This privacy policy sets out how hikerpilot collects, uses, stores and protects your personal data, when you use our website or services. We process personal data exclusively in accordance with the Algemene Verordening Gegevensbescherming (“AVG”) / General Data Protection Regulation (“GDPR”). We may amend this privacy policy from time to time and recommend that you visit this page to stay informed.

The data controller is:

[BEDRIJFSNAAM]

Address: [ADRES]

Chamber of commerce number: [KVK‑NUMMER]

E‑mail: [E‑MAILADRES]

Data protection officer (FG/DPO): [DPO‑GEGEVENS]

If you have any questions or suggestions regarding data protection, please feel free to contact us via the “Contact” section.

When using our services you may give us personal data (meaning any information about you from which you can be identified). This does not include data where identity details have been removed (anonymous data). When we ask you to give us personal data, we do so in order to provide you with the functionality available on our platform. If it is necessary to give your data, we will point this out to you in the relevant form by marking it as a mandatory field. Providing any other data is voluntary.

If we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you.

Personal data can be:

- identity and contact data: first name, last name, billing address, e-mail address;

- transaction and financial data: invoices, details about payments and services you have purchased from us as well as payment card details;

- technical data: internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-ins, device information, operating system and platform, app‑version, crash‑logs;

- profile data: your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;

- usage data: information about how you use our website and services, including the full Uniform Resource Locators (URL) clickstream to, through and from our website and services (including date and time); pages you viewed or searched for; page response times, download errors, length of sessions and visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number;

- marketing and communications data: your preferences in receiving marketing from us and your communication preferences.

We may also collect, use and share statistical or demographic data. This aggregated data could be derived from your personal data but is not considered personal data as it will not directly or indirectly reveal your identity.

You may give us personal data when you create an account to use our website, subscribe to use our services, fill in contact forms or register to receive our newsletter.

When you report a problem or when you contact us by e-mail or phone or reach out to us in a different way (e.g. through social media), we may also collect information from you via these channels. When you contact us, we process the subject and content of your request, including metadata such as (for e-mails) your e-mail address and the time and date of your request, or (for calls) who you are, where you called from, and the date and length of the call.

If you are using our platform from your mobile device, you can decide to allow us to use your current location and show it on the map shown on your screen. This helps us give you the best possible experience. All location data is processed on servers located in the EU and is not stored on your device.

When purchasing a subscription a payment service provider shall process payments. In this case, we require you to provide your identity, contact, and financial data.

As you interact with our website and services, we automatically collect technical information about your device, browsing actions, patterns, location data and usage data. We do this by using cookies, server logs, analytics software (Matomo) and similar technologies.

This technical information includes your IP address (anonymized where possible), the date and time of the server request, the referrer URL (when you are redirected by a third-party website or mobile app) as well as information about your device’s hardware and software (for example, browser type and version, operating system, mobile app version, language settings, the latency of the network connection). We also collect information about your clicks on the website, and which pages are shown to you. When you use our mobile app, we collect data that identifies the mobile device as well as data about the operation (including possible crashes) of the app on that device.

In this paragraph we describe the purposes for which we plan to use your personal data, and which of the legal bases we rely on to do so. Note that we may process your personal data for more than one ground depending on the specific purpose for which we are using your data. Most commonly we will use your personal data:

- to fulfil our contractual obligations to you,

- where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests,

- to comply with a legal obligation.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. We will not sell or rent your personal data to anyone.

We have also identified what our legitimate interests are where appropriate. Before relying on legitimate interests we conduct a Legitimate Interest Assessment (“LIA”) that confirms:

- the processing pursues a genuine, specific legitimate interest (purpose test);
- the processing is necessary for that purpose and cannot reasonably be achieved in a less intrusive way (necessity test);
- our interests are not overridden by your fundamental rights and freedoms (balancing test).

You may request a summary of the LIA for any specific processing activity or object at any time by contacting us via the details in the “Contact” section. If you object, we will stop processing your personal data for that purpose unless we demonstrate compelling legitimate grounds or the processing is required to establish, exercise or defend legal claims.

The primary purpose for collecting the data is to allow you to fully use all features of our platform, and to provide services to you.

By creating a user account on our platform, you enter into a contractual relationship with us. We store the information you include and manage in your user account, such as your e-mail address and password, uploaded photos, billing and payment information. We also store information about when your user account has been used.

