Please note that the deadline for applying for a ticket starting on 1 January is two weeks earlier than the typical deadlines.

04 Sep

Privacy Statement

Introduction

Bike to Work Ltd protects your personal information and data.
Bike to Work Ltd will only use the information that we collect about you lawfully in accordance with the Data Protection Acts, 1988-2018 and the EU General Data Protection Regulation (GDPR).

Who we are

The biketowork.ie, travelhub.ie, fithub.ie, biketowork.co.uk and hubex.ie websites and all subdomains are owned by Bike To Work Ltd, Bike to Work Ltd trading as TravelHub and Bike to Work Ltd trading as HubEx respectively. Bike To Work Ltd, Bike to Work Ltd trading as TravelHub, Bike to Work Ltd trading as FitHub and Bike to Work Ltd trading as HubEx, whom we refer to as “Bike to Work Ltd”, “we,” “us,” “our” in this Privacy Statement, is committed to protecting your privacy. Bike To Work Ltd is a company registered in Ireland (company number 464697) with its registered office at 175 Ivy Exchange, Granby Place, Parnell Square West, Dublin 1. 
You can contact us at the above address of by phone to +353 1 514 3520 or email info@hubex.ie

This Privacy Statement

Please note that use of the Website by you and any Services offered by Bike to Work Ltd (such as our customer support phone lines) is subject to this Privacy Statement (the “Privacy Statement“) and to the Website’s terms and conditions of use (“Terms and Conditions“). 
Our Privacy Statement explains what information we collect, how we use and/or share this information, and how such information is maintained. By using this Website or any other Services of Bike to Work Ltd, you signify your acceptance of this Privacy Statement. If you do not agree to the terms of this Privacy Statement, in whole or part, you should not use this Website or services of Bike to Work Ltd. Please note that this Statement applies with respect to the information collected on the Website and through any other contact we have with you.
Our IT Security Policies ensures that any information you provide us remains private and secure. To reassure you, below we provide details of the information you provide to us, and how it will and, more importantly, will not be used. We will never collect sensitive information about you without your explicit consent. The information we hold will be accurate and up to date. You can check the information that we hold about you by contacting us (and there may be an administrative fee payable for this). If you find any inaccuracies we will delete or correct it promptly.

Use of Data for Benefits and Orders

LEGAL BASIS FOR COLLECTING DATA

Bike to Work Ltd may provide administration services to the employer such as administering the Cycle to Work Scheme or Travel Pass scheme. Bike to Work Ltd are processing the data on behalf of the employer on the legal basis of contract, as the employee is entering into a contract with the employer in order to process the order. This contract is detailed in the purchase agreement which the employee enters into with the employer. 

For hubex.ie sites Bike to Work Ltd are providing a hubex.ie employee benefits website for employees of the employer. Bike to Work Ltd are processing the data on behalf of the employer on the legal basis of contract, as the employer is providing benefits to the employee under the employee's contract of employment. 

In both cases the employer is the data controller for the data and Bike to Work Ltd are a data processor. 

DATA COLLECTED

For Cycle to Work Scheme orders we may collect the following data.
  • Name
  • Middle initial
  • Surname
  • Employer Name
  • Employee ID
  • Work email
  • Work phone
  • Depending on the settings for the employer we may also collect additional information such as employee ID or work location. These will be detailed in the user registration or the order submittal forms.

For Taxsaver Ticket Scheme orders we may collect the following data.
  • Name
  • Middle initial
  • Surname
  • Employer Name
  • Employee ID
  • Work email
  • Work phone
  • Photo
  • Leap Card public transport integrated ticket ID

For hubex.ie benefits sites we may collect the following data to provide access to the site. If a Cycle to Work Scheme or Taxsaver Ticket Scheme orders is placed on a hubex.ie site the information above applies too.
  • Name
  • Work email
  • Work phone
  • Employer name

Depending on the settings for the employer we may also collect additional information such as the work location, or work department. These will be detailed in the user registration or the order submittal forms.

