PRIVACY STATEMENT Bike Center Paul van Hal / Paul van Hal Bike Center – mountain bike rental Version October 2026 (Translation for your convenience. The Dutch text is the binding version.) 1. Who we are We are Paul van Hal Bike Center, Nieuweweg 29A, 3765 GA Soest, the Netherlands. We rent (electric) mountain bikes and bicycles from Soest and at Theehuis 't Hooge Erf in Lage Vuursche. We are responsible for processing your personal data as described in this statement. You can reach us at info@bcpvh.nl or +31 35 888 96 72. 2. Which data we process and why a. Booking and renting: your name, email address, phone number (optional), address, postcode and city, and the details of your booking (date, time, location, rented bikes, amount). We use these to carry out your booking, send you a confirmation and a reminder and have your bike ready. Basis: performance of the agreement. b. Paying: you pay via Mollie. We do not see or store your bank details or credit card number. We only store whether and how you paid. In case of a refund we store the amount and the method. Basis: performance of the agreement. c. Invoices and administration: we keep invoice data because the law requires it. Basis: legal obligation. d. Security and preventing misuse: we store the IP address from which a booking was made, to prevent misuse and fraud. Basis: legitimate interest. e. Service after your rental: afterwards we may send you a short email asking how it went and whether you would like to write a review. Basis: legitimate interest. You can always object to this. f. Customer account (optional): if you create an account, we store your details so you do not have to enter them again and can see your bookings. You log in with a link we send by email. If you choose 'stay logged in', we place a cookie for this. Basis: performance of the agreement and your choice to create an account. You can always delete your account yourself. g. Cookies and statistics: necessary cookies we place without consent. Cookies for statistics and marketing we only place if you choose so. Read more in our cookie statement. Basis: consent. 3. How long we keep data We keep bookings and invoices for 7 years, because the law requires this for the administration. We keep a customer account until you delete it. We keep the proof of your cookie choice for a maximum of 24 months, without your name or email address. Login links are valid for 20 minutes. We keep the IP address together with the booking. 4. Who we share your data with We do not sell your data. We only share it with parties that need it to provide our service: Mollie (payments), our hosting and email provider, and, only if you give consent, Google (statistics and advertising measurement). With parties that process data for us, we make agreements about security and use. Otherwise we only pass on data if the law requires us to. 5. Security Our website uses a secure connection (https). Staff have their own login with two-step verification and only see what they need for their work. 6. Your rights You have the right to access your data, have it corrected or deleted, restrict the processing, object and have your data transferred. If you gave consent, you can withdraw it at any time. Email us at info@bcpvh.nl. We respond within a month. Data we are legally required to keep cannot be deleted earlier. Do you disagree with how we handle your data? Then please contact us. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl). 7. Changes We may change this statement. The most recent version is always on our website. With every booking we store which version you have seen.