Privacy policy

1. Who we are and how to reach us

BackPedal Ltd (company no. 13487789, 86–90 Paul Street, London EC2A 4NE) is the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible to you for it.

For anything about your data, email team@backpedal.co or write to the address above. We are registered with the Information Commissioner's Office under reference ZB118527.

Two other organisations are controllers in their own right for parts of what happens, and have their own privacy notices:

• Sundays Insurance (the trading name of Gator Bikesure Ltd), for the backup theft insurance on plans that include it. We pass them what they need to insure you and to handle a claim; from there, their notice applies.
• Your tracker's maker, if you use your own tracker rather than our kit. Their app and their notice govern what that tracker records. We only receive what you share with us after a theft (section 3.6).

This policy applies from 28 October 2026 and replaces the earlier one.

2. The data we hold and why

We collect only what we need to protect your bike, bill you and talk to you. The table is the full list. "Contract" means we need the data to provide what you bought; "legitimate interests" means we have a genuine business reason that does not override your rights; "legal duty" means the law requires it; "consent" means you chose it and can withdraw it at any time.

3. Tracker and location data

This is the part of our service that handles the most sensitive data about you: where your bike is. Here is exactly what happens to it.

3.1 How our trackers report. Our kit has two devices. A GPS tracker that spends almost all its time asleep: while dormant it sends us a brief check-in over the mobile network, carrying its battery level, whether it has moved, and a location where it can get one. It does not stream your movements, and nobody watches these check-ins; they are processed by our systems to confirm the tracker is alive. A close-range beacon that broadcasts a fixed identifier over Bluetooth. It carries no location of its own. Our team and recovery agents carry a BackPedal scanning app that listens for these beacons as they move around; it is what finds a bike in the last few metres, including inside a building. The app reports a beacon to our team only when that bike has been reported stolen. A sighting of any other bike is not shown to anyone; it is stored by beacon identifier alongside the tracker's own check-ins, on the same schedule (3.8), so it is there if that bike is later stolen. Such sightings are rare, since they need one of our team to pass close by.

3.2 When a theft is reported. You tell us your bike is stolen. A member of our recovery team then switches the GPS tracker to frequent reporting. We only ever do this after you have reported a theft to us, so it never happens without your knowledge, and each activation is recorded. Frequent reporting ends when the recovery closes.

3.3 What is recorded. Each report carries the tracker's identifier, a timestamp, a location, battery level, movement and speed, and signal information. A beacon sighting carries the beacon's identifier, a timestamp and the location of the phone that saw it. Activations are recorded with the time and the person. During a recovery we add our team's notes and the police crime reference.

3.4 Where it is held. Tracker reports arrive on our tracking platform, run for us by flespi (Gurtam) in data centres in the Netherlands, where they are kept for a rolling 365 days and then deleted automatically. They are also stored in our own encrypted database on Amazon Web Services in London. The record that links a tracker to you and your bike is held separately in our operations system, so the tracking systems themselves hold device identifiers, not names. Our in-house recovery platform shows live positions only for bikes reported stolen.

3.5 Who can see it. By default, no one looks at where your bike is. Access to individual tracking data is limited to a small number of named BackPedal staff who run the service, each with their own login, and it is used to check a tracker is working, to help you fit it, and to run a recovery. Our recovery agents see the live position of the bike they have been sent to recover, for as long as that recovery is open, and nothing else. We never sell location data and never share it with advertisers.

3.6 Your own tracker. On Recovery only and Recovery + Insurance, your tracker belongs to you and its maker's privacy notice governs what it records. We see nothing from it until you report a theft and share its location with us; we then use what you share to recover the bike and keep it as section 3.8 describes.

3.7 The police and your insurer. When your bike is stolen we share its location data, your contact details and the theft details with the police, to recover the bike and to file the crime report. If you claim on your insurance, we give Sundays the policy details, the theft details and, where they ask, the tracking history. We rely on our contract with you, our legitimate interest in recovering stolen bikes, and the law's provisions for preventing and detecting crime.

3.8 After a recovery. Live tracking stops and the bike's position history is removed from the recovery platform at once. We keep the underlying tracker data in our database for 12 months after the recovery closes, for two reasons: thefts that follow a pattern have helped us recover other bikes, and the police, your insurer or you may need the record as evidence. We keep it longer only while a claim, dispute or police investigation is open. The copy on our tracking platform expires after 365 days regardless. Nothing in that copy is looked at unless a recovery or a request needs it.

