Skip to content

Legal

Privacy policy

As of 22 August 2026. We process your personal data solely in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). This policy describes what we actually run — not what we might run one day.

1. Controller

GlowRide – Linda Kroiher, sole proprietorship, Oberrauchenödt 29, 4264 Grünbach, Austria.

For all data protection matters: info@glowride.at. We are not legally required to appoint a data protection officer.

2. What data we process

  • Account: email address, name, phone number (optional), billing address (optional), date of birth (voluntary, only for birthday surprises), shoe size (voluntary, only so we can set aside loaner shoes for you), language and theme preference.
  • Bookings: booked classes, bike number, attendance, cancellations and the reason given.
  • Credits and payments: purchases, balance, vouchers, referrals, invoices.
  • Communication: messages sent through the contact form, a record of emails sent to you, marketing consent status.
  • Technical: server logs (IP address, timestamp, page requested, browser identifier), your cookie choice.

We do not ask for health data. If you tell us about a health circumstance yourself (for instance when cancelling at short notice), we process it for that one case only and delete it afterwards.

3. Purposes and legal bases

  • Performance of contract (Art. 6(1)(b) GDPR): account, bookings, credits, payments, class-related emails such as confirmations and reminders.
  • Legal obligation (Art. 6(1)(c) GDPR): retention of invoices and accounting records (§ 132 BAO).
  • Legitimate interest (Art. 6(1)(f) GDPR): IT security, abuse and spam prevention, answering contact form enquiries.
  • Consent (Art. 6(1)(a) GDPR): marketing emails (double opt-in), analytics cookies, the Meta Pixel, loading Google maps.

You can withdraw any consent at any time with effect for the future — for emails via the unsubscribe link in every message or in your account, for cookies via "change cookie settings" in the footer.

4. Payment for our open-air classes

You book your seat at our open-air classes on this website using a credit. Credits are bought online; payment is handled by our payment processor Stripe (see section 5). No attendee data is shared with the venue or any on-site partner.

5. Recipients and processors

  • Supabase Inc. — database, account management and file storage, hosted in the EU Frankfurt region.
  • Vercel Inc. — hosting and delivery of the website, EU regions.
  • Stripe Payments Europe Ltd. (Ireland) — payment processing when buying credits. Card details are handled exclusively by Stripe and never reach our systems.
  • Resend Inc. — delivery of our emails.
  • Google Ireland Ltd. — analytics and maps, in each case only with your consent (see sections 6 and 7).
  • Meta Platforms Ireland Ltd. — Meta Pixel for ad measurement on Facebook and Instagram, only with your consent (see section 8).

Data processing agreements under Art. 28 GDPR are in place with all of the above. Where data is transferred to the USA, the transfer is based on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

6. Google Analytics 4

We use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages are found and used, so we can improve what we offer. We do not sell this data and we do not combine it with your account.

The analytics script is only loaded after you have accepted the "analytics" category in the cookie banner. Without that consent it is not loaded and no connection to Google is made.

What is processed: truncated IP address, pages viewed, time on page, approximate location at city level, device type and browser, and the referring site. Google Analytics truncates IP addresses within the EU before storing them. Google sets the cookies _ga and _ga_<ID> with a lifetime of up to 24 months. Usage data is retained in our Analytics account for 14 months.

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act 2021. You can withdraw it at any time via "change cookie settings" in the footer; the script is then no longer loaded.

7. Google Maps

On the home page and on class detail pages we embed maps from Google Maps so you can find the meeting point. When a map loads, Google receives your IP address and may set cookies.

That is why no map loads automatically: you first see a placeholder with a "load map" button. Only your click — or consent previously given for the "marketing" category — loads the map. If you don't click, no connection to Google is made.

8. Meta Pixel (Facebook and Instagram)

We use the Meta Pixel from Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) to measure whether our ads on Facebook and Instagram lead to bookings, and to show you ads there that match your visit. We do not pass names or email addresses to Meta.

The pixel is only loaded after you have accepted the "marketing" category in the cookie banner. Without that consent it is not loaded and no connection to Meta is made.

What is processed: IP address, pages viewed, device type and browser, and events such as registration, starting a purchase and completing a purchase (with the amount, without payment details). Meta sets the cookies _fbp (lifetime 3 months) and, where applicable, _fbc (lifetime 3 months). If you are logged in to Facebook or Instagram at the same time, Meta may link this data to your account there; Meta is independently responsible for that processing. Data is transferred to the USA in the process — Meta is certified under the EU-US Data Privacy Framework.

The legal basis is your consent under Art. 6(1)(a) GDPR in conjunction with § 165(3) of the Austrian Telecommunications Act 2021. You can withdraw it at any time via "change cookie settings" in the footer; the pixel is then no longer loaded and its cookies are deleted. What Meta processes and which rights you have there: facebook.com/privacy/policy.

9. Cookies

Which cookies we use, what for and for how long is set out in full in our cookie inventory. Strictly necessary cookies are set without consent under § 165(3) TKG 2021; everything else only with it.

10. Retention periods

  • Account data: until you delete your account.
  • Booking data: 3 years after your last booking.
  • Invoices and accounting records: 7 years (§ 132 BAO).
  • Contact form messages: 12 months after the matter is closed.
  • Cookie consent records: 12 months.
  • Analytics data in Google Analytics: 14 months.
  • Meta Pixel cookies: 3 months.
  • Server logs: 30 days.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21 GDPR).

Just write to info@glowride.at. If you believe we are processing your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority: dsb.gv.at.

12. Obligation to provide data

For an account and a booking we need at least your email address — without it we cannot confirm a class or hold a bike for you. Everything else, in particular phone number, date of birth and shoe size, is voluntary and there is no disadvantage in leaving it out.