Any personal information processed by GCI in connection with this Privacy Policy is controlled by GCI, which is considered the “Data Controller”.  Instances where data has been sent to GCI by either a reseller (Bike Shop), or the customer’s employer, then they are also considered a “Data Controller”.   You can access the privacy policies of those companies directly from them.

All your personal information shall be held and used in accordance with the UK General Data Protection Regulation (UK GDPR), national laws implementing GDPR and any legislation that replaces it in whole or in part and any other legislation relating to the protection of personal data.

If you want to know what information GCI collects and holds about you, or to exercise any of your rights as set out in the section ‘What are your rights in terms of personal information?’ below, please contact GCI at:
data@greencommuteInitiative.uk
Data Protection, Green Commute Initiative Ltd, Unit F, Membury Business Park, Ermin Street, Lambourn Woodlands, Hungerford, RG17 7TU.

Personal information means details which identify you or could be used to identify you.  It may also include information about how you use the GCI website.

In order for GCI to process a cycle to work application, GCI needs to capture your name, address, contact numbers and email address.  This may be collected when you have entered this information on the GCI website, or contacted GCI by phone or email.  You may have also provided this to a reseller to submit the application with you or via a Business Benefit provider.

If you have opted-in to receive our marketing e-newsletter, we will hold your name, email address, postcode, value of the bike package, chosen reseller and the date on which you consented to receive marketing information.

GCI also holds information about your use of the GCI website; your device and your location, if you have been browsing our website using your IP.  GCI monitors this to track the usage and effectiveness of the GCI website which then enables issues to be resolved or improvements to be made.  You can choose to disable geolocation sharing on your device.

This Privacy Policy applies to personal information about you that GCI collects, uses and otherwise processes regarding your relationship with GCI as a customer or potential customer, including when you hire a bike with GCI, use the website or contact GCI by phone or email.

When it is referenced that others are data controllers in the sections ’Controller of Personal Information’ and ’Who do we share your personal information with?’ you should consult their privacy policies for further information.

GCI will only process your personal information when there is a legal basis to do so.  Under EU and UK data protection laws the legal basis will be because your personal information is required to process your GCI order or because you consented to receive marketing information.

The main grounds that GCI relies upon in order to process your Information are the following:

1. Necessary for the performance of a contract to which you are party to.
2. Necessary for the purposes of legitimate interests – either GCI, or a third party, will need to process your information for the purposes of our (or a third party’s) legitimate interests, provided GCI has established that those interests are not overridden by your rights and freedoms, including your right to have your information protected. GCI’s legitimate interests include using personal information to process your order, or to contact you in the event of a safety recall on a bicycle and/or equipment.
3. Necessary for compliance with a legal obligation – GCI is subject to certain legal requirements which may require GCI to process your information. GCI may also be obliged by law to disclose your information to a regulatory body or law enforcement agency.
4. You as an individual have given clear consent for GCI to process your personal data in order for you to receive a regular e-newsletter.

GCI will keep your information for as long as it is required for the purpose it is being processed for.  In instances where you have secured a bike through our cycle to work scheme, this will be seven years.

GCI will actively review the information it holds and delete it securely, or in some cases anonymise it, when there is no longer a legal, business or customer need for it to be retained. If you stop interacting with GCI as a customer, your information will be removed or anonymised after seven years.

Your personal information may be shared with your chosen bike shop, your employer and where applicable via a Business Benefit provider.

GCI shares information with your chosen bike shop so that they may contact you regarding bike collection and/or warranty and recall information.

GCI needs to share information with your employer and where applicable, via a Business Benefit provider, in order to complete your salary sacrifice application.

In order to provide certain services, GCI will share your information with third party service providers such as IT infrastructure companies and email logistics providers.  GCI will not share your data with any third party where it is not necessary to do so in order to provide a service to you.

GCI may also need to share your personal data in response to a valid, legal request from HMRC or another statutory body.

All data is hosted within the UK, but GCI, like many companies, use third parties located in other countries to help run the business.  As a result, personal data may be accessed outside the countries where GCI and its customers are located.

GCI has taken steps to ensure all personal data is accessed with adequate protection and that all transfers of personal data outside the EEA are done lawfully.  Where GCI transfers personal data outside of the EEA to a country not determined by the European Commission as providing an adequate level of protection for personal data, the transfers will be under an agreement which covers the requirements for the transfer of personal data outside the EEA, such as the European Commission approved standard contractual clauses.

If you would like more information on these safeguards, please contact:
data@GreencommuteInitiative.uk
Data Protection, Green Commute Initiative Ltd, Unit F, Membury Business Park, Ermin Street, Lambourn Woodlands, Hungerford, RG17 7TU.

Under data protection laws in the European Union and the UK, you have certain rights in relation to your personal information.  Responses to exercise your rights will be provided within one month and generally there is no fee for making these requests.

Please send your Rights Request to:
data@GreencommuteInitiative.uk
Data Protection, Green Commute Initiative Ltd, Unit F, Membury Business Park, Ermin Street, Lambourn Woodlands, Hungerford, RG17 7TU.

The request can be made in writing or email and must contain the following:

• Your name and postal address.
• Details of your request.
• Details which may help GCI locate the information which is the subject of your request, for example your application /order number and/or employer name.

If you are applying on behalf of another person then signed authority from the individual is required.

GCI will handle all requests in accordance with applicable law.  However, depending on the right you wish to exercise, and the nature of the personal information involved, there may be legal or contractual reasons why GCI cannot grant your request.  Further explanation of those rights and the exceptions to them are set out below.

• Right to Access. You have the right to access the personal information GCI holds about you.  Please see ‘Requesting a copy of your personal information’ above.
• Right to Rectification. Where any information GCI holds is incorrect, you have the right to request the correction of inaccurate personal data held about you.
• Right to be Forgotten. On receiving a request, GCI will erase all personal information held about you within one month.  GCI will be unable to erase your data if you are covered by an active hire agreement.  In this situation your personal details will be erased after the standard 7 years.
• Right to Object to or Restrict Processing. By submitting your details to GCI, you have consented to GCI processing your data as outlined in this document.  Where you wish to cancel your application before your bike has been collected, you have the right to ask GCI to not proceed.
• Right of Data Portability. In certain instances, you have a right to receive any information that GCI holds about you in a structured, commonly used and machine-readable format.  You can request GCI to transmit that information to you or directly to a third-party organisation.  Whilst GCI is happy for such requests to be made, GCI is not able to guarantee technical compatibility with a third-party organisation’s systems.

You can exercise any of the above rights by contacting GCI at the address or email address set out above.  You can exercise your rights free of charge.

Most of the above rights are subject to limitations and exceptions.  GCI will provide reasons if it is unable to comply with any request for the exercise of your rights.

If you have any privacy-related questions or comments, please contact:
data@GreencommuteInitiative.uk
Data Protection, Green Commute Initiative Ltd, Unit F, Membury Business Park, Ermin Street, Lambourn Woodlands, Hungerford, RG17 7TU.

If you are unhappy with the way GCI is using your personal data, you can also complain to the UK Information Commissioner’s Office using the details below:

Telephone: 0303 123 11113
Website: https://ico.org.uk/concerns/
Post: Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

We are here to help and encourage you to contact us to resolve your complaint first.