App Privacy Policy
GOBAO Electronic Technology GmbH is committed to protecting and respecting your privacy. This Privacy Policy (“Policy”) describes how your personal data will be processed when you use the GOBAO App (“App”) or the services provided through the App.
You can find below:
• Introduction
• Processing of Personal Data
• What data do we collect and how do we use your personal data
• Retention period
• Purpose limitation
• Security of Personal Data
• Sharing of Personal Data
• International Transfer
• Third-Party SDKs and Service Providers
• Cookies and Similar Technologies
• Sensitive Personal Data
• Rights in relation to Personal Data
• Children’s Privacy
• Withdrawal of Consent
• Questions and inquiries
• How will we update this Privacy Policy
This Privacy Policy does not apply to our authorised retailers, or third parties to whom you directly provide your information including but not limited to, subscription services, insurance companies, or other third parties. These entities are independent of us and responsible for their own collection of information. Please refer directly to those entities and their privacy policies for more information.
1. Introduction
This Privacy Policy (“Policy”) provides information on the personal data processing by GOBAO Electronic Technology GmbH in the European region, a private company with limited liability established under applicable law, having its statutory seat in Emil-von-Behring-Straße 6, 63128 Dietzenbach, Germany, as well as its subsidiaries and affiliate companies (hereinafter individually and collectively referred to as “GOBAO”, “we”, “us” or “our”).
The GOBAO App is a mobile application designed to connect with GOBAO smart e-bikes, enabling users to view real-time vehicle status, record cycling activities, manage firmware over-the-air (OTA) updates, bind vehicles to authorised dealers for after-sales service, and access related smart mobility services.
Gobao can be reached via the following contact details:
• Mailing address: Emil-von-Behring-Straße 6, 63128 Dietzenbach, Germany
• Telephone number: +49 (0) 8142 / 654 5492
• Email address: service@gobao-ebike.com
Contact details of the Data Protection Officer:
DataCo GmbH (www.dataguard.com)
Sandstraße 33, 80335 München, Germany
Email: privacy@dataguard.com
When contacting the Data Protection Officer, please specify the company (GOBAO Electronic Technology GmbH) your inquiry relates to. Please refrain from including sensitive information such as a copy of your ID in your request.
This Policy applies to all personal data processed by GOBAO and/or on behalf of GOBAO, which identify or may identify a person (“Personal Data”). These persons involved are hereinafter collectively referred to as data subjects (“Data Subjects”).
GOBAO reserves the right to review and/or alter the Policy periodically, in order to comply with (local and/or European) legislation, and for any other purpose deemed reasonably necessary by GOBAO.
For queries and inquiries about this Policy, please contact us at service@gobao-ebike.com.
2. Processing of Personal Data
This Policy sets out the elements necessary for GOBAO’s compliance with applicable privacy legislation, principles and practice, including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and other applicable privacy laws (“Applicable Laws”).
The Policy is an external policy and is directed towards Data Subjects whose Personal Data are being processed by GOBAO for the purpose for which information has been collected. This Policy applies to the processing of Personal Data, in which GOBAO acts as the data controller within the meaning of the Applicable Laws. This is the case when GOBAO determines the purpose for and the means for the processing of Personal Data of Data Subjects within the purposes of this Policy.
For business purposes, Data Subjects may be asked to provide their Personal Data. If this is the case, GOBAO, its affiliates and partners shall be required to keep such information confidential.
