Privacy Policy

1. Who we are

This Privacy Policy is issued by GO CYC SPORTS SERVICES, a business licensed in the Emirate of Abu Dhabi, United Arab Emirates.

In this Policy, “GOCYC“, “we“, “us” and “our” refer to GO CYC SPORTS SERVICES. “You” and “your” refer to any person who uses the Platform.

GOCYC acts as the data controller for the personal data described in this Policy, except where expressly stated otherwise.

For all data protection matters, contact privacy@gocyc.ae. Our full registration and contact details are set out in Section 20.

2. What this Policy covers

This Policy applies to the GOCYC mobile application, the GOCYC website, and all related services (together, the “Platform“), including:

• user accounts and profiles
• bicycle rentals
• cycling event discovery, registration and ticketing
• bookings for maintenance, repair and other services offered by third-party service providers
• purchases of products sold by GOCYC
• product listings published by third-party sellers
• community cycling programmes, group rides and organised activities
• communications with our team

This Policy applies to everyone who interacts with the Platform, including individual users, event organisers, service providers, sellers and corporate or institutional partners.

By using the Platform, you acknowledge that you have read and understood this Policy.

3. The law we work under

We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its Executive Regulations, together with other applicable United Arab Emirates legislation, including Federal Law No. 15 of 2020 on Consumer Protection and its Executive Regulations, and Federal Decree-Law No. 14 of 2023 on Trading Through Modern Technology.

4. Definitions

Personal data — any information relating to an identified natural person, or a natural person who can be identified directly or indirectly.

Processing — any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, erasure or destruction.

Data subject — the natural person to whom personal data relates.

Controller — the party that determines the purposes and means of processing personal data.

Processor — a party that processes personal data on behalf of, and under the instructions of, a controller.

5. Our core commitments

We do not sell your personal data. We have never sold personal data and we do not make it available to any third party for that party’s own advertising or commercial purposes.

We do not share your data with data brokers.

We collect only what the Platform needs to function. Where a service can operate without a piece of personal data, we do not ask for it.

We do not require identity documents in the app. We do not collect, request or store Emirates ID, passport or other government identity documents through the Platform.

6. What personal data we collect

6.1 Account and profile data

• full name
• mobile telephone number (used to register and verify your account)
• email address
• profile photograph, where you choose to upload one
• gender and date of birth, where you choose to provide them
• language and communication preferences
• your city or emirate or address, where you choose to provide it

6.2 Emergency contact data

When you complete your profile, you may provide an emergency contact telephone number. This is stored in your profile record and is used only to contact that person in the event of an incident during a ride, event, rental or activity organised or facilitated by GOCYC.

If you provide the details of another person as your emergency contact, you confirm that you have that person’s permission to do so and that you have informed them that GOCYC holds their number for this purpose.

We do not collect medical records, diagnoses, treatment information, allergy or medication data, insurance data, or any other health record through the Platform.

6.3 Transaction data

• records of your rentals, event registrations, service bookings and product purchases
• amounts paid, currency, date, time and status of each transaction
• delivery or collection address where you order a physical product
• tax invoices issued to you, which are stored in the app for your access

We do not store your full payment card number, expiry date or security code. Card details are entered into, and held by, our licensed third-party payment processor. We receive only a transaction reference, the outcome of the payment, and a masked identifier such as the last four digits and card type.

6.4 Rental data

• the bicycle or equipment allocated to you, its identifier and its declared value
• rental start and end times, pick-up and return locations
• condition records, including photographs taken at hand-over and return
• any damage, loss, late return or incident record arising from a rental

6.5 Event and programme data

Where you register for an event, group ride or community programme through the Platform:

• your registration details and the event or programme you registered for
• category, distance, wave or session where applicable
• attendance and participation records
• jersey or apparel size, where the event provides kit
• team or club affiliation, where you provide it
• any additional information the event organiser requires, which is shown to you on the relevant event page before you register

6.6 Activity integration data

If you choose to connect a third-party activity-tracking account — currently Strava — we receive summary distance data, such as total kilometres ridden over a period, so that we can display your riding totals, progress and any applicable challenge or leaderboard position within the Platform.

