EN EN ▾
DE DE EN EN
Schlag den Huber! 2026

Data Protection Concept for the Radbonus App

As of 19.02.2026

Introduction

Purpose and Objective of the Data Protection Concept

The Radbonus app takes an unusual approach to data protection: it completely forgoes collecting identifying personal data. This data protection concept documents the technical and organizational measures that ensure a data-minimized and anonymous user experience. The goal is to consistently protect users' privacy while meeting legal requirements, especially the GDPR. The Radbonus app processes usage data without any link to identity. From the perspective of Radbonus GmbH as the controller, the data cannot be assigned to an identified or identifiable natural person (Recital 26 GDPR; relative personal reference according to CJEU C-413/23 P). Radbonus proactively complies with the GDPR principles.

Scope of the Data Protection Measures

This data protection concept applies to the entire Radbonus app as well as all associated server applications and services within the respective Partner World. It describes the collection, processing, storage, and protection of data in order to fully safeguard users' privacy. The concept is accepted by the user when entering the Partner World and applies for the entire duration of use within this Partner World.

Definitions and Terms

Data protection approach

The Radbonus app follows a data protection approach that has no comparable counterpart in the field of employee fitness and bike-promoting apps:

This data protection approach ensures that even in the event of a security issue, no identifiable personal data can be exposed, because such data is never collected or stored at any point. To the best of Radbonus GmbH's knowledge, this architecture is unmatched in the employee bike-promotion app market segment — comparable providers typically rely on account-based systems with email registration, GPS tracking, and third-party analytics.

Responsibilities

Data Protection Officer

The Data Protection Officer of Radbonus GmbH is Johannes Milczewski. He is responsible for monitoring and ensuring compliance with data protection regulations within the company. Johannes Milczewski has extensive expertise in data protection law and data security. He is the central contact person for all data protection-related questions and concerns.

Tasks of the Data Protection Officer

Responsible parties and contact information

Radbonus GmbH, represented by the managing directors Marius-Eugen Gerdan and Katharina Gerdan-Dörenhoff, is the responsible party for operating the Radbonus app. If you have any questions or concerns about data protection, you can contact the Data Protection Officer, Johannes Milczewski.

Contact information for the Data Protection Officer:

Data collection and processing

The Radbonus app allows users to record their cycling activities without any link to their identity. From the perspective of Radbonus GmbH as the controller, the usage data processed cannot be assigned to an identified or identifiable natural person. This concept ensures that users' privacy is protected at the architectural level — not through retroactive measures, but by refraining from collecting identifying data.

Types of data collected and how they are processed

Radbonus ID

Optional: Nickname

Optional: Device tokens (push notifications)

App and operating system information

Distances ridden

Bike type

Optional: Membership in a team

Membership in a Partner World

Favorites

Prize winnings

Data not stored

The Radbonus app deliberately does not store any data that could identify a person. This includes:

Purpose of data collection and processing

The collected data is used exclusively to operate the Radbonus app. This includes improving the user experience, providing content, and taking part in Challenges, Battles, and Missions. Since usage data is collected without any link to identity, the Radbonus app ensures that users’ privacy is always protected.

Prize winnings

If a user wins a prize, prize handling is carried out entirely outside the Radbonus app and without Radbonus collecting any personal data. The app simply shows the user the prize. Redemption takes place via mechanisms provided by the partner, such as voucher codes, which are displayed directly in the app and do not require any personal data to be entered. No personal data is stored in connection with prize handling, either in the app or on the servers of Radbonus GmbH.

Legal bases and classification of data processing

Classification of the processed data

The Radbonus app processes only usage data, which is to be classified as anonymous data within the meaning of Recital 26 of the GDPR. The following analysis substantiates this classification.

Assessment standard: Recital 26 GDPR

Under Recital 26 GDPR, the principles of data protection do not apply to anonymous information — i.e. information that does not relate to an identified or identifiable natural person. To determine whether a person is identifiable, account must be taken of all means reasonably likely to be used to identify the natural person directly or indirectly. In doing so, all objective factors must be considered, in particular the costs of identification and the time required for it, the technology available at the time of processing, and technological developments.

