This policy explains which personal data is processed when you use https://www.pedalia.at, for what purposes, on what legal basis, and what rights you have.
Last updated: 29.09.2026
1.1. The controller within the meaning of the General Data Protection Regulation is Pedalia e.U., company register number FN 686491x, Schlechtastraße 4/15, 1030 Wien, Österreich, owner Ali Kazemi, reachable at [email protected]. This email address is also the contact address for all data protection matters.
1.2. No data protection officer is currently appointed.
2.1. On registration we process your name, email address and password. The password is stored solely as a cryptographic hash and is not readable by us. We also store the time your email address was confirmed, the time of your last login, and the IP address used for it.
2.2. For trader accounts we additionally process the company name, address, phone number, VAT number, company description and the information required to review and approve the trader profile. We also store whether and when the trader profile was reviewed and approved.
2.3. Content you publish yourself — in particular descriptions, prices, images, condition details and location information — is publicly accessible by design. Please do not publish anything you do not want to be public, and obscure third parties' personal data in images.
2.4. Price changes to listings are logged with their time and amount. Traders need this price history for the promotional price function Pedalia offers and the determination of the relevant comparison price it requires.
2.5. Messages you send to other users via the platform are stored so that they can be delivered and read by the people involved. They may be examined in order to investigate abuse reports and to comply with legal obligations.
2.6. For paid subscriptions taken out by commercial providers we use an external payment service provider. Complete payment card details are processed exclusively there and never reach us. We receive only the information needed to perform the contract, in particular payment status, card brand, the last four digits and the billing data.
2.7. When the site is accessed, the IP address, time, address requested, volume of data transferred, status code, referrer and browser identifier are processed for technical reasons. This data is necessary for operating the service, diagnosing faults and defending against attacks.
2.8. To defend the login, registration and password reset forms, and reports made without a user account, against automated access, we use a bot detection service. To limit request frequency we also evaluate the IP address and browser identifier.
2.9. When a bike listing's page is opened, we store the time, the IP address and, if signed in, the user account, to count views and to avoid counting the same visit twice within a few minutes. The legal basis is our legitimate interest in reliable view statistics for sellers (Art. 6(1)(f) GDPR).
2.10. Where a listing, a user account or other content is reported, we process the information from the report, the reporting person's contact details, the content concerned and the information needed to review it. We also store the moderation decision taken, its reasons, and any complaint against it.
2.11. The identity of the reporting person is not disclosed to the affected user.
3.1. Providing the user account, publishing listings, delivering messages and administering subscriptions: performance of the user contract pursuant to Art. 6(1)(b) GDPR.
3.2. Operating, securing and stabilising the platform, defending against misuse and fraud, and pursuing breaches of our terms: legitimate interest pursuant to Art. 6(1)(f) GDPR in a functioning and secure service.
3.3. Compliance with legal obligations, in particular commercial and tax retention duties and the obligations under Regulation (EU) 2022/2065: Art. 6(1)(c) GDPR.
3.4. We process reports of unlawful content and the resulting moderation procedures to comply with our obligations under Regulation (EU) 2022/2065 on digital services, insofar as those obligations apply in the specific case. The legal basis is Art. 6(1)(c) GDPR.
We handle reports of breaches of our contract terms that do not concern a statutory reporting obligation on the basis of our legitimate interest in enforcing the platform's agreed rules and preventing misuse, pursuant to Art. 6(1)(f) GDPR.
3.5. Audience measurement using analytics services: solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 165 TKG 2021. Without consent these services are not loaded and set no cookies.
3.6. Sending emails in the course of your use of the service, for example to confirm your email address, reset your password or notify you of status changes: Art. 6(1)(b) GDPR.
4.1. Personal data is disclosed to service providers only where this is necessary for the relevant service, where a statutory obligation exists, or where the corresponding consent has been given.
Where a service provider processes personal data solely on our instructions, an agreement under Art. 28 GDPR is in place with them. Individual providers may also be independently responsible under data protection law for certain processing operations.
Pedalia does not sell personal user data and does not disclose it to third parties for their own advertising purposes.
4.2. The platform is operated with Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany; the servers are located in data centres within the European Union. Email is sent via the same provider's infrastructure; no additional mail delivery service is used.
4.3. We use Stripe to administer subscriptions. The contracting party within the European Union is Stripe Payments Europe Ltd., established in Ireland.
Stripe receives the data required for payment processing either directly or through the payment functions Stripe provides. Stripe also processes certain data under its own data protection responsibility, in particular to comply with its own legal obligations and for fraud prevention.
4.4. We use Google reCAPTCHA to protect the forms named in clause 2.8. The provider for users in the European Economic Area is Google Ireland Limited. IP address, browser identifier and interaction data are transmitted to Google in the process.
4.5. Only with your consent do we use Google Analytics. The provider for users in the European Economic Area is Google Ireland Limited. The IP address is processed in truncated form. Without consent the service is not loaded; consent once given can be withdrawn at any time via the cookie settings.
4.6. Disclosure to courts, authorities or legal representatives takes place only where we are legally obliged to do so or where it is necessary to establish, exercise or defend legal claims.
4.7. Using services from Google and Stripe can result in processing by affiliated companies in the United States.
For transfers to correspondingly certified US companies, the European Commission's adequacy decision on the EU-US Data Privacy Framework may be used. Insofar as a transfer is not covered by it, the providers use, under their own contract terms, in particular the standard contractual clauses approved by the European Commission.
