Privacy policy

Effective as of March 31, 2026

This is the Privacy Policy of Tenways Technovation Europe B.V., a company incorporated in the Netherlands, whose registered number is 85385115, with a registered headquarters located at Kabelweg 57, 1014 BA Amsterdam, the Netherlands ("Tenways", "we", "our", or "us").
We are committed to protecting your privacy and handling your data responsibly. We also aim to be transparent about why and how we use your data. This Privacy Policy explains how we collect, use, share, and safeguard your data when you use our products, services, websites, and mobile applications.

1. About this Privacy Policy

This policy applies to the use of:

· Our website https://www.tenways.com (the "Website"),

· The services we offer (the “Services”), such as, but not limited to, placing an order and purchasing through our platforms, getting in touch with customer support (email, form, or via channels), enabling IoT aka Smart Connect features, etc.

· Tenways app (the “App”),

· Website, Services and App together are referred to as our “Platform”.

It does not apply to third-party services, websites, or platforms that may be linked from our services. Their handling of personal data is governed by their own privacy policies.

2. What We Collect

We collect information necessary to deliver our services and meet your expectations as a user. This may include:

a. Information You Share with Us

Account setup: Name, email, phone number, password, country, date of birth
Optional profile data: Avatar, nickname, gender, location
Orders and payments: Recipient name, address, contact details, items ordered, order number, shipping/billing details
Customer support: Order history, submitted queries, attachments (eg, photos or screenshots)

b. Information Collected Automatically

Device details: IP address, browser type, OS, app version, location data, system language, device model, firmware version
Bike data: Bike ID, battery level, connection logs, signal quality, activation time
Ride activity: Distance, speed, start/end locations, elevation, routes, frequency, duration, ride logs
Smart feature: GPS tracking, status updates, lock/unlock activity, IoT module usage
Usage logs: Crashes, errors, diagnostics, user behavior patterns
Membership activity: Points earned, order-related actions, account ID
Cookies and similar tools: Functional, analytics, and preference cookies to optimize experience

You can manage your cookie settings through your browser or device preferences.

3. How We Use Your Data

A. Different Services and Data Processing Contexts

Depending on how you interact with Tenways, different types of data processing may apply:

Website and e-commerce: purchasing products, placing orders, payments and customer support
Leasing and subscription services: contract management, billing and account administration (including via third-party platforms such as circuly)
App and IoT features (Smart Connect): bike connectivity, location tracking, ride activity and device-related data
Marketing and communications: newsletters, campaigns and customer engagement (e.g. via Klaviyo)

The applicable data processing activities and legal bases depend on the specific service you use.

B. We process your personal data to deliver our services in line with user expectations and contractual commitments. This includes:

Type of Personal Data	Purpose of Processing	Description	Legal Basis	Data Recipient
Account Information (e.g. name, email address, phone number.)	Account setup & authentication	Creating and maintaining your user profile	Necessary for the performance of a contract (GDPR Article 6(1)(b))	IT service providers (for platform hosting and authentication) Tenways’ affiliates
Bike & Device Data (e.g. bike status, location data)	Bike activation & operation	Activating smart features, tracking usage, and showing bike status	Necessary for the performance of a contract (GDPR Article 6(1)(b)) Consent (for location data (GDPR Article 6(1)(a), Article 9(2)(a))	Service providers supporting IoT connectivity Tenways’ affiliates
Ride Activity Data (e.g. distance, speed, duration of rides)	Ride analytics & personalization	Generating ride statistics and health metrics	Legitimate interest (GDPR Article 6(1)(f)) Consent (for health-related data) (GDPR Article 6(1)(a), Article 9(2)(a))	Tenways’ affiliates
Order & Support Data (e.g. items ordered, payment and delivery details, customer support queries)	Product delivery & support	Processing orders, payments, and offering post-sale support	Necessary for the performance of a contract (GDPR Article 6(1)(b))	Payment processors Commerce and logistics partners Customer support service providers Tenways’ affiliates
Membership & Loyalty Data (e.g. loyalty points, membership ID, rewards status)	Membership rewards	Calculating and displaying user rewards	Consent (GDPR Article 6(1)(a))	Other Tenways users Tenways’ affiliates
Usage & Diagnostics Data (e.g. app usage logs, crash reports, error codes, device diagnostics)	Service improvement	Analyzing aggregated data to enhance product performance	Legitimate interest (GDPR Article 6(1)(f))	Analytics and crash-reporting service providers
Social & Community Data (e.g. profile name, avatar, country, total ride distance, group ride stats, achievement earned)	Social & community features	Showing leaderboard rankings, shared achievements, or future community engagement	Legitimate interes (GDPR Article 6(1)(f)) / Consent (GDPR Article 6(1)(a)	Other Tenways users Tenways’ affiliates
Security Data (e.g. account IDs, login history, IP address, usage patterns flagged for anomalies)	Security and misuse prevention	Monitoring system integrity and preventing unauthorized access or fraud	Legitimate interest (GDPR Article 6(1)(f))	IT security / fraud prevention service providers Tenways’ affiliates
Legal/Compliance Data (information needed to fulfill legal obligations)	Legal compliance	Responding to lawful requests from authorities	Compliance with legal obligations (GDPR Article 6(1)(c))	Government authorities, law enforcement agencies, or courts as mandated by law

Essential functions: Some data, such as bike ID, location data, ride metrics, and activation time is essential for operating your smart bike and app features. This processing is necessary for us to fulfill the agreement concluded with you. Without it, these services cannot function.