Current case law: CJEU C-413/23 P of September 4, 2025 (Relative personal reference)

In its judgment of September 4, 2025 in EDPS v Single Resolution Board (C-413/23 P), the Court of Justice of the European Union confirmed and clarified key principles for classifying data as personal or anonymous:

This case law directly supports classifying Radbonus usage data as anonymous: Radbonus has no means whatsoever — neither legal nor factual — to assign the Radbonus ID to a natural person. There is no key, no mapping table, and no technical path to re-identification. From the only relevant perspective, that of Radbonus as controller, the data is anonymous.

Distinction from cookie IDs and online identifiers

Randomly generated identifiers (e.g. cookie IDs, tracking IDs) can, according to the established case law of the CJEU, constitute personal data if they can be linked with additional information in order to recognize users or create profiles (cf. CJEU C-673/17 „Planet49", para. 45 ff.; Recital 30 GDPR). The decisive factor is not the randomness of the identifier, but the possibility of assigning it to a natural person.

The Radbonus ID differs from the typical cookie/tracking ID scenario in several key respects:

While cookie IDs typically operate in an ecosystem in which account data, device identifiers, location data, and third-party networks make linkage possible, all of these points of connection are absent in the Radbonus system. The mere existence of a randomly generated identifier does not by itself create a personal data relationship — it is the possible links that make the difference under data protection law.

Analysis: Why the processed data is anonymous

The central question is: Can a natural person be identified via the Radbonus ID or the data records linked to it — by Radbonus, by partners, or by third parties?

The Radbonus ID is a key to anonymous data, not to a person:

The Radbonus ID is generated using a random generator. It has no connection to the device, phone number, hardware identifiers, third-party accounts, or any other identifying features. Neither Radbonus nor any third party has a mapping table that would make it possible to link the ID to a natural person. The records linked via the ID contain usage data without any identity reference: distances ridden, timestamps, Challenge participation, bike type, favorites, and reward information. None of these data fields contains personal information. Radbonus does not have any additional information that would make it possible to assign the data to a natural person. A technical key that refers to non-identity-based records and for which no linkability exists does not establish a personal data reference within the meaning of Recital 26 — neither the key itself nor the data linked to it become personal data by virtue of the existence of the key.

Distinction from pseudonymization:

Pseudonymization within the meaning of Art. 4 No. 5 GDPR exists when personal data are processed in such a way that they can no longer be assigned to a specific person without the use of additional information — with that additional information being kept separately. In the case of the Radbonus app, however, no such "additional information" exists: There is no mapping table, no mapping, no database, and no technical path that creates a connection between the Radbonus ID and a natural person. The Radbonus ID does not replace a previously known identity — it was never linked to an identity.

On the topic of "singling out":

Singling out and linkability are technical properties of stable identifiers. For the data protection assessment, what matters is whether, taking into account means likely to be used by a reasonable person, assignment to a natural person is possible (Recital 26 GDPR).

Recital 26 GDPR names singling out as one factor in assessing whether data can be assigned to a natural person. Singling out describes the ability to isolate an individual record in a database and distinguish it from other records. In the Radbonus system, there is no point of linkage for this: no identity data, no location data, and no IP addresses are processed at application level; partners and other users see only aggregated kilometer totals without time or event details. In detail:

Singling Out is a risk factor, but without an identity bridge it is not enough. The Article 29 Working Party (WP 216) distinguishes three criteria for assessing anonymization methods: Singling Out, Linkability, and Inference. In the Radbonus system, Singling Out is technically possible (the Radbonus ID makes it possible to isolate a data record), and Linkability within the system is given (records with the same ID can be linked to one another). However, there is no realistic way to determine a natural person from this. What matters is not mere isolatability, but whether the isolated data record can be assigned to a natural person — directly or indirectly, by the controller or by third parties using means likely to be used according to general reasonableness.

The Radbonus records contain no identifying data fields. An isolated Radbonus record contains: a randomly generated ID, a distance in kilometers, a timestamp, and, if applicable, Challenge participation. None of these fields identifies a person. The timestamp documents when a distance was reported to the system — not when or where a ride started or ended. The distance describes a route without a start or end point, without a route, without any geographic reference. 12.3 km can be any route between any points. Without geographic location, movement data lacks the feature that makes it identifiable: spatial context. A commuter who rides 15 km every day is not distinguishable from hundreds of thousands of other people who also ride 15 km from the Radbonus data.

