Privacy Policy of the Radbonus App

As of: February 2026

Who is responsible?

Radbonus GmbH represented by Marius-Eugen Gerdan and Katharina Gerdan-Dörenhoff

Data Protection Officer: Johannes Milczewski Email: privacy@radbonus.com Phone: +49 221 177 32 99 - 0

What does the Radbonus app do?

With the Radbonus app, you can record your cycling activities and participate in challenges and competitions — either in the public world or within a partner or campaign world of your company, organization, or municipality. You do not need a user account for this — no email address, no name, no phone number.

Radbonus pursues a data protection approach that is unmatched in the field of fitness and cycling promotion apps: While other providers typically require registration with an email address and share data with advertising and analytics networks, Radbonus works entirely without account data, without device IDs, and without third-party tracking. We do not know who you are — and we do not want to know.

What we do not need to operate the app

• No registration with name, email address, phone number, or postal address
• No device IDs
• No IP addresses at the application level
• No tracking by advertising networks or analytics services

If additional information is required in a partner or campaign world for specific purposes (e.g., prize delivery), you will be informed separately.

What happens when you use the app?

When you participate, the app uses your device's location data (GPS coordinates, location access) to determine the kilometers you have cycled. These are assigned to a randomly generated, anonymous Radbonus ID that is created during installation and has no connection to your person or your device. You choose a nickname that must not be recognizable as a real name — the app checks this automatically — and your bicycle type. A verified registration via email, phone number, or other contact data does not take place as a matter of principle.

Depending on the partner or campaign world, additional data may be collected. You can find out what these are and what they are used for in the privacy information displayed when you enter the respective world. This world-specific information is part of this privacy policy.

On what legal basis do we process data?

• Performance of a contract (Art. 6(1)(b) GDPR): Recording your kilometers, timestamps, nickname, and bicycle type — this is necessary for the app to function.
• Legitimate interest (Art. 6(1)(f) GDPR): Bug fixing and app optimization.
• Consent (Art. 6(1)(a) GDPR): Push notifications — you decide for yourself and can revoke consent at any time.

The legal bases for world-specific processing are set out in the privacy information of the respective partner or campaign world.

Who receives your data?

The organizer (e.g., employer, organization, or municipality): Receives only aggregated statistics. The organizer never sees your individual activities or your Radbonus ID.

Other participants: See only your nickname (or a shortened ID fragment) and a rounded total kilometer count in rankings.

Technical service providers:

• Hetzner Online GmbH (Germany) — Server infrastructure.
• Google / Firebase Cloud Messaging — Push notifications on Android and iOS, if activated. Third-country transfer secured by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers. Beyond that, we do not share data with third parties. We do not use any advertising, tracking, or analytics services.

How long do we store data?

Your data is only stored for as long as it is necessary for the respective purposes. After 24 months of inactivity, your data is automatically deleted. Consent-based data (e.g., push tokens) is deleted immediately upon revocation. Details on world-specific retention periods can be found in the privacy information of your partner or campaign world.

Where is your data stored?

On Radbonus GmbH's own servers in Germany, in an ISO/IEC 27001-certified data center. No data is stored in cloud services. All transmissions are encrypted (SSL/TLS).

Your rights

• Access — What data is stored for your Radbonus ID.
• Rectification — Have incorrect information corrected.
• Erasure — Have your data deleted.
• Restriction — Have processing temporarily suspended.
• Data portability — Receive your data in a machine-readable format.
• Objection — Object to processing based on legitimate interest.
• Withdrawal — Withdraw given consent at any time.

For this, please contact our Data Protection Officer: privacy@radbonus.com

You also have the right to lodge a complaint with the competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

Security

We protect your data through encrypted transmission and storage, multi-factor authentication for server access, regular security testing, and a strict access control policy.

Changes to this privacy policy

We may update this privacy policy to reflect changes in our processing activities or legal requirements. This version is linked in the Apple App Store and Google Play Store and is available on the respective campaign pages.