We do not collect your ride history, GPS routes, route maps, individual activity files, heart rate, power or other performance metrics.

This integration is entirely optional. It operates only if you actively connect the account, and you can disconnect it at any time from within the app, after which we stop receiving new data.

6.7 Location data

The Platform uses mapping services to display events, rides, rental locations, cycle tracks and points of interest. Where you grant permission through your device settings, we use your approximate or precise device location at the time you use a relevant feature to show you what is nearby and to provide directions.

We do not track your location in the background, and we do not build a location history from your use of the Platform. You can withdraw location permission at any time in your device settings; some features will be less useful as a result.

6.8 Technical and usage data

• device model, operating system and version, app version, device identifiers
• IP address, approximate location derived from IP, language settings
• pages and screens viewed, features used, session duration, referring source
• diagnostic and crash reports, including the technical state of the app at the time of a failure

6.9 Communications data

• messages, enquiries, complaints and support requests you send us, and our replies
• feedback, reviews and ratings you submit
• your marketing preferences and consent records

6.10 Partner and business contact data

If you interact with us as an event organiser, service provider, seller, supplier, sponsor, or corporate or institutional partner, we process the business contact details of your representatives — name, role, email, telephone — together with the contractual, commercial and operational records relating to our relationship, and, where required, trade licence and tax registration details of your organisation.

7. How we collect personal data

We collect personal data:

• directly from you, when you register, complete your profile, make a booking or purchase, register for an event, contact us, or take part in a programme;
• automatically, when you use the Platform, through your device, our servers, cookies and similar technologies;
• from third parties you connect, where you authorise an integration such as Strava;
• from partners, where an event organiser, community programme partner or institutional partner provides us with participant details for an activity delivered through the Platform;
• in person, at rentals, events, rides and activations, including condition records and attendance registers.

8. Why we process personal data, and on what basis

Purpose	Lawful basis under the PDPL
Create and maintain your account; verify your phone number	Performance of a contract with you
Process rentals, event registrations, service bookings and product orders	Performance of a contract with you
Take payment, issue tax invoices, process refunds	Performance of a contract; compliance with a legal obligation
Contact your emergency contact following an incident	Protection of the vital interests of the data subject
Deliver community programmes and organised rides	Performance of a contract; our legitimate interests
Provide customer support and handle complaints	Performance of a contract; compliance with a legal obligation
Display your riding totals and challenge standings from a connected activity account	Your consent
Show nearby events, tracks and rental locations	Your consent (device location permission)
Operate, secure, test, debug and improve the Platform	Our legitimate interests
Analyse usage trends and measure feature performance	Our legitimate interests
Send you service messages about your bookings and account	Performance of a contract
Send you marketing about GOCYC services and events	Your consent, or our legitimate interests where you are an existing customer
Prevent, detect and investigate fraud, misuse, damage, theft and abuse	Our legitimate interests; protection of our rights
Maintain accounting, VAT and corporate records	Compliance with a legal obligation
Respond to lawful requests from competent authorities	Compliance with a legal obligation; public interest
Report on government-supported and institutional programmes	Public interest; performance of a contract with the relevant authority

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

9. Marketing communications

We may send you information about GOCYC events, programmes, services, products and offers by email, SMS, push notification or in-app message.

• If you are not an existing customer, we will send marketing only where you have consented.
• If you are an existing customer, we may send you information about services similar to those you have already used, and you may opt out at any time.

Every marketing message includes an unsubscribe mechanism. You can also change your preferences in the app, or email privacy@gocyc.ae.

Opting out of marketing does not stop service messages — booking confirmations, rental reminders, event instructions, safety notices, payment receipts, tax invoices and account or security notifications. These may be necessary to deliver the service you have requested.

