Privacy notice

Controller

CycleFit Europe
Lloyd Thomas
Peter-Krenkel-Str. 10
64625 Bensheim
Germany

(Postal address: an office and mailing address only, not a visitor address.)

Email: lloyd@bikefiteurope.com

Send any question about your data to this address.

General information

Personal data is any information that relates to an identified or identifiable person. We process personal data only to the extent needed to provide the website, to communicate with you, and to prepare, carry out and follow up an aero test, or where you have given consent.

Data is transmitted over this website in encrypted form using a secure connection (TLS/SSL).

Hosting and server log files

This website runs on a dedicated server provided by 1blu AG, Berlin, our processor (Art. 28 GDPR); the server is located in Germany.

Each time the website is called up, the web server records the following in access log files: your IP address, the time of the request, the requested URL, the amount of data transferred, the user agent of your browser and the referrer.

We need this data to deliver the website technically, to keep it stable and secure and to prevent misuse. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

Retention: the log files are rotated by size and deleted automatically after at most ten rotations.

Analytics with Umami

On the public pages of this website we measure use with Umami. Umami runs on our own server and is reached through this domain (path /_u). No third party receives the data.

Umami works without cookies and does not track you across websites. The script sets no cookie and stores nothing on your device. It reads your screen size and browser language and checks a local opt-out setting, and sends these with the page view. From your IP address Umami derives your approximate location (country, region, city) and a pseudonymous session identifier (a hash of IP address, user agent and a salt that changes monthly); the IP address itself is not stored. Umami also records the page address, the referring page, and your browser, operating system and device type. Screen size, browser language and page title are stored with each page view. The measurement data stays on our server.

We count page views, clicks on calls to action and clicks on outbound links to the booking site. If your browser sends a Do Not Track signal, the tracker does not record your visit.

Legal basis: our legitimate interest in knowing which pages are used and in improving them (Art. 6(1)(f) GDPR). You can object to this processing at any time (see Your rights).

Retention: we keep the analytics data as long as we need it to see how the website is used over time, and delete it when it is no longer needed for that, at the latest when we stop using Umami.

The analytics script is not loaded on the report pages.

Cookies

The public pages of this website set no cookies, except where noted in this section.

If you sign in to the logged-in area (see Sign-in and accounts), the aero application sets a session cookie. It is strictly necessary to keep you signed in and is marked HttpOnly and SameSite=Lax (and Secure on the live site). It is a session cookie, so the browser removes it when you close the browser. It is set under § 25(2) no. 2 TDDDG, which does not require consent.

Booking

Aero camps and test days are booked on booking.bikefiteurope.com, our own booking system, which is operated by the same controller. This website only links to it: no booking system is embedded (no iFrame), and no data is passed from this website when you follow the link, beyond the usual request to that site and the campaign parameters in the link address.

The data you enter when you book, and the payment, are covered by the privacy notice of the booking site.

Sign-in and accounts

The aero application has no passwords. Staff sign in with a single-use link sent to their email address (valid for 30 minutes). Athletes receive an invitation link by email from their fitter (valid for 7 days) to confirm their profile, and later sign in with a single-use link in the same way.

We send these emails through our Google Workspace account (Gmail, SMTP). Google Cloud EMEA Limited, Dublin, Ireland, acts as our processor for this, with Google LLC as its sub-processor. This can involve a transfer of data to the USA; it is covered by the EU-US Data Privacy Framework. The email contains your address and the link.

Legal basis: performance of the contract and pre-contractual steps (Art. 6(1)(b) GDPR) for athletes, and our legitimate interest in secure access (Art. 6(1)(f) GDPR) for staff.

Aero testing data

To carry out an aero test and write your report we process the following data:

• identity and contact data: first and last name, email address, notes our fitter adds, and sign-in and invitation times
• test set-up: rider mass, body height, bike mass, equipment and position details (for example head and shoulder position), the track and the environmental conditions
• test recordings: FIT files and live sensor data with speed, power, cadence and GPS position, lap data and the results calculated from them; heart rate only as contained in the original FIT file and in values stored before 16 October 2026
• photos or files our fitter attaches to a test run (for example equipment changes)
• the report for your test, and a log of changes made to the analysis

Purpose: to carry out the aero test you booked and to produce and explain your report. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Providing these data is voluntary, but without them the test cannot be carried out or evaluated.

Your recordings can contain heart rate, and we record your body mass and height. We need body mass to calculate your result. Heart rate is not used in the calculation. From 16 October 2026 we do not store heart rate from files you upload or from live data: we drop it on import and do not show it in reports. Heart-rate values stored from earlier recordings remain until you ask us to delete them. We keep the original FIT file exactly as uploaded as evidence of your test, so if your device recorded heart rate, it is still inside that original file. We do not assess your health. If you do not want heart rate recorded at all, switch off or unpair your heart-rate strap for the test, or ask us to delete it. CycleFit Europe is not a medical provider and offers no medical or therapeutic services; an aero test does not replace a medical examination.

Any use beyond the test, in particular publishing photos, recordings or results, requires your separate, explicit consent.

Report links

A report link that you receive after an aero test contains a personal access token. Anyone who has the link can open the report, so please share it only with people you trust. The link is valid for a limited time only.

Report pages are marked noindex, so search engines do not list them.

Contact by email

If you write to us, we process the details you give us (such as your name, email address and the content of your message) to answer your request.

Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) where your request relates to a booking or service, otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). We keep this data until your request is finally dealt with and no statutory retention duty applies.

Retention

We store personal data only as long as the purpose requires or statutory retention periods demand. After that the data is deleted or anonymised.

Test data and reports are kept while your athlete account exists and are deleted when you ask us to, unless a statutory duty prevents it. Accounting records, such as invoices on the booking side, are kept for the statutory periods (§ 147 AO, § 257 HGB), generally six to ten years.

Your rights

Within the statutory conditions you have the right to:

• access to the data we process about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of a consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. A withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

To use your rights, an informal message to the contact details above is enough.

Right to lodge a complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you believe the processing of your data breaches the GDPR. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany. Telephone: +49 611 1408-0. Email: poststelle@datenschutz.hessen.de

Updates to this notice

This notice is current as of the date below. As we develop the website and the service, or when the law changes, we may need to update it.