1. Purpose

This Backup & Retention Policy (the "Backup & Retention Policy") establishes the general principles applied by Bike Booking Engine, S.L. ("Bike Booking Engine", "BBE", "we", "us" or the "Company") in relation to:

• The creation of backups;
• The retention of such backups;
• The recovery of information;
• The retention of data during the provision of the Services;
• The retention of data following termination of a subscription; and
• The progressive deletion of information from Bike Booking Engine's systems.

Its purpose is to contribute to the availability, integrity and resilience of the Platform while establishing reasonable criteria to prevent the indefinite retention of information once it is no longer necessary.

2. Scope

This Policy applies to the systems, databases, information and other technological resources managed by Bike Booking Engine in connection with the provision of the Services, to the extent that they are subject to the backup and retention mechanisms described herein.

Where applicable, this Policy may apply to:

• Customer Data;
• Information generated through the use of the Platform;
• Configurations;
• Information necessary for the operation of the Services;
• Technical logs;
• Databases; and
• Other elements necessary for the recovery and continuity of the Platform.

Retention periods may vary depending on the nature and purpose of the information.

3. Objectives

Bike Booking Engine's backup and retention strategy has the following primary objectives:

• Reducing the risk of data loss;
• Maintaining recovery points for certain incidents;
• Facilitating system restoration where necessary;
• Contributing to the continuity and resilience of the Services;
• Establishing defined retention periods;
• Avoiding, where reasonably possible, the indefinite retention of information; and
• Enabling the progressive deletion of data once its operational or contractual purpose has ended.

4. General Principles

Bike Booking Engine applies the following general principles to backups and data retention:

a) Recoverability

Backup mechanisms are primarily intended to enable the recovery of systems and information following certain incidents.

b) Limited Retention

Information should not be retained indefinitely once there is no longer a legitimate purpose for its retention.

c) Rotation

Backups are subject to defined retention and deletion cycles.

d) Separation

Backups are maintained separately from the primary server to which they relate.

e) Verification

Bike Booking Engine periodically performs restoration tests designed to verify the integrity and effectiveness of its recovery mechanisms.

f) Proportionality

Retention periods and mechanisms may vary depending on the nature of the information, its purpose and applicable operational or legal requirements.

5. Distinction Between Active Data and Backups

For the purposes of this Policy, a distinction shall be made between:

Active Data: information stored within systems used for the ordinary operation of the Platform.

Backups: copies of information maintained primarily for recovery, resilience and Service continuity purposes.

The deletion of information from active systems does not necessarily result in its immediate deletion from all existing backups.

Where information has been deleted from active systems, it may remain temporarily within backups until those backups reach the end of their ordinary retention cycle.

During such period, backups are not intended to be used as ordinary operational systems or as permanent archives of deleted information.

6. No Permanent Archiving Service

The backup mechanisms maintained by Bike Booking Engine form part of the operational and security measures designed to protect the Platform.

They do not constitute an independent archiving, document custody or permanent information retention service for the Customer.

The Customer remains responsible for any archiving, retention or record-keeping obligations applicable to it under applicable law or according to its own business requirements.

Where the Platform allows certain information to be exported, the Customer may use such functionality to maintain additional copies of any data it considers necessary to retain.

7. Relationship with Other Documents

This Policy shall be interpreted together with, where applicable:

• The Terms of Service;
• The Security Policy;
• The Service Level Agreement (SLA);
• The Data Processing Agreement (DPA);
• The Privacy Policy; and
• Any other applicable contractual documentation.

In particular, where retained information constitutes Personal Data processed by Bike Booking Engine on behalf of a Customer, the terms set out in the DPA shall also apply.

8. Backup Creation

Bike Booking Engine maintains a periodic backup system designed to facilitate the recovery of information and systems in the event of certain incidents.

Backups form part of the measures implemented to support the availability, integrity and resilience of the Platform.

The existence of backups does not imply that every individual item of data can be recovered under all circumstances, nor does it constitute a guarantee against all forms of data loss.

9. Daily Backups

Bike Booking Engine performs a full backup on a daily basis.

Daily backups are retained for a period of 30 days.

