Pendl processes personal data in accordance with this privacy statement. For questions, you can contact info@pendl.app.

Address corporate headquarters	Foreestelaan 24/102, 9000 Ghent
Telephone	+32 499 62 73 31
Email	info@pendl.app
Company number	VAT BE 1032188876
RPR	Ghent, Ghent division

Why do we process personal data?

Your personal data is processed for:

• Enabling our services (profile creation, rankings, reporting)
• Making the website accessible (cookies)
• Direct marketing (e.g. newsletter)
• Contacting you for providing services if necessary
• Informing you about changes to services or products
• Legal obligations (e.g. tax return)

What personal data do we process?

We may process the following personal data:

Personal identification data

• Email address — for authentication and account recovery
• First name and last name — for display in the application
• Password — stored as a secure hash (bcrypt), never as readable text

Optional for users

• Nickname — alternative display name
• Date of birth — used for age-based rankings
• Gender — used for gender-based rankings
• Profile picture — securely stored on our servers
• Address — stored encrypted, used for reimbursement management
• Bank account number — stored encrypted, used for reimbursement payments
• Employee number — used for payroll reporting to your employer

Ride data

When you register a cycling ride, we store:

• Ride name, date, and distance
• Ride type (one-way or return)
• Elevation gain (if available)
• Calculated reimbursement amount

Strava data (if linked)

If you choose to link your Strava account, we receive:

• Strava user ID
• OAuth access and refresh tokens — to synchronize your activities
• Cycling activity data — commuting rides are imported as rides

We only import rides marked as commutes. We do not have access to your full Strava profile, social data, or non-cycling activities.

Technical data

During your use of the application, we automatically collect:

• IP address — for security and session management
• User agent — browser and device information
• Weather location (if enabled) — the city you enter for weather forecasts, not your GPS location

The data is used exclusively for the purposes for which it was obtained.

Provision to third parties

The data you provide to us may be shared with third parties if this is necessary for the execution of the purposes described above. For example, we use a third party for:

• Providing your personal data to your company
• Managing the internet environment (web hosting)

We never pass on personal data to other parties with whom we have not concluded a data processing agreement. With these parties (processors), we naturally make the necessary arrangements to ensure the security of your personal data. Furthermore, we will not provide the data you supply to third parties unless this is legally required and permitted. We may also share personal data with third parties if you give us permission to do so. You have the right to withdraw this consent at any time, without affecting the lawfulness of processing before its withdrawal. We do not provide personal data to parties located outside the EU.

Legal basis of processing

Personal data is processed on the basis of Article 6.1 (b) (necessary for the performance of a contract) of the General Data Protection Regulation.

Retention period

Personal data processed for customer management will be retained for the period necessary to comply with legal requirements (including in the field of accounting).

Right of access, rectification, erasure, restriction, objection and portability of personal data

The customer has the right at any time to access their personal data and may have it corrected if it is incorrect or incomplete, have it deleted, have its processing restricted, and object to the processing of personal data concerning them on the basis of Article 6.1 (e) or (f), including profiling based on those provisions.

In addition, the customer has the right to obtain a copy (in a structured, commonly used and machine-readable format) of their personal data and to have the personal data transferred to another company.

To exercise the above rights, the customer is requested to:

• Adjust the settings of their customer account themselves; and/or
• Send an email to info@pendl.app

Direct marketing

The customer has the right to object free of charge to any processing of their personal data for direct marketing purposes.

Complaint

The Customer has the right to lodge a complaint with the Commission for the Protection of Privacy (Drukpersstraat 35, 1000 Brussels - commission@privacycommission.be).

Cookies

For full details about which cookies we set and why, see our Cookie Policy.

Disclaimer

For information about intellectual property, limitation of liability, and applicable law, see our Disclaimer.

AI Policy

For information about how we use AI within our organization, see our AI Policy.