GoCycle | Privacy Policy

Privacy Policy

Last updated: 7 September 2026

Welcome to the GoCycle App!

Karbon Kinetics Ltd., together with its parent companies, subsidiaries and affiliated entities (collectively, “GoCycle,” “we,” “us” or “our”), takes your privacy seriously. Karbon Kinetics Ltd. is the controller responsible for the personal data described in this Privacy Policy and is located at New Bridge Street House, 30–34 New Bridge Street, London EC4V 6BJ, United Kingdom.

This Privacy Policy （ “the Policy” ） is designed to explain how we, as the data controller, and the processors we engage (e.g., cloud service providers), collect, use, and process your personal data—both currently and in the future—as well as to inform you of your legal rights regarding your personal data.

If you have any questions about this Policy or wish to exercise your data protection rights, please contact us at DPO@gocycle.com.

If you are located in the European Economic Area (EEA) or the United Kingdom, the provisions in the main body of this Privacy Policy shall apply to you.

If you reside in the United States or Canada, please also read the jurisdiction-specific terms that apply to your region. If those terms conflict with the main body of this Privacy Policy, the jurisdiction-specific terms will prevail to the extent of the conflict.

For individuals from all other countries/regions, we will provide protections in accordance with applicable local laws.

1. How We Collect and Process Your Personal Data

In this section, we will explain the types of personal data we collect and use, how we use it, the legal basis for such use, and the recipients to whom we will disclose your personal data .

While you are not legally required to provide personal data to us, certain personal data is necessary for us to provide our products and services. Without these data, we may not be able to deliver our products and services to you.

Personal Data	Use	Legal Bases	Recipients
When you choose to Sign up/Log in via email, we collect: Email address, password, User ID, country/region When you choose to Sign up/Log in via GoCycle.com, we collect: Email address, password, User ID, country/region When you choose to Sign up/Log in via third-party accounts, we collect: Google: Google UID, email address, profile picture, country/region Apple: Apple UID, email address, profile picture, country/region	To create a user account, verify your identity, and facilitate account management—such as by providing region-specific services based on your country or region to enhance service efficiency.	Necessary to perform our contract with you.	Cloud Service Providers, our website, the third-party platform you have chosen （ such as Google ）
When you forget your password and Reset Your Password , or proactively Change Your Password, we collect: Email address, your new password	To verify your identity to help you change the password.	Necessary to perform our contract with you.	Cloud Service Providers
When you use Bike Pairing function to pair your bike through Bluetooth, we collect: User ID, QR code of your bike	To pair your bike.	Necessary to perform our contract with you.	Cloud Service Providers
When you fill Bike Registration(optinal) to register your bike, we collect: User ID, email address, address, serial number, purchase date and channel	To provide warranty services based on bike information.	We collect these data with your consent ， and these data is necessary to provide warranty services for you.	Cloud Service Providers
When you enter the Garage page to personalize your bike such as bike name and picture, and change your bike in your garage, we collect: User ID, bike ID, bike name and picture	To personalize your bike and manage your bikes.	We collect these data with your consent.	Cloud Service Providers
When you enter the Ebike page and check Positioning and Riding Data, we collect: Bike ID, max speed, average speed, total Calorie, total CO2 reduced	To display the latest updated positioning and riding data.	We collect these data with your consent.	Cloud Service Providers
When you enter the Location page, we collect: The Location of your bike, and time	To display the latest updated location of you and your bike, and navigate to your bike.	We collect these data with your consent.	Cloud Service Providers
When you click the Operational Slot , we collect: Operational Slot ID, click behavior	To display the content of the operational slot you have clicked on	We collect these data with your consent.	Cloud Service Providers
When you enter the Ebike page and use Diagnostics service, we collect: Bike ID, diagnostics items, description of diagnostics steps, voice description and diagnostics results	To diagnose your bike.	We collect these data with your consent.	Cloud Service Providers
When you use Contact Us, we collect: email address, issue description and any screenshot you choose to submit	To respond to your question and provide customer support.	We collect these data with your consent.	Cloud Service Providers and customer support service providers
When you enter the Ebike page and use Help service, we collect: The content you entered in the search box	To search for the contents of the instruction manual and related bike information.	We collect these data with your consent.	Cloud Service Providers
When you enter the Ebike Settings page and use the Update Firmware function, we collect: Type and version of the firmware of your bike	To confirm whether there is an updatable new version of the firmware.	We collect these data with your consent.	Cloud Service Providers
When you enter the Ebike Settings page and use the Backup and Restore function, we collect: Bike ID, bike setting data	To back up your bike setting information and restore it.	We collect these data with your consent.	Cloud Service Providers
When you enter the Ebike Settings page and use the IoT Service function, we collect: Bike ID, user ID, equipment ID, network setup short link and ICCID.	To activate and subscribe to IoT services, and display IoT status.	We collect these data with your consent.	Cloud Service Providers
When you enter the Ebike Settings page and use the About My Bike service, we collect: Bike model, serial number(SN), the date of your purchase, SN and version of the devices on your bike	To display the basic information of your bike.	We collect these data with your consent.	Cloud Service Providers
When you use the Bike Error Notification service, we collect: Bike ID, error message, timestamp	To notify you when your bike encounters a malfunction .	We collect these data with your consent.	Cloud Service Providers
When you use the Bike Record and Phone Record function, we collect: Riding duration, distance, date, speed, altitude, start and end battery level, start and end time and location, carbon reduction, calories, rider/motor effort ratio, riding-mode distance and duration, and time zone	To record and display your cycling data.	We collect these data with your consent.	Cloud Service Providers
After completing a Phone Record, you will enter the Ride Summary Page, we collect: Start time, maximum speed, average speed, distance, riding duration, maximum altitude, elevation gain, gps track	To display a comprehensive summary of your ride.	We collect these data with your consent.	Cloud Service Providers
When you use the Go function, we collect: Longitude (six decimal places), latitude(six decimal places), time, bike ID, User ID	To track your location and generate track record.	We collect these data with your consent.	Cloud Service Providers
When you download or share a ride or route through an external channel, we collect: Longitude (six decimal places), latitude(six decimal places), time, bike ID, User ID	To download or share your riding records through the external channel you select.	We collect these data with your consent.	Cloud Service Providers and the external service you select
When you use Auto Upload Bike Rides, we collect: User ID and your auto-upload setting	To apply your choice as to whether eligible bike ride records are uploaded and displayed in your account.	Necessary to perform our contract with you.	Cloud Service Providers
When you use Bike Sharing, we collect: User ID, bike ID, the invited user’s email address, the sharing relationship and information necessary to send the invitation	To send the invitation, authorize another user to access the shared bike and manage or end the sharing relationship.	Necessary to perform the sharing service requested by you.	Cloud Service Providers and email service providers
When you Update your personal data, we collect: Profile picture, nickname, gender, date of birth, country/region, zipcode	To update your personal data.	We collect these data with your consent.	Cloud Service Providers
When you use Account Details, we collect: Nickname, gender, date of birth, country/region and city	To update your basic account information.	We collect these data with your consent.	Cloud Service Providers
When you Log Out, we collect: User ID	To log out.	We collect these data with your consent.	Cloud Service Providers
When you check your Medals , we collect: User ID, medal ID, medal information	To check and display medals you have obtained.	We collect these data with your consent.	Cloud Service Providers
When you Change Password , we collect: User ID, old password, new password	To verify the old password and update it to the new one.	We collect these data with your consent.	Cloud Service Providers
When you Connect to Apple Health , we collect: User ID, Apple Health ID	To connect to Apple Health and share cycling data with Apple Health	We collect these data with your consent.	Cloud Service Providers, Apple Health
When you Delete Your Account , we collect: User ID	To delete your account based on your ID.	We collect these data with your consent.	Cloud Service Providers

