Lifeonabike Logo

Last Updated: 20 October 2026

Life On a Bike is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use our Platform. It applies to visitors of our website, to people who request a quote or book a tour, and to the travellers included in a booking.

1. CONTROLLER INFORMATION

The data controller for this Platform is:

  • Company: Redpilled OÜ
  • Registry code: 17419878
  • VAT: EE102949454
  • Address: Ruunaoja tn 3, 11415 Tallinn, Estonia
  • Email: info@lifeonabike.com

We do not have a designated Data Protection Officer (DPO), but all privacy inquiries should be directed to the email above.

1.1 Our Role and the Role of Tour Operators

Life on a Bike (Redpilled OÜ) is the controller for the operation of the Platform and for the management of your quote and booking (enquiries, quotes, booking administration, communications with you and transmission of your booking to the Tour Operator). The Tour Operator that organises your package is an independent controller for the performance of the travel contract (delivering the tour, accommodation, bikes, guides, transfers and assistance), under its own privacy notice. We each process your data for our own purposes and are each responsible for our own processing.

2. SCOPE OF THIS POLICY

2.1 What This Policy Covers

This Privacy Policy applies to personal data we collect through:

  • Our website (lifeonabike.com)
  • Mobile applications (if any)
  • Email communications
  • Customer support interactions
  • Booking and payment processes

2.2 Third-Party Services

This Policy does not cover:

  • Tour Operator websites or services (they have their own privacy policies)
  • Stripe payment processing (covered by Stripe's privacy policy)
  • Third-party websites linked from our Platform

When we share your data with Tour Operators or Stripe, they become independent data controllers for that data.

3. LEGAL BASIS FOR PROCESSING (GDPR)

We process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):

Purpose Legal Basis
Handling quote requests, bookings and payments Performance of contract and pre-contractual steps (GDPR Art. 6(1)(b))
Communicating with you about your quote or booking Performance of contract
Sharing data with Tour Operators Performance of contract + Legitimate interest
Data of travel companions and emergency contacts (Section 4.5) Performance of the travel contract + Legitimate interest in the safety of the trip
Customer support Performance of contract + Legitimate interest
Marketing communications Consent (GDPR Art. 6(1)(a))
Analytics cookies and similar technologies (Google Analytics 4, Microsoft Clarity) Consent (GDPR Art. 6(1)(a))
Measurement of enquiries and bookings sent from our server to Google Analytics (Section 12.3) Consent (GDPR Art. 6(1)(a))
Technically necessary cookies and storage Legitimate interest / necessity for the service you request
Fraud prevention and security (including Google reCAPTCHA and rate limiting) Legitimate interest + Legal obligation
Compliance with legal obligations Legal obligation (GDPR Art. 6(1)(c))

4. PERSONAL DATA WE COLLECT

4.1 Information You Provide Directly

Quote Requests:

  • Name, email address and phone number
  • Tour, dates, number of travellers and room or bike choices
  • Any free-text request you choose to write (please do not include health information, see Section 4.4)
  • For tailor-made (Travel Design) requests: group composition, dates, area, accommodation and bike preferences, budget

Booking Information (participants form):

  • First name and surname of each traveller
  • Email address and phone number
  • Date of birth (needed by the Tour Operator for age-based prices and conditions)
  • Height (needed by the Tour Operator to assign the right bike size)
  • Room type and bike type
  • Billing details: address, city, post code, country, tax ID / VAT number

Date of birth and height are booking data, not health data.

Payment Information:

  • Payment card details are entered directly on Stripe's payment page; we do not receive full card numbers
  • Payment status, amounts and transaction references

Communications:

  • Emails you send us and our replies
  • Feedback you send us through our feedback forms
  • Survey responses (if you participate)

4.2 Information Collected Automatically

Technical Data:

  • IP address
  • Browser type and version
  • Operating system
  • Device type (desktop, mobile, tablet)
  • Screen resolution
  • Time zone and location (country/city level)

Usage Data:

  • Pages visited and time spent on pages
  • Tours viewed and searched
  • Clicks and navigation paths
  • Referral source (how you found our Platform)
  • Date and time of visits

Cookies and Tracking:

  • Technically necessary cookies (for example your cookie consent choice)
  • Analytics cookies (Google Analytics 4, Microsoft Clarity) - only with your consent
  • See Section 12 for detailed information

