Privacy notice for reservations

This notice covers reservations of the traffic schools through this system: the request form, the calendar on kidbike.de, the waiting list, the usage agreement and the emails about it. Deutsche Fassung (the German version is authoritative).

Controller

KidBike e.V., Verkehrsschulen Friedrichshain-Kreuzberg. Address and representatives: see the legal notice at www.kidbike.de/impressum. For any data protection question, write to events@kidbike.de.

What we process, why, and on what basis

• Request and reservation: name, salutation, address, email, phone, organisation if any, the requested date, number of people, type of event, extras and your message, to review your request, prepare the usage agreement and host the event (Art. 6(1)(b) GDPR).
• Signature: your name, the drawn signature, time, IP address and browser identifier at signing, and a checksum of the document, as proof of who signed which version when (Art. 6(1)(b) and (f) GDPR).
• Copy of an ID (only at venues that require it): to check who is responsible for the facility and the deposit (Art. 6(1)(f) GDPR). If you prefer not to upload a copy, write to us and show the ID at handover instead. The copy is deleted automatically shortly after the event.
• Payment: incoming payments, invoices, for processing and statutory retention (Art. 6(1)(b) and (c) GDPR).
• Emails: when which email went to which address, and its text for a limited time.
• Waiting list: name, email, phone and the requested period, to tell you when it becomes free.
• Abuse protection: requests per IP address are counted for at most one day (Art. 6(1)(f) GDPR).
• Address search and map: queried through our server (Photon by komoot, Germany; map tiles from OpenStreetMap); your IP address is not passed on.

The public pages set no cookies and use no tracking or advertising.

Processors

Supabase (database and files, Frankfurt), Netlify (hosting), Resend (email delivery), sevDesk (accounting, Germany). Netlify and Resend are based in the USA; transfers rely on the EU-US Data Privacy Framework or EU standard contractual clauses.

Retention

• ID copies: until shortly after the event.
• Email texts: 12 months. Photos of the site: 12 months, longer only for an open damage case.
• Waiting list: 3 months after the requested date.
• Contact details, messages and signed agreements: 3 years after your last event, then made anonymous.
• Invoices and accounting records: as long as tax and commercial law require (up to 10 years).

Your rights

Access, rectification, erasure, restriction, portability and objection (Art. 15 to 21 GDPR): write to events@kidbike.de. You may also complain to a supervisory authority; in Berlin, the Berlin Commissioner for Data Protection and Freedom of Information. No automated decisions are made; a person decides on every request.