The following table lists the categories of personal data collected by the App that are stored exclusively on your device. These data are not transmitted to or stored on any cloud servers and remain under your sole control unless you choose to share or back them up manually.

Feature	Data Type
Connection Status	Bike ID, bluetooth connection status, Iot connection status, the latest update time of bike status.
Key Data (such as power and light) and Operations	The on/off status of the power and lights, as well as the battery level and estimated range.
Battery	Bike ID, state of health(SoH), charge cycles, voltage, current and Battery Lock.
Riding Mode	The riding mode you switched and modified.
Location	The Location of your App.
Ebike Settings	Metric units, alarm, auto shift, security verification - verify interval, security verification - lost mode, unusual activity detection, E-Shift Calibration, Ride Tune, DRL Setting, Light Mode, Audio Settings and Auto-Split Ride settings
Geofencing	Type and range of the fence
Transport Mode	Click behavior
Language, App Theme, Map Style and Cache	Language, App theme, map style and locally cached information
About	Version of your App

Please note:

When your bike is not connected to the App, ride data is stored locally on the bike itself. Once the bike connects to the App and the IoT network is activated, the data is uploaded via Bluetooth or IoT services to the App or directly to our servers. After uploading, the data is processed in accordance with this Privacy Policy. Until this upload occurs, no ride data is shared with us or any third party.

2. How We Store Your Personal Data

We manage your data carefully to ensure that we only keep what is necessary. To protect your privacy, we routinely delete logs and retain only the data needed to provide the services you have requested, as detailed in the Policy.