Once this period has expired, the corresponding backups are deleted in accordance with the ordinary rotation cycle and are progressively replaced by more recent backups.

This mechanism provides multiple recent recovery points in the event of certain incidents.

10. Weekly Backups

In addition, Bike Booking Engine maintains weekly backups for longer-term retention.

These backups are retained for a period of 6 months.

Once this period has expired, the corresponding backups are deleted in accordance with the ordinary rotation cycle.

The combination of daily and weekly backups provides different recovery time horizons.

11. Backup Separation

Backups are maintained separately from the primary server to which they relate.

This separation is intended to reduce the risk that an incident affecting the primary system could simultaneously compromise the available recovery mechanisms.

The architecture, location and technologies used to maintain such separation may evolve as Bike Booking Engine's infrastructure, providers or security requirements change.

12. Backup Protection

Backups are subject to security measures designed to prevent unauthorized access or use.

Access to backup and recovery mechanisms is restricted to authorized personnel who require such access to perform functions related to:

• System administration;
• Recovery;
• Maintenance;
• Security; or
• Incident management.

The existence of a backup does not alter the confidentiality and protection obligations applicable to the information contained within it.

13. Backup Rotation

Backups are subject to defined rotation cycles.

As a general rule:

• Daily backups are retained for 30 days; and
• Weekly backups are retained for 6 months.

Once the applicable retention period has expired, the backups cease to form part of the ordinary recovery set and are deleted in accordance with applicable procedures.

As a result, certain information previously deleted from active systems may remain temporarily present within a backup until that backup reaches the end of its retention period.

14. Restoration Testing

Bike Booking Engine performs periodic restoration tests designed to verify the integrity of backups and reasonably confirm the ability to recover information.

These tests form part of the Platform's maintenance and resilience mechanisms.

The frequency, scope and methodology of such tests may be adapted according to the technical characteristics of the systems and operational requirements.

15. Use of Backups

Backups are primarily intended for the recovery of systems or information following incidents that may result in loss, corruption, unavailability or other significant alterations.

Bike Booking Engine will determine, based on the technical circumstances of each incident, whether it is appropriate to use a backup to recover all or part of the affected systems.

Backups are not intended to serve as an ordinary mechanism for recovering information voluntarily deleted by Customers or their Authorized Users.

16. Restoration of Information

Where technically feasible and reasonably appropriate, Bike Booking Engine may restore systems or information using available recovery points.

The possibility and scope of restoration will depend on factors including:

• The nature of the incident;
• When the incident occurred;
• When the incident was detected;
• The systems affected;
• The available recovery points;
• The integrity of existing backups; and
• The technical characteristics of the affected system.

A restoration may involve the recovery of an entire system or specific components, as technically appropriate.

17. No Guarantee of Individual Data Recovery

The existence of backups does not constitute a guarantee that any individual record, file, reservation, configuration or other specific item can be independently recovered.

Backup systems are designed primarily for operational recovery, resilience and continuity of the Platform, rather than as an individualized recovery service for deleted data.

Bike Booking Engine does not guarantee the complete recovery of all information under all circumstances.

18. General Retention Principle

Bike Booking Engine retains information for as long as reasonably necessary to provide the Services, maintain the operation of the Platform, comply with its contractual and legal obligations, and fulfill other legitimate purposes related to the provision of the Services.

Retention periods may vary depending on:

• The nature of the information;
• The purpose for which it is processed;
• The contractual relationship with the Customer;
• Operational requirements;
• Applicable legal obligations; and
• The existence of incidents, claims, disputes or proceedings that justify additional retention.

Information shall not be retained indefinitely once the purpose justifying its retention has ceased to exist, unless there is a legal obligation or other lawful basis requiring or permitting its retention for an additional period.

19. Data During an Active Subscription

While the Customer's subscription remains active, Bike Booking Engine will retain the data necessary to provide the contracted functionalities and maintain the operation of the Platform.

The deletion of certain data during an active subscription may depend on:

• The functionalities available;
• Actions taken by the Customer;
• The technical requirements of the Platform;
• Applicable retention periods; and
• Relevant legal or contractual obligations.

The existence of an active subscription does not necessarily mean that all historically generated information must be retained indefinitely.

