Privacy Policy

In accordance with the General Data Protection Regulation (EU) 2016/679

1. Data Controller

JOOLL is the data controller responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR). As a bike leasing company based in Denmark, we are bound by Danish and EU data protection law.

If you have any questions or concerns regarding this privacy policy or how we handle your data, please contact us at:

Company: JOOLL

Country: Denmark

Email: jooll@jooll.dk

Address: Roskildevej 46, 2000 Frederiksberg

2. Scope of This Policy

This privacy policy applies to all personal data we collect, use, and share in connection with our bike leasing services. It covers data collected through our website, customer portal, mobile application, and any other interactions you may have with JOOLL, including but not limited to:

Signing up for or enquiring about a bike lease
Using our customer portal or app
Communicating with our support team
Using GPS-tracked leased bikes
Any other interaction with our services, platforms, or communications

This policy does not apply to personal data collected by third parties independently of JOOLL.

3. Personal Data We Collect

We collect personal data that is necessary to provide our bike leasing services, manage your account, and fulfil our legal obligations. The types of personal data we collect include:

3.1 Identity and Contact Information

Full name
Email address
Phone number
Home or delivery address
Date of birth (where required for age verification or credit assessment)

3.2 Lease and Financial Information

Lease agreement details and terms
Payment information (processed securely via our payment providers)
Credit or financial assessment data (processed by our leasing bank partners)

3.3 Technical and Usage Data

IP address and device identifiers
Browser type and version
Pages visited and interaction patterns on our website or portal
Log-in and log-out times

3.4 Location Data (GPS Tracking)

Real-time and historical location data of your leased bike, collected via GPS tracking devices (see Section 8 for full details)

3.5 Communication Data

Messages and correspondence sent to or received from our support team
Feedback or reviews you provide

4. How We Collect Your Data

We collect personal data through several channels:

Directly from you — when you register, sign a lease agreement, contact our support team, or fill in forms on our website (including forms built via WPForms and Elementor Forms).
Automatically — when you visit our website or use our portal, we may collect technical and usage data through cookies, log files, and similar technologies.
From our tools and systems — data generated or stored through our internal platforms such as Google Sheets, AppSheet, and Google Looker.
From GPS tracking devices — location data transmitted by trackers installed on your leased bike (see Section 8).
From third-party providers — for example, data necessary for credit checks or delivery provided by our leasing bank or delivery partners.

5. Purposes and Legal Basis for Processing

We only process your personal data where we have a lawful basis to do so under the GDPR. The table below sets out our main processing purposes and the corresponding legal basis:

JOOLL Privacy Policy Table

Purpose	Legal Basis
Managing your bike lease agreement and providing the leased bike	Performance of a contract (Art. 6(1)(b))
Processing payments and handling billing	Performance of a contract (Art. 6(1)(b))
Credit assessment via leasing bank partners	Performance of a contract (Art. 6(1)(b))
Customer support and communication	Legitimate interest (Art. 6(1)(f))
GPS tracking for theft recovery and bike location	Legitimate interest (Art. 6(1)(f)) — see Section 8
Sending marketing communications (newsletters, promotions)	Consent (Art. 6(1)(a))
Website and portal analytics	Legitimate interest (Art. 6(1)(f))
Complying with legal obligations (e.g. tax, reporting)	Legal obligation (Art. 6(1)(c))
Delivery of bikes and related equipment	Performance of a contract (Art. 6(1)(b))

Credit assessments are necessary in order to enter into and perform a lease agreement. Without a completed credit assessment, we are unable to offer or maintain a leasing contract.

Where we rely on legitimate interest as our legal basis, we have carried out a balancing test to ensure that our interests do not override your rights and freedoms.

5.1 Email Tracking and Analytics

Our transactional and marketing emails may include standard tracking technologies such as tracking pixels or click tracking. These technologies allow us to determine whether an email has been opened and whether links within the email have been clicked.

We use this information to measure the effectiveness of our communications, improve the relevance of our emails, and ensure that important service-related messages are delivered and read.

Tracking in marketing emails is only used where you have provided consent to receive marketing communications. Transactional emails necessary for the performance of a contract may include limited tracking based on our legitimate interest in ensuring reliable delivery and improving service quality.

You can withdraw your consent to marketing emails at any time by using the unsubscribe link included in our emails or by contacting us directly.