3.9 In aggregate. We use tracker data in anonymised, aggregated form to understand where and how bikes are stolen, to measure the service (for example, how far our riders travel in a year) and to show it: a map of dots, never a named bike. Nothing in that form identifies you or your bike.

3.10 When you cancel. Monitoring of your trackers stops. Ask us and we delete your location data from our database and ask flespi to delete their copy, normally within 30 days. We keep only what an open theft, insurance claim or legal duty requires, and tell you if that applies.

4. Who we share data with

We share personal data with the companies that run parts of our service for us, and with a few organisations that receive it for their own purposes. None of them may use it for anything else. Where a provider holds data outside the UK, we rely on the UK's adequacy decision for the EEA, or on the UK's international data transfer agreement or the UK extension to the EU–US Data Privacy Framework.

We may also share data if the law requires it, to protect someone's safety, or with a buyer if BackPedal or its assets are sold, in which case the buyer takes on this policy.

5. How we protect data

• Data is encrypted in transit and at rest, in every system listed in section 4.
• Access to customer and tracking data is limited to named staff with individual logins, and administrative actions on trackers are logged.
• Our tracking systems hold device identifiers; the link to your name lives in a separate system.
• Photos you upload are stored privately and served only to you and our team.
• We never hold your full card number; Stripe and Klarna do.
• We collect the minimum we need and delete on the schedule in sections 2 and 3.

If a breach ever puts your data at risk, we will tell you and the Information Commissioner's Office as the law requires.

6. Your rights and how to use them

You can ask us, at any time, to:

• tell you what data we hold about you and give you a copy;
• correct anything that is wrong;
• delete your data, including your tracker and location data (section 3.10);
• stop or limit what we do with it, or object where we rely on legitimate interests;
• stop marketing to you;
• give you your data in a portable form;
• withdraw consent where consent is what we rely on.

Email team@backpedal.co. We will answer within one month, and may ask you to confirm who you are first. There is no charge unless a request is clearly excessive. Some data has to stay for a while even after a deletion request: tax records, an open theft or insurance claim, or a dispute. We will tell you what we have kept and why.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

7. Cookies and analytics

We use essential cookies to run the site: remembering your cookie choice, keeping a checkout in progress, and the cookies Stripe and Klarna set to take a payment securely.

We also run first-party analytics through PostHog, served from our own domain. It records which pages are visited, what is clicked, the device and browser, and an approximate location from your IP address. It also records how pages are used, as a replay: the pages you move through, what you click and choose, and values you enter such as a bike's value. Anything that identifies you, such as your name, email address, home address and card details, is masked before it leaves your browser, and the replays are not linked to your name or email. We use this to understand how the site is used and to fix problems, not for advertising, and we do not share it with advertisers. We treat it as part of operating the site, so it runs without a separate opt-in, and we keep it for up to 12 months.

We also use Google Tag Manager to run Google Analytics 4 and Google Ads conversion tracking. Google Analytics gives us a second, aggregated view of site traffic. Google Ads conversion tracking tells Google when a visit that came from one of our adverts leads to a quote or a purchase, so we can see which adverts work; it sets a Google cookie on your browser to do so. These tags currently run for every visitor. We are adding a switch for them to Cookie preferences, linked in the footer; until then you can block them with your browser's cookie settings or Google's own opt-out tools.

We do not use any other advertising or cross-site tracking cookies, and we do not share your personal data with advertisers.

8. Emails, messages and calls

Service emails. We email you about your order, your kit, when your cover starts, before each renewal, and about a theft. These are part of the service and you cannot opt out of them while you have a plan.

Marketing. We send news and offers only if you signed up for them, or if you are a customer and have not opted out. Every marketing email has an unsubscribe link, and you can also email us to stop. We do not share your details with other companies for their marketing.

WhatsApp and phone. You can reach us on WhatsApp and on our phone lines. Calls to our theft line and our support line are recorded, so that we have an accurate record of what was said, which matters most during a theft. Recordings are held by Aircall, our phone provider, and kept for 12 months; a recording that forms part of a theft report is kept with that report (section 2). We keep notes of what we agree on WhatsApp.

Quick quotes and theft reports from non-members. If you ask for a quote or use Report a bike theft without buying, we use what you give us to answer you and may follow up once or twice about BackPedal. You can tell us to stop at any time.

9. Changes to this policy and complaints

We will update this policy when what we do changes. For anything that affects you materially, such as a new use of tracker data, we email you before it takes effect. The date at the top shows the current version.

Complaints about how we handle your data go to team@backpedal.co first. If you are not satisfied with our answer, the Information Commissioner's Office is the regulator (section 6).