Making cycling e-asier privacy notice

This privacy notice (Notice) explains how Cycling UK (we, our, us) collects, uses and shares your personal data in respect to the National E-Cycle Scheme (scheme), and your rights in relation to the personal data we hold.  

For details on Cycling UK’s other data processing please see our privacy policy.

Updating the Notice

We may modify this Notice at any time. We will endeavour to update you to any significant changes to this Notice. This Notice was last updated in February 2024. 

Data controller and contact details:

The Cyclists Touring Club (trading as Cycling UK with company number 25185 and registered as a charity in England and Wales with charity number 1147607 and in Scotland with charity number SC042541) is the data controller of your personal data. 

If you have any questions about this Notice, or if you would like to exercise any of your legal rights in respect of your personal data, please contact our Data Protection Officer using the following details: 

• Email: dpo@cyclinguk.org 
• ​Post: FAO Data Protection Officer, Parklands​, Railton Road, Guildford, Surrey GU2 9JX 

How we collect your information

We may collect your personal information: 

• From the information you provide to us when you fill in the form on our e-booking system.
• From the information you provide to us when you complete any of the surveys we send to you for monitoring and evaluation purposes. 
• When you correspond with us by phone; email, or by other means in respect to the Scheme
• From GPS tracking devices we may attach to the E-Cycles that are activated in the event of a reported theft or non-return of the E-Cycle. These tracking devices provide us with geo-location data to enable the recovery of our E-Cycles  
• From third parties, such as our Scheme partners (e.g bike retailers) or the police, if they provide information to us about your participation in the Scheme (for example, details of misuse, non-compliance with our terms, accidents or unlawful activity)   

The types of information we collect

We may collect and process the following personal information about you: 

• When you use our e-booking system we collect your name, postcode, contact details (address, email address and phone number) and details concerning your hire or attendance at our short-term sessions (including any mobility/access requirements). We will process this information because it is necessary for the performance of our E-Cycle hire agreement with you or to take steps at your request prior to entering into the hire agreement with you, and – in the case of access requirements – to establish and comply with our legal duty of care 
• You will be asked to complete surveys at various times. Your responses will be used to evaluate the effectiveness of the scheme. Your contact details (name, email address and telephone number) will be used to recontact you for the follow-up survey and to invite you to take part in interviews and focus groups. We are also collecting the following demographic data as part of our surveys: 

  • Gender. 

  • Age (banded). 

  • Household income (banded). 

  • Ethnicity. 

  • Partial postcode. 

  • Employment status. 

  • Physical and mental health conditions. 

• Your demographic data will be used for research and statistical purposes only. 

• We use geolocation data from our tracking devices to enable us to recover stolen or non-returned E-Cycles. Our legal basis for this processing is our legitimate interests in recovering our property and to comply with our legal obligation to assist the police. These tracking devices are only activated in the event of a theft or late return of an E-Cycle and otherwise do not track your use of the E-Cycle.

Our legal basis for using your information

• The processing of data is carried out under the lawful basis of Article 6(1)(e) of the UK GDPR, as it is deemed necessary for the performance of a task conducted in the public interest. This processing is integral to efficiently managing the program and monitoring its impacts.
• In the course of our operations, we gather special categories of personal information, including details about ethnicity and physical and mental health conditions. The lawful basis for processing this data is grounded in Article 9(2)(g) of the UK GDPR. This provision permits processing for reasons of substantial public interest, thereby ensuring that our program is designed to be inclusive and responsive to the diverse needs of the community. 

Who we share your information with

Information processed in respect to the Scheme is shared with: 

• Our insurers where this is required (for example, we may need to share your information in the case of an accident) to comply with our legal obligations or to exercise or defend a legal claim.
• We appoint data processors to allow us to carry out certain functions such as managing your booking or making card authorisations. Data processors we work with include:
  • Stripe: We use the payment management system Stripe to get a credit/debit card authorisation for one-month loans. This is for security purposes only and there are no charges made to your card. Stripe Payments UK Ltd is a leading financial management system, enabling the card authorisation to be securely taken via our website and database.
  • Bike Rent Manager: We use Bike Rent Manager to handle your booking. Bike Rent Manager is an inventory and reservations system that allows us to manage your loan securely.
• Should other evaluation partners be contracted in the future, this notice will be updated to reflect those changes.
• Anonymised data may be shared or published for reporting purposes. 

Legal obligations

We process your personal data for our compliance with our legal obligations including for charity regulatory reporting requirements, to report crimes and serious incidents, and to comply with our legal duty of care. In this respect and only if required, we will share your data with the Charity Commission, the police and other competent authorities. 

Direct marketing and consent

We also process your personal data where we have your specific consent to do so (for example, where we have sought and obtained your consent to send you direct marketing by email. If you have given your consent and you wish to withdraw it, please contact us using the contact details set out above or click the “unsubscribe” link in the emails we send. 

How long your information is kept

We will retain your personal data for as long as is required for legal purposes and our legitimate business purposes after the termination of our agreement with you. In particular: 

• In relation to personal data relating to your use of the Scheme, we will retain that data for a period of seven years after the E-Cycle hire agreement has concluded in case any legal claims arise out of your use of the Scheme.
• ​We will retain your details on our marketing database until you inform us that you no longer wish to receive our marketing communications. However, where you do unsubscribe from our marketing communications we will keep your details on a suppression list to ensure that we do not send you information you have asked not to receive.
• In relation to your survey data, your data will be anonymised at the earliest opportunity and consolidated with data from other research participants. We will use this aggregated data to analyse the efficacy and efficiency of the programme you have been involved in. Your personal data in relation to our surveys will only be retained for the duration of the scheme's monitoring and evaluation programme, which is expected to end in 2027. 

Your rights

Under UK data protection law you have the following rights in relation to our processing of your personal data: 

• To obtain access to, and copies of, the personal data that we hold about you 
• To require us to correct the personal data we hold about you if it is incorrect 
• To require us to erase your personal data in certain circumstances 
• To require us to restrict our data processing activities in certain circumstances (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal) 
• To receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for transmitting that personal data to another data controller 
• To object, on grounds relating to your situation, to any of our processing activities where you feel this has a disproportionate impact on your rights 
• To complain about the processing of your data to the Information Commissioner’s Office (ICO), although the ICO recommends that you first try and resolve the complaint with us  

Please note that the above rights are not absolute, and we may be entitled to refuse your requests where exceptions apply.

We may modify this Notice at any time. We will endeavour to update you to any significant changes to this Notice. This Notice was last updated in January 2023.