4.3 Information from Third Parties

Payment Data from Stripe:

  • Payment confirmation status
  • Transaction IDs
  • Fraud risk indicators

Data from Tour Operators:

  • Availability and confirmation of your booking, and any information about your booking the Tour Operator needs to share with us

Data from Trustpilot:

  • The notification that a review has been published, including the reviewer's name, which we use only to stop sending review invitations

4.4 Health Data

We do not collect health data. Our forms contain no field for medical conditions, medication or disabilities, and our Terms ask you to share any such information directly with the Tour Operator, which processes it as an independent controller under its own privacy notice. If you send us health information anyway, we do not use it, we ask you to send it directly to the Tour Operator, and we delete it from our systems.

4.5 Travel Companions and Emergency Contacts

If you book for other travellers or give us an emergency contact, you provide us with their name and contact details. We use them only to manage the booking and transmit them to the Tour Operator for the same purpose, on the basis of the performance of the travel contract and of our legitimate interest in the safety of the trip. Please share this notice with them.

5. HOW WE USE YOUR PERSONAL DATA

5.1 Essential Uses (Cannot Opt Out)

We use your data to:

a) Process Bookings:

  • Confirm and manage your reservations
  • Process payments via Stripe
  • Send booking confirmations and receipts
  • Schedule balance payments

b) Share with Tour Operators:

  • Transmit your booking details to the Tour Operator responsible for your tour
  • Enable the Tour Operator to contact you directly
  • Coordinate tour logistics

c) Customer Support:

  • Respond to your inquiries
  • Resolve issues with bookings
  • Handle cancellations and modifications

d) Platform Operations:

  • Maintain and improve Platform functionality
  • Debug technical issues
  • Ensure Platform security

e) Legal Compliance:

  • Comply with accounting, tax, and legal requirements
  • Respond to legal requests (court orders, government inquiries)
  • Prevent fraud and enforce our Terms

5.2 Optional Uses (You Can Opt Out)

Marketing Communications:

  • Send promotional emails about new tours, special offers, and travel inspiration
  • Personalized tour recommendations based on your interests
  • Post-trip follow-ups and review requests

You can opt out by:

Note: Even if you opt out of marketing, we will still send essential transactional emails (booking confirmations, payment receipts, etc.).

5.3 Analytics and Improvement

Platform Analytics:

  • Analyze how users navigate the Platform
  • Identify popular tours and features
  • Detect and fix usability issues
  • Optimize Platform performance

Business Intelligence:

  • Aggregate statistics (no individual identification)
  • Market research and trends
  • Product development

Tools We Use:

  • Google Analytics 4 and Microsoft Clarity, only with your consent (see Section 12)
  • Email tracking (open rates, click rates), see Section 13

5.4 What We Do NOT Do

We do NOT:

  • Sell your personal data to third parties
  • Share your data with third parties for their own marketing purposes (without your consent)
  • Use your data for purposes incompatible with those described in this Policy
  • Take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (see Section 5.5)

5.5 Artificial Intelligence and Automated Processing

We use third-party artificial intelligence services to help prepare tour descriptions, images and videos, to draft and send customer communications, and to organise internal records. The providers are:

  • Anthropic PBC (United States) — text: drafting and processing of communications and internal records
  • Google LLC (United States) — generation of images and video; no personal data is used for this purpose
  • Notion Labs, Inc. (United States) — internal workspace

We use these services under their business/API terms. Transfers to these providers rely on the EU-U.S. Data Privacy Framework and, where applicable, on Standard Contractual Clauses.

Some emails are written by an AI assistant and sent without review by a team member. Every email we send carries a notice in its footer stating that our emails may be drafted with the help of artificial intelligence and reviewed by a member of our team, or prepared and sent automatically by an AI assistant. Other emails, such as payment reminders and review requests, are standard messages with a fixed text sent automatically and signed by the Life on a Bike team. Replies may be read by a person or processed by an AI agent. Images on the Platform carry a visible "AI" mark, meaning "AI-generated or AI-modified", applied by policy to all images including photographs (see Section 28 of our Terms and Conditions).

We do not use artificial intelligence to take decisions that produce legal effects concerning you, or that similarly significantly affect you, within the meaning of Article 22 GDPR. Prices are calculated by fixed rules from the Tour Operator's rates; availability, bookings and cancellations are decided by the Tour Operator.