We retain your data for as long as necessary for the purposes outlined in this Policy, and where applicable, in accordance with your consent. Once these purposes are fulfilled or if you submit a deletion request to our Data Protection Officer via email to DPO@gocycle.com or terminate your account, whichever occurs first, we will either delete your data or anonymize it. However, where we are required by applicable laws to retain certain personal data, we will either delete such data after the statutory retention period has expired or anonymize it.

The GoCycle App is intended for users aged 16 or older. If you are under 16, do not use the App or provide personal data through it. A user who is at least 16 but has not reached the age at which they may independently enter into a binding contract in their jurisdiction must use the App with the agreement of a parent or legal guardian. If you believe that we hold personal data relating to a child under 16, please contact DPO@gocycle.com.

3. How We Disclose Your Personal Data

We may transfer your personal data outside of your location as necessary to provide our services.

We disclose your personal data with:

Third Party Service Recipients:

Only when necessary will we share your personal data with third parties. For your reference, we have provided a table below outlining how your data is shared with third-party service providers.

Cloud Service Providers	Hosting and delivering our services
Authentication Service Providers	User verification and account security
Health and Fitness Service Providers	Connecting to Apple Health and sharing the ride information you select

Corporate Group Companies

Companies within our corporate group process your personal data solely for the purpose of providing service to you. All such group companies may only use your personal data in accordance with this Policy.

Legal and Regulatory Bodies

We may be legally obligated to disclose your data to authorities under certain circumstances. For instance, when complying with legal demands such as subpoenas or search warrants, we might not be able to notify you in advance or obtain your consent for such disclosures.

Merger, Sale, or Other Asset Transfers.

We may share or disclose or otherwise transfer your personal data to the our professional advisors such as attorneys or accountants (“Outside Professionals”), other advisors, potential transactional partners, or other third-parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.

Please note:

If you choose to download or share a ride record or route through an external application or service, the selected information may include precise location or activity details. The recipient's use of information you choose to share is governed by that recipient's terms and privacy practices. Please review the information before sharing it.

4. How We Protect Your Personal Data

We implement technical and organizational security measures, including encryption technology, to protect your information. Access to our systems and technology is strictly limited by comprehensive information security policies.

We maintain a formal incident management process to ensure the swift identification, response, and resolution of any security incidents. Our process is designed to minimize impact and keep you informed without delay.

5. Where Will Your Personal Data Be Processed

Personal data processed through the GoCycle App is stored in our data centre in Frankfurt, Germany, including personal data relating to users in the United Kingdom, the EEA, the United States and Canada. Because our operations and support teams may be located in different countries, authorised personnel may access personal data remotely where necessary to provide, secure or support the services. Where this involves an international transfer of personal data, we use safeguards required by applicable law, which may include adequacy decisions, standard contractual clauses, transfer assessments and appropriate access controls. For information about the safeguards that apply, contact DPO@gocycle.com.

6. Your Rights

If you reside in the United Kingdom or the European Economic Area (EEA), you may have the following rights, subject to applicable law:

To confirm if we have your data, see what we hold, and get details like why we use it, who we share it with, where we got it (if not from you), how long we keep it, whether we use it for automated decision-making, including profiling, and more.
To fix or complete your data.
To delete your data – for instance, when you close your account, withdraw consent, or we have used it unlawfully.
To request to pause using your data (but keep it) if you dispute its accuracy, question our right to use it, or object to processing.
To receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format. Additionally, you are entitled to transmit this personal data to another entity without any hindrance from us.
To withdraw your consent at any time.
To lodge a complaint with a data protection supervisory authority. If you are in the United Kingdom, you may complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. If you are in the EEA, you may complain to the competent supervisory authority in your country; the EDPB member list is provided below.

https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

To exercise your rights above, you can email us at DPO@gocycle.com. Please specify which right(s) you wish to exercise and your intended action. For security, we may ask for identity verification or clarifying your request details to prevent unauthorized data access. We will respond within legal timelines.

7. Updates

We will inform you of any changes via general announcements on our services or by sending you a notification when you log in to or update the App. If the update includes terms that significantly impact your rights, we will seek your consent once more.

8. Language

Except as otherwise prescribed by law, in the event of any discrepancy or inconsistency between the English version and local language version of this Policy, this English version shall prevail.

SUPPLEMENTAL TERMS – JURISDICTION-SPECIFIC

Some jurisdictions’ laws contain additional terms for users of the App, which are set out in this section. If you are a user located in one of the jurisdictions below, the terms set out below under the name of your jurisdiction apply to you in addition to the terms set out in our Policy above.

USA

If you are a U.S. resident, we process your personal information in accordance with applicable U.S. state privacy laws. Where those laws apply to us, this section provides supplemental information, including information required by the California Consumer Privacy Act (CCPA) and other applicable state privacy laws.