The often-cited scenario “only one person rides 40 km at night” assumes knowledge that neither Radbonus nor the partner has. To infer a specific person from the record “random ID XYZ, 40 km, 23:15” an attacker would need access to two sources of information at the same time: (1) access to Radbonus’ individual usage data (timestamp, distance per user) and (2) external contextual knowledge about the members of the relevant Partner World (who rides when and how far). Radbonus’ architecture ensures that these two sources of information never come together in the hands of any one actor: Radbonus has the individual usage data, but knows neither the identity nor the habits of the partner’s employees. The partner knows its employees, but receives from Radbonus only aggregated total kilometers — no individual timestamps, no distances per ride, no activity patterns of individual users (see section “Data Protection Role of the Partners”). Even a person who were both a Radbonus employee and a partner employee would have no access to the individualized usage data of other Radbonus IDs.

Linkability fails because there are no linking points. Linking Radbonus records with external data sources (fitness apps, time tracking systems, social media) would require a shared identifier — an email address, a device ID, an IP address, a location. None of these linking points exist in the Radbonus data. The Radbonus ID is randomly generated and has no connection to devices, accounts, or people. Without a shared key, systematic linking with external data sources is not possible.

On the residual risk from inference in edge cases:

Radbonus acknowledges that in theoretical extreme cases — for example, in a Partner World with a very small single-digit number of participants — the ratio of known participants to records could make narrowing down possible. However, for several reasons this residual risk is not a means likely to be used according to reasonable judgment within the meaning of Recital 26: It requires combining external contextual knowledge with individualized usage data, which, for architectural reasons, never come together in the hands of any one actor. It presupposes an active interest in identifying individual cyclists, for which no economic or other motive is apparent. And even in the extreme case, it remains probabilistic — a distance of 40 km does not allow a certain conclusion, since other users may also have ridden the same distance on the same day.

This theoretical residual risk does not change the legal classification of the data as anonymous from Radbonus’ perspective as controller (cf. CJEU C-413/23 P on relative anonymity), but it does justify the additional protective measures documented below: AI-based nickname validation by a local language model with active user confirmation, the deliberate choice not to run Team Battles with small groups, the exclusive sharing of aggregated statistics with partners, the double protection barrier between contextual knowledge and individual data, the precautionary observance of GDPR standards as an additional protection framework, and the following operational small-world protective measures:

Operational small-world controls (architectural inference barriers):

These measures ensure that even in the theoretical extreme case of small Partner Worlds, the data points required for an inference are not available architecturally. Anonymity is not just argued for, but technically enforced.

On profile transfer:

The Radbonus ID can be used by the user to transfer his usage data to another device. The fact that a user knows his own ID and can retrieve his own data does not create a personal reference from the perspective of the controller (Radbonus). What matters is the perspective of the controller and the question of whether that controller — or a third party using means reasonably likely to be used under ordinary circumstances — can make an attribution. Radbonus cannot do that. The situation is comparable to a cloakroom ticket number: the holder can collect his item, but the cloakroom operator does not know which person has which number.

On the "all means reasonably likely to be used" test (Recital 26) — scenario analysis:

The key question under Recital 26 GDPR is: Who has which information — and can a natural person be identified from it using means reasonably likely to be used under ordinary circumstances? Radbonus GmbH examined this question across all relevant actors:

Scenario 1 — Radbonus itself (controller): Radbonus has: Radbonus ID, start times, end times, duration, total km, optional nickname, challenge participation. Radbonus does not have: names, addresses, email, phone numbers, location data, IP addresses (X-Forwarded-For is disabled), device IDs, mapping tables. Radbonus knows neither the users' identities nor the internal structures, employees, or organizational processes of the partner companies. There is no identity attribute and no internal or external mapping source. Radbonus can recognize a usage profile internally (linkability), but cannot identify a natural person. Assessment: No identifiability from the controller's point of view. This is legally strong because the CJEU explicitly refers to the perspective of the respective controller (C-413/23 P).

Scenario 2 — External data leak (leak scenario): In the event of a hypothetical leak of the ranking display, only the following would be affected: display identifiers (truncated ID fragments or validated nicknames) and aggregated total kilometers. An external third party receiving this data has: no company context, no internal knowledge of employees, no riding habits, no mapping table. For example, they see: "Meerkatze — 1,800 km in May". They can: verify nothing, identify no real person, combine no additional data source in any meaningful way. Because there are no identity or linking data, assignment to natural persons is not possible for external third parties; the risk to the rights and freedoms of natural persons is correspondingly low. Assessment: Not identifiable to the outside world. An assessment under Art. 33/34 GDPR is still carried out as a precaution insofar as device tokens (push) could be affected (see section "Measures in the Event of Security Incidents").