6. DATA SHARING AND RECIPIENTS

6.1 Tour Operators (Independent Controllers)

What We Share: When you book a tour, we share the following with the responsible Tour Operator:

  • Traveler names
  • Contact information (email, phone)
  • Date of birth and height (for age-based conditions and bike size)
  • Emergency contact, if you gave us one
  • Booking details (tour, dates, number of travelers, type of room, type of bike, any free-text requests)

Purpose: To enable the Tour Operator to provide the tour services you booked.

Legal Basis: Performance of contract + necessary for fulfilling your booking request.

Tour Operator's Responsibility: The Tour Operator is an independent data controller for the performance of the travel contract, while Life on a Bike remains controller for the Platform and the management of your booking (Section 1.1). The Tour Operator is responsible for:

  • Compliance with GDPR and their national privacy laws
  • Processing your data only for tour provision
  • Protecting your data
  • Responding to your data subject rights requests related to their processing

We require Tour Operators to maintain GDPR compliance, but we are not responsible for their data practices. Review the Tour Operator's privacy policy (provided to you after booking).

6.2 Payment Processor (Stripe)

What We Share:

  • Booking amount and currency
  • Your name and email
  • Billing address

What Stripe Collects Directly:

  • Payment card details (you enter these directly on Stripe's secure form)
  • Transaction data

Purpose: To process payments securely. Payments are made to the Tour Operator's own Stripe account (Stripe Connect), so the Tour Operator also receives the payment data of your transaction.

Stripe's Role: Stripe is an independent data controller for payment data. See Stripe's Privacy Policy: https://stripe.com/privacy

Data Location: Stripe Payments Europe Ltd. (Ireland) processes EU customer payments. Data may be transferred to Stripe Inc. (USA) for fraud prevention, subject to Standard Contractual Clauses.

6.3 Service Providers and Other Recipients

We share data with the following service providers, which process it on our behalf under the providers' data processing terms. For each one we indicate its location and, for providers outside the EEA, the transfer mechanism (EU-U.S. Data Privacy Framework ("DPF") where the provider is certified, otherwise Standard Contractual Clauses ("SCC")).

Provider Purpose Location / transfer mechanism
Airtable (Formagrid, Inc.) Database for quotes, bookings and customer records United States — DPF / SCC
Supabase, Inc. Image storage, server functions and database Data hosted in the EU (Ireland); US company — DPF / SCC
Vercel, Inc. Website hosting United States — DPF / SCC
Upstash, Inc. (via Vercel) Rate limiting against abuse (IP addresses, short-lived) EU or United States — DPF / SCC
Brevo (Sendinblue SAS) Sending transactional and marketing emails France (EU)
Google Workspace / Gmail (Google LLC) Email correspondence with you United States — DPF
Slack Technologies, LLC Internal notifications United States — DPF / SCC
Notion Labs, Inc. Internal workspace United States — DPF / SCC
HubSpot, Inc. Customer relationship management United States — DPF / SCC
Anthropic PBC AI drafting and processing of text (Section 5.5) United States — DPF / SCC
Google LLC (Gemini, Veo) AI image and video generation, no personal data (Section 5.5) United States — DPF
Google LLC (Google Analytics 4, reCAPTCHA) Analytics (with consent) and protection of forms against abuse (Section 12) United States — DPF
Microsoft Corporation (Clarity) Analytics, only with consent (Section 12) United States — DPF
CookieYes Limited Cookie consent banner and record of your choice United Kingdom — adequacy decision; other countries — SCC

Independent controllers (they decide for their own purposes how to process the data they receive):

  • Tour Operators — performance of the travel contract (Section 6.1)
  • Stripe — payment processing (Section 6.2)
  • BeSafe Group S.r.l. (Italy) — only if you choose the protected rate (BeSafe Rate Plus), whose cover BeSafe provides under its own conditions (https://www.travel.besafesuite.com/insurances/besafe-plus): the data needed to provide the cover
  • Trustpilot A/S (Denmark) — only if you write a review on Trustpilot, under Trustpilot's own privacy policy

6.4 Legal and Safety Disclosures

We may disclose your data if required by law or to:

  • Comply with legal processes (court orders, subpoenas, warrants)
  • Respond to government or regulatory requests
  • Enforce our Terms and Conditions
  • Protect our rights, property, or safety
  • Protect the rights, property, or safety of users or the public
  • Detect, prevent, or address fraud, security, or technical issues

6.5 Business Transfers

If Lifeonabike is involved in a merger, acquisition, bankruptcy, or sale of assets, your personal data may be transferred to the successor entity. You will be notified via email and/or Platform notice.

