, Challenge participation, nickname, bike type, team membership.

Right to rectification (Art. 16 GDPR)

Correction of incorrect data, especially optional details (nickname, bike type, team membership).

Right to erasure (Art. 17 GDPR)

Upon request, all data stored for the Radbonus ID will be deleted, including GPS route data, device tokens, and optional details. Data that has already been included in Geo-Hash aggregates can’t be deleted anymore because it no longer has any personal reference. Aggregated Challenge results will be kept so public group results don’t get distorted.

Right to restriction of processing (Art. 18 GDPR)

Upon request, processing will be restricted — the data will be blocked and no longer processed, but not deleted.

Right to data portability (Art. 20 GDPR)

Users can request an export of their data in a structured, commonly used, machine-readable format (JSON).

Right to object (Art. 21 GDPR)

Users can object to processing based on legitimate interest (Art. 6(1)(f)) — especially Fraud Detection and Geo-Hash aggregation. If the objection is justified, the relevant processing will be stopped.

Withdrawal of consent

Consents (push notifications, nickname) can be withdrawn at any time.In particular, we don’t use any third-party analytics, tracking, advertising, or marketing services.

Data protection through technical design and privacy-friendly defaults

Privacy by Design

• Pseudonymous identification: Randomly generated Radbonus ID with no link to a device or a person.
• GPS data with purpose limitation and retention: Stored on the server only for defined purposes, automatically deleted after 12 months.
• Aggregation before sharing: Geo-hashes instead of individual routes for partners.
• Fraud detection without profiling: Rule-based plausibility checks, no behavior analysis, no automated decision-making.
• Minimal data flow: No account data, no device IDs, no IP at the application level.
• Nickname validation via a local LLM: Two-step check with active user confirmation.
• Encrypted communication and storage: SSL/TLS + encryption at rest for GPS data.

Privacy by Default

• Data minimization: Only the data required for functionality.
• GPS off by default: Location permission must be actively granted by the user.
• Opt-in for push notifications and nickname.
• No third-party tracking or analytics.

Operational small-World controls

• Minimum participant count (15) for rankings.
• Kilometer rounding in ranking displays.
• Delayed ranking updates (defined intervals, not real time).
• No route visibility for third parties: Neither partners nor other users can see individual routes.
• Minimum aggregation level (50 rides) for geo-hash heatmaps.

Regular review and updates

• Internal and external security audits (incl.Burp Suite, penetration tests).
• Reviewing how effective pseudonymization is: Regular checks to make sure the technical and organizational measures still ensure effective pseudonymization, taking into account current technological developments and relevant case law.
• DPIA review: The Data Protection Impact Assessment is updated whenever there are major changes to processing activities (new data sources, changed geo-hash resolution, new partner features).
• Continuous improvement based on audit results and legal changes.
• Documentation and logging of all changes.

Training and awareness

• Regular training on data protection and data security for all employees.
• Specialized training for employees with access to GPS data and fraud detection systems.
• Onboarding sessions for new employees.
• Awareness measures: Regular reminders, workshops, and information materials.
• Open communication and feedback loops.

Final provisions

Period of validity

This data protection concept comes into force on 02/01/2026 and remains valid until further notice. It is reviewed regularly and adjusted as needed.

How it’s communicated

• Internal: To all employees via training and internal communications.
• External: To users and partners via the website and within the Partner World.

Contact person

If you have any questions or concerns about this data protection concept, you can contact the Data Protection Officer (contact details can be found in the “Data Protection Officer” section).