Scenario 3 — Partner company (organizational level): According to the architecture, partners receive: aggregated world kilometers, participant counts, challenge completion rates. Partners do not receive: identifiers, individual kilometers, timestamps, Radbonus IDs, individual activity patterns. The partner does have contextual knowledge about its employees, but lacks all individual data. It cannot say: "This employee rode 1,800 km." It only sees: "12,400 km total in the world." Assessment: The partner cannot identify a single person because it lacks individual data.

Scenario 4 — Other users within the Partner World (colleague level): Other users see in the ranking: display identifier (nickname or shortened ID fragment) and rounded total kilometers in the competition period — but only once a minimum of 15 active users has been reached in the respective Partner World. Below this threshold, no rankings are shown. They do not see: start times, end times, duration, individual events, raw data. Individual ride times and data are accessible exclusively to the respective user in their app and are not displayed in any form visible to other users, partners, or Radbonus.

Typical attack vector in the data protection assessment: “A colleague knows that only one person on the team rides a bike every morning at 5:30 a.m. — they see the time in the ranking and can identify the person.” This vector is architecturally excluded in the Radbonus system: the ranking shows only a display identifier and an aggregated total kilometers figure for the competition period. Start times, end times, times of day, ride duration, individual distances, and activity patterns are never shown to other users in any form at any time. A colleague sees “Meerkatze — 1,800 km in May.” They do not see: “Meerkatze — 12.3 km, 5:32 a.m., duration 38 min.” The time-based behavior recognition that typically gives rise to re-identification scenarios fails because of the architecture — not because of an assessment decision, but because the data required for it is not available.

What remains is just the kilometer total: A colleague might guess “That’s probably Thomas, he rides a lot.” But: they have no access to raw data. They cannot verify their guess. They only see a display identifier and a single number (total km). Nicknames also undergo AI-supported validation (local LLM), which detects and rejects identifying content — so the nickname itself does not provide a reliable basis for identification. It remains a social guess based on a single, non-distinctive metric.

Assessment: Identifiability within the meaning of Recital 26 requires more than a speculative assumption. It needs a realistic, reliable assignment possibility based on means that are, in general, likely to be used according to objective judgment. If the data typically required for behavioral attribution (times, patterns, individual events) is not architecturally available and the only visible information is an aggregated kilometer total, then there is no basis for identification — it remains a guess, not an identification.

Scenario 5 — Combination of multiple data sources: Re-identification by combining external data sources (fitness apps, time tracking systems, social media) would require a shared identifier (email, device ID, IP address, location). None of these linking points exist in the Radbonus data. The Radbonus ID is randomly generated and has no connection to devices, accounts, or people. IP addresses are not available on the backend servers (X-Forwarded-For is disabled). Location data is never stored server-side. Without a common key, any systematic linking fails. The data stored server-side (distances, timestamps, bike type) do not form a sufficiently specific profile for re-identification: a distance describes neither the start nor the end point, and a timestamp documents the reporting time — not when or where a ride took place. Without geographical context, these data points lack the property that makes movement data identifiable: spatial context. 12.3 km could be any route whatsoever. Assessment: The “bridge” is missing. Without a bridge, every profile remains isolated.

Summary risk differentiation:

The key finding from the scenario analysis: there is no actor who simultaneously has contextual knowledge, verifiable individual data, and a linking feature.

The central protective barrier is that no actor has both contextual knowledge and verifiable individual raw data. Identifying a natural person would require one actor to have access at the same time to individualized usage data and identity-related contextual knowledge, and to be able to link that information. No such constellation exists in the Radbonus system.

Radbonus processes usage data without any personal reference; what third parties can see is only a non-identifying display identifier with aggregated mileage totals. Start/end times and duration are accessible only to the respective user. Partners do not receive any individual data.

Precautionary compliance with GDPR standards

The above analysis shows that the processed usage data is to be classified as anonymous data within the meaning of Recital 26 GDPR. Regardless of this classification, Radbonus GmbH has decided to comply with the key GDPR standards and principles as a precaution. This includes in particular:

This precautionary self-commitment ensures that the protection of user data is guaranteed at the documented level, regardless of the legal classification.