7. INTERNATIONAL DATA TRANSFERS

7.1 Data Storage Location

Our booking database (Airtable) is hosted in the United States; images and server functions (Supabase) are hosted in the European Union (Ireland); the website is served by Vercel. See Section 6.3 for each provider.

7.2 Transfers Outside the EEA

Several service providers listed in Section 6.3 (e.g., Airtable, Vercel, Google LLC, Anthropic PBC, Stripe Inc.) are located outside the European Economic Area (EEA), primarily in the United States. Some Tour Operators are established outside the EEA: transmitting your booking to them is necessary for the performance of the contract you request.

Safeguards: When we transfer data outside the EEA, we ensure appropriate safeguards:

  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Adequacy decisions (e.g., UK is considered adequate)
  • Certification schemes (e.g., EU-U.S. Data Privacy Framework for U.S. companies)

Stripe Transfers: Stripe Payments Europe Ltd. (Ireland) processes EU payments. Data may be transferred to Stripe Inc. (USA) with SCCs in place.

Google Analytics: Google LLC (USA) processes analytics data. Google is certified under the EU-U.S. Data Privacy Framework.

7.3 Your Rights Regarding Transfers

If you object to data transfers outside the EEA, you may request deletion of your data. However, this may prevent us from providing services (as payment processing via Stripe requires such transfers).

8. DATA RETENTION

8.1 How Long We Keep Your Data

We keep personal data in accordance with our Data Retention Policy (version 1.1). The periods are:

Data Type Retention Period Reason
Booking and contract data, payment and accounting records 10 years after the end of the relationship Estonian tax and accounting law, civil limitation periods, Package Travel Directive
Quote requests that did not lead to a booking 12 months from our last contact with you, then deleted Pre-contractual steps
Support emails As long as relevant to the booking, and no longer than 10 years Contract and dispute resolution
Marketing consents Until you withdraw consent Consent and proof of consent
Analytics data Up to 14 months (Google Analytics and Microsoft Clarity); cookies last as described in Section 12 Consent
Health information sent to us despite Section 4.4 Deleted once we have asked you to send it to the Tour Operator Not processed

8.2 Extended Retention for Legal Claims

If there is an ongoing dispute, complaint, or legal claim, we may retain relevant data until the matter is resolved, even beyond the periods above.

8.3 Deletion After Retention Period

After the retention period expires, we securely delete or anonymize your data so it can no longer identify you.

9. YOUR RIGHTS UNDER GDPR

As a data subject in the European Economic Area, you have the following rights:

9.1 Right of Access (Art. 15 GDPR)

You can request a copy of the personal data we hold about you.

We will provide:

  • Categories of data processed
  • Purposes of processing
  • Recipients of your data
  • Retention periods
  • A copy of your data in a structured, commonly used format

How to exercise: Email info@lifeonabike.com with subject "Data Access Request" Response time: Within 1 month (may be extended by 2 months for complex requests)

9.2 Right to Rectification (Art. 16 GDPR)

You can request correction of inaccurate or incomplete data.

How to exercise:

Response time: Within 1 month

9.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your personal data in certain circumstances:

  • Data no longer necessary for the purposes collected
  • You withdraw consent (for consent-based processing)
  • You object to processing and there are no overriding legitimate grounds
  • Data processed unlawfully
  • Legal obligation to delete

Exceptions (we may refuse deletion if):

  • Required to comply with legal obligations (e.g., tax records)
  • Necessary to establish, exercise, or defend legal claims
  • Public interest or scientific/historical research purposes

How to exercise: Email info@lifeonabike.com with subject "Data Deletion Request"

Note: If you have an upcoming or recently completed booking, we may need to retain booking data for legal/contractual reasons.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request that we limit how we use your data in certain situations:

  • You contest the accuracy (while we verify)
  • Processing is unlawful but you don't want deletion
  • We no longer need the data but you need it for legal claims
  • You've objected to processing (while we verify our legitimate interests)

How to exercise: Email info@lifeonabike.com

9.5 Right to Data Portability (Art. 20 GDPR)

You can receive your personal data in a structured, machine-readable format (e.g., JSON, CSV) and transmit it to another controller.

