Privacy

Translation notice: This English version is provided for convenience. The German version is authoritative.

In brief: We use your data for workshop appointments, repair orders, communication and billing. The BYB workshop manager runs on a server operated by Backyard Bicycles. We do not sell customer data and do not use personalised advertising tracking on this website.

1. Controller

Backyard Bicycles
Owner: Thomas Rudi
Mittelstraße 22
68169 Mannheim
Germany
Phone: +49 621 32466644
Email: service@backyard-bicycles.de

2. Website and email hosting

The public website and our email mailboxes are hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, the hosting provider processes technically necessary connection data, in particular the IP address, date and time, requested address, referrer, browser and operating-system information. This data is used to deliver the website and ensure its stability and security.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

3. BYB workshop manager on our own server

Our workshop manager is provided on a server operated by Backyard Bicycles and is accessible through an encrypted connection at werkstatt.backyard-bicycles.de. It is used to manage the data required for appointments, customer service, bicycles, workshop orders, cost estimates, invoices and order-status communication.

Depending on the transaction, this may include:

• name, company and contact details
• address and preferred language
• bicycle details such as manufacturer, model, frame number and technical characteristics
• appointment request, fault description and requested work
• order status, completed work, parts, prices and invoice data
• order-related photographs, documents and customer-facing notes
• communication history and voluntary WhatsApp permission

Legal basis: Art. 6(1)(b) GDPR for pre-contractual steps and the performance of workshop and purchase contracts, Art. 6(1)(c) GDPR for statutory documentation and retention duties, and Art. 6(1)(f) GDPR for the traceable and secure organisation of workshop operations.

4. Online appointment booking

The appointment booking function is embedded directly from our workshop manager. When you access or use it, technically necessary connection data and the information you enter are transmitted to our own server. This may include your name, telephone number, email address, bicycle details, selected service, appointment and a message.

We use this data to schedule and prepare the workshop appointment and to contact you if necessary. Legal basis: Art. 6(1)(b) GDPR.

5. Personal order status and token links

We may provide a personal status link for a workshop order. It contains a long, randomly generated access key (token). The link only provides the information intended for the relevant order, such as the bicycle, order status, agreed work, cost information, customer-facing notes and, where applicable, documents.

The link is not publicly listed on our website. Anyone who receives it can access the released order information, so please do not forward it carelessly. If unauthorised disclosure is suspected, we can replace or disable the access key.

Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR. Our legitimate interest is simple yet access-controlled customer communication.

6. Contact by email and telephone

When you contact us by email or telephone, we process your contact details and the content of your message to answer your enquiry. If it concerns a contract or workshop order, the legal basis is Art. 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in handling enquiries under Art. 6(1)(f) GDPR.

7. Voluntary communication via WhatsApp

We use WhatsApp for order-related messages only if you select the relevant WhatsApp checkbox when your order is created or updated. Permission is voluntary; without it, we do not communicate through WhatsApp. You may withdraw your consent at any time with future effect by email, telephone or directly at the workshop.

When WhatsApp is used, your telephone number, profile and communication data in particular are processed by WhatsApp Ireland Limited. Processing by affiliated companies outside the European Union cannot be ruled out. Further information is available in the WhatsApp Privacy Policy.

Legal basis: your consent under Art. 6(1)(a) GDPR.

8. Invoices and statutory retention

We retain invoices, accounting records and tax-relevant data in accordance with statutory retention duties. Where required, data may be disclosed to tax advisers, tax authorities, financial institutions or other legally authorised recipients. Legal basis: Art. 6(1)(b) and (c) GDPR.

9. Technically necessary sessions and no advertising tracking

The public website currently does not use web analytics or personalised advertising tracking. Technically necessary session cookies may be used for protected or interactive workshop-manager functions. They are used only for security and functionality, not advertising.

Legal basis: Section 25(2) TDDDG and, where personal data is processed, Art. 6(1)(b) or (f) GDPR.

10. Fonts, maps and embedded tour content

Google Fonts

For consistent presentation, the website loads fonts from Google Fonts. This technically establishes a connection to Google servers and transmits the IP address in particular. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(f) GDPR; our interest is a consistent and readable presentation.

OpenStreetMap and Leaflet

Selected tour pages display maps using Leaflet and map tiles from OpenStreetMap. Loading such a map transmits your IP address in particular to the servers providing the map tiles. Further information is available in the OpenStreetMap Foundation Privacy Policy.

Komoot

Individual tour reports may contain an embedded Komoot map. Loading it provides komoot GmbH, Friedrich-Wilhelm-Boelcke-Straße 2, 14473 Potsdam, Germany, with technically necessary connection and usage data. Further information is available in the Komoot Privacy Policy.

Legal basis for maps and tour embeds: Art. 6(1)(f) GDPR. Our legitimate interest is the illustrative presentation of tours and routes.

11. External links

Our website contains links to third-party services, including Google Maps, Instagram, WhatsApp, Komoot and external event organisers. Data is transferred to the relevant provider only after you open such a link. The respective provider is responsible for subsequent processing.

12. Encryption and access protection

The website, appointment booking and status pages are transmitted through encrypted HTTPS connections. The internal workshop manager is access protected. Customer and order data may only be accessed by people who need it for their work. Despite careful safeguards, internet transmission can never be entirely risk free.

13. Retention period

We retain personal data only for as long as it is required for appointment handling, workshop orders, customer service and billing. It is then deleted or restricted unless statutory retention duties, warranty periods or legitimate interests in establishing or defending legal claims require further retention. Consent records are retained for as long as necessary to demonstrate consent.

14. Your rights

Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect. To exercise your rights, email service@backyard-bicycles.de.

You may also lodge a complaint with the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg or another competent supervisory authority.

15. Version and changes

Last updated: 30 September 2026. We update this privacy notice when our technical processes or services change.