The following table summarises GOBAO’s data processing activities in connection with the App:
Data Processing Activities | Type of Data Processed | Legal Basis for Processing | Purpose(s) of the data processing | Retention period |
Account Management | Email address; Login password; Account name; User-uploaded photo; Phone number; Account authorization records | Consent (Art. 6(1)(a) GDPR); Performance of a contract (Art. 6(1)(b) GDPR) | To create and authenticate user accounts; to enable access to App services | As long as the account exists; deleted within 30 days after account deletion |
Vehicle and Device Usage | Phone number; Mobile phone model; Vehicle binding records; Vehicle Identification Number (VIN); PIN; Device information; Bluetooth connection data | Performance of a contract (Art. 6(1)(b) GDPR); Consent (Art. 6(1)(a) GDPR) | To bind the user’s e-bike to Owner; To connect the App with the e-bike via Bluetooth; to display real-time vehicle status; to ensure device compatibility and stable connection | As long as the vehicle remains bound to the dealer; Vehicle binding records deleted within 30 days after unbinding or account deletion |
User Operations / Analytics | Buried point behaviour records (in-app interaction events) | Consent (Art. 6(1)(a) GDPR) | To analyse user behaviour and improve App functionality and user experience | 12 months from collection, thereafter anonymised |
User Cycling Activities | Location data; Location reporting timestamp; Cycling track; Cycling data; Cycling distance; Cycling speed; Average speed; Maximum speed; Power consumption; Cadence; Gear position; Motor power; Raw cycling data file (unstructured) | Consent (Art. 6(1)(a) GDPR) | To record and display cycling activities, routes and performance metrics; to provide ride statistics and history | As long as the account exists; real time position for 7 days, thereafter anonymised. |
App Permissions | Location permission; Camera permission; Location data; Photos | Consent (Art. 6(1)(a) GDPR) | To enable Bluetooth device discovery and connection (location permission); to allow user profile photo upload and QR code scanning (camera permission) | Permission data is processed in real-time and not stored persistently beyond the associated activity records |
App Security Logs / IT Infrastructure Operations | Security event logs; access logs; system operation records | Legitimate interests for IT security and compliance (Art. 6(1)(f) GDPR) | To monitor and ensure the security and integrity of the App and backend infrastructure; to detect and prevent unauthorised access | 6 months from generation |
Technical Logs / Diagnostic Data | Device diagnostic information; crash reports; performance metrics | Performance of a contract (Art. 6(1)(b) GDPR); Legitimate interests (warranty period) (Art. 6(1)(f) GDPR) | To diagnose hardware and software issues; to fulfil warranty obligations; to improve product quality | During the warranty period; thereafter anonymised or deleted within 12 months |
Note: Your password is protected by industry-standard encryption (bcrypt/Argon2 hashing) and is never stored or accessible in plain text by our systems or personnel.
3. What data do we collect and how do we use your personal data
Our App has various functionalities, which entail different types of personal data processing. When we provide our services, we have a need to process your personal data. The personal data processing activities and types of data processed are listed above in Section 2.
Specifically, we collect and use your personal data for the following purposes:
(a) Account Registration and Authentication: We collect your email address, username and password to create your account and verify your identity when you log in. This is necessary to provide you with access to the App and its services.
(b) Vehicle Binding and Connection: We collect your Vehicle Identification Number (VIN), Bluetooth connection data and device information to pair your App with your GOBAO e-bike, enabling real-time vehicle status display and smart features.
(c) Cycling Activity Recording: With your consent, we collect location data, cycling metrics and ride tracks to record your cycling activities and provide you with ride statistics, history and performance analysis.
(d) Firmware Over-the-Air (OTA) Updates: We collect device and firmware version information to deliver firmware updates for the dashboard, motor controller and battery management system, ensuring product safety, bug fixes and performance improvements.
(e) Dealer Binding and After-Sales Service: We collect your phone number and vehicle information to bind your e-bike to an authorised dealer, facilitating warranty claims, maintenance and after-sales support.
(f) App Improvement and Analytics: With your consent, we collect anonymised in-app behaviour data to understand how users interact with the App and to improve our services.
(g) Technical Diagnostics and Security: We collect log files and diagnostic data to troubleshoot technical issues, ensure App stability and security, and fulfil warranty obligations.
4. Security of Personal Data
We strive to maintain the highest standards of security and GOBAO has put in place robust technical and organisational measures for the protection of your data in accordance with the current, general state of technology, especially to protect the data against loss, falsification or access by unauthorised third persons. These measures include, but are not limited to:
• Encryption of data in transit using TLS 1.2 or higher;
• Role-based access control and least-privilege principles for internal personnel;
• Regular security assessments and penetration testing;
• Continuous monitoring of infrastructure for security events;
• Employee data protection training and confidentiality obligations.
Once we have received your personal data, we will use strict procedures and security features to prevent unauthorised access. However, the transmission of information via the internet is not completely secure. So, whilst we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted via our App.