Data Protection Impact Assessment (DPIA) — Threshold Test

Radbonus GmbH has checked whether a Data Protection Impact Assessment under Art. 35 GDPR is required. A DPIA is mandatory if processing is likely to result in a high risk to the rights and freedoms of natural persons, especially in cases of systematic monitoring, profiling, or large-scale processing of special categories of data.

Result of the threshold test: A DPIA is not required. This is due to the following reasons:

Supporting consideration: Data Protection Impact Assessment (DPIA-Light) in the event of assumed personal data status

Even under the most conservative assumption that all usage data should be classified as personal data, Radbonus GmbH carried out a simplified impact assessment. The result confirms: Even if personal data status is assumed, there is no high risk to the rights and freedoms of natural persons.

Risk Likelihood Severity Countermeasure Residual risk
Re-identification by Radbonus (Controller) Very low — no identity data, no mapping table, no contextual knowledge Low — data without sensitive character Architectural separation: Radbonus knows neither the users’ identities nor their company structure Negligible
Re-identification by partner Very low — partners receive only aggregated statistics Low — no individual data available Double protection barrier: partner has contextual knowledge, but no individual data Negligible
Inference by colleagues in a small Partner World Low — only rounded total km visible, no times/patterns Low — suspicion remains speculative and unverified Minimum participant count (15) for rankings, km rounding, delayed updates, LLM nickname validation Negligible
Device token leak (push) Low — tokens encrypted and stored separately Low — token cannot be assigned without Radbonus ID Encryption, separate storage, invalidation in case of incident, Art. 33/34 assessment Low
External data leak (ranking data leak) Low — bare-metal servers, ISO 27001, no cloud hosting Very low — only display identifiers + rounded total km Pen tests (quarterly), access controls, encryption, no identity attribute in the data Negligible
Combination with external data sources Very low — no shared identifier (no email, no device ID, no IP, no GPS) Low — without a link point, no systematic combination is possible No third-party APIs, no tracking, no account data, no location data server-side Negligible

Result of the DPIA-Light: No identified risk reaches the threshold of “high risk” within the meaning of Art. 35 GDPR. The technical and organizational measures implemented reduce all residual risks to a negligible level. A full DPIA under Art. 35 is therefore not required, even if a personal reference is assumed. This simplified impact assessment is kept as documented proof of the risk assessment.

Regardless of this assessment, the protective measures documented in this concept — especially privacy by design, data minimization, and precautionary GDPR compliance — are retained as risk minimization.

Retention periods and data lifecycle

Because the Radbonus app processes usage data without any link to a person’s identity (with the exception of device tokens, which are treated as potentially personally identifiable as a precaution), the stored data is not subject to any deletion obligation under data protection law. Anonymous data do not fall within the scope of the GDPR and are not covered by the principles of storage limitation (Art. 5(1)(e) GDPR).

Even so, Radbonus GmbH follows a clear data retention strategy:

Retention overview:

Data category Storage location Purpose Standard retention Deletion trigger
Radbonus ID + usage data (distances, timestamps, Challenge participations, favorites, bike type) Radbonus bare-metal servers (Frankfurt) Service delivery, Challenge execution Duration of active use 24 months of inactivity; user deactivation; end of Partner World + contractual retention period
Nickname Radbonus bare-metal servers (Frankfurt) Display name in the ranking Duration of active use Deactivation of the usage profile; change/removal by user
Device token (push) Radbonus bare-metal servers (Frankfurt), encrypted + separated Push notification delivery As long as consent is active Withdrawal of consent; deactivation in app/OS; inactivity cleanup
App/OS version Radbonus bare-metal servers (Frankfurt) Troubleshooting, compatibility Duration of active use 24 months of inactivity
Backups (encrypted) Radbonus bare-metal servers (Frankfurt) Disaster recovery 6 months rolling Automatic overwrite after 6 months

The fact that no legally defined retention periods apply to anonymous data is not a shortcoming, but the logical consequence of anonymization: where there is no personal reference, there is also no obligation to delete. The Radbonus GmbH's precautionary data retention strategy goes beyond what is legally required and ensures that anonymous data is not kept any longer than necessary.

