Effective date: 12 september 2025

These Terms of Use for Data from Connected Devices and Services (“Terms of Use”) specifically govern the collection, processing, and use of data, other than personal data that can be traced back to an individual (hereinafter: “Data”), generated by your use of connected devices and related services.

By registering the connected devices and related services through one or more Digital Service(s) of Urban Arrow, you acknowledge that you have read and understood these Terms of Use and that you agree to them.

Which Data are covered by these Terms of Use?

The Data we collect from your product or related services and that are readily available, as defined by the EU Data Act. On the Urban Arrow website, more information is provided on matters such as:

• What type of Data they are (e.g., how often you ride, its location).

• How much Data we expect to collect.

• How often Data are collected.

• Where Data are stored.

• How long Data are retained.

• Where the Data can be accessed.

You can find a detailed list of all these Data and their characteristics on our website: www.urbanarrow.com/data-act-pon-bike. If, during our agreement, we start collecting new Data, we will update that list on this website.

How Pon.Bike uses and shares Data

How we use Data

Urban Arrow uses Data only for the purposes we have agreed with you. This includes:

• Managing our agreement with you: Creating reports for you, performing analyses, or otherwise described in the Digital Service.

• Providing support: Helping you with any issues, warranty claims, or questions about your product or service.

• Ensuring smooth operation of the services: Making sure your product or service functions correctly and safely and that quality remains high.

• Improving our products: Enhancing the performance of our existing products or services.

• Developing new products: Creating new products or services, including AI solutions. We may do this ourselves, with directly related Pon.Bike brands such as Kalkhoff and Gazelle, with trusted partners working for us, or through special collaborations.

• Combining Data: We may combine Data with other data, or create new data from them, for any lawful purpose. This may include sharing such combined or new datasets with others. But don’t worry — these combined datasets will never allow anyone to identify or trace back the specific data from your product.

• Tracking bicycles: Specifically for preventing or recovering stolen bicycles, with your explicit consent.

• Improving safety: Helping to improve mobility and road safety for everyone.

We will not use your Data to determine your financial situation, your assets, your habits, or the way you use the product in any way that could harm you.

Sharing Data with others

We may share Data with other companies (third parties) as long as they use the Data only for purposes that align with the objectives of the EU Data Act and other relevant laws. This includes, but is not limited to:

• Improving and developing their own products and services: For example, analyzing data to make their operations more efficient or to create new features.

• Conducting research and analysis: Carrying out anonymous data analysis to identify trends, understand market behavior, or for scientific studies.

• Assisting with operational matters: Supporting their daily business activities, such as logistics or resource management.

• Meeting legal requirements: Sharing Data when legally required to do so by authorities.

• Collaborating with partners: Sharing Data for joint projects aimed at mutual growth and innovation, provided this falls within agreed purposes and does not harm your or our interests.

We will always ensure that these third parties contractually agree to keep the Data confidential and to comply with all relevant data protection and data-sharing laws.

We may also use services such as cloud computing (where data are stored and managed online) to achieve the purposes mentioned above. These third parties may also use such services to achieve their agreed purposes.

How Urban Arrow uses and shares personal data

Any data that is personal data will be strictly used, shared with others, or processed by Urban Arrow in accordance with our Privacy Statement and always in compliance with the law.

How we protect your Data

Urban Arrow will take reasonable protective measures for your Data. We do this by taking into account the latest technology, the potential harm you could suffer if your data were lost or shared without authorization, and the cost of such protective measures.

You agree not to alter or remove any of these technical protective measures unless you have our prior written consent.

User access to Data upon request

Making your Data available

Urban Arrow will share your Data with you when you or someone authorized by you requests it. This Data will include all necessary background information (metadata) so that you can correctly understand and use it. You can easily submit this request by following the instructions on our website www.urbanarrow.com/data-act-pon-bike.

Sharing personal data

If the Data contain personal information and you are not the person the data relate to (the “data subject”), we can only share them if there is a valid legal basis under the GDPR (the main EU privacy law, Article 6). If sensitive personal data are involved, the additional requirements of Article 9 of the GDPR and Article 5(3) of the ePrivacy Directive must also be fulfilled.

When you request personal data and you are not the data subject, you must, with each request, inform us of your legal basis for wanting access to that data. This is very important for us to comply with privacy laws.