In the unfortunate event that a personal data security incident occurs, we will assess the risk to your rights and freedoms and, where required by Applicable Laws, report it to the competent supervisory authority within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay, in accordance with the requirements of the law and regulatory authorities.
5. Sharing of Personal Data
We share the information identified above for the following purposes and with the following categories of recipients:
(a) Within the GOBAO Group: We may share your Personal Data within the GOBAO Group, which includes parent companies, corporate affiliates, subsidiaries, business units and other companies that share common ownership, for the purposes described in this Policy.
(b) B2B Business Partners (White-label / Fleet Partners): We provide dedicated brand-exclusive management back-office access to our white-label partners. Such partners may only view vehicles and associated personal data linked exclusively to their own branded e-bike fleets. Data sharing is limited strictly to data necessary for their own fleet operation, and binding data processing agreements are signed with all white-label customers to impose data security, access restriction and non-disclosure obligations in compliance with GDPR.
(c) Authorised Dealers and Service Partners: When you bind your e-bike to an authorised dealer, we share the necessary vehicle and contact information with that dealer to enable after-sales service, warranty processing and maintenance support. Dealers are bound by confidentiality and data protection obligations.
(d) Third-Party Service Providers: When we use third-party service providers (e.g., cloud hosting providers, analytics services, customer support tools), we only share with them the personal information that is necessary for them to provide their services, and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions. A list of key third-party service providers is set out in Section 9 below.
(e) Legal, Security or Safety Purposes: We may share your information with third parties, law enforcement or other government agencies to comply with law or legal requirements; to enforce or apply our Terms of Service and other agreements; and to protect our rights and the property or safety of our users or third parties. We also may disclose information about you and your e-bike when we have reason to believe that someone is causing injury to or interference with our rights or property, other users of the App or anyone else that could be harmed by such activities.
(f) Corporate Transactions: With other companies in connection with a corporate transaction, if we or some or all of our assets are acquired by another company, including through a sale in connection with bankruptcy, we will share the information that we hold with that company, subject to appropriate confidentiality safeguards.
When third parties are given access to your personal data, we will take the required contractual, technical and organisational measures to ensure that your personal data are only processed to the extent that such processing is necessary.
In all cases, GOBAO will expressly state why such information is necessary, so that Data Subjects may provide the information at their own discretion. GOBAO will not disclose Personal Data provided by Data Subjects to any party, other than GOBAO itself, without prior permission from the Data Subjects, except as required or permitted by Applicable Laws.
6. International Transfer
GOBAO may transfer Personal Data to a country outside your current region. Our primary servers are located in Germany (European Union). However, certain third-party service providers may process data in countries outside the EU/EEA (see Section 9).
In such cases, we will take appropriate measures in compliance with the Applicable Laws, and where appropriate safeguards are in place that ensure the level of protection of Data Subjects as required by the Applicable Laws. Such safeguards may include:
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Adequacy decisions adopted by the European Commission for the recipient country;
• Binding Corporate Rules (BCRs) where applicable;
• Other appropriate safeguards recognised under Applicable Laws.
If you wish to know details in connection with the transfer of your personal data and any country to which your personal data is transferred, please contact us using the contact information provided in Section 1.
7. Third-Party SDKs and Service Providers
To operate and improve the App, we integrate the following third-party software development kits (SDKs) and service providers. Each provider processes data in accordance with its own privacy policy and our instructions:
- Firebase (Google LLC): We use Firebase for app analytics, crash reporting, push notifications and cloud messaging. Firebase may collect device identifiers, IP addresses, crash logs and usage data.
(b) Cloud Hosting Provider: Our backend infrastructure is hosted on secure cloud servers located in Germany/EU.
(c) Mapping and Location Services: For displaying cycling routes and maps, we may integrate mapping service providers. These providers may process location data when you use the map feature.
(d) Customer Support Tools: We may use third-party customer support platforms to handle your inquiries. Only data necessary for handling your request is shared.
We require all third-party service providers to enter into data processing agreements that comply with GDPR and impose strict confidentiality, security and data minimisation obligations. We regularly review their compliance.
8. Cookies and Similar Technologies
The App itself does not use traditional HTTP cookies. However, we and our third-party service providers may use similar technologies, including:
• Local storage: To store your login state, app preferences and settings on your device;
• Device identifiers: To recognise your device and provide push notifications;
• Analytics tags: To collect anonymised usage statistics.
