Hellorider

Hellorider is SOC 2 compliant. On SOC2C this listing is Listed.

According to Hellorider's public trust center, Hellorider is GDPR compliant. On SOC2C this listing is Listed.

According to Hellorider's public trust center, Hellorider is ISO 27001 certified. On SOC2C this listing is Listed.

Yes. Hellorider's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Hellorider hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Hellorider shares the personal data it collects using cookies, when using its website, with third parties to design its website more effectively. When a rider or (potential) customer contacts Hellorider, we use the data to answer the question and, where appropriate, to make more effective use of communication via chat. More information on this can be found in its privacy statement. Furthermore, Hellorider does not share personal data with third parties outside the parties mentioned in the privacy statement.

Hellorider qualifies as an independent controller. The employer, lease company and dealers also qualify as (independent) controllers. Hellorider, its customers and the dealers are not processors. For this reason, a processor agreement between these organizations is not necessary. This is only mandatory when a controller - processor relationship exists. Naturally, Hellorider has a duty to handle the personal data to be processed with care. A controller such as Hellorider must independently comply with the GDPR. For example, it must determine for itself whether the processing operations meet all the requirements of the GDPR, for example whether there is a valid basis to process the personal data, and it has a duty to ensure an adequate level of protection of personal data.

If an organization processes personal data for its own purposes and shares this data with another organization that uses the personal data for its own purposes, there are two independent data controllers applicable. It has already been mentioned above that this applies to Hellorider, its customers and its dealers. There is no joint controller responsibility in this case, as the parties do not jointly determine the purpose and means of processing personal data. For this reason, Article 26 AVG does not apply. There is therefore no legal obligation to establish a mutual arrangement on personal data processing. Because Hellorider does consider it important to agree on some basic principles when it comes to (the processing of) personal data with its customers, it has included an article for this purpose in the agreement it enters into with its customers.

Hellorider processes personal data within the EEA, unless such a transfer meets the exceptions and/or conditions provided for in (privacy) legislation.

Hellorider retains the personal data of leasing contracts concluded for the duration of the contract with an expiry date of 1 year. Personal data of employees specified by their employer and invited by Hellorider is kept by Hellorider for the duration of the invitation with an expiry of 30 days. Personal data of employees who have selected a bike but whose order is cancelled before the contract starts Hellorider retains for 90 days after the cancellation. Invoice data is kept by Hellorider according to the legal retention period (of 7 years).