10. Cookies and similar technologies

Our website and app may use cookies, caching, SDKs, pixels and similar technologies to:

• keep the Platform working — maintaining your session, remembering your login, securing transactions, load balancing. These are strictly necessary and cannot be switched off.
• remember your preferences — language, region, display settings.
• measure and improve performance — understanding which features are used, where users encounter errors, and how the Platform performs across devices.

You can refuse or delete cookies through your browser settings, and control advertising identifiers through your device settings. If you block strictly necessary cookies, parts of the Platform will not function.

We do not use cookies to build advertising profiles about you, and we do not permit third parties to use tracking technologies on the Platform for their own advertising purposes.

App analytics

The GOCYC mobile app uses Google Analytics for Firebase to understand how the app is used and how bookings and purchases perform, so that we can fix problems and improve the Platform. We do not use it for advertising.

While analytics is switched on, the app sends Google:

• app usage — the screens you view and the features you use, such as viewing a product, adding it to your cart, starting checkout, signing up and logging in
• purchase and refund details — the order reference, the items, their price and quantity, and the total value in AED
• identifiers — an app instance ID that Firebase generates for your installation of the app, and your internal GOCYC account number when you are signed in
• technical data — device model, operating system, app version, language, the city you have chosen in your profile, and approximate location derived from your IP address

We do not send your name, telephone number, email address or payment card details to Google Analytics, and we do not use your device’s advertising identifier.

Purchase and refund events are also sent to Google Analytics from our own servers when a payment or refund is completed, so that our sales figures stay accurate if the app is closed before the payment finishes. These events carry the same purchase details and app instance ID as those sent by the app, and nothing more.

Google acts as our processor for this data. Analytics data is processed on Google’s infrastructure outside the UAE, including in the United States and the European Union, and we keep a copy in Google BigQuery in the European Union for our own reporting. These transfers are made on the basis set out in Section 12.

Analytics data is kept for 14 months and then deleted, both in Google Analytics and in our BigQuery copy. Aggregated reports that do not identify you may be kept longer.

Analytics is on by default. You can switch it off at any time in the app under Settings → Share usage analytics. While it is off, the app stops sending analytics data from your device, and we stop sending purchase and refund events for it from our servers. Switching analytics off does not affect how the app works.

11. Who we share personal data with

We share personal data only in the circumstances set out below.

11.1 Service providers acting on our instructions

We use carefully selected third-party providers to operate the Platform. They act as processors — they may use personal data only to perform services for us, under written contract, and never for their own purposes. The categories are:

• payment processing — to take payment, issue refunds and prevent payment fraud
• cloud hosting and data storage
• mapping and location services — to display maps, locations and directions
• messaging and notification delivery — SMS verification codes, transactional email, push notifications
• analytics, diagnostics and crash reporting — to monitor stability and improve the Platform
• customer support tooling
• accounting, audit and professional advisory services

We keep an internal register of these providers. If you would like to know which providers currently process your personal data, email privacy@gocyc.ae and we will tell you.

11.2 Event organisers

Where you register for an event through the Platform, we provide the organiser of that event with the registration data necessary to run it — typically your name, contact details, category or wave, and any additional information the event page told you would be collected.

The event organiser is an independent controller of that data. They are responsible for how they use it, and they are required to operate their own privacy notice and to comply with UAE data protection law. The organiser is identified on the event page before you register. Their cancellation, refund and data-handling terms apply in addition to ours. If you have a question about how an organiser uses your data, contact them directly; we will help you reach them.

11.3 Service providers offering services on the Platform

Where you book a service through the Platform — for example mobile maintenance or repair — we provide the relevant provider with the information they need to deliver it, including your name, contact number, appointment time, service location and details of the bicycle or equipment concerned.

11.4 Sellers listing products on the Platform

Third parties may list products on the Platform which, when selected, direct you to that seller’s own website to complete the purchase. We do not transfer your personal data to those sellers. Any personal data you provide once you leave the Platform is collected by that seller under their own privacy policy and terms, and this Policy does not apply to it.