20. Termination or Cancellation of the Subscription

When a subscription is cancelled or terminated for any reason, Customer Data will not be deleted immediately.

As a general rule, Bike Booking Engine will retain Customer Data for a period of 90 days from the effective date of termination of the Service.

This period is intended to allow, where applicable:

• Potential account reactivation;
• Recovery of information;
• Data export;
• Resolution of outstanding incidents; and
• Management of other obligations arising from the contractual relationship.

During this period, access to the Platform may be restricted or disabled depending on the status of the account and the terms applicable to termination.

21. Data Export Following Termination

During the post-termination retention period, the Customer may request, where applicable and technically feasible, the export of its data in accordance with the functionalities and procedures available through Bike Booking Engine.

The Customer shall be responsible for requesting and retaining any information required for its own legal, tax, accounting, operational or commercial obligations.

Termination of the contractual relationship does not make Bike Booking Engine a permanent archiving or document custody service for the Customer.

22. Deletion After the 90-Day Period

Once the general 90-day period has expired, Bike Booking Engine will proceed to delete Customer Data from active systems in accordance with its deletion procedures.

Deletion may be carried out through automated processes or internal procedures designed to remove the information from the systems used for the ordinary operation of the Platform.

Once such deletion has been completed, Bike Booking Engine does not guarantee that the data can be recovered.

23. Exceptions to Deletion

Certain information may be retained for a longer period where necessary or permitted in order to:

• Comply with a legal obligation;
• Respond to requests from competent authorities;
• Manage tax, accounting or administrative obligations;
• Manage claims or disputes;
• Establish, exercise or defend legal claims;
• Investigate fraud, abuse or security incidents; or
• Comply with other legitimate obligations arising from the contractual relationship.

Where reasonably possible, information retained for these purposes shall be limited to that which is necessary for the purpose justifying its retention.

24. Deleted Data and Backups

Deletion of Customer Data from active systems does not result in its immediate deletion from all existing backups.

Data may temporarily remain within:

• Daily backups, for the corresponding retention cycle; and
• Weekly backups, for the corresponding retention cycle.

Such data will progressively disappear as the backups containing it reach the end of their respective retention periods and are deleted in accordance with the ordinary rotation process.

Bike Booking Engine will not use backups as a mechanism to deliberately retain data that has been deleted from active systems.

25. Restorations Containing Previously Deleted Data

Where it becomes necessary to restore a backup containing information that had previously been deleted from active systems, Bike Booking Engine may apply such technical procedures as are reasonably necessary to prevent the restoration from resulting in the permanent and unjustified reactivation of deleted data.

The technical restoration of a backup shall not, in itself, alter the retention periods applicable to such information.

26. Early Deletion Requests

Where applicable, the Customer may request the deletion of certain data before the end of the general retention period.

Bike Booking Engine will assess and execute such requests in accordance with:

• Available technical functionality;
• Contractual obligations;
• The Customer's lawful instructions;
• Applicable law; and
• Any applicable retention obligations.

Early deletion from active systems does not necessarily result in the immediate deletion of data contained within backups that remain subject to their ordinary rotation cycles.

27. Customer Responsibility for Data Retention

The Customer shall be responsible for determining what information it needs to retain in order to comply with its own legal, tax, accounting, administrative or business obligations.

Before the applicable retention period expires, the Customer shall obtain or export any information it needs to retain outside the Platform.

Bike Booking Engine shall not be responsible for retaining information indefinitely once the retention periods established in this Policy have expired, except where a legal or contractual obligation requires otherwise.

28. Application of Specific Retention Periods

Without prejudice to the general retention period applicable to Customer Data, certain categories of information may be subject to specific retention periods based on:

• The nature of the data;
• The purpose of the processing;
• The Platform functionality through which the data was obtained;
• The Customer's lawful instructions;
• Applicable legal obligations; and
• The need to protect the legitimate rights and interests of the parties.

Where a specific retention period applies to a particular category of information, such period shall prevail over the general retention period with respect to that information.

29. End-User Identification Documentation

Where the Customer enables the relevant functionality, end users may upload a copy of their identity document, passport or other accepted identification document through the online check-in process.

This functionality is intended to enable the Customer to identify and verify the end user, as well as to facilitate the preparation and efficient delivery of the goods or services covered by the booking.