Subprocessing (Subprocessor)

The Radbonus app is operated entirely on its own infrastructure. Data processing takes place on bare-metal servers operated by Radbonus GmbH itself in Germany. No cloud services, external databases, or third-party APIs are used to process usage data.

The following external services are used in connection with the operation of the Radbonus app:

Beyond that, there are no subprocessing relationships. In particular, no third-party analytics, tracking, advertising, or marketing services are used.

Measures to ensure anonymity

Radbonus GmbH uses the following technical and organizational measures to permanently ensure the anonymity of the processed data:

Legal bases for data processing

Although the core data in the Radbonus system are to be classified as anonymous based on the analysis set out here, and the GDPR therefore does not apply, Radbonus assigns the processing activities to the following legal bases as a precaution:

Performance of a contract / service provision (Art. 6 para. 1 lit. b GDPR by analogy): The following data processing activities are functionally necessary to provide the Radbonus service within the respective Partner World:

These processing activities do not require separate consent, as they directly serve the provision of the service.

Consent (Art. 6 para. 1 lit. a GDPR): For processing that goes beyond the core functionality and potentially concerns personally identifiable data, explicit consent is obtained:

These consents can be withdrawn at any time — for push notifications by disabling them in the device settings, for nicknames by changing or removing them in the user profile.

Classification under Section 25 TTDSG (access to terminal equipment)

Storing the Radbonus ID on the user's device is strictly necessary within the meaning of Section 25(2) No. 2 TTDSG, because without this identifier the assignment of the user's usage data to Challenges and Battles, as expressly desired by the user, would not be technically possible — consent is not required for this. The collection of location data for local distance calculation takes place via the operating system's own location permission (iOS/Android) and is actively granted by the user. The storage of device tokens for push notifications is based on the user's explicit consent (Section 25(1) TTDSG in conjunction with Art. 6 para. 1 lit. a GDPR).

Information Obligations — Privacy Notice Mapping (Art. 13/14 GDPR by analogy)

Although Radbonus GmbH classifies the core data as anonymous and Art. 13/14 GDPR does not apply to anonymous data, the following overview provides, as a precaution, the transparency information that would be required if personal data were assumed:

Required information (Art. 13 GDPR) Implementation
Controller (para. 1 lit. a) Radbonus GmbH, represented by Marius-Eugen Gerdan and Katharina Gerdan-Dörenhoff
Data Protection Officer (para. 1 lit. b) Johannes Milczewski, privacy@radbonus.com, +49 221 177 32 99 - 0
Purposes and legal bases (para. 1 lit. c/d) Provision of the service (Art. 6 para. 1 lit. b by analogy): distances, timestamps, Challenge participations, bike type, favorites. Consent (Art. 6 para. 1 lit. a): push notifications (device tokens), nickname
Recipients (para. 1 lit. e) Hetzner Online GmbH (infrastructure/load balancer, processor pursuant to Art. 28); Google/Firebase (FCM push, processor pursuant to Art. 28); Apple (APNs iOS delivery). Partners receive only aggregated statistics — no individual data, no identifiers
Third-country transfer (para. 1 lit. f) Where FCM/APNs process data outside the EEA: SCCs pursuant to Art. 46 para. 2 lit. c; EU-U.S. Data Privacy Framework pursuant to Art. 45 (Google); Apple Data Processing Terms
Retention period (para. 2 lit. a) Usage data: active use, max. 24 months after last activity. Device tokens: until revocation/deactivation. Nicknames: until removal/deactivation. Backups: 6 months on a rolling basis. See retention table for details
Data subject rights (para. 2 lit. b/c/d) Access, rectification, deactivation (analogous to erasure), withdrawal of consent — granted as a precaution (see section “User Rights")
Right to lodge a complaint (para. 2 lit. d) Right to lodge a complaint with the competent supervisory authority for data protection: North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information (LDI NRW)
Necessity of providing the data (para. 2 lit. e) Distances and timestamps are required to provide the service. Push notifications and nickname are optional; not providing them has no impact on the usability of the app

Data Sharing

The Radbonus app follows a strict principle of data sovereignty.