11.5 Government, regulatory and institutional bodies

GOCYC works with UAE government departments, sports councils, cycling federations and clubs, and other public and institutional bodies to deliver community cycling programmes and events. In that context we share personal data as follows.

(a) Lawful and regulatory requests. We disclose personal data where we are required to do so by UAE law, by a competent court, regulator, law enforcement body or government authority, or where disclosure is necessary to comply with a legal obligation, to protect public safety, or to establish, exercise or defend legal claims.

(b) Programme delivery and reporting. Where a programme, event or initiative is run with, supported by, hosted by, or delivered on behalf of a government or institutional partner, we share participation data with that partner. Depending on what the partner requires and what has been agreed for that programme, this may include aggregate statistics (such as attendance numbers, participation trends and demographic breakdowns) and identifiable participant records (such as participant lists containing names and contact details, registration records and attendance registers).

Where a programme involves the sharing of identifiable participant records, this is stated on the registration page for that programme before you register, together with the identity of the partner concerned. Partners receiving identifiable records are bound by confidentiality obligations and must handle the data in accordance with UAE law.

11.6 Insurers, advisers and incident handling

Where an incident, injury, damage, loss, theft or dispute occurs, we may share relevant personal data with our legal advisers, insurers, loss adjusters, and the emergency services, to the extent necessary to respond to and resolve the matter.

11.7 Corporate transactions

If GOCYC is involved in a merger, acquisition, restructuring, financing, or a sale of all or part of its business or assets, personal data may be transferred as part of that transaction. The recipient will remain bound by this Policy, or by a policy offering equivalent protection, and we will notify you of any material change.

12. International transfers

The Platform is operated from the United Arab Emirates and our primary processing takes place in the UAE.

Some of our service providers operate infrastructure outside the UAE. Where personal data is transferred outside the UAE, we do so only where:

• the destination has an adequate level of protection as recognised under UAE law; or
• the transfer is subject to a written contract imposing protections equivalent to those required by the PDPL; or
• the transfer is otherwise permitted under Articles 22 and 23 of the PDPL, including where it is necessary to perform a contract with you.

We take reasonable steps to satisfy ourselves that any recipient outside the UAE applies an appropriate standard of protection.

13. How long we keep personal data

We keep personal data only for as long as necessary for the purpose it was collected for, and for any period required by law.

Data	Retention
Account and profile data	For as long as your account is active, and for 12 months after closure
Transaction, invoice, VAT and accounting records	5 years from the end of the relevant tax period, as required by UAE tax law, and longer where a dispute or audit is open
Rental records, condition reports and incident records	3 years from the end of the rental, and longer where a claim or dispute is open
Event and programme participation records	3 years, or the period agreed with the relevant partner or authority
Emergency contact details	For as long as your account is active; deleted on closure
Activity integration data	Until you disconnect the integration, then deleted within 30 days
Support correspondence	2 years from resolution
Marketing consent and opt-out records	For as long as necessary to honour your preference
Technical logs, diagnostics and crash reports	12 months
App analytics data	14 months

When a retention period ends, we delete the data or irreversibly anonymise it. Where deletion is not immediately possible because data is held in secure backups, we isolate it from further processing until deletion occurs in the ordinary backup cycle.

14. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption of personal data in transit and at rest
• role-based access control, so that staff access only the data their role requires
• authentication controls on administrative systems
• segregation of production and development environments
• logging and monitoring of access to systems holding personal data
• written confidentiality obligations on staff, contractors and service providers
• vetting of service providers before engagement, and written data processing agreements
• regular review of our collection, storage and processing practices

No transmission over the internet is entirely secure. While we protect your personal data to a commercially reasonable standard, we cannot guarantee the security of data transmitted to us over the internet, and any such transmission is at your own risk.

You are responsible for keeping your account credentials and the device you use confidential. Tell us immediately at privacy@gocyc.ae if you believe your account has been accessed without your authorisation.

