WhaleRoad Privacy Policy

Last Updated: February 1, 2026

Guangzhou Jingtu Technology Co. Ltd. (hereinafter referred to as "we", "us", or "WhaleRoad") values your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable laws. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our WhaleRoad electronic shifting control application (hereinafter referred to as "the App").

Important Notice: Please read this Privacy Policy carefully before using the App. By using the App, you acknowledge that you have read and understood the terms of this Privacy Policy. If you do not agree with any part of this policy, please discontinue the use of the App immediately.

1. Information We Collect and Legal Basis

We collect and process your personal data based on the following legal grounds:

1.1 Information You Provide to Us

Account Information: When you register, we collect your email address, username, and password.
Legal Basis: Performance of Contract (Art. 6(1)(b) GDPR) to provide you with the service.

1.2 Information Collected Automatically

Device Information: We collect device model, OS version, unique identifiers (e.g., SN, Android ID, IMEI, MAC address), and Bluetooth version.
Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR) to ensure compatibility and functionality of the electronic shifting system.
Riding Data: We collect shifting records, mileage, speed, cadence, and power data when you use the electronic shifting features.
Legal Basis: Performance of Contract (Art. 6(1)(b) GDPR) to provide core app functionalities.
Location Data: With your explicit consent, we collect location data to record riding tracks and provide location-based services.
Legal Basis: Consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time.
Log Information: We collect usage logs, IP addresses, access times, and crash reports.
Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR) to maintain security and improve app stability.

1.3 Background Collection

We do not collect personal data in the background silently. All data collection occurs only when you actively use relevant features.

2. Permissions and Cookies

2.1 Cookies

We use cookies to ensure the App functions correctly. Cookies are small data files stored on your device. We do not use cookies for purposes other than those stated in this policy. You can manage or delete cookies according to your preferences, but this may affect your experience.

2.2 App Permissions

Location Permission: Requested only when you use "Ride Tracking". Collected only in the foreground (every 5 seconds) to map your route. We do not track location in the background.
Bluetooth Permission: Requested to scan and connect to WhaleRoad electronic shifting devices. Invoked only upon user action.
Storage Permission: Used to store riding data, settings, and cache.
Network Permission: Used to communicate with our servers for updates and data synchronization.

3. Third-Party Services

We may use third-party services to support our App. We ensure these third parties comply with GDPR requirements.

Cloud Infrastructure

Amazon Web Services (AWS)

Purpose: Data hosting and storage.
Region:European Union (AWS – EU Region, including France)
Privacy: AWS Privacy Notice

4. Data Storage and Cross-Border Transfer

4.1 Storage Location

For users in the European Economic Area (EEA), your personal data is stored on servers located in European Union (AWS – EU Region, including France).

4.2 International Transfers

WhaleRoad is headquartered in China. To provide our services, limited access to personal data may occur from outside the EEA solely for technical support, system maintenance, and security purposes, and only where strictly necessary.

When we transfer your personal data outside the EEA to countries not deemed to provide an adequate level of protection (such as China), we rely on appropriate safeguards, including:

Standard Contractual Clauses (SCCs): We rely on appropriate safeguards for international data transfers, which may include the European Commission’s Standard Contractual Clauses (SCCs), in accordance with Article 46 of the GDPR, where applicable.
Derogations: In some cases, we may rely on derogations for specific situations (e.g., performance of a contract).

5. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

Right of Access: You have the right to request a copy of the personal data we hold about you.
Right to Rectification: You can request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can request deletion of your data under certain conditions.
Right to Restriction of Processing: You can ask us to limit how we use your data.
Right to Data Portability: You can request to receive your data in a structured, commonly used format.
Right to Object: You can object to the processing of your data based on legitimate interests.
Right to Withdraw Consent: Where processing is based on consent (e.g., Location), you can withdraw it at any time.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by law. When data is no longer needed, we will delete or anonymize it securely.

7. Children's Privacy

Our services are not directed to children under 16. If you are under 16, you must obtain parental consent before using the App. If we discover that we have collected data from a child without verification of parental consent, we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes via the App (e.g., push notifications or pop-ups). Continued use of the App after such changes constitutes acknowledgement of the updated policy.

9. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Company: Guangzhou Jingtu Technology Co. Ltd.

Address: Huangpu District, Guangzhou, China

Email: contact@mywhaleroad.com

Privacy Contact Point: You may contact our privacy team regarding data protection matters via the email address above.

Note: In accordance with Article 27 of the GDPR, we have not yet appointed a designated EU Representative. During this transitional period, Guangzhou Jingtu Technology Co. Ltd. acts as the primary contact point for EU data subjects and supervisory authorities via the contact details provided above.

You also have the right to lodge a complaint with a supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.