Privacy policy

1. Controller

Durst & Illing GbR, trading as endless bikes
Schyrenstraße 9 · courtyard
81543 Munich, Germany
Telephone: 089 97406200
Email: hello@endless-bikes.de

2. Hosting and server logs

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes personal data on our behalf under a data-processing agreement.

When you access the website, technically necessary connection data is processed. This includes in particular the IP address, date and time of access, requested page or file, amount of data transferred, referrer URL, browser, operating system, and status or error messages. Processing is necessary to provide the website securely and reliably, detect attacks and resolve technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and trouble-free operation of this website.

Server logs are retained only for as long as required for operation, troubleshooting and IT security. They are kept for longer only when a security incident must be investigated or legal obligations apply. Further information is available in Hetzner’s privacy policy.

3. Contact by form, email or telephone

If you contact us, we process your details to answer the enquiry and, where appropriate, to take pre-contractual steps or perform a contract. Depending on the request, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. Our legitimate interest is handling enquiries and communicating with customers and prospective customers.

Through the contact form, we process your name, email address, optional telephone number, selected type of enquiry, message and up to three voluntarily uploaded JPG or PNG photographs with a combined size of no more than 12 MB. Photographs are processed temporarily during transmission, sent to us as email attachments and not stored in a website database or permanent file store.

We generally delete enquiries no later than twelve months after they have been concluded. If the enquiry results in a contractual relationship, the data is retained in accordance with statutory commercial and tax-law retention periods.

4. Contact-form spam protection

To protect the form against automated requests, we use an invisible input trap, a check of the completion time and server-side rate limiting. We do not use an external CAPTCHA service.

The IP address is processed temporarily for rate limiting. No more than five requests per IP address are permitted within 15 minutes. The corresponding rate-limit data is reset after this period. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the form and our technical systems against misuse and overload.

5. Contact-form delivery through Brevo

We use Brevo’s transactional email service to deliver form messages. Brevo processes the form details and any attached photographs on our behalf under a data-processing agreement.

The message is sent through Brevo to our Google Workspace mailbox. Brevo does not permanently store email previews for these form messages. Technical delivery logs are deleted after one month. Personalised open and click tracking is disabled. Form data is not used for newsletters, advertising or building a contact list. Further information is available in Brevo’s privacy policy.

6. Google Workspace

We use Google Workspace for business email communication. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Messages sent to us by email or through the contact form are processed in our Google Workspace mailbox. We have concluded a data-processing agreement with Google.

Processing by Google companies or subprocessors outside the European Economic Area, particularly in the United States, cannot be ruled out. According to Google, the legally required safeguards for international data transfers are used. Further information is available in Google’s privacy policy.

7. Google Maps and Google Calendar

We offer an embedded Google map and Google appointment booking on the contact and workshop pages. This content loads only after you actively select the relevant button. Before that, your browser does not connect to Google.

After activation, your browser connects directly to Google. In particular, the IP address, time, referrer, browser and device information may be processed, and cookies or comparable technologies may be used. If you are signed in to Google at the same time, Google may associate the visit with your account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing in third countries, particularly the United States, cannot be ruled out.

The legal basis for loading this content is your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. Consent applies only to the content you activate. You can read our address and regular opening hours without loading embedded content or voluntarily open the external link.

8. Google business information

The Google rating and current changes to our opening hours displayed on the website are retrieved server-side through the Google Places API. Your browser requests this information only from our own server and does not connect directly to Google for this purpose. No form input is transferred to Google. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is displaying up-to-date business information on the website.

9. YouTube videos

YouTube videos initially appear only as local placeholders. A connection to YouTube is established only when you explicitly activate a specific video using the “Load YouTube video” button. The video then loads in privacy-enhanced mode through youtube-nocookie.com.

In particular, the IP address, time, referrer, browser and device information may be processed. Further information may be stored during playback. If you are signed in to Google or YouTube, the visit may be associated with your account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing in third countries, particularly the United States, cannot be ruled out.

The legal basis is your consent under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. Activation applies only to the selected video and can be withdrawn using “Block video again”. Alternatively, you can use the direct YouTube link provided.

10. WhatsApp and external links

If you contact us through WhatsApp, WhatsApp processes your telephone number, messages, other content you provide and metadata. The provider in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Use is voluntary; you can contact us by email or telephone instead. Depending on the content, we process your message under Article 6(1)(b) or Article 6(1)(f) GDPR.

Links to WhatsApp, Instagram, YouTube, Facebook, Google Maps and other external websites connect to the relevant provider only after you click them. From that point, the provider’s privacy terms also apply.

11. Cookies, analytics and online shop

This website itself does not use analytics, marketing or tracking services and does not set cookies intended for these purposes. External content from Google and YouTube loads only after your active consent; the relevant providers may then use cookies or comparable technologies.

No online shop is integrated into this website. Products cannot be ordered or paid for online. SumUp and other shop or payment services are not loaded through this website and receive no order, payment or customer data from it.

12. Recipients and data transfers

Personal data is available only to the parties that require it for the relevant purpose. These may include our employees and the hosting, email and delivery service providers named above. Data is disclosed only where required to perform a contract, comply with a legal obligation, act on your consent or pursue a permitted legitimate interest.

Where data is processed outside the European Economic Area, the relevant providers state that transfers are based on an adequacy decision, in particular the EU-US Data Privacy Framework, or suitable safeguards such as the European Commission’s standard contractual clauses.

13. Your rights

Subject to the statutory conditions, you have the right to access under Article 15 GDPR, rectification under Article 16 GDPR, erasure under Article 17 GDPR, restriction of processing under Article 18 GDPR and data portability under Article 20 GDPR.

You may withdraw consent at any time with effect for the future. Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority generally responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Last updated

Last updated: 14 September 2026. We update this privacy policy when the website, the services used or the legal requirements change.