This privacy policy describes the data processing currently carried out on nbnl.de (front end, associated APIs and functional modules such as the catalogue, game, Tour Buddy, advisor, blog, travel, accident reports, Best Routes, “Hot or Not”, Garage as well as the community with its community stream and public member profiles).
This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The servers are located in Germany. A data processing agreement is in place with IONOS.
When the website is accessed, technically necessary data are processed (in particular IP address, time of access, URL requested, HTTP status code, volume of data transferred, user agent, referrer) in order to ensure secure and stable operation and to be able to fend off attacks. IP-related server logs are deleted or anonymised after 14 days at the latest.
For registration and login we process in particular the biker name, e-mail address and password. Passwords are stored hashed on the server. On successful login a session cookie is set.
Instead of a preset avatar, Premium users can upload a photo of their own as a profile picture. The image is cropped square to 400×400 pixels on the server, converted to WebP and stored in object storage (MinIO/S3-compatible). The image delivered contains no EXIF metadata.
If you use the questionnaire (Tour Buddy), the advisor or the card game, the content and results you enter are processed in order to provide the feature technically (e.g. match results, recommendations, game evaluation).
Users can optionally store up to three emergency contacts (name, telephone number, e-mail address, relationship). These data relate to third parties and are stored and processed exclusively at the user’s instigation.
Before you enter a person as an emergency contact, please obtain their consent and inform them about the storage. If, at your instigation, an emergency notification is sent to a contact, we point out to the recipient in the notification e-mail that they have been stored as an emergency contact, by whom, and about the right of access, objection and erasure vis-à-vis datenschutz@nbnl.de (Art. 14 GDPR).
In the community feature “Hot or Not”, logged-in users can upload photos of their own motorcycles. On upload, the image file and supplementary details (model assignment or free text, category and the confirmations given regarding the terms of use) are processed and stored under your account ID. Before being stored, the image is converted to WebP on the server, technically optimised and given an NBNL watermark.
You can delete your own uploads at any time via “My uploads”. In addition, the terms for image uploads.
In the Best Routes area, logged-in users can submit routes of their own — either as an uploaded GPS file (GPX/KML/GeoJSON), as a recording from the nbnl riding mode or as a route they created themselves in the route planner. The following are processed in particular:
Depending on their level of detail and where they were recorded, GPS tracks may allow conclusions to be drawn about where a person has been. Submit only routes whose publication you deliberately want. Published tracks can be viewed, downloaded and exported into other applications by other users. In addition, the terms for track uploads.
The “Live View” feature is a purely voluntary, optional feature and has to be activated by the user. Once switched on, your own live location can be shared either with selected friends, a tour group (via a joining code) or through a time-limited public share link. What is transmitted in the process is in particular geo-coordinates, time stamps and optionally speed and direction. The location is recorded only while the feature is active; once it is stopped or the share token expires, live positions are deleted. Server logs relating to Live View are deleted or anonymised after a maximum of 24 hours.
In riding mode, the user can voluntarily record their own ride as a GPS track. The recording runs only if the user actively starts it. Geo-coordinates, time stamps, speed values and where applicable elevation values are captured, as well as calculated ride statistics (distance, duration, average).
Note: GPS recordings may allow conclusions to be drawn about where a person has been — particularly if they start or end at a home or workplace. Record only what you deliberately want to store or share.
In the personal Garage, logged-in users can manage their motorcycles and the associated data. The content is by default visible only to the respective user; selected bikes can optionally be marked as public or “for sale”.
Vehicle registration document scan: You can upload a photo of your vehicle registration certificate part I in order to fill the vehicle fields automatically. For this purpose the image is transmitted to our AI provider OpenAI in the USA (see section 11a); it is not stored permanently with us unless you expressly file it as a document in the record. Keeper data (name and address, fields C.1.1–C.1.3 and C.4c) are filtered out of the result and not stored. The uploaded image itself, however, is transmitted in full — cover the keeper block before taking the photo if you want to avoid this. The values read out are shown to you for confirmation before they are adopted.
Model-related evaluation: From the scan we additionally take the purely model-related details (e.g. key numbers, displacement, power, weights, tyre sizes) into our model catalogue, in order to improve the vehicle data for users of the same model. The vehicle identification number, registration number, date of first registration and keeper data do not feed into this. You can object to this evaluation at any time at datenschutz@nbnl.de widersprechen.
Manual search: If you use the search for manuals and maintenance details, we store the sources found with the respective motorcycle so that the same search does not have to be repeated. These entries are not shown to you and are not delivered to other users; they are deleted with the motorcycle or the account.