TRANSACTIONAL PROCESSING OF DATA

We will process the data as follows:

  • To provide information on benefits, process orders, process the renewal of orders
  • To keep users informed about benefits, orders, and the renewal of orders
  • In improving and developing this website and Bike to Work Ltd's related websites.
  • To respond to any queries users might have and generally provide customer support.
We also always reserve the right to disclose data in order to:
  • comply with applicable laws
  • respond to governmental enquiries; or enquiries from a legal, governmental or quasi-governmental local authority agency, or Internet protection agency
  • comply with a valid legal process or procedure
  • protect our rights or property, this website, and/or other users of this website


TRANSFER OF DATA TO THIRD PARTIES

For Cycle to Work Scheme orders, we may transfer users' name and surname to the bike shop along with the details of the quote for the bicycle and accessories that the employee got from the bike shop.

Employees may wish to give the shop additional information to allow them to order the bicycle, arrange collection, or as part of any warranty for the goods. Employees are responsible for transferring this data to the bicycle shop and the bicycle shop will be the controller of this data which will be administered using the bicycle shop's systems.

For Travel Pass tickets we may transfer the following data to the Public Transport Operator in order to process the ticket.

  • Name
  • Middle initial
  • Surname
  • Work email
  • Work phone
  • Photo
  • Leap Card public transport integrated ticket ID

In these cases the Public Transport operator will become a data controller for this data and will administer the data using their systems. Employees should make contact directly with the operator regarding their individual data rights for data controlled by the Operator.

AGREEING TO THIS USE OF DATA

Employees must agree to this data use to use the website by checking the checkbox to agree to this Privacy Statement.


Marketing Use of Data

We may ask users to consent to allow us to use their data for marketing purposes. Users have a choice whether they opt in or not. Employees do not have to opt in in order to place an order with us. 

If users consent to allow us to use your marketing data we may use the following data:

  • Name
  • Surname
  • Work email
  • Work phone
  • Employer Name
  • Details of the orders you place.

We may use and process the data for the following:

  • To send news on our services and other related services and services related to the Cycle to Work Scheme and TravelPass scheme.
  • To send special offers and discounts on bikes, accessories and cycling related products.
  • To let users know about new public transport services or other information on public transport.
  • To analyse trends and carry out research on our orders and in cycling and the use of public transport generally.

We will never sell users data. We will not transfer data to third parties other than third parties we use to process the data for our use as set out below in the section on third parties.

Zoom Webinars

We use a third party Zoom to run our webinars. If you register for a webinar you will be asked to enter your name and email address. This will be used to notify and remind you of the webinar and send a follow up email after the webinar. Your name and email address will be deleted from Zoom within 30 days of the webinar. Webinars may be recorded. 

Third Party Processors

In the section above we have described how we may transfer users data to Bike Shops for Cycle to Work Scheme Orders and Public Transport Operators for Travel Pass Orders as part of fulfilling those orders. These Bike Shops and Public Transport Operators become Data Controllers for that data.

Beyond this, we use may third party Sub-Processors to deliver our services and may securely transfer data to them. These may include

  • Our software developer
  • Our server hosting company
  • Third party services for delivery of emails such as The Rocket Science Group LLC, AWS or Google.
  • Outsourced service providers such as Adobe Sign, Atlassian, API Layer, Dropbox, AWS, SmartSheet, Xero, Zoom, Zendesk
  • Professional advisers and auditors.

This third party processing is on behalf of us. We will not transfer data to third parties for their purposes without users' explicit consent. We will inform the Employer of our current Sub-Processors and of any proposed additions or changes to them.

Personally Identifiable Information collected while browsing our websites

When using the Website, we may also collect users' IP (Internet Protocol). An IP address is a number that is assigned to a user's computer when they use the Internet. The IP address is also used to help identify a user during a particular session and to gather broad demographic data. 
We use your IP address to:
  • help our website function to process orders
  • address to help diagnose problems with our server
  • to administer the Website.

