# Brand My Bike Privacy Policy

Effective 3 September 2026 · Version 2026-09-03

Controller: **Ilhan Pektas, trading as GI MGMT**, Waidmannstraße 1, 60596 Frankfurt am Main, Germany. Contact: hello@brandmybike.com.

Brand My Bike processes account, Listing, auction, payment-status, artwork, fulfilment, Ride Proof, support, security and consent records to operate the B2B marketplace. Full card data is handled by Stripe. Private FIT/GPX files and full route points are not published. A public route requires express Rider release, removes at least the first and last kilometre and reduces coordinate precision. Strava is optional, read-only and does not publish automatically.

The anonymous create flow stores a private Auction Intent for up to seven days. Its claim token is kept in a Secure, HttpOnly, SameSite=Lax cookie and only a hash is stored in the database. Optional Vercel Analytics and DataFast load only after consent and remain excluded from admin pages.

The full policy explains legal bases, recipients, international transfers, retention, account export/deletion, objection and GDPR rights, and names the Hessian data protection authority.

## Binding documents

- [Full English Privacy Policy](https://brandmybike.com/privacy)
- [Vollständige deutsche Datenschutzerklärung](https://brandmybike.com/de/privacy)
- [Marketplace Terms](https://brandmybike.com/terms)
- [Impressum](https://brandmybike.com/impressum)