What your Data will look like and how you will receive them

We will provide the Data to you free of charge, and they will be of at least the same quality as we ourselves have. They will always be complete, organized, standardized, and in a machine-readable format, together with the necessary background information (metadata) to help you use them.

All details about the characteristics of the Data and how to access them can be found on our website: www.urbanarrow.com/data-act-pon-bike.

You will get access to the Data:

• Easily and securely, either by us sending the Data to you or giving you access to the location where they are stored.

• Without unnecessary delays once we ourselves have the Data (if applicable).

• Continuously and in real-time OR periodically (we specify if/where this applies on our website).

We will make sure to clearly explain how you can access the Data on the website. We will also provide you, at no extra cost, with all tools and information you need to easily access your Data.

All details of the Data, including the way Data are obtained, are set out at www.urbanarrow.com/data-act-pon-bike, and these details form part of this agreement.

What to do if something goes wrong (Feedback)

If you notice a problem with the Data, their quality, or the way you access them, please let us know with a detailed description. We will then work together to find out what happened. This helps us continuously improve our services.

When we may make changes

The most up-to-date information about your Data and how to access them will always be available on our website: www.urbanarrow.com/data-act-pon-bike. We will only notify you if there is a material change that could significantly impact how you obtain or use the Data. In such cases, we will inform you in advance via an email from Urban Arrow.

The only exception would be if immediate changes are required due to urgent reasons, such as a newly discovered security vulnerability. In that case, notification may take place afterwards.

How you may use and share Data

You are free to use the Data we provide to you for any lawful purpose and to share them freely, but please respect the few restrictions we explain below.

What you must not do with the Data

To keep things fair and safe, you agree not to:

• Create a competing product: Do not use our Data to build a product that directly competes with Urban Arrow's product, nor share the Data with anyone else intending to do so.

• Spy on our company: Do not use the Data to figure out our financial situation, assets, or how we manufacture our products.

• Force access or exploit weaknesses: Do not attempt to gain access to Data by force, or exploit technical weaknesses in our systems designed to protect the Data.

• Share with “gatekeepers”: Do not share the Data with a company considered a “gatekeeper” under EU law (specifically Article 3 of Regulation (EU) 2022/1925).

• Break the law: Do not use the Data for any purpose that violates EU law or relevant national laws.

Making Data available to another company (data recipient)

You may choose to share your data, along with the necessary background information (metadata), directly with another company (or “data recipient”) of your choice. For more information on how another company can access your data, visit: developer portal.

Important for personal data: If the Data you ask us to share contain personal information (meaning they can identify someone), and you are not the person the Data relate to, we can only share them if there is a valid legal basis under the GDPR (the main EU privacy law). When submitting such a request, you must clearly state your legal basis (such as “consent” or “legitimate interest”) for processing.

If your request involves sensitive personal data (such as health information), we will need to ask you for additional information to ensure compliance with all requirements under GDPR Article 9 and the ePrivacy Directive.

We will ensure that the Data we send to the data recipient are of at least the same quality as we ourselves have. They will always be in an organized, standard, and machine-readable format, and we will, where possible, transmit them easily and securely.

When you make such a request, we will then work with the data recipient to establish the terms for sharing the Data. These terms will be fair, reasonable, non-discriminatory, and transparent, as required by the Data Act.

Please note that you cannot use this option to send Data to a “gatekeeper” company (as defined by Article 3 of Regulation (EU) 2022/1925), nor can you request Data for testing new products, substances, or processes that are not yet available on the market.

When you transfer your product (or its use)

If you permanently transfer ownership of your product, or your right to use it, to someone else (for example, when you sell the product), this is called a “transfer of use.” In such cases, each new user must create their own account, register the bicycle via the app, and agree to these Terms of Use.

When transferring use, your product (the bicycle) must be removed from your account. To do this, log into the app and select the relevant bicycle. Under the “details” button, you will find the option to remove it.

When you delete your account

In addition to removing your product from your account, in which multiple bicycles may be registered, you can also delete your account itself. To do this, log in at http://consumer.acount.pon.bike/ with your account details. There you will find the option to delete your account and all your (personal) data

Conclusion

By continuing to use our products and services and keeping them registered in the app, you agree to these Terms of Use regarding your Data.

We are committed to ensuring that you have control over your Data and understand how they are used. If you have any questions about these Terms or anything else, please do not hesitate to contact our customer service.