Version 1 September 2026 · Bikefit Van Staeyen · Rodeborgstraat 67, 2900 Schoten, Belgium · company number BE 0800.517.937

This is a translation of the Dutch original. In case of any discrepancy, the Dutch version prevails.

We take your privacy seriously. This policy explains which personal data we process, why, on what legal basis, how long we keep it, who we share it with and what rights you have. It deliberately describes only what we actually do — a bike fitting practice, not an online shop.

1. Who is responsible for your data?

Bikefit Van Staeyen, with registered office at Rodeborgstraat 67, 2900 Schoten, Belgium and company number BE 0800.517.937, is the data controller. This means we determine why and how your personal data is processed.

You can reach us at bikefit_vanstaeyen@outlook.com or +32 478 16 11 35.

We process your data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

2. Who does this policy apply to?

This policy applies to anyone who visits our website, books an appointment, receives a bike fit or related service, subscribes to our newsletter, or otherwise contacts us.

3. What data do we process, and why?

3.1 Booking your appointment

Bookings are handled through Calendly, acting as our processor. This involves your name, email address, telephone number, chosen package and time slot, together with the answers you give when booking.

Legal basis: performance of the contract you enter into with us (art. 6(1)(b) GDPR). Without this data we cannot schedule or confirm the appointment.

3.2 During the bike fit — health data

A bike fit requires information about your body. We process your injury history, surgeries and relevant medical background, current complaints, body measurements and mobility tests, and the results of our .flow analyses — including sEMG muscle activation, thermal imaging, pressure measurements and 3D posture and spine scans.

This is health data and constitutes a special category of personal data under article 9 GDPR. We process it solely on the basis of your explicit consent (art. 9(2)(a) GDPR), given at the start of the session and withdrawable at any time. We use it only to carry out the fit, produce your report and follow up afterwards.

Our analyses are not a medical diagnosis. See also articles 2 and 3 of our terms and conditions.

3.3 Photographs and video

During a fitting we record images for biomechanical analysis. This material is used internally and is never published, shared or used for promotion without your prior, separate and written consent. That consent is independent of the fit itself: you may refuse or later withdraw it without any consequence for the service.

3.4 Newsletter

If you subscribe to our newsletter we store your email address, the language you subscribed in and where on the site you did so. Legal basis: your consent (art. 6(1)(a) GDPR). Every newsletter contains an unsubscribe link, and you can also unsubscribe by emailing us.

3.5 Contact

If you contact us by email or telephone, we process the data you provide in order to answer you. Legal basis: our legitimate interest in responding to enquiries, or steps taken prior to entering into a contract (art. 6(1)(f) and 6(1)(b) GDPR).

3.6 Use of the website

Our web server records technical data needed to deliver and secure the site, such as your IP address, browser type and the page requested. In addition — only if you consent — we measure how the site is used, via Google Analytics. See section 9.

We do not build profiles and take no automated decisions producing legal effects for you.

4. Who do we share your data with?

We do not sell your data and do not share it with third parties for their own purposes. We do rely on service providers acting as our processors, each under a data processing agreement and only for the data they need:

• Calendly LLC — scheduling and confirming appointments

• Google Ireland Ltd. / Google LLC — hosting of the website and database (Google Cloud, European region), website statistics (Google Analytics) and the embedded map on our contact page

• MailerLite — sending the newsletter

• Our accountant and, where legally required, the competent authorities

Our knowledge pages may embed episodes from Spotify or YouTube. If you play them, Spotify or Google respectively processes data under their own privacy policies, over which we have no control.

Your health data and image material are never shared with third parties unless you expressly request or consent to it, or the law obliges us.

5. Transfers outside the European Economic Area

Some of our service providers are established in, or process data in, the United States. Such transfers rely on the EU–US Data Privacy Framework or, where that does not apply, on the Standard Contractual Clauses approved by the European Commission, together with appropriate supplementary measures.

6. How long do we keep your data?

• Client file, measurement data and reports: 10 years after your last session, so a position can be reconstructed and followed up later

• Fitting images: 5 years, unless you ask for deletion sooner

• Invoices and accounting records: 7 years, as legally required

• Newsletter data: until you unsubscribe

• Website statistics: no longer than 14 months

After these periods your data is deleted or irreversibly anonymised.

7. How do we secure your data?

We take appropriate technical and organisational measures: encrypted connections, access with strong passwords and limited rights, hosting with a certified provider inside the EU, and regular backups. Access to your file is restricted to staff who need it for their work.

No system is infallible. Should a breach occur that poses a high risk to your rights and freedoms, we will notify you and the Belgian Data Protection Authority within the statutory time limits.

8. What are your rights?

You have the right to:

• access the data we hold about you

• have inaccurate or incomplete data corrected

• have your data erased (“right to be forgotten”)

• restrict processing

• data portability: a copy of your data in a common format

• object to processing based on legitimate interest, and to direct marketing

• withdraw your consent at any time, without giving reasons — this does not affect the lawfulness of processing before withdrawal

To exercise these rights, email bikefit_vanstaeyen@outlook.com. To avoid disclosing data to the wrong person, we may ask you to prove your identity. We respond within one month; for a complex request this may be extended by two months, of which we will inform you in good time. Exercising your rights is free of charge.

If you are unhappy with how we handle your data, you may lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels — +32 (0)2 274 48 00 — contact@apd-gba.be — www.dataprotectionauthority.be.

9. Cookies

A cookie is a small file a website places on your device. We use as few as possible, in two groups.

Necessary cookies

These are required for the site to work and to remember your cookie choice. They are always set and do not require consent. Your choice itself is stored locally in your browser, not on our servers.

Analytics cookies

We use Google Analytics 4 to understand which pages are visited and how visitors use the site. These cookies are only set after you have consented via the cookie banner. If you decline, no analytics cookie is set and no identifiers are sent.

Cookies from embedded services

When you book an appointment, our Calendly booking module loads. The contact page embeds a Google Map, and some articles embed Spotify or YouTube episodes. These services may set their own cookies as soon as you open the page concerned. To avoid this, do not visit those pages or block the cookies in your browser.

Changing your choice

At the bottom of every page you will find the “Cookie preferences” link. It reopens the banner so you can change or withdraw your choice at any time. You can also manage or delete cookies through your browser settings; blocking all cookies may affect how the site works.

10. Changes to this policy

We may update this policy when our services or the applicable rules change. The date at the top shows when it was last amended. For a material change we will ask for your cookie consent again and inform you where necessary.

11. Contact

Questions or comments about this policy? Email bikefit_vanstaeyen@outlook.com or write to Rodeborgstraat 67, 2900 Schoten, Belgium.