No Sharing of Identifying Data

Display ID in Rankings

A non-identifying display ID is used for rankings. If the user has set a validated nickname, that nickname is shown; otherwise, a heavily shortened fragment of the Radbonus ID (the first characters) is displayed as a placeholder. Before being stored, nicknames undergo a two-stage automated review, including AI-supported semantic analysis by a local language model (see section “Data Collection”). Rankings are shown only starting at a minimum participant count of 15 active users within a Partner World; below this threshold, users see only their own data. Kilometers in the ranking display are rounded to full kilometers, and the ranking is updated at defined intervals (not in real time). In both cases, the display ID serves only to visually distinguish participants in the ranking and is not suitable for enabling third parties to access individual data. Neither partners nor other users receive access via the display ID to start/end times, duration, individual events, or raw data; only a rounded, delayed-updated total distance in kilometers for the respective competition period is visible. The display ID is specific to the Partner World and cannot be linked across different Partner Worlds.

Access model (who sees what)

The following overview shows which data is available to each party:

Access matrix (detailed overview):

Data category / access level Users (own app) Other users (ranking) Partners Radbonus (Ops/Admin) Hetzner (Infra) Google (FCM) Apple (APNs)
Identity data (name, email, phone) No No No No No No No
Radbonus ID (full) Yes No No Yes No No No
Display identifier (nickname/ID fragment) Yes Yes (from 15 participants) Optional (public rankings only) Yes No No No
Total kilometers (competition period, rounded) Yes Yes (from 15 participants) Aggregated only Yes No No No
Individual events (rides) Yes No No Yes No No No
Start/end times Yes No No Yes No No No
Team membership Optional No Aggregated only Yes No No No
Bike type Optional No Aggregated only Yes No No No
Geocoordinates / GPS routes No (local only, deleted immediately) No No No No No No
IP addresses (application level) No No No No No No No
IP addresses (network level/load balancer) No No No No Yes (transport) No No
Device token (push) Optional No No Yes (separately, encrypted) No Yes (transport) Yes (transport)
Data export / raw data download Yes (own data) No No Internal only No No No

The matrix shows: No external actor has a combination of identity attributes and individualized usage data. The rows “Identity data" and “Geocoordinates" consistently confirm “No" across all actors — the data typically required for re-identification does not exist in the system.

Data protection role of partners

Partners (companies and organizations) that run a Partner World at Radbonus set it up as a company world for their employees or members. The users of these Partner Worlds are adult employees or organization members. From a data protection perspective, partners are neither joint controllers (Art. 26 GDPR) nor processors (Art. 28 GDPR).

Distinction from joint controllership: Joint controllership requires that two or more controllers jointly determine the purposes and means of the processing (Art. 26 para. 1 GDPR). Partners can configure their Partner World — this includes visual customization (colors, logos), the design of Challenges, and target values in kilometers. These configuration options relate to the content design of the service, not to the purposes and means of data processing. The purpose of the processing (recording anonymous cycling activities to run Challenges and Battles) remains the same regardless of the specific configuration of a Partner World and is defined exclusively by Radbonus. Partners have no influence over the processing architecture, the data categories, the storage logic, or access to the underlying systems. The situation is comparable to a company using a SaaS platform and configuring content there without thereby becoming a joint controller of the platform's data processing. If, in an individual case — for example due to a different assessment by a supervisory authority — joint controllership is assumed, Radbonus GmbH will provide an agreement in accordance with Art. 26 GDPR.

Partners receive from Radbonus only:

Partners never receive:

Individual usage data (own times, routes, Challenge progress) is visible only to the respective user in their app. This data does not leave the user app view in individualized form.

This strict limitation to aggregated data creates a double protective barrier: Radbonus has no knowledge of the partner's internal structures or employees. The partner does have contextual knowledge of its organization, but does not receive any individualized data from Radbonus. Neither side has the combination of contextual knowledge and individual data that would be required for re-identification.

Ensuring data protection

Through these measures, Radbonus GmbH ensures that user data always remains under control and protected. The exclusive use of its own servers in highly secure data centers underlines Radbonus GmbH's commitment to user data protection and data security.

Data storage and security

The Radbonus app is designed for the secure storage and processing of usage data. The app and backend process usage data without any identity reference. This means that even in the event of a security issue, no identifiable personal data can be exposed, because such data does not exist at any point in time.