Bike Booking Engine shall process such documentation on behalf of the Customer and exclusively in connection with the provision of this functionality, without prejudice to the Customer's responsibilities as Data Controller.

30. Retention of Identification Documentation

Identification documentation uploaded during the online check-in process shall be retained only for the period necessary to manage the relevant booking.

As a general rule, such documentation shall be automatically deleted from active systems within 72 hours following the completion of the booking.

This specific retention period shall prevail over the general retention period applicable to other data relating to the booking or the Customer's account.

Deletion of the identification document does not necessarily result in the deletion of other booking data that may be subject to different retention periods.

31. Exceptional Retention of Identification Documentation

Exceptionally, identification documentation may be retained for an additional period where there is an incident, claim, dispute, judicial or administrative proceeding, legal obligation or other circumstance that legitimately justifies such retention.

Where Bike Booking Engine acts as a Data Processor, any additional retention shall be carried out in accordance with the Customer's lawful instructions, unless applicable law directly requires Bike Booking Engine to retain certain information.

The documentation shall be retained only for as long as reasonably necessary to address the circumstance justifying the additional retention and shall be deleted once it is no longer necessary, unless otherwise required by law.

32. Identification Documentation Contained in Backups

The automatic deletion of identification documentation from active systems does not necessarily result in its immediate deletion from existing backups.

Where such documentation is contained within a backup, it may remain temporarily within that backup until the backup reaches the end of its ordinary retention cycle.

During such period, identification documentation contained in backups:

• Shall not be available for the ordinary use of the Platform;
• Shall not be used as a mechanism to deliberately extend its retention;
• Shall remain subject to the security measures applicable to backups; and
• Shall progressively disappear as the corresponding backups are rotated.

33. Booking Data

Data associated with bookings may be retained for periods different from those applicable to identification documentation.

Such data may include, among other things:

• Booking information;
• End-customer data;
• Products or services booked;
• Dates and duration;
• Amounts;
• Booking status;
• Operational information; and
• Other information necessary for the management of the Service.

Retention of such data may be necessary to enable the Customer to manage its business operations, maintain operational records, comply with legal or contractual obligations, and use the Platform's statistical or administrative functionalities.

The deletion of identification documentation as provided in the preceding sections does not result in the automatic deletion of the booking or its remaining data.

34. Technical and Security Logs

Technical, access, security and audit logs may be subject to specific retention periods according to their purpose.

Such logs may be retained for as long as reasonably necessary to:

• Ensure the security of the Platform;
• Investigate incidents;
• Detect anomalous activity;
• Prevent fraud or abuse;
• Provide traceability;
• Resolve technical issues; and
• Comply with legal obligations.

Specific retention periods may vary depending on the nature and purpose of each log.

35. Data Subject to Legal Retention Obligations

Certain information may be subject to retention periods established by applicable law.

Where a legal retention obligation applies, such information may be retained for the required period even where the contractual relationship has ended or the original operational purpose no longer exists.

Where reasonably possible, access to information retained exclusively to comply with a legal obligation shall be limited to the purposes justifying such retention.

36. Retention Minimization

Bike Booking Engine seeks to apply the principle of minimization also to the period for which information is retained.

Where different categories of data associated with the same operation are subject to different retention requirements, different retention periods may be applied to each category.

Accordingly, deletion of a particular category of information shall not necessarily require the simultaneous deletion of all data associated with the same account, user, booking or transaction.

37. Deletion of Information

Bike Booking Engine maintains procedures designed to delete information once the applicable retention period has expired or where another circumstance justifies its deletion.

Deletion may be carried out through:

• Automated processes;
• Platform mechanisms;
• Internal procedures; or
• Mechanisms provided by the infrastructure providers used by Bike Booking Engine.

The applicable method may vary depending on the nature of the information, the system in which it is stored and the technical characteristics of the infrastructure used.

38. Deletion from Active Systems

Where certain information is required to be deleted, Bike Booking Engine will remove it from active systems in accordance with the applicable procedures.

Once the deletion process has been completed, such information will no longer be available for the ordinary use of the Platform.