5.1. We store personal data only for as long as is necessary for the relevant purposes or as required by statutory retention obligations. Because that necessity depends on the purpose, the criteria determining the period are set out below.
5.2. Account and profile data is stored for the duration of the user relationship. After it ends, the data is erased or its processing restricted, unless a retention obligation or a need to defend legal claims requires otherwise.
5.3. Listings are removed from public view when they are deactivated, expire or are deleted. Records may be kept beyond that point for evidentiary purposes, in particular to handle notices and complaints under Regulation (EU) 2022/2065.
5.4. Messages are stored for as long as they remain available to the people involved for their communication via the platform. Where a specific abuse report or legal dispute exists, the messages affected by it may continue to be stored until that matter is concluded, or for as long as they are needed to pursue the claim.
5.5. Data on reports, moderation decisions and complaints is stored for the handling of the relevant matter. It is retained for longer where this is necessary to comply with statutory documentation duties, to assess repeated infringements, or to defend against specific claims.
5.6. Invoice and payment data is subject to commercial and tax retention obligations, in particular under § 212 UGB and § 132 BAO, and is retained for seven years.
5.7. Server logs are stored only for as long as is necessary for operation, fault diagnosis and security, and are then deleted or anonymised.
5.8. For listing views, the IP address and the link to a user account are removed after 120 days; only the anonymous view count is kept.
6.1. Under the GDPR you have the right of access (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object (Art. 21).
6.2. Where processing is based on consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal is unaffected.
6.3. To exercise these rights, an informal message to the email address given in the Imprint is sufficient. Requests to delete your account are accepted by that route and handled within the statutory period of one month. We may ask for additional information where this is necessary to establish your identity.
6.4. Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.
7.1. Strictly necessary cookies are required for the site to work. These include in particular the session cookie for logged-in users, cookies securing forms, and the cookie storing your cookie choices. They are set without consent on the basis of § 165(3) TKG 2021.
7.2. All other cookies, in particular those used for audience measurement, are set only after your express consent. The service concerned is not loaded without consent.
7.3. You can change or withdraw your choices at any time via the “Cookie settings” link at the foot of the page. You can also delete cookies in your browser or restrict their storage generally; the site may not work fully as a result.
7.4. Google reCAPTCHA is used exclusively on forms where protection against automated abuse is necessary for the secure provision of the function concerned. Pedalia does not use reCAPTCHA beyond that, in particular not for analytics or advertising purposes.
8.1. Providing your data is neither legally nor contractually required. However, without the information requested at registration we cannot maintain a user account, and without the information a listing requires it cannot be published.
8.2. Approving a trader account additionally requires the company details named in the GTC and a payment method deposited with the payment service provider. Without that information no trader subscription is concluded.
8.3. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Decisions to remove or restrict content are not taken on a solely automated basis.
9.1. We prepare a Pedalia shop profile for bicycle businesses in Austria before we contact them. That data is therefore not collected from the business itself — the paragraphs below are the information required by Art. 14 GDPR.
9.2. The data processed is: the company name, address, phone number, email address, website and logo of the business, a contact person published on its website, and details of the bikes offered there (title, description, price, images and technical data).
9.3. The source is exclusively the publicly accessible website of the business concerned, together with publicly accessible business directories and map services. We collect no data from non-public sources and no special categories of personal data.
9.4. The purpose is to prepare a dealer profile and to contact the business about it. The legal basis is our legitimate interest in assembling a complete Austrian bicycle marketplace and in approaching potential partner businesses (Art. 6(1)(f) GDPR). Once a business claims its profile, we rely on performance of a contract for any further processing (Art. 6(1)(b) GDPR).
9.5. Until it is claimed, none of it is publicly visible: neither the prepared profile nor the prepared listings appear on the marketplace, in search, or in search engines. Nothing becomes visible until the business has claimed its profile and published it itself.
9.6. We do not pass the data on to third parties. If a prepared record is not adopted, we store it for at most 24 months. It is deleted earlier once it is established that no further approach is intended, or that the data is no longer usable for that purpose.
9.7. Any business may object to this processing at any time (Art. 21 GDPR) and request deletion — through the link in our invitation email, with no account and no reason required, or informally by email to us. We then delete the prepared listings, the prepared profile and the underlying data. The only thing retained is the email address, and solely for the purpose of not writing to that business again.
10.1. When you are signed in, we save the filters of your searches on the bike list (search term, categories, brands, price range, seller type, condition, e-bike or not) together with the time, so you can return to earlier searches. We keep at most your last 20 searches and delete each one no later than 90 days after you last used it. The legal basis is our legitimate interest in making the site easier for you to use (Art. 6(1)(f) GDPR).
10.2. You can delete individual searches or your entire search history in your profile at any time. Each search is automatically deleted 90 days after you last used it. If you object to this storage, you can write to the contact address given in the Imprint. Your search history is visible only to you; we do not use it for advertising and do not pass it on.
10.3. You create search agents yourself by saving a search. For this we store the filters, the name you give the agent and the time of its last check. Once a day we check whether matching bikes have been newly published since the last check, or have come within your price range through a price change, and send them to you by email. We record which bikes we have already sent you, so that you never receive the same one twice. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).
10.4. You can deactivate, activate or delete any search agent in your profile. Every email also contains a link to deactivate the agent that works without signing in. If you delete a search agent, or your account is deleted, we delete it together with the record of bikes already sent.
11.1. We update this privacy policy when our processing changes or when an update becomes legally necessary. The version published on this page is the one that applies.