The data kept in your user account can help you plan and manage future hikes. When you explore the trails on our platform, you shall be able to save specific items in a favorites list that we will store for you.

If you link your user account to a social media account you control, for logging in, you might trigger exchanges of data between our platform and that social media provider. You can always choose to unlink your user account by updating your user account settings and preferences.

If you purchase a subscription, we collect data to enable us to process and collect your payment.

We use this data for the purpose of the performance of our contract with you and to the extent necessary for our legitimate interest in administering and recovering payments due to us.

The technical data that we collect when you visit our webpage, is used for the performance of our contract with you and our legitimate interest in the proper functioning of our website and the improvement of our website's performance.

When you create a user account, we will send transactional or other non-promotional messages by e-mail . Also, we may inform you by e-mail about news about our platform and changes to our terms, this privacy policy, the website or our services.

We may further ask you to leave a review or take a survey or we may communicate with you on other matters relating to our website and services. We may also invite you to participate in market research. In that case, please review the information in the invitation about what personal data will be collected and how and for what purpose it will be used.

We process this data on the grounds of (a) the performance of our contract with you, (b) compliance with a legal obligation, (c) our legitimate interest in keeping our records updated and researching how customers use our services and developing and growing our business, and (d) consent.

We may use your contact information and your interaction with our platform to send you e-mail communications with personalized marketing messages, advertisements and suggestions and recommendations to you about goods or services that may be of interest to you.

Please note that, if you change your mind about being sent marketing communications you can “opt out” at any time by clicking the “unsubscribe” link within any marketing communication. Once you “opt out” or “unsubscribe”, you will no longer receive any marketing communications from us. Also, you can manage your preferences via your account settings.

We use collected personal data for analytical purposes in order to improve our services, for example for understanding feature adoption, fixing errors, analyzing how you or people like you with similar interests use our platform, and for developing new functionality. In addition, we use data to test, measure, analyze and troubleshoot platform features so as to get insights into the performance of our services, how they are used, and how our platform can be improved. We strive to use anonymized and de-identified personal data for this analytical work.

We process this data on the grounds of our legitimate interest in running, developing and growing our business, researching how customers use our services, defining types of customers for our services, and keeping our website updated and relevant.

Collecting data also has the technical purpose of administering and protecting our business and this website (including data analysis, troubleshooting, testing, system maintenance, logging, monitoring, support, updates, reporting and hosting of data) and of ensuring the security and proper operation of our IT systems, for example, to prevent and detect attacks on our IT systems and identify attack patterns.

We may also use the collected data to detect and prevent fraud, block unauthorised access, spam or other malicious activity, and detect and prevent other abuse of our platform (for example, this may help us determine whether a bot is using our platform rather than a legitimate user, or to determine whether a user is making a fraudulent payment).

We process this data on the grounds of our legitimate interest in the proper operation of our business, administration and IT services, network security, detection and prevention of fraud, and compliance with a legal obligation.

We store data about transactions, payments, contracts or of potential legal relevance during the applicable limitation period(s). Collecting and processing this data takes place based on the performance of our contract with you, on legal obligations applicable to us and on our legitimate interest in running and managing our business, including the administration and documentation of our business operations and the protection of our legal positions.

Whenever you use our platform, we may use tracking technologies (including cookies) to distinguish you from other users of our platform. This helps us to provide you with a good experience when you browse our website and also allows us to improve the website and the services. When we use the word “cookies” in this privacy policy, we mean any tracking technology that stores or accesses information on the user’s device. Cookies are widely used to make websites work, or work more efficiently, as well as to store information about the content a user views and interacts with, for example, to remember preferences and settings and to analyze how online services are used.

Cookies are usually classified by purpose (functional cookies, analytical cookies, marketing cookies), by publisher (first-party cookies and third-party cookies), and by duration (session cookies and persistent cookies). This classification is important because different legal requirements apply based on how the cookie is classified.

We use a consent management platform (Klaro) which gives you full control over which cookies and services you allow.

You can:
- accept or reject (categories of) cookies;
- change your preferences at any time;
- withdraw consent with immediate effect.

Essential cookies cannot be disabled because they are required for the website to function.