Deletion from active systems does not necessarily result in the simultaneous deletion of all backups that may contain such information.

39. Automated Deletion

Certain categories of information may be subject to automated deletion processes based on predefined retention periods.

Where a specific retention period applies to a particular functionality, Bike Booking Engine may use automated mechanisms to perform deletion once that period has expired.

In particular, identification documentation uploaded through the online check-in functionality shall be subject to the automated deletion process established in this Policy.

40. Deletion of Backups

Backups are deleted in accordance with their ordinary rotation cycles.

As a general rule:

• Daily backups cease to be retained once their 30-day retention period has expired; and
• Weekly backups cease to be retained once their 6-month retention period has expired.

Deletion of information from active systems does not require the individual modification of every existing backup that may contain such information.

Instead, such information will progressively disappear as the relevant backups reach the end of their respective retention periods.

41. No Ordinary Use of Deleted Data

Once certain information has been deleted from active systems, Bike Booking Engine will not use backups as an ordinary mechanism to make such information available again to the Customer or users.

Backups are intended for recovery and resilience purposes and do not constitute an alternative archive of deleted information.

The foregoing is without prejudice to technical restorations that may be necessary in the event of an incident.

42. Restoration of Backups Containing Deleted Data

Where a backup must be restored for technical reasons, it may contain information that had previously been deleted from active systems.

In such circumstances, Bike Booking Engine will seek to apply reasonable measures to preserve the previously applicable retention periods and deletion decisions.

The restoration of a backup shall not be interpreted as starting a new retention period for information that was already required to be deleted.

43. Temporary Suspension of Deletion

Bike Booking Engine may temporarily suspend the deletion of certain information where there is a legitimate reason justifying its continued retention.

Such circumstances may include:

• A legal obligation;
• A request from a competent authority;
• A claim or dispute;
• Judicial or administrative proceedings;
• An investigation relating to fraud or abuse;
• A security incident; or
• The need to establish, exercise or defend legal claims.

Where reasonably possible, such suspension shall be limited to the information necessary and to the period during which the circumstance justifying the retention continues to exist.

44. Customer Instructions

Where Bike Booking Engine acts as a Data Processor, it may carry out the Customer's lawful requests relating to the retention or deletion of Personal Data in accordance with the Data Processing Agreement (DPA) and applicable law.

Customer instructions may not require Bike Booking Engine to take actions that are:

• Contrary to applicable law;
• Technically impossible;
• Incompatible with legal obligations directly applicable to Bike Booking Engine; or
• Likely to unjustifiably compromise the security or integrity of the Platform.

Where a request cannot be carried out as requested, Bike Booking Engine may inform the Customer of the applicable limitations.

45. Anonymized Data

Where certain data has been transformed in such a way that it no longer permits the identification of a natural person on an irreversible basis in accordance with applicable law, such data may no longer be subject to the retention periods applicable to the original Personal Data.

Bike Booking Engine may retain and use properly anonymized information for legitimate purposes such as:

• Statistical analysis;
• Improvement of the Services;
• Performance analysis;
• Capacity planning; and
• Development and evolution of the Platform.

Mere pseudonymization of data shall not, by itself, be considered irreversible anonymization.

46. Technical Limitations of Deletion

Due to the nature of distributed systems, backups, technical logs and infrastructure processes, deletion of information may require a reasonable period of time to be completed across all affected systems.

Where data has been marked or processed for deletion, its temporary presence in auxiliary systems or backups shall not mean that it remains available for ordinary use.

Bike Booking Engine will seek to ensure that deletion processes are carried out in accordance with the retention periods and procedures established in this Policy.

47. Evolution of Deletion Procedures

Bike Booking Engine may modify the procedures, technologies and mechanisms used to delete information as the Platform and its infrastructure evolve.

Such changes may be made, among other reasons, to improve:

• Security;
• Efficiency;
• Automation;
• Reliability;
• Scalability; or
• Regulatory compliance.

Changes to the technology used to perform deletion shall not, by themselves, alter the retention periods established in this Policy.

48. Bike Booking Engine's Responsibility

Bike Booking Engine shall be responsible for implementing the backup, retention and deletion mechanisms described in this Policy with respect to the systems and components under its control.