Storage locations and duration

Technical and organizational security measures

Minimization of data collection

Usage data without identity reference

Radbonus processes usage data without any identity reference and without knowledge of the users' identities. The Radbonus ID as a technical key refers exclusively to data records that themselves contain no personal information. No personal data is collected or stored (e.g. name, address, email, phone number). IP addresses are not available at the application level — forwarding via X-Forwarded-For is disabled on the load balancers. Geo coordinates are processed exclusively locally on the end device and are never stored server-side. Even in the event of a security issue, no personal data can therefore be exposed, because such data is never present on the Radbonus systems at any point (with the exception of the encrypted device tokens stored, for which separate incident handling applies — see section „Measures in the event of security incidents").

Measures in the Event of Security Incidents

User Rights

Although the Radbonus app processes usage data without any link to identity, and the GDPR rules on data subject rights do not apply to anonymous data, Radbonus GmbH nevertheless offers users the following options as a precaution:

Authentication and access control when exercising rights

Since Radbonus does not store identity data, authentication for requests for information and deactivation takes place exclusively through possession of the Radbonus ID on the end device. The Radbonus ID is stored only locally in the app and cannot be viewed from outside. Guessing other users' IDs is practically impossible because of the random generator and the key length. Retrieval of your own usage data is only possible through the app itself — there is no external API or web interface through which profile data could be accessed using a Radbonus ID. For requests by email to the Data Protection Officer, the user is asked to provide their Radbonus ID from within the app; no identity check is required, since the identifier itself has no personal reference.

Information about stored data

Users can receive information about which anonymous data is stored in relation to their Radbonus ID. This information includes, among other things:

Correction of data

If users notice that the stored data is incorrect or incomplete, they can request a correction. This mainly concerns optional details such as nickname or team membership.

Deactivation of the usage profile

Upon the user's request, the usage profile (Radbonus ID and associated records) is deactivated. Since Radbonus processes usage data without any link to identity, the following measures are taken when deactivation occurs:

Deactivation of push notifications

Users can disable the use of device tokens for push notifications at any time. This can be done in the app settings. When disabled, the device tokens are deleted.

Contact

Users can contact the Data Protection Officer with any questions or concerns (contact details see section "Data Protection Officer").

Consent and opt-out mechanisms

The Radbonus app offers users clear and transparent mechanisms for giving consent and opting out so they can manage their preferences.

Consent

Consent to data processing

Use of optional features is voluntary. This applies in particular to:

Consent is given by actively using the relevant features in the app and can be withdrawn at any time.

Consent for Push Notifications

Users can agree to the use of device tokens for sending Push Notifications. These notifications provide updates on new Challenges, rewards, and other relevant events. Consent is given when the app is first used or through the relevant settings in the app.

Opt-out mechanisms

Opt-out of Push Notifications

Users can disable the use of device tokens for Push Notifications at any time. This can be done in the app settings. When disabled, the device tokens are deleted, and the user will no longer receive notifications.

Deactivation of the usage profile

Upon the user's request, the usage profile will be deactivated. Information such as device tokens for Push Notifications and optional details will then be deleted.

Withdrawal of consent

Users can withdraw their consent to use optional features at any time. Withdrawal can be made by contacting the data protection officer (contact details see section "Data Protection Officer").

Data protection by design and by default

The Radbonus app takes a proactive approach to building privacy protection into its technical and organizational processes from the start.

Privacy by Design

Privacy by Default

Minimizing Data Collection

Regular Review and Updates

Radbonus GmbH is committed to continuously reviewing and updating its data protection and security measures to ensure that the documented standards are consistently maintained.

Audits and Controls

Procedures for Adjusting the Data Protection Concept

Documentation and Logging

Training and awareness

Radbonus GmbH places great importance on ensuring that all employees and relevant stakeholders are fully informed about data protection and data security.

Training programs for employees

Data protection awareness measures

Promoting a data protection culture

Final Provisions

Validity Period of the Privacy Policy

This privacy policy takes effect on February 1, 2026, and remains valid until further notice. It is reviewed regularly and updated as needed to comply with current legal requirements and best practices in data protection.

Procedure for Publishing the Policy

Contact for Questions

If you have any questions or concerns about this privacy policy, you can contact the Data Protection Officer of Radbonus GmbH (contact details see section "Data Protection Officer").

The Radbonus App

To participate, record your cycled kilometers with the Radbonus app. With these cycling km, you automatically participate in the challenges described above. Great bonuses await you!

Learn more
Radbonus App Screens
Contact support FAQ about the app
Legal notice Terms of participation Privacy Policy FAQ