6. Who We Share Your Data With

We may share your personal data with selected third parties where necessary to provide our services, comply with legal requirements, or pursue legitimate business interests. We do not sell your personal data to third parties.

6.1 Data Processors

A data processor is a third party that processes data on our behalf. All our data processors are bound by contractual obligations to protect your data in accordance with GDPR. See Section 7 for a full list of our data processors.

6.2 Leasing Bank Partners

We share the necessary personal and financial data with our leasing bank partners (Grenke and Ikano) to facilitate the lease agreement. These entities act as independent data controllers for the data they receive and are subject to their own privacy policies and GDPR obligations.

6.3 Delivery Partners

To arrange the delivery of your bike or related equipment, we share your name and delivery address with our delivery partners (Cargoboard, Jetpak, and Sendebudet). This sharing is limited to what is strictly necessary for completing the delivery.

6.4 Legal and Regulatory Obligations

We may disclose your personal data if required by law, court order, or a lawful request from a public authority or law enforcement body.

6.5 Payment Processing

We use Stripe as our payment service provider to process payments securely. When you make a payment, necessary personal and payment-related information is shared directly with Stripe. JOOLL does not store full payment card details.

Stripe processes payment data both as a data processor on our behalf and, for certain purposes such as fraud prevention and legal compliance, as an independent data controller in accordance with its own privacy policy.

7. List of Data Processors

The table below lists the third-party tools and services we use as data processors. Each processor handles only the data necessary for their specific function and is contractually required to protect it in line with GDPR.

JOOLL Privacy Policy Table

Processor / Tool	Function	Data Processed
Google Workspace (Sheets, Looker)	Data storage, internal dashboards and reporting	Customer records, lease data, operational data
AppSheet	Internal operational tool (apps and workflows)	Customer and lease data used in day-to-day operations
SupportBee	Customer support and communication platform	Support tickets, customer correspondence
Brevo	Email delivery platform for transactional and service-related communications (e.g. lease confirmations, service messages, account notifications)	Email address, name, transactional communication data
Mailchimp	Email marketing and newsletter platform	Email address, name, marketing preferences and consent status
Simply (hosting)	Website and mail hosting	Website traffic data, email data
Zapier	Workflow automation and app integration	Data passed between connected apps as required
WPForms	WordPress web forms	Form submissions (contact, enquiry, etc.)
Elementor Forms	WordPress web forms	Form submissions (contact, enquiry, etc.)
BikeTrax / Copenhagen Trackers / Knog	GPS tracking device providers	Bike location data (see Section 8)
Cargoboard	Bike and equipment delivery	Name and delivery address
Jetpak	Bike and equipment delivery	Name and delivery address
Sendebudet	Bike and equipment delivery	Name and delivery address
Stripe	Payment processing and billing	Name, email address, payment status, transaction data (payment card details are processed directly by Stripe)

We use separate platforms for transactional communications and marketing communications in order to ensure clear separation of purposes and appropriate consent management. Transactional emails necessary for the performance of a contract are sent via Brevo, while marketing emails and newsletters are sent via Mailchimp and only to users who have provided valid consent.

Note: Grenke and Ikano (our leasing bank partners) act as independent data controllers, not as data processors on our behalf. They are therefore not included in this table but are described in Section 6.2.

8. GPS Tracking of Leased Bikes

All bikes leased through JOOLL are equipped with GPS tracking devices. This section explains in detail how location data is collected, used, and protected.

8.1 Tracking Providers

GPS tracking devices are supplied by one or more of the following providers: BikeTrax, Copenhagen Trackers, or Knog. These devices continuously collect and transmit location data about your bike

8.2 What Is Tracked

The GPS tracker records the real-time geographical location of your leased bike. This includes the coordinates of the bike at regular intervals while the device is active.

8.3 Purpose of Tracking

We use GPS location data for two specific purposes:

Theft recovery — to locate and recover your bike if it is reported stolen.
Customer service — to allow you to view the current location of your own bike at any time through your customer account or app.

8.4 Access to Location Data

Your access: You may view the real-time location of your bike at any time through your customer portal or app.

Our access: JOOLL will only access your bike’s location data when you report a theft or when you request support assistance that requires it. Under normal circumstances, we do not actively monitor your routes, usage patterns, or movements.