Applies to:

  • Data you provided to us
  • Processing based on consent or contract
  • Processing carried out by automated means

How to exercise: Email info@lifeonabike.com with subject "Data Portability Request"

9.6 Right to Object (Art. 21 GDPR)

Object to Processing Based on Legitimate Interest: You can object to processing based on our legitimate interests (e.g., fraud prevention and security). We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

Object to Marketing: You can object to marketing communications at any time by:

9.7 Right to Withdraw Consent (Art. 7 GDPR)

For processing based on consent (e.g., marketing emails, optional cookies), you can withdraw consent at any time.

Withdrawal does not affect:

  • Lawfulness of processing before withdrawal
  • Processing based on other legal grounds (e.g., contract)

How to withdraw:

  • Unsubscribe from marketing emails
  • Change your cookie choices as described in Section 12.4
  • Email info@lifeonabike.com

9.8 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you can lodge a complaint with a supervisory authority:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

Or the data protection authority of the EU/EEA country where you live or work, or where the alleged infringement took place.

9.9 Exercising Your Rights

How to Submit Requests:

Include:

  • Your full name
  • Email address used for your quote or booking
  • Description of your request
  • Proof of identity (to prevent unauthorized access)

Response Time: We will respond within 1 month of receiving your request (may be extended by 2 additional months for complex requests, with explanation).

Free of Charge: We do not charge fees for exercising your rights, unless requests are manifestly unfounded or excessive (especially repetitive).

10. DATA SECURITY

10.1 Technical and Organizational Measures

We implement appropriate security measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

Technical Measures:

  • Encryption in transit: All data transmitted via HTTPS/TLS
  • Encryption at rest: Sensitive data encrypted in databases
  • Payment security: PCI-DSS Level 1 compliance via Stripe (we do not store complete card numbers)
  • Access controls: Multi-factor authentication for staff accounts
  • Firewalls and intrusion detection
  • Regular security updates and patches

Organizational Measures:

  • Data access limitations: Only authorized personnel access personal data on a need-to-know basis
  • Staff training: Privacy and security training for employees
  • Data processing agreements: With all processors
  • Incident response plan: Procedures for data breach notification
  • Regular audits: Internal security reviews

10.2 Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms:

  • We will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware
  • We will notify affected individuals without undue delay if the breach poses a high risk
  • Notification will include: nature of the breach, likely consequences, and measures taken

11. CHILDREN'S PRIVACY

11.1 Age Restriction

Our Platform is not intended for children under 18 years old. We do not knowingly collect personal data from children under 18.

11.2 Parental Consent

If a parent/guardian books a tour for a minor (under 18), the parent/guardian provides the minor's data and consents to processing on the minor's behalf.

11.3 If We Discover Child Data

If we become aware that we have collected data from a child under 18 without proper parental consent, we will delete it promptly.

12. COOKIES AND TRACKING TECHNOLOGIES

12.1 What Are Cookies

Cookies are small text files stored on your device when you visit our Platform. Similar technologies (such as scripts that read information from your browser) work in a comparable way; in this Section we call them all "cookies".

12.2 Cookie Consent Banner

We use the CookieYes consent banner. When you first visit our Platform you can accept, reject or customise non-essential cookies. Analytics cookies are used only with your consent; technically necessary cookies are used on the basis of our legitimate interest in providing the service you request, or because they are strictly necessary for it.

12.3 Cookies and Technologies We Use

Technically necessary (no consent required):

  • CookieYes consent cookie (cookieyes-consent, 1 year): stores your cookie choices
  • Banner preference (bannerSeen, 7 days): remembers that you closed the discount banner
  • Google reCAPTCHA v3: loaded on our quote and booking forms to protect them against bots and fraud. reCAPTCHA collects technical data about your device and your interaction with the page and sends it to Google LLC (United States, DPF). Legal basis: our legitimate interest in the security of the Platform.

