Hellorider

Hellorider publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Hellorider is SOC 2 compliant and holds GDPR, ISO 27001. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Hellorider hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@hellorider.com or via a /security page (Hellorider lists a security contact).

Hellorider lists 31 subprocessors on its trust center, including Amazon Web Services, GitLab, Zendesk, Office 365, Slack. Buyers use this for fourth-party risk review.

Hellorider hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information. Data residency details are on its trust center.

Hellorider's trust center is at https://trust.hellorider.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Hellorider shares the personal data it collects using cookies, when using its website, with third parties to design its website more effectively. When a rider or (potential) customer contacts Hellorider, we use the data to answer the question and, where appropriate, to make more effective use of communication via chat. More information on this can be found in its privacy statement. Furthermore, Hellorider does not share personal data with third parties outside the parties mentioned in the privacy statement.

Hellorider qualifies as an independent controller. The employer, lease company and dealers also qualify as (independent) controllers. Hellorider, its customers and the dealers are not processors. For this reason, a processor agreement between these organizations is not necessary. This is only mandatory when a controller - processor relationship exists. Naturally, Hellorider has a duty to handle the personal data to be processed with care. A controller such as Hellorider must independently comply with the GDPR. For example, it must determine for itself whether the processing operations meet all the requirements of the GDPR, for example whether there is a valid basis to process the personal data, and it has a duty to ensure an adequate level of protection of personal data.

If an organization processes personal data for its own purposes and shares this data with another organization that uses the personal data for its own purposes, there are two independent data controllers applicable. It has already been mentioned above that this applies to Hellorider, its customers and its dealers. There is no joint controller responsibility in this case, as the parties do not jointly determine the purpose and means of processing personal data. For this reason, Article 26 AVG does not apply. There is therefore no legal obligation to establish a mutual arrangement on personal data processing. Because Hellorider does consider it important to agree on some basic principles when it comes to (the processing of) personal data with its customers, it has included an article for this purpose in the agreement it enters into with its customers.

Hellorider processes personal data within the EEA, unless such a transfer meets the exceptions and/or conditions provided for in (privacy) legislation.

Hellorider retains the personal data of leasing contracts concluded for the duration of the contract with an expiry date of 1 year. Personal data of employees specified by their employer and invited by Hellorider is kept by Hellorider for the duration of the invitation with an expiry of 30 days. Personal data of employees who have selected a bike but whose order is cancelled before the contract starts Hellorider retains for 90 days after the cancellation. Invoice data is kept by Hellorider according to the legal retention period (of 7 years).

Personal data is treated confidentially by Hellorider. Hellorider has agreed a confidentiality clause in the contracts it enters into with its customers. It also agrees confidentiality with dealers.

With multiple controllers involved, there is a risk that a rider may not know where to turn with questions or complaints surrounding the processing of his or her personal data. It also depends on to whom it should be addressed. When it comes to questions and/or complaints regarding Hellorider's services, a rider or customer can always contact Hellorider. Via the e-mail address [privacy@hellorider.com](mailto:privacy@hellorider.com), a data subject can view, retrieve, request the deletion, request the correction or request the updating of their personal data. If Hellorider is not the right party to put the question to, it will refer to the employer or dealer.