Bike Booking Engine will seek to maintain reasonable procedures designed to:

• Perform the established backups;
• Apply the defined retention cycles;
• Conduct the relevant restoration tests;
• Carry out the applicable deletion processes; and
• Protect information throughout its retention period.

The foregoing obligations shall be interpreted taking into account the technical limitations and other conditions set out in this Policy.

49. Customer Responsibility

The Customer is responsible for determining what information it needs to retain in order to comply with its own legal, tax, accounting, administrative, contractual or business obligations.

In particular, the Customer is responsible for:

• Properly using the available export functionalities;
• Obtaining copies of any information it needs to retain outside the Platform;
• Appropriately managing the deletion of information through functionalities under its control;
• Establishing its own internal retention criteria where appropriate; and
• Providing Bike Booking Engine with lawful instructions where Bike Booking Engine acts as a Data Processor.

Bike Booking Engine's backup mechanisms do not replace the Customer's own retention or archiving obligations.

50. Responsibility for End-User Data

Where the Customer uses the Platform to collect or manage Personal Data relating to its customers, users, employees or other natural persons, the Customer shall be responsible for determining the lawfulness, necessity and purpose of such processing in its capacity as Data Controller, where applicable.

This includes, in particular, the Customer's decision to enable functionalities allowing identification documentation to be collected during the online check-in process.

Bike Booking Engine shall process such data on behalf of the Customer in accordance with the Data Processing Agreement (DPA) and the lawful instructions received.

51. Infrastructure and External Service Providers

Bike Booking Engine may use specialized providers to deliver infrastructure, storage, backup or other technological services necessary for the operation of the Platform.

Certain retention, rotation or deletion processes may technically depend on the mechanisms provided by such providers.

Bike Booking Engine may replace or modify the providers it uses without requiring an amendment to this Policy, provided that the general principles of retention, protection and deletion described herein remain substantially unchanged.

Where such providers process Personal Data on behalf of Bike Booking Engine, their involvement shall be subject to the applicable data protection requirements.

52. Changes to Retention Periods

Bike Booking Engine may review the retention periods established in this Policy where necessary as a result of:

• Technical changes;
• Modifications to the Services;
• Infrastructure changes;
• Evolving risks;
• Operational requirements;
• Legal or regulatory obligations; or
• Improvements in security and data protection practices.

Where a change materially affects the retention periods communicated to Customers, Bike Booking Engine will seek to reflect such change in an updated version of this Policy.

53. No Absolute Guarantee

Bike Booking Engine implements reasonable measures designed to reduce the risk of data loss and facilitate system recovery.

However, no backup or recovery mechanism can guarantee the complete recovery of all information under every circumstance.

Accordingly, this Policy shall not be interpreted as a guarantee of:

• The absolute absence of data loss;
• Recovery of any individual item;
• Immediate recovery;
• Permanent availability of any restoration point; or
• Retention of information beyond the applicable retention periods.

Specific commitments regarding Service availability shall be governed by the Service Level Agreement (SLA) where applicable.

54. Review of this Policy

Bike Booking Engine may periodically review this Backup & Retention Policy to reflect changes in:

• The Platform;
• The Services;
• Infrastructure;
• Backup and recovery practices;
• Retention periods;
• Applicable law; or
• Security and operational requirements.

Changes to internal technical procedures or implementations shall not necessarily require an amendment to this Policy where its principles and retention periods remain substantially unchanged.

55. Contractual Precedence

This Policy describes the general backup, retention and deletion framework applied by Bike Booking Engine.

In the event of any conflict between this Policy and a specific written agreement entered into between Bike Booking Engine and a Customer, the specific agreement shall prevail with respect to the matters expressly governed by it, without prejudice to any obligations arising under applicable law.

Where Personal Data is processed by Bike Booking Engine on behalf of the Customer, the provisions of the Data Processing Agreement (DPA) shall also apply.

56. Contact

Questions relating to this Policy may be submitted to:

57. Effective Date

This Backup & Retention Policy shall take effect on the date indicated as its Last Updated date.

The version in force shall be the version published or otherwise made available by Bike Booking Engine from time to time.

58. Version and Last Updated

Version: 2.0

Last Updated: 09/08/2026