15. Personal data breaches

If a breach occurs that is likely to prejudice the privacy, confidentiality, security or integrity of your personal data, we will:

• notify the UAE Data Office without undue delay and in accordance with the timeframes required by law; and
• notify you without undue delay where the breach is likely to cause you harm, describing what happened, what data was affected, what we are doing about it, and what you can do to protect yourself.

16. Your rights

Under the PDPL you have the right to:

• be informed about how we process your personal data
• access the personal data we hold about you, and obtain a copy
• correct personal data that is inaccurate, incomplete or out of date
• request erasure of your personal data, where the law allows
• restrict processing in defined circumstances
• object to processing based on our legitimate interests, and to direct marketing at any time
• portability — receive personal data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
• withdraw consent at any time, where processing is based on consent
• object to automated decision-making that produces legal effects or similarly significantly affects you

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile users for that purpose.

How to exercise your rights

Email privacy@gocyc.ae with the request and enough information to identify your account. We may ask you to verify your identity before we act, to protect you against unauthorised disclosure.

We respond within 30 days. Where a request is complex or where we receive a number of requests from you, we may extend this by a further 30 days and will tell you if we do, with the reason.

There is no charge, unless a request is manifestly excessive or repetitive, in which case we may charge a reasonable fee or decline to act, giving reasons.

Some rights are qualified. For example, we may be unable to erase data we are required to keep for tax, accounting, legal or safety reasons. Where we cannot fully meet a request, we will explain why.

Deleting your account

You can request account deletion in the app or by emailing privacy@gocyc.ae. We will delete or anonymise your account and profile data in accordance with Section 13, retaining only what we are legally required to keep.

17. Children

The Platform is intended for adults.

An account may only be opened and operated by a person aged 18 or over. A person under 18 may use the Platform, participate in an event or programme, or be the subject of a rental only where a parent or legal guardian:

• registers on their behalf or supervises their use of the account;
• provides consent for the collection and processing of the minor’s personal data; and
• accepts the GOCYC Terms & Conditions on the minor’s behalf and assumes responsibility for their participation.

We do not knowingly collect personal data from a person under 18 without the consent of a parent or legal guardian. If you believe a minor has provided us with personal data without that consent, contact privacy@gocyc.ae and we will delete it and close the account.

Where a community programme is designed for young riders, the registration process for that programme collects guardian consent and guardian contact details, and the guardian is the point of contact for all data protection matters relating to that participant.

18. Third-party links and integrations

The Platform contains links to third-party websites, event pages, seller websites and services. When you follow a link away from the Platform, or connect a third-party account, that third party processes your data under its own privacy policy and terms, over which we have no control and for which we accept no responsibility.

We recommend that you read the privacy policy of every third-party service you use, including any activity-tracking account you connect and any seller website you are directed to.

19. Changes to this Policy

We may update this Policy from time to time to reflect changes in our services, technology or legal obligations. The current version, with its version number and effective date, is always available in the app and on our website.

Where a change is material — in particular a change to the purposes of processing, the categories of recipients, or your rights — we will notify you in advance by email, in-app notice, or both, and where the law requires it we will seek your consent.

Continued use of the Platform after a change takes effect constitutes acknowledgement of the updated Policy.

20. Contact and complaints

Data protection matters: privacy@gocyc.ae General support: support@gocyc.ae

Controller details

Legal entity	GO CYC SPORTS SERVICES
Commercial Licence No.	CN-5722238
Licence type	Trader Business Establishment
Licensing authority	Abu Dhabi Department of Economic Development
Tax Registration Number (TRN)	105493898800003
Registered address	Abu Dhabi, United Arab Emirates
Country of domicile	United Arab Emirates
Data protection contact	privacy@gocyc.ae
General support	support@gocyc.ae

We take privacy complaints seriously and will investigate and respond to any complaint you raise.

If you are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office, the federal supervisory authority for personal data protection in the United Arab Emirates.

GO CYC SPORTS SERVICES · Commercial Licence CN-5722238 · TRN 105493898800003 · Abu Dhabi, United Arab Emirates

Read the Terms & Conditions