You can manage or clear local storage through your device settings or by uninstalling the App. You can also disable push notifications in your device settings.
9. Rights in relation to Personal Data
Under the GDPR and other Applicable Laws, you generally have the following rights in relation to your personal data:
(a) Right of Access (Art. 15 GDPR): You have the right to ask us for access to and a copy of your personal data that we hold.
(b) Right to Data Portability (Art. 20 GDPR): You have the right to ask that some of your personal data is provided to you or sent to another data controller in a commonly used, machine-readable format, where the processing is based on consent or contract and carried out by automated means.
(c) Right to Rectification (Art. 16 GDPR): You have the right to ask us to update or correct your personal data in order to make it accurate and complete.
(d) Right to Erasure (“Right to be Forgotten”) (Art. 17 GDPR): You have the right to ask us to delete your personal data from our records in certain circumstances, such as where the data is no longer necessary for the purposes collected, or where you withdraw your consent and there is no other legal basis for processing.
(e) Right to Restriction of Processing (Art. 18 GDPR): You have the right to ask us to restrict the processing of your personal data in certain circumstances, such as where the accuracy of the data is contested, or where the processing is unlawful.
(f) Right to Object (Art. 21 GDPR): You have the right to object to us processing your personal data in certain circumstances, including where processing is based on our legitimate interests or for direct marketing purposes.
(g) Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw that consent at any time. See Section 14 for details.
To exercise these rights, please contact us using the contact information provided in Section 1. To ensure the security of your data, we may require you to provide necessary information for identity verification. We will respond to your request within one month of receipt. If the request is complex or numerous, we may extend this period by a further two months where necessary and will inform you in advance of the extension and the reasons for the delay.
These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your data or if making the information available to you would reveal personal data about another person or if we are legally prevented from disclosing such information. In some instances, this may mean that we are able to retain data even if you withdraw your consent.
We hope that we can satisfy any queries you may have about the way we process your data. If you have any concerns about how we process your data you can contact us as described below in Section 15 “Questions and inquiries”.
In the event you still have unresolved concerns, you also have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for GOBAO Electronic Technology GmbH is the Hessian Data Protection Commissioner (Hessischer Beauftragter für Datenschutz und Informationsfreiheit, HBDI), Postfach 3163, 65021 Wiesbaden, Germany (https://datenschutz.hessen.de).
Finally, please note that where we require personal data to comply with legal or contractual obligations, then provision of such data is mandatory: if such data is not provided, then we will not be able to manage our contractual relationship, or to meet obligations placed on us. In all other cases, provision of requested personal data is optional.
10. Children's Privacy
The App and its services are not directed to children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect or solicit personal data from children. If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that information as soon as possible. If you believe that a child has provided us with personal data, please contact us at service@gobao-ebike.com.
11. Withdrawal of Consent
Where we rely on your consent to process your personal data (as indicated in Section 2), you have the right to withdraw your consent at any time, free of charge. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
You can withdraw your consent in the following ways:
• Device settings: You can disable location, camera, Bluetooth or notification permissions at the operating system level on your mobile device;
• Email request: Send an email to service@gobao-ebike.com with your request, specifying which consent(s) you wish to withdraw;
• Account deletion: You may delete your account at any time through the App settings or by contacting us, which will result in the deletion of your personal data in accordance with Section 4.
Please note that withdrawing certain consents or permissions may limit or disable specific App functionalities (e.g., disabling Bluetooth will prevent vehicle connection; disabling location will prevent cycling track recording).
12. How will we update this Privacy Policy
We may update this Privacy Policy according to changes in our business functions and measures concerning the protection of personal information. If we make changes to this Privacy Policy, we will notify you through our App (e.g., via in-app notification or pop-up) and/or by email to your registered email address.
Where changes to this Privacy Policy will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice (at least 30 days) so that you have the opportunity to exercise any rights you have, including the right to delete your account if you do not agree with the updated terms.
The “Version update date” and “Version effective date” at the top of this Policy indicate when the latest version was issued and when it takes effect. We encourage you to review this Policy periodically.