For this appendix, "Personal Information" refers to any information that identifies, relates to, describes, can reasonably be associated with, or could reasonably be linked (directly or indirectly) to a specific consumer or household, as well as any other information defined as personal data under the California Consumer Privacy Act (CCPA) and other U.S. state data privacy laws.

In the preceding twelve months since this notice was last updated, we have collected personal information from the following categories:

Identifiers.
Information that identifies or is capable of being associated with you.
Commercial information.
Internet or other electronic network activity information.
Geolocation data.
Audio, electronic, visual, thermal, olfactory, or similar information.
Sensitive personal information.

The sensitive personal information we collect includes:

Account log-in credentials (in combination with passwords)

We collect account log-in credentials to authenticate your account and provide account-based services. These credentials are protected during transmission and storage. We do not sell this information or use it for cross-context behavioural advertising.

Precise geolocation

We collect your precise geolocation data in these scenarios and for these following purposes:

When you enter the Location page	To display the latest updated location of you and your bike, and navigate to your bike.
When you use the click “ Go”	To track your location and generate track record.
When you Share Your Trip	To share your riding records

This data is used exclusively for device connectivity and will not be used for any other purposes, including but not limited to advertising, analytics, or third-party sharing.

Health data

We collect ride and activity information, including route, riding time, elevation gain, speed and estimated calories, to record and display ride activities and to enable local download or sharing through an external channel selected by you. We do not use precise ride or health-related information for targeted advertising or sell it to third parties.

The GoCycle App is not intended for children under 16 years of age. If you are under 16, do not use or provide any information on this App. If you believe we might have any information from or about a child under 16, please contact us at DPO@gocycle.com.

If you would like to learn more about how we store, disclose and protect your personal data, and where will your personal data be processed, please refer to the following section of this Privacy Policy:

" How We Store Your Personal Data ";
" How We Disclose Your Personal Data ";
" How We Protect Your Personal Data ";
" Where Will Your Personal Data Be Processed ";

Under the CCPA and other U.S. state data privacy laws, you may exercise the following rights:

The right to request a copy of the personal information that we have collected about you in the prior 12 months.
The right to request details about the categories of personal information we collect, the categories of sources, the business or commercial purposes for collecting information, and the categories of third parties with which we share information.
The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
The right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.
The right to correct inaccurate personal information that we maintain about you.
The right to limit the use and disclosure of sensitive personal information.
The right to opt out of the sale or sharing of personal information and of processing for targeted advertising, including through a recognised universal opt-out mechanism such as Global Privacy Control where required by applicable law. Where applicable law provides an appeal right, you may appeal our denial of a privacy request by replying to our decision or emailing DPO@gocycle.com. If we deny the appeal, we will provide information about how to contact the relevant state regulator or attorney general where required.

An authorized agent can submit an access or deletion request on your behalf by sending a written authorization, signed by you, to us via email at DPO@gocycle.com. However, we may still require you to directly verify your identity and confirm that you provided the authorized agent with permission to submit the request.

Canada

In accordance with the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable Canadian provincial privacy laws, we adopt this Canada Privacy Addendum.

We have collected personal information from the following categories:

Identifiers.
Information that identifies or is capable of being associated with you.
Internet or other electronic network activity information.
Geolocation data.
Sensory Data (Such as audio, electronic, or similar information)
Sensitive type of personal information.

We only collect, use and disclose personal information with your express or implied consent, except in limited circumstances such as authorized by applicable law. Sensitive types of personal information—such as precise geolocation data—are collected solely with your express consent. For Bluetooth and location permissions, we inform you via pop-up notifications and obtain your consent. You can disable these permissions anytime by going to Settings > Device Permissions . This information is used exclusively for the purposes outlined at the time of collection and is not shared with third-party service providers without your prior consent. To ensure the security of your data, we implement robust technical measures, including encryption during transmission, to protect your information from unauthorized access or disclosure.

If you would like to learn more about how we store, disclose and protect your personal data, and where will your personal information be processed, please refer to the following section of this Privacy Policy:

" How We Store Your Personal Data ";
" How We Disclose Your Personal Data ";
" How We Protect Your Personal Data ";
" Where Will Your Personal Data Be Processed ";

Under the PIPEDA and applicable Canadian provincial privacy acts, you may exercise the following rights:

The right to be informed about our policies and practices regarding the collection, use, and disclosure of their personal information.
The right to request access to the personal information that us holds about you.
The right to request a rectification if your personal information held by us is inaccurate or incomplete.
The right to request deletion of the personal information that we have collected about you, subject to certain exemptions.
The right to withdraw their consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.

An authorized agent can submit an access or rectification request on your behalf by sending a written authorization, signed by you, to us via email at DPO@gocycle.com. However, we may still require you to directly verify your identity and confirm that you provided the authorized agent with permission to submit the request.