1. Who we are and how to contact us
The controller of your personal data is TENWAYS TECHNOVATION EUROPE B.V., Kabelweg 57, 1014 BA Amsterdam, the Netherlands (Chamber of Commerce no. 85385115). For any privacy question, or to exercise your rights, contact us at privacy@tenways.com. We aim to respond within one month, in line with the GDPR.
2. What this Notice covers
Your participation in the Programme: placing an order, confirming your eligibility, collection and hand-over of the bicycle at a partner store, scheduled maintenance and the initial health check, warranty support, and return or purchase of the bicycle at the end of the lease. If you choose to use the Tenways app, that is a separate, voluntary service governed by the general Tenways Privacy Policy.
3. The personal data we collect, and where it comes from
We collect the following personal data directly from you when you order and during the lease:
- Identity and contact details: name, and your university email address;
- Confirmation of your enrolment / student status (see Section 4);
- Residence address and, where different, billing address;
- Payment information: your bank details and SEPA direct-debit mandate (or card details), handled by our payment providers;
- Order reference (SPF number) and bicycle frame number;
- Hand-over and return records, including your confirmation / signature and photographic evidence of the bicycle’s condition;
- Maintenance and return appointment information.
We collect this data directly from you. We do not buy your data from third parties or build profiles about you.
4. How we confirm your eligibility
We primarily confirm that you are an enrolled student through your university email address (by requiring you to order from that address). Where a university email address is not available, we may ask to check your student ID at hand-over; in that case, the ID is checked visually and no copy is made or retained — we keep only a record that verification was completed.
5. Why we use your data and our legal basis
| Purpose | Legal basis (and, for legitimate interests, the interest concerned) |
|---|---|
| Administering your lease: processing your order, collecting monthly payments, and managing your account | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Confirming your eligibility as an enrolled student | Our legitimate interest in confirming eligibility for the Programme and preventing misuse (Art. 6(1)(f)). We use your university email where possible; you may object to this processing |
| Arranging collection, scheduled maintenance, the health check and returns through the partner store | Performance of our contract with you (Art. 6(1)(b)) |
| Handling theft and damage insurance for the bicycle | Performance of our contract, and our legitimate interest in protecting the leased asset (Art. 6(1)(b)/(f)) |
| Providing customer support and warranty service | Performance of our contract with you (Art. 6(1)(b)) |
| Issuing invoices and keeping accounting and tax records | Compliance with a legal obligation (Art. 6(1)(c)) |
| Handling disputes and establishing, exercising or defending legal claims | Our legitimate interest in protecting our legal position (Art. 6(1)(f)) |
6. Who we share your data with, and their role
| Recipient | Role and purpose |
|---|---|
| Circuly | Our processor — the subscription-management platform used to administer orders, payments and the lease |
| The Click & Collect partner store | Our processor, under a data processing agreement — assembles, hands over, maintains and takes back the bicycle, and confirms collection |
| Our insurer | Recipient — to arrange and handle insurance for the bicycle |
| Payment providers | Recipient — to collect payments |
| Odoo | Our processor — business system used to process and manage orders |
We do not sell your personal data. Where a returned bicycle is later resold, that does not involve sharing your personal data with the buyer.
7. International transfers
For the administration of the Student Subscription Programme, your personal data is processed within the European Economic Area (EEA) and is not transferred outside the EEA. If you choose to use the Tenways app (which is not required to use the bicycle), the data processed through the app is governed by the general Tenways Privacy Policy, which explains transfers outside the EEA, including to China, under EU Standard Contractual Clauses.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Eligibility confirmation (via university email or visual ID check) | We keep only a record that eligibility was confirmed; we do not retain any ID document |
| Operational records: hand-over / return records, maintenance appointments, and the shared order-tracking file (name, email, order number) | Up to 12 months after completion of the relevant service |
| Photographic evidence of hand-over / return condition | 90 days, unless needed for a pending dispute or warranty claim |
| The lease contract and records needed for legal claims | 5 years after the end of the lease (Dutch limitation period) |
| Invoices, payment and tax records | 7 years (Dutch statutory tax-retention period) |
9. How we protect your data
We maintain appropriate technical and organisational measures, including access controls, secure storage and staff confidentiality. We limit access to your data to those who need it, and require our processors (including the partner store) to protect it under written data processing agreements.
10. Your rights
You have the right to: access your personal data; have it corrected; have it deleted; restrict or object to our use of it (including where we rely on legitimate interests); receive it in a portable format; and, where we rely on consent, withdraw that consent at any time. To exercise any of these rights, contact privacy@tenways.com; we respond within one month.
If you have a concern, you also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl.
11. Changes to this Notice
We may update this Notice to reflect changes in the Programme or in legal requirements. We will inform you of any material change.
12. When and how we provide this Notice
We provide this Notice to you on the order-process page before any personal data is collected, and again together with the lease agreement. If you need to refer to it later, please contact privacy@tenways.com or request a copy at any time.