8.5 Legal Basis

We process location data on the basis of our legitimate interest (Article 6(1)(f) GDPR) in protecting our property — the leased bikes — and in providing you with theft recovery and bike location services. This tracking also serves your interest in being able to recover your bike if stolen and to locate it when needed.

We have conducted a legitimate interest assessment and concluded that this processing is proportionate, limited in scope, and does not override your fundamental rights and freedoms.

8.6 Third-Party Processing

Your bike’s location data is processed and stored by our tracking device providers (BikeTrax, Copenhagen Trackers, and/or Knog). These providers act as data processors on our behalf and are contractually bound to protect your data in accordance with GDPR requirements.

8.7 Tracker Requirements

The GPS tracker cannot be disabled through the customer interface and must remain active for the entire duration of your lease. This is a mandatory condition of your lease agreement. Tampering with, disabling, or removing the tracker is prohibited and constitutes a breach of your lease terms.

8.8 Data Retention — Location Data

Location data is retained for the duration of your lease plus 30 days after the lease ends. Historical location data older than this period is automatically deleted. At the conclusion of your leasing period, the tracker will be permanently removed from our system.

9. Data Retention

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. The table below outlines our general retention periods:

JOOLL Privacy Policy Table

Type of Data	Retention Period
Lease contract and customer records	Duration of the lease plus 7 years (for legal and tax compliance)
Payment and financial records	Duration of the lease plus 7 years
GPS location data	Duration of the lease plus 30 days (see Section 8.8)
Support correspondence	Up to 3 years after the last interaction
Marketing consent records	Until consent is withdrawn, plus 1 year
Website and usage logs	Up to 12 months

When data is no longer needed and the retention period has passed, it will be securely deleted or anonymised.

10. Your Data Protection Rights

As a data subject under the GDPR, you have the following rights. You may exercise these rights by contacting us using the details provided in Section 1.

Right of access — You may request a copy of the personal data we hold about you.
Right to rectification — You may ask us to correct any inaccurate personal data or complete any incomplete data.
Right to erasure (“right to be forgotten”) — You may request that we delete your personal data, subject to certain legal exceptions (e.g. where retention is required by law or to fulfil a contract).
Right to restriction of processing — You may ask us to restrict how we use your data in certain circumstances.
Right to data portability — You may request your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another data controller.
Right to object — You may object to the processing of your personal data where we rely on legitimate interest as our legal basis. Note: objecting to GPS tracking (Section 8) may make it impossible for us to continue the lease agreement.
Right to withdraw consent — Where processing is based on your consent (e.g. marketing emails), you may withdraw that consent at any time without affecting the lawfulness of any prior processing.
Right to lodge a complaint — You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe we have not complied with GDPR. You can reach them at datatilsynet.dk.

Please allow up to 30 days for us to respond to any request.

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies (such as local storage or tracking pixels) to improve your browsing experience and collect usage data for analytics purposes.

Essential cookies — Required for the website to function correctly. These cannot be disabled.
Analytics cookies — Help us understand how visitors use our website so we can improve it. These are subject to your consent.
Marketing cookies — Used to deliver relevant advertisements or track the effectiveness of marketing campaigns. These are also subject to your consent.

You can manage your cookie preferences through the cookie banner displayed when you first visit our website, or by adjusting the settings in your web browser. For more detail, please refer to our dedicated Cookie Policy available on our website.

12. International Transfers of Personal Data

Some of our data processors may be based outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we ensure that an appropriate level of protection is in place. This may include:

The recipient country being recognised by the European Commission as providing an adequate level of protection.
The use of Standard Contractual Clauses (SCCs) approved by the European Commission.
Other transfer mechanisms permitted under the GDPR.

If you would like more information about the specific measures in place for international transfers, please contact us.

13. Children's Data

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so that we can delete it.

14. Security of Your Data

We take the protection of your personal data seriously and implement appropriate technical and organisational measures to ensure a level of security suited to the risk. These measures include, but are not limited to:

Encryption of data in transit and at rest where appropriate.
Access controls ensuring that only authorised personnel can access personal data.
Regular review and updating of our security practices.
Contractual obligations on our data processors to maintain appropriate security measures.

However, no method of transmission over the internet or electronic storage is 100% secure. We will do our best to protect your data, but we cannot guarantee absolute security.

15. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will notify you — for example, by email or by posting a notice on our website.

We encourage you to review this policy regularly. Continued use of our services after any changes constitutes your acceptance of the updated policy.