1. Who is responsible for your data
Your motorcycle club is the controller for the personal data used to administer its membership and RideQuest challenges. The club decides who may participate, what each challenge requires, who may see challenge information and when challenge data should be removed. The club's identity is shown when you join and inside the app.
FreeBikers runs the RideQuest software for the club and is its processor for that challenge data:
Rajinder Pal Singh Grover, operating under the name FreeBikers
Frejasvej 9, 6000 Kolding, Denmark
Email: support@freebikers.dk
FreeBikers is also a controller for the limited processing it determines itself: operating and securing accounts and the service, dealing with its own legal obligations and records, administering its relationship with clubs and, when payments are activated, processing its own transaction records.
2. Data collected when you register
RideQuest holds:
• email address;
• password as a bcrypt hash - the plain password is not stored;
• first and last name;
• club membership number;
• the club to which you belong;
• chosen language;
• leaderboard opt-out choice; and
• account creation date, shown as "member since".
RideQuest does not ask for your date of birth, home address, telephone number, driving licence, motorcycle registration, insurance information or payment-card details. You confirm that you have the required licence, road-legal motorcycle and insurance, but RideQuest does not record or verify those matters.
3. Data collected at a check-in
Each submitted check-in stores:
• one photograph of you;
• one photograph of your motorcycle;
• GPS position at submission;
• distance from the challenge destination;
• reported GPS accuracy;
• whether the phone reports a simulated location;
• difference between the phone clock and RideQuest server time;
• time the photograph was taken; and
• submission time.
The app reads location only when you submit a check-in. It does not continuously record your route, collect background location or hold the Android background-location permission.
If a check-in is outside the club's radius, it is refused mechanically. The refused attempt and the same technical fields are stored. You can retry or ask the club to review it. RideQuest does not make another decision producing legal or similarly significant effects solely by automated means.
4. Why the data is used
The club uses registration and challenge data to confirm club membership, enrol you, operate the challenge, validate check-ins, prevent false check-ins, show progress, operate any enabled leaderboard and produce certificates.
FreeBikers uses data to authenticate accounts, deliver and secure RideQuest, diagnose faults, answer support requests, follow the club's instructions and comply with legal obligations. When payments are activated, it also uses transaction information to perform and document the paid agreement.
Depending on the activity and the controller involved, the legal basis is performance of the rider or club agreement, legitimate interests in operating a fair and secure club challenge, and legal obligations concerning accounting, consumer rights and data protection. A controller relying on legitimate interests balances those interests against the rider's rights. You may object as explained below.
Photographs are not used for facial recognition or biometric identification.
5. Who can see the data
• You can see your own account information, check-ins, photographs, progress and certificate.
• Administrators of your club can see riders in their own club, including names, membership numbers, email addresses, check-ins, photographs, positions and progress. They cannot see another club's data.
• If your club enables a leaderboard and you have not opted out, riders in the same challenge can see only your first name and leaderboard position. They cannot see your surname, membership number, email, photographs or location.
• FreeBikers has technical server access and uses it only to run, secure and support the service and follow lawful club instructions.
• Hetzner hosts the service in Nuremberg, Germany.
• The map-image provider receives the network request needed to show map tiles, including the requesting IP address and ordinary browser or device request information. RideQuest uses OpenStreetMap map images; the provider does not receive your RideQuest account or check-in record from FreeBikers.
• When paid challenges are activated, PayPal handles the payment under its own privacy terms. FreeBikers receives payment status and transaction information, not your card details.
There is no public rider profile, advertising, analytics, tracking, sale of rider data or general sharing function.
6. Hosting, transfers and backups
The production service and photographs are hosted by Hetzner in Nuremberg, Germany. Photographs are outside the public web folder and are served only to the signed-in rider who owns them or an administrator of that rider's club. Email is sent from the same server.
Cloudflare provides DNS resolution only. RideQuest web and app traffic does not pass through Cloudflare.
Nightly backups are retained for 14 days. At the date of this notice, those backups are temporarily stored in a personal Google Drive account and include the production data. FreeBikers is moving that backup storage to Hetzner because the personal Google account does not provide the data-processing terms required for this use. This notice will be updated when the migration and deletion of the Google copies are complete.
Apart from the map request and the temporary backup arrangement just described, RideQuest does not intentionally host rider data outside the EU. If an international transfer is required, the responsible controller must use a lawful transfer mechanism and provide information about it.
7. Retention
• Account and profile data, challenge enrolments, progress, check-in records and photographs are kept while the account remains active, so you can use your history and certificates. They are deleted when you delete the account, the club removes you, or the account has been inactive for 24 months. Where contact is possible, a warning is sent 30 days before inactivity deletion.
• Precise GPS positions, distance, GPS accuracy, simulated-location signals, clock-difference signals and refused-attempt details are deleted 12 months after the challenge ends, unless a specific dispute or security investigation requires a relevant record for longer.
• Security logs are normally kept for 90 days.
• Closed support and data-rights cases are kept for 3 years so the handling can be documented.
• Payment and accounting records are kept as required by Danish accounting law, normally for 5 years from the end of the relevant financial year. When an account is deleted, RideQuest removes the link identifying the rider where the record no longer needs that identity.
• Nightly backups rotate after 14 days. If a backup is restored, deletions that should already have taken effect are applied again.
The internal Retention Schedule contains the complete operational rules. A relevant record may be held longer where necessary for an existing legal claim, official investigation or statutory duty, and then only for that purpose.
8. Your choices and rights
In the app you can correct your name, change your language or password, opt out of club leaderboards, leave a challenge and delete your account.
You can also submit a request for access, correction, erasure, portability, restriction or objection through the app. A request concerning the club's challenge data is sent to the club as controller. You may contact support@freebikers.dk about processing for which FreeBikers is the controller or if you need help reaching the club.
Rights are subject to the conditions and exceptions in data-protection law. Identity may be checked before a request is fulfilled. You may complain to the Danish Data Protection Agency, Datatilsynet, at https://www.datatilsynet.dk.
9. Security
RideQuest uses account authentication, bcrypt password hashing, access separation between clubs, restricted server access and protected photograph storage. Only one FreeBikers operator has server access. No internet service can be guaranteed completely secure. If a personal-data breach occurs, FreeBikers and the relevant club follow their legal notification duties.
10. Cookie information
The website sets exactly one cookie. It is a technically necessary session cookie used to keep a club administrator signed in. It expires when the browser session ends and is not used for analytics, advertising or tracking. No consent banner is required for this strictly necessary cookie, but this section provides the required information about it.
The rider-facing landing and QR-code join pages do not use analytics or advertising cookies.
11. Changes
The version date is shown above. This notice is updated when the processing changes materially, including completion of the backup migration or activation of rider payments.