We set functional cookies, which ensure essential and basic functionalities of our website and services, without your consent. Some of these are persistent cookies (which are stored on your device in between browser sessions) to remember your preferences or actions across the website, for example to save your login information for future logins to the website.

We also use session cookies which allow the website to link your actions during a browser session to enable certain features of the website, to better understand how you interact with the website and to monitor aggregate usage by users and web traffic routing on the website. Unlike persistent cookies, session cookies are deleted from your computer when you log off and then close your browser.

Specifically, we use the following functional cookies:

- Cookies enabling you to create an account and sign in and determine whether you have logged in or are still logged in. In addition, we use cookies that save your chosen language and certain other preferences (which you can manage in your user account).

- Cookies that ensure that the cookie settings you have made are saved correctly. Depending on their function, these cookies are only stored for the duration of your visit (session cookies) or for a longer period of time, e.g. until you actively log out.

- We also use the Facebook and Google APIs in order to provide you with a secure, fast, and easy way to log in into our app using your Facebook account or your Google account.

Additionally, we use cookies to measure online traffic and analyze and evaluate usage behavior. They collect information about how you interact with our website, which pages you have visited and which features of our website you have used. Your usage behavior can be traced using a user ID. This enables us to better understand the use of our services and optimize them accordingly.

We offer you the option to accept or decline such analytical cookies. You can revoke your consent at any time via the "Privacy Settings" link on the top of this page. Alternatively, you can change your settings in your user account. When you withdraw consent, your data will no longer be collected through those trackers. However, we will continue processing the data collected before the withdrawal.

We use privacy-friendly software, provided by Matomo, to measure online traffic and analyze and evaluate usage behavior.

Marketing cookies may be used to trace a user’s specific actions or recurring behavioral patterns in the use of functionalities back to specific, identified or identifiable individuals for the purpose of grouping different profiles within clusters. This is aimed at enabling a business to provide customized services beyond what is strictly necessary for the delivery of the service and send targeted advertising messages in line with the preferences expressed by the user during their browsing activities. Currently, we do not set this type of marketing cookies.

Our website does use affiliate links which may earn us a commission at no additional cost to you. When you click on an affiliate link, an affiliate cookie is stored in your browser. Affiliate cookies are created by websites to enable them to collect information and track from where the sale originated so that they can pay the affiliate marketer who was the reason behind the purchase. Such cookies have an expiry time. Please note that these affiliate websites have their own privacy policies for which we do not accept any responsibility or liability.

You can set up your browser options, to stop your computer accepting cookies or to prompt you before accepting a cookie from the websites you visit. Most browsers allow you to choose which cookies to accept and which to reject. If you do not accept cookies, however, you may not be able to use all functionality of our website or services and you may be required to modify or manually enter certain information or preferences each time you use our services.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.youronlinechoices.com or www.allaboutcookies.org. On www.youronlinechoices.com you will be able to view a list of third parties (in the "Your ad choices" section) that install cookies on your browser.

We will delete or anonymize your personal data as soon as it is no longer required for the purposes for which we collected or used it. As a rule, we store your personal data for the duration of the usage or our contractual relationship plus a period of 30 days in which we keep backup copies (after the deletion). We may retain your personal data for a longer period in the event of a complaint, if we reasonably believe there is a prospect of litigation in respect to our contractual relationship, to comply with law enforcement requests, maintain security, prevent fraud and abuse, resolve disputes, enforce our legal agreements, or fulfil your request to “unsubscribe” from further messages from us. We will also keep your data if we are obliged to do so to meet legal, regulatory, tax, accounting or reporting requirements applicable to us.

We may use outside service providers to support us in providing our services, so-called processors. Personal data is passed on to these processors, or is collected by them, to enable them to carry out further processing (such as IT and system administration services, email communications, hosting services, backup services). These processors process personal data on our behalf and are bound by the GDPR and further instructions, if applicable. Providers may process the following types of personal data:

- technical, contact, transaction and financial data (technical and payment services);

- email communications and contact data (email communications service);

- contact data and financial data (cloud accounting system).

We host our website on the servers of DigitalOcean. Processing takes place on servers within the European Union.

For electronically processed payments we use a payment service provider. Payment service providers may use your personal data for their own purposes, such as to detect and prevent attempts to commit fraud and to comply with legal requirements applicable to them. When we transmit payment information to the payment service providers to process the payment, the further processing of this payment information is the sole responsibility of the payment service provider. We only receive information from the payment service provider that the payment has been properly processed. We process this information along with your name in order to complete the transaction you have made.