Analytics (consent required):

  • Google Analytics 4 (Google LLC, United States, DPF): we use Google Consent Mode v2 with all storage denied by default. Before you consent, the Google tag sets no analytics cookies and may send Google cookieless pings (without identifiers) about page views. Analytics cookies are set only after you accept analytics cookies.
  • Microsoft Clarity (Microsoft Corporation, United States, DPF): records how pages are used (clicks, scrolling, page views). It is loaded only after you accept analytics cookies, and never on the pages of our Tour Operator registration area.
  • Site version (siteVersion, our own cookie, session): assigns you to one of two versions of some pages so that we can compare them (A/B testing). It is set only after you accept analytics cookies; otherwise you see the standard version.

Server-side measurement: only if you have accepted analytics cookies, and only on pages where the Google tag is not active (for example the participants form and the payment confirmation page), our server sends Google Analytics 4 an event about your action, such as sending the participants form or paying a deposit. The event contains no contact details and is linked to the Google Analytics identifier already set in your browser. If you have not accepted analytics cookies, no server-side event is sent.

The full, current list of cookies, with their duration, is shown in the CookieYes banner under "Customise".

We do not use advertising or retargeting cookies, Meta (Facebook) Pixel, Google Ads conversion tracking or heatmap tools other than Microsoft Clarity.

12.4 Changing Your Choices

You can change or withdraw your consent at any time through the CookieYes consent button shown on the Platform, which reopens the cookie banner. Withdrawing consent does not affect processing carried out before withdrawal.

12.5 Managing Cookies via Browser

You can also control cookies through your browser settings:

  • Block all cookies: May impair Platform functionality
  • Delete existing cookies: Clear browsing data

12.6 Third-Party Privacy Policies

13. EMAIL TRACKING

13.1 Open and Click Tracking

Emails we send through Brevo use open and click tracking: an invisible image records whether and when you opened the email, and links pass through a redirect that records which ones you clicked. We use this to check that booking and payment emails reach you and to improve our content.

Legal basis: for marketing emails, your consent, given when you subscribed; for service emails, our legitimate interest in knowing that essential messages have been delivered.

Your choices: you can block open tracking by turning off automatic image loading in your email client, and you can object to tracking at any time by writing to info@lifeonabike.com.

13.2 Marketing vs. Transactional Emails

Marketing Emails (opt-in):

  • Promotional offers
  • New tour announcements
  • Travel inspiration
  • You can unsubscribe anytime

Transactional Emails (cannot opt out):

  • Booking confirmations
  • Payment receipts
  • Balance payment reminders
  • Customer support responses
  • Essential for service delivery

14. CHANGES TO THIS PRIVACY POLICY

14.1 Updates

We may update this Privacy Policy to reflect:

  • Changes in our data practices
  • New features or services
  • Legal or regulatory requirements
  • User feedback

Notification:

  • Updated Policy posted on Platform with new "Last Updated" date
  • Material changes: Email notification, where we hold your email address, at least 30 days before effective date

Continued Use: Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

14.2 Review Regularly

We encourage you to review this Privacy Policy periodically.

15. CONTACT US

15.1 Privacy Questions

For questions about this Privacy Policy or our data practices:

15.2 Data Subject Rights Requests

To exercise your GDPR rights (access, deletion, etc.):

Include your full name, the email used for your quote or booking, and proof of identity.

15.3 Data Protection Authority

You have the right to lodge a complaint with:

Estonian Data Protection Inspectorate

16. CALIFORNIA PRIVACY RIGHTS (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

16.1 CCPA Rights

  • Right to Know: What personal information we collect, use, and disclose
  • Right to Delete: Request deletion of your personal information
  • Right to Opt-Out of Sale: We do NOT sell personal information, so this does not apply
  • Right to Non-Discrimination: We will not discriminate against you for exercising CCPA rights

16.2 Exercising CCPA Rights

Email: info@lifeonabike.com with "California Privacy Request" in the subject line. We will verify your identity before processing requests.

16.3 "Do Not Sell My Personal Information"

We do NOT sell personal information as defined by the CCPA. We share data only as described in Section 6 (for business purposes necessary to provide services).

17. ACCESSIBILITY

17.1 Accessible Format

If you need this Privacy Policy in an accessible format (large print, audio, etc.), please contact info@lifeonabike.com.

Last Updated: 20 October 2026

Privacy Policy | Lifeonabike.com