Privacy | Lease a Bike

Highlights Privacy

At Lease a Bike, we take your privacy seriously. Privacy is in our DNA, and we design our platform, websites, and solutions to respect your privacy and that of your employees for a worry-free bike lease.

Some key points of focus regarding privacy are:

1. Periodic assessment of our privacy compliance

We respect the privacy of our own employees, our customers and partners, and their employees. That is why we take privacy very seriously. We conduct an annual IT risk assessment and Business Impact Assessment (BIA) to ensure that security and privacy measures are implemented that comply with the latest privacy legislation and the current state of cybersecurity threats.

2. Security and privacy by design guaranteed

For all new digital (IT system) initiatives and changes to existing processes or (new) third parties, a mandatory security and privacy by design intake and assessment is in place to ensure that privacy and security by design are implemented for any (new) personal and/or confidential data collected and/or processed.

3. Data minimization applied

Data minimization is applied to the (personal) data collected and processed via our platform for the bike leasing process. This means that we only collect and process the minimum necessary (personal) data required for the bike lease process.

4. Personal data in the European Economic Area (EEA)

We aim to store all personal data in a location that provides sufficient privacy safeguards. Therefore, we strive to ensure that all personal data is stored within the European Economic Area (EEA).

5. Periodic review of Privacy Statement, Terms of Use, Cookie Statement / toolbar

A key aspect of privacy is informing you in a transparent and comprehensive manner about which personal data is collected, how we process it, and how we protect it. The most important documents for this are the Privacy Statement, Terms of Use, Cookie Statement, and Cookie toolbar. These documents are periodically reviewed by the Data Protection Officer (as part of privacy controls) to confirm that they remain in accordance with the latest privacy legislation and case law, as well as our internal privacy requirements.

6. Strong supplier management

We focus on contracting only adequate external suppliers and have implemented strong supplier management controls. All new third parties are screened as part of the security and privacy by design intake and assessment to determine which measures are necessary (such as a Data Processing Agreement, additional security measures) and to monitor follow-up before going live.

7. Data retention set up

The retention of personal data involves the timely deletion of data when it is no longer needed for the bike lease process or relevant legislation. We therefore periodically check whether the data retention policies in various countries are still up to date and conduct an assessment to identify which (personal) data can be deleted.

8. Professional privacy management software in place

As the data controller for the bike lease platform, we are responsible for privacy processes, such as maintaining a processing register (RoPA), handling data subject rights requests, managing (potential) data breaches, and performing security and privacy by design intakes and assessments. Therefore, we have implemented professional software for these processes to ensure adequate, timely, and complete registration, processing, and monitoring of follow-up actions.

If you would like more information about our privacy approach, please contact your account manager or visit our Trust Center.

Frequently Asked Questions

: Lease a Bike is part of BMS Group and Pon Holdings. Lease a Bike has appointed a dedicated Data Protection Officer (DPO) who is part of the Pon Security and Privacy (S&P) Office. The Pon S&P Office operates an independent department within the Pon Holdings group to provide guidance, assess, and monitor that all companies comply with the security and privacy requirements and relevant privacy legislation. The monitoring e.g. also involves periodic privacy audits. The Privacy Officer of BMS Group reports to Lease a Bike and the board of Pon Holdings about the privacy status and follow up on improvement actions.
Additionally, Lease a Bike has a SOC 2 ® type 2 that proves the relevant privacy measures are implemented.
: While this question is understandable, it is common practice for bike lease mobility providers not to work with a Data Processing Agreement (DPA). A “Data Controller - to - Data Controller” relationship is in place between the employer and Lease a Bike and therefore a Data Processor Agreement (DPA) with Lease a Bike is not applicable. More details are explained in the question about “controller - controller relationship”.
: The employer has a controller-to-controller relationship with Lease a Bike because:
You as employer are a Data Controller as you:
Determine the main “Purpose” (why): initiates the selected employees of your company who are able to participate in the bike lease.
Determine the “Means” (how), by determining the scope of the bike lease e.g :
Approval of lease requests from your employees in the bike lease platform;
Number of bikes, maximum price and type of bikes;
Whether the employee is free to choose a service budget or whether the minimum budget can be increased before the contract is signed;
How many bikes individual employees can lease for themselves or for their whole family.
We as Lease a Bike are also a Data Controller as we:
Collect the (personal) data directly from your employee and process the (personal) data in the bike lease platform conform to the “Purposes” (why) as informed to the employee via the Privacy Statement;
Ask your employee to agree with the Terms of Use for the bike lease platform and therefore have a direct contractual relationship with the employee;
Determine the “Means” (how) of processing (e.g. the types of data to be processed, retention periods, who gets access, location of the data, involved third parties) as stipulated in and agreed upon in the Terms of Use and Privacy Statement by the your employee during registration on the bike lease portal;
Are acting on its role as Data Controller e.g. by maintaining a Data Processing Register, handling the Data Subject Rights requests from your employees, handling and reporting about data breaches.
Advantages for the employer are:
As Lease a Bike is fully accountable, we will make sure that privacy and security is up to standard. Therefore we have a SOC 2 ® type 2 assurance report in place. This report provides comfort to you as an employer about the implemented security and privacy measures;
Lease a Bike is responsible for handling all kinds of privacy related activities, like handling Data Subject Rights requests, having a data register in place and handling security and data breaches. This saves you as an employer a lot of time.
Not you as an employer but Lease a Bike is fully accountable for any privacy related fines from the data protection authorities;
The bike lease process and platform does not have to be compliant with the industry specific regulation your business is in. So there is no additional effort required from you to check the compliance.
We also have a detailed document that explains the above in more detail. If you want more information, please contact your sales representative.
: Yes, we have an appendix that can be added to the master bike lease contract to define in more detail what the responsibilities are between you as an employer and us.
Please note that this is not required by privacy legislation and is only aligned if you as an employer want to have this. Contact your sales representative for more information.
: No, the (personal) data provided by your employees is directly provided by the employee to us during registration on the bike lease platform. The (personal) data may even not be known by you as an employer as the data can also include a private email address or private phone number. Therefore we can not hand over all the data to you as an employer. Of course, we delete (personal) data in accordance with the (legal) retention policy.
: No, the bike lease process and bike lease platform are processes that are outside your primary business processes. An important reason for this is that it is up to your employee to decide to join the bike lease process and not up to you as employer. Therefore the bike lease process does not have to comply with the industry specific regulation (like banking, telecom, government, health). Naturally, we take security and privacy extremely seriously, which is why we have SOC 2 assurance report for our bike lease process and platform.