Security and retention

The data which we hold, will be held securely within our systems in accordance with our internal security policies and the law.
For biketowork.ie and travelhub.ie accounts: We will anonymise users who have not place orders 12 months after they are registered. For users who place orders; we will hold data for seven years after the user places their last order after which it will be anonymised.
For hubex.ie accounts: We will anonymise deactivated users who have not place orders 12 months after they are deactivated. For deactivated users who place orders; we will hold data for seven years after the user places their last order after which it will be anonymised.
For Zoom webinars registration information will be deleted from Zoom within 30 days of the webinar.

Cookies and Google Analytics

We use “cookies”, technology to store data in your computer using the functionality of your browser. The information stored in the cookie is used to identify users.
When users first view our website they will get a popup about cookies. At any other time they can click in a Cookies Declaration link in the footer of the website to get information and options for cookies. We will list the different types of cookies we use. Certain cookies are necessary for the proper functioning of the website and cannot be opted out of. Other cookies are optional and users can change their preferences.
Necessary Cookies
We use cookies which enables us to operate an efficient service and to track the patterns of behaviour of visitors to the website. These are necessary and are not optional.
Optional Statistics and Marketing Cookies
We may ask users to accept other cookies to help us understand how visitors use our website, for analytics, to provide instant messaging chat, to help our marketing and to display ads. These cookies are optional.
This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on users computer to help the website analyse how users use the site. The information generated by the cookie about users' use of the website (including your IP address) may be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating users' use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. 
Note that the use of cookies by third party advertisers or ad servers such as Google is not subject to this Privacy Statement, but is subject to their own respective Privacy Statements.

Your Rights

Users have the followings rights which can be exercised as follows:

RIGHT TO BE INFORMED
This Privacy Statement informs users about their data.

RIGHT OF ACCESS
In the footer of our websites users can access information on cookies used.

If users login at www.travelhub.ie/login and click My Account they can access the data that we hold on them.

RIGHT OF RECTIFICATION
When users login at www.travelhub.ie/login and click My Account they can immediately edit certain data fields that we hold on them. For other fields we cannot allow users to edit the data immediately as it may be in use for active orders. Users can raise a ticket to request a data amendment.

Users can also opt-in or opt-out of the use of their data for marketing purposes.

RIGHT OF ERASURE
See the section above on our general data retention policy.

Users can request that we erase the data we hold on them by logging in at www.travelhub.ie, clicking My Account and creating a ticket. We will discuss the erasure request with the Employer. We will erase or anonymise as much data as possible. We or the employer may need to retain certain amounts of data. For example if an order is processed for a Cycle to Work Scheme bike or Travel Pass ticket the employee will get tax relief on that order and the employer may need to retain the data for audit purposes. We will communicate the response to the data request to the employee.

RIGHT TO RESTRICT PROCESSING
We have outlined above what data we require in order to process orders. 

Users can login at www.travelhub.ie/login and go to My Account and request that we restrict processing by opting out of consenting to the use of your data for marketing purposes (if the user had previously consented).

RIGHT TO DATA PORTABILITY

The employer can request copies of the data if required to ensure data portability.


RIGHT TO OBJECT
When we reply to any data rectification request we will inform the user about their right to object and include details on how to object. Users can also report Data Protection issues generally on our reporting form.

RIGHTS RELATING TO AUTOMATED DECISION MAKING INCLUDING PROFILING

We don't have automated decision making processes.


Changes to this Statement

Please note that this Statement forms part of the Terms and Conditions for use of the websites and all associated subdomains and Bike to Work Ltd and associated brands services and forms part of the Agreement between you and Bike to Work Ltd. Users can determine with this Statement was last revised by referring to the last updated date below. We may, from time to time, amend this Statement, in whole or part, in our sole discretion. If we make major changes we will ask users to accept the revised Privacy Statement before they place any new orders.

Revisions


Revised 4 Sep 2024: Section on Zoom Webinars added. List of third parties updated, link to reporting form added to Right to Object section.
Revised: 1 May 2024: Detail added on data processing on hubex.ie sites.
Revised: 8th Nov 2023: Minor revision to clarify data retention policy for hubex.ie accounts.
Revised: 16th May 2018: Full update to reflect the GDPR
Revised: 6th October 2016: Reference to Data Protection Act 1998 updated to Data Protection Acts, 1988 and 2003
Published: 4th March 2015