This Privacy Notice explains how The Bikeability Trust collects, uses, stores, shares and protects personal information in connection with the CycleIn website and related services.

We process personal data in accordance with the Data Protection Act 2018, the UK General Data Protection Regulation ("UK GDPR"), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any other applicable data protection legislation. Where applicable, this notice also incorporates the requirements of the EU General Data Protection Regulation (EU GDPR) 2016/679.

This Privacy Notice applies to personal data processed in connection with the CycleIn website, including personal data relating to learners, website users, employees of organisations purchasing licences, prospective customers and other individuals who interact with us.

The Bikeability Trust is a charitable incorporated organisation (Charity Number 1171111) with a vision to ensure everyone has the confidence to cycle and enjoy this skill for life.

The Bikeability Trust is the data controller for personal data processed through the CycleIn website and services.

Contact details

The Bikeability Trust
PO Box 1494
Cambridge
CB22 3YT

Email: DPO@bikeabilitytrust.org

Whenever we process personal data, we will ensure that it is:

• processed fairly, lawfully and transparently;
• collected for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date where necessary;
• retained only for as long as necessary; and
• processed securely using appropriate technical and organisational measures.

We will also:

• seek your consent where required by law;
• inform you if we intend to use your data for a new purpose; and
• respect your privacy rights and choices.

Depending on how you use CycleIn, we may collect and process the following categories of personal data:

Identity and Contact Information

• name;
• email address;
• telephone number;
• postal address;
• billing address;
• organisation name;
• job title;
• postcode.

Account and Learning Information

• account credentials;
• account and licence information;
• learner access information;
• learner progress and completion data;
• subscription information;
• communication preferences.

Customer Service Information

• service enquiry information;
• customer support records;
• ticket management records.

Transaction Information

• order information;
• payment information;
• financial transaction records.

Where payment services are provided through approved payment processors, payment card information is tokenised and is not stored in CycleIn systems.

Technical and Usage Information

• IP address;
• browser type;
• device information;
• website usage information;
• cookie identifiers;
• analytics information.

Marketing and Engagement Information

• marketing preferences;
• webinar registration information;
• survey responses and feedback.

How We Use Personal Data

Creation of Accounts and Access to CycleIn

Legal basis: Article 6(1)(b) UK GDPR (Contract)

We process personal data to:

• create and manage learner accounts;
• provide access to CycleIn content;
• administer licences and subscriptions;
• provide customer support; and
• communicate important information relating to the service.

Administration of Organisational Licences

Legal basis: Article 6(1)(b) UK GDPR (Contract)

Where an employer, university, local authority or other organisation purchases licences, we process personal data necessary to administer those licences and facilitate learner access.

Content Distribution and Learning Access

Legal basis: Article 6(1)(b) UK GDPR (Contract)

Some organisations may choose to deliver CycleIn through their own Learning Management System ("LMS").

To support this service, The Bikeability Trust and TSO use scormPROXY, a content distribution service provided by WelcomeNext S.L., to host, manage and distribute CycleIn content to authorised third-party LMS platforms. Personal data such as learner names and email addresses may be processed to authenticate users, manage access rights and support course delivery.

Where learners access CycleIn through an organisation's LMS, that organisation may act as an independent data controller in relation to personal data processed within its own LMS environment. Learners should refer to their organisation's privacy notice for information about such processing.

Order Administration, Finance and Payments

Legal basis: Article 6(1)(b) UK GDPR (Contract)

We process personal data to:

• administer purchases and subscriptions;
• process payments;
• maintain financial records;
• provide customer support;
• manage contractual relationships.

Customer Support and Service Management

Legal basis: Article 6(1)(b) UK GDPR (Contract) and/or Article 6(1)(f) UK GDPR (Legitimate Interests)

We process personal data to respond to enquiries, manage support requests, maintain service quality and operate CycleIn effectively.

Our legitimate interest is the efficient administration and improvement of the service.

Service Communications

Legal basis: Article 6(1)(f) UK GDPR (Legitimate Interests)

We may contact users regarding:

• important platform updates;
• service improvements;
• account security matters; and
• licence or subscription renewals.

Our legitimate interest is ensuring users receive information necessary for the effective operation of the service.

Marketing Communications

Legal basis: Article 6(1)(a) UK GDPR (Consent), where consent is required

Where you have consented, The Bikeability Trust and its appointed processor, TSO, may send communications relating to:

• CycleIn;
• Bikeability programmes;
• webinars;
• service updates;
• related products and services.

You may withdraw your consent at any time by using the unsubscribe link included in marketing communications or by contacting us.

Surveys, Feedback and Service Improvement

Legal basis: Article 6(1)(f) UK GDPR (Legitimate Interests) and/or Article 6(1)(a) UK GDPR (Consent)

We may invite users to participate in surveys, webinars and feedback activities to help us understand user needs, improve CycleIn and develop future services.

Website Analytics and Improvement

Legal basis: Article 6(1)(a) UK GDPR (Consent) where required and/or Article 6(1)(f) UK GDPR (Legitimate Interests)

We use analytics and related technologies to understand how users interact with CycleIn, improve website performance and support service development.

Who We Share Personal Data With

The Bikeability Trust engages carefully selected third-party service providers to process personal data on its behalf in connection with the delivery, operation, support, marketing, payment processing and administration of CycleIn.

The Stationery Office Limited ("TSO") provides services relating to the hosting, operation and management of the CycleIn website, learner accounts, licence administration, order fulfilment and marketing support.

Where necessary for the provision of these services, TSO may engage approved sub-processors and may share personal data with its parent company, Williams Lea, affiliated Williams Lea entities and approved service providers, subject to appropriate contractual and data protection safeguards.

Processors and sub-processors may support activities including:

• content distribution and learner access;
• account creation and administration;
• website hosting;
• online payments;
• finance and order administration;
• customer support and ticket management;
• email services;
• marketing communications;
• webinar delivery;
• surveys and customer feedback;
• website analytics and tag management.

All processors and sub-processors approved by The Bikeability Trust are required to process personal data only in accordance with our instructions and applicable data protection legislation.

Some of our service providers may process personal data outside the United Kingdom or European Economic Area.

Where personal data is transferred internationally, we will ensure that appropriate safeguards are in place, including approved contractual measures and other lawful transfer mechanisms, to ensure that personal data remains protected in accordance with applicable data protection law.

You may contact us for further information regarding these safeguards.