A transfer of data may take place for the purpose of resolving disputes and asserting, exercising or defending rights and claims, including to enforce or apply our terms and conditions, terms of use and/or any other legal agreements, or to protect our rights, property, safety or our customers.

We may also be under a duty to disclose or share your personal data in order to comply with any legal obligation. In certain cases, for example, we may need to use or disclose your data to tax authorities, regulators and other authorities (for example law enforcement or the financial authorities).

In the case of indications of cases of fraud or a possible criminal matter or other illegal or abusive behavior, where we may need to clarify the illegal use of our platform, personal data will be passed on to external consultants (e.g. lawyers), the law enforcement authorities and, if necessary, to injured third parties.

This data is passed on on the basis of our legitimate interest in combating abuse, prosecuting criminal offenses and asserting, exercising or defending claims or on the basis of a legal obligation applicable to us.

We may also use professional advisors who provide consultancy, banking, legal, insurance, accounting and administrative services. We may need to share your personal data with these professional advisers, to the extent necessary and in line with contractual and other obligations applicable to them.

As part of the further development of our business, the structure of our company may change. In such transactions, user information may be shared. Whenever personal data is passed on to third parties to the extent described above we ensure that this is done in accordance with this privacy policy and the relevant data protection laws. The transfer of personal data is justified by the fact that we have a legitimate interest in adapting our company’s form to fit economic and legal circumstances.

We aim not to process data in countries outside the European Economic Area ("EEA"), in so-called third-party countries, or transfer data to recipients in these third-party countries. When we do work with service providers in third-party countries, we select providers that have GDPR-compliant processes in place where processing takes place on servers within the European Union.

If data will be processed outside the EEA, we will use:

- EU‑US Data Privacy Framework (if applicable);
- standard contractual clauses (SCC’s);
- additional security measures.

We take appropriate technical and organizational security measures to protect your personal data from unauthorized access, loss, or misuse, including:

- encryption (HTTPS, TLS);
- access control;
- logging and monitoring;
- regular back‑ups;
- secured hosting within the EU.

However, no system is completely secure, and we cannot guarantee absolute protection.

Our website contains links to external websites which have their own privacy policies for which we do not accept any responsibility or liability. We encourage you to review their privacy policies.

With regard to your personal data, you have the following rights.

You can request a copy of your personal data processed by us.

You can inform us anytime of changes to your personal data and ask us to correct your personal data. You can make some of these changes directly online when you have a user account. Please note that we may need to verify the accuracy of the new data you provide to us.

You have the right to request us that we delete your personal data. Please note that, if you delete your user account, your profile will be completely and permanently deleted.

Deletion of your personal data will not affect the lawfulness of any processing carried out before you withdraw the deletion of your data.

In certain situations, you can ask us to restrict the processing of your personal data and object to particular ways we are using your personal data.

You have the right to receive the personal data that you have provided to us in a structured, machine-readable, commonly used format.

Where we process your personal data based on legitimate interest or the public interest, you have the right to object to that use of your personal data, subject to applicable law.

You may withdraw consent for the processing of your personal data.

Withdrawal of consent will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you have a user account, you can access your personal data through our platform. You find the option to add, update, or remove information we have about you in your user account settings.

You can also submit a request by e-mail or mail. To protect your personal data, we may need to verify your identity before completing your request.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Please note that we process the personal data transmitted by you when you exercise your rights for the purpose of implementing these rights and provide evidence of this. This processing of your data is necessary for compliance with our legal obligations, and in addition it is in our legitimate interest to document evidence of compliance which may be necessary for the exercise or defense of legal claims. You are neither contractually nor legally obliged to provide your personal data, but we can refuse to fulfil your request to exercise your rights when you do not provide the required data.

You may file a complaint with the Autoriteit Persoonsgegevens.

We reserve the right to update this privacy policy. When we post changes to this privacy policy, we will update the date of this privacy policy. When required by applicable law, we may inform you by additional means, if we make material changes to how your personal information is collected, accessed or otherwise used or if your rights under this privacy policy are materially impacted. We recommend that you check this page from time to time to inform yourself of any changes in this privacy policy.