In cases where your consent is required (e.g. for precise location tracking or health data), we’ll always ask before processing.

C. Smart Connect and IoT Features

When you activate and use our Smart Connect features via the mobile application, we process device and bike-related data, including bike identifiers, connection logs, usage data and, where enabled, location data. Such data may be collected while the device is connected and in use.

Location data is only processed where the user has enabled the relevant permissions on their device. Users can disable location tracking at any time via their device or app settings.

The processing of IoT data is necessary to provide core functionality (e.g. bike connectivity, ride tracking, and security-related features) and is based on contract performance (GDPR Article 6(1)(b)). Where precise location tracking is involved, we rely on user consent (GDPR Article 6(1)(a)).

Location and ride data may be used to provide features such as ride tracking and fitness-related insights. In certain cases, location data may also be used for security purposes, including theft detection and recovery, where applicable.

The Smart Connect functionality is activated by the user through the app (e.g. by scanning the bike frame code). Users may deactivate the service at any time by disconnecting the device via the app. Once disconnected, the IoT functionality will no longer operate.

IoT data is used solely to provide and improve the functionality of our services and is not used for independent tracking or surveillance purposes.

4. Social Features (Current & Future)

We may use certain profile information (e.g. nickname, avatar, country, total ride distance) in features that support social interaction, such as:

· Group ride stats

· Community achievements

· Rankings or badges

· Future social integrations in the app

You will always be able to opt out of public visibility or social participation by adjusting the settings in the app.

5. Sharing Your Information

We may share personal data in the following situations:

· With service providers helping us with logistics, payments, hosting, analytics, or support; We may also use service providers supporting our IoT infrastructure and connectivity services.

With regulators or authorities when required by law or in response to valid legal requests
Within our company group, for internal purposes or to improve our services
In connection with a sale or transfer, including during due diligence, as part of a merger, acquisition, or business restructuring

We only disclose what is necessary and ensure all partners meet relevant data protection standards.

Specific Service Providers

We use certain third-party service providers to support our services. These providers act as data processors and process personal data on our behalf and in accordance with our instructions.

circuly (Subscription and Leasing Management)

We use circuly, a subscription and leasing management platform provided by circuly GmbH (Germany), to manage leasing and subscription services for Tenways products, including order processing, billing, contract administration and customer management.

In this context, personal data such as name, contact details, address, order information, subscription details and payment-related information may be processed.

The processing is necessary for the performance of a contract (GDPR Article 6(1)(b)) and our legitimate interests in managing and improving our services (GDPR Article 6(1)(f)).

For more information, please refer to: https://www.circuly.io/data-privacy

Klaviyo (Email Marketing and Customer Engagement)

We use Klaviyo Inc. to manage email communications, marketing campaigns and customer engagement.

In this context, personal data such as name, email address, purchase history and interaction data may be processed.

Where required by applicable law, such processing is based on your consent (GDPR Article 6(1)(a)). Otherwise, it is based on our legitimate interests in communicating with our customers and improving our services (GDPR Article 6(1)(f)).

Klaviyo may process personal data in the United States. Klaviyo participates in the EU-U.S. Data Privacy Framework and has certified to the U.S. Department of Commerce that it adheres to the DPF Principles.

For more information, please refer to: https://www.klaviyo.com/legal/privacy

6. How We Protect Your Data

We maintain technical, administrative, and physical safeguards to protect your personal data. This includes:

Encrypted communications
Access controls
Anonymization where possible
Regular system monitoring

While we aim for high security, no online system is 100% immune to breaches. We encourage users to protect their accounts with strong passwords and secure devices.

7. Data Retention

We keep personal data:

As long as needed to provide services and fulfill our contract
For legal and compliance purposes
Until the user deletes their account or withdraws consent (where applicable)

If we retain data in backups, it is securely isolated until deletion is possible. Anonymized data may be retained for research and analysis without further notice.

8. Transfers Outside the EU/EEA

Your personal data may be processed by Tenways Group companies and service providers located outside the European Economic Area (EEA) for purposes such as product development, IT support, and IoT-related services.

Where such transfers take place, we implement appropriate safeguards in accordance with applicable data protection laws, including the use of Standard Contractual Clauses approved by the European Commission.

You may request further information about these safeguards by contacting us.

9. Your Rights (EU/EEA Residents)

If you live in the EU or EEA, you have certain rights under the GDPR, including:

Access – request to see what personal data we hold about you
Correction – update or correct your information
Deletion – ask us to erase your data in certain cases
Restriction – limit how we use your data
Portability – request your data in a readable format
Objection – object to certain uses, including marketing
Withdraw consent – revoke your consent at any time (this won’t affect previous use)
Complain – lodge a complaint with your local data protection authority

To exercise these rights, contact us at support@tenways.com. We respond to all requests in accordance with applicable law.

10. Children’s Privacy

Our services are not intended for children under 16. In accordance with GDPR and Dutch law, minors under the age of 16 cannot independently consent to the processing of personal data; therefore, we do not knowingly offer our services to such individuals without verifiable parental or guardian consent. We also do not knowingly collect data from children under 16. If we learn that we have inadvertently collected personal data from a child without proper consent, we will take immediate steps to delete the information from our records.

11. Updates to This Policy

We may update this Privacy Policy to reflect changes in our services or legal requirements. If the changes are significant, we’ll notify you through our app, website, or by other means. The latest version is always available on our website and reflects the current data practices.

12. How to Contact Us

Questions or concerns? We're here to help.

Tenways Privacy Team
support@tenways.com