Data are recorded exclusively at the user’s instigation. Sensitive identifiers such as the registration number or the chassis number are stored only if they are actively entered. If a bike is made public or marked “for sale”, the registration number, insurance/contact details and other private notes are not displayed in the public view; only model master data, description, images and, where applicable, the sale price are published. You can edit or delete individual entries at any time.
In the Wallet, signed-in users can store copies of personal documents so they have them to hand while travelling. The contents are meant for that user alone: they are never shared, never published and at no point shown to other users.
Health-related documents: A health insurance card, travel health cover or an emergency card may contain information that counts as health data (Art. 9(1) GDPR) — such as your insurer, blood group or allergies. You store such documents voluntarily and on your own initiative; we do not request them, do not evaluate them and draw no conclusions from them. The legal basis is your explicit consent under Art. 9(2)(a) GDPR, given when you store the document and revocable at any time with future effect by deleting it. The wallet works fully without these documents.
Details about other people: An emergency card usually names another person with their name and phone number. Only store such details if that person agrees. We use them solely to display them in your own wallet, match them against nothing and contact no one.
Lawfulness of the copy: Section 20(2) of the German Identity Card Act (PAuswG) expressly permits holders to make and use a copy of their own identity card. We do not request a copy of your ID, we do not verify identity with it, and we do not analyse the images.
Delivery: The files are held in a non-public storage area. A direct request without a signed-in session is refused; they are delivered solely through your own session and without intermediate caching.
Offline copy: At your explicit request, your browser stores copies of the documents on the device so they remain readable without a network connection. These copies are unencrypted on your device — this also applies to health-related documents and to details about other people. They are removed automatically when you sign out and can be deleted at any time via “Delete from device”. On a device you share with others, you should not enable the offline store.
Display lock: The Wallet locks itself after five minutes without activity. This locks the display in the interface; it is not a substitute for encrypting your files.
Wallet PIN (optional): You can additionally protect the Wallet with a four-digit PIN. The PIN is not stored in plain text but solely as a salted verification value (scrypt) combined with a server-side secret; we do not view, recover or disclose it. Once a PIN is set, the server only delivers your documents after it has been entered; after five consecutive wrong entries the Wallet is locked for 15 minutes. If you forget the PIN, we send, at your request, a single-use link valid for one hour to your account's email address, with which you set a new PIN in your signed-in session. We notify you by email whenever the PIN is set, changed or removed. Stored are the verification value, the number of failed attempts, any lock timestamp and, for reset links, their verification value, expiry and the requesting IP address; reset entries are no longer used after expiry.
You can delete each document individually. Deleting your account removes all entries and the associated files.
In the Community (/gemeinschaft) we operate a community stream in which logged-in members can publish their own posts and see the posts of others. What is processed in the process is in particular the post text (free text of up to 5,000 characters), up to four images, hashtags, an optional route reference, a repost (“share”) and, for travel posts, an embedded video link. Every post is assigned to your account ID and displayed with your displayed name and profile picture.
Alongside deliberately written posts, the stream can also show automatic activity notices (e.g. “has added a bike”, “has shared a route”, “has completed a tour”, “has passed the licence test”, “has received a badge”). These personal activity notices appear only if you have expressly activated the stream (feed_opt_in). Without this consent, the display of automatic activities is deactivated by default (data protection by default, Art. 25 GDPR).
To protect against spam and circumvention of contact channels, post texts are automatically pre-checked; links, domains, e-mail addresses, HTML code and social media handles are blocked in the process. Posts can be edited at any time (marked “edited”) or deleted. In addition, the community rules as well as the terms of use.
Members can enable a public profile that is reachable at its own address (/profil/…). The profile is not public automatically — it becomes visible only once you actively make it public (profil_public). Depending on your settings, the following details may be displayed:
You control visibility in a granular way: each block (location, bike, statistics, bio, characteristics, friends, groups, activity, gallery) can be shown or hidden individually; the Garage release can be switched separately (garage_public). Visitors who are not logged in see — even where the profile is public — only a reduced basic view (masked name, profile picture, member since); bio, location, bike, statistics, gallery and contacts remain hidden from them. You change your settings under “My profile”; APIs: /api/user/profile, /api/user/share-settings, /api/user/profile/image, /api/user/profile/cover.
Within the community, members can interact with one another. What is processed in the process is:
For weather and surroundings details in the community area you can voluntarily store a place name (weather_label) — either manually or through a one-off reverse geocoding call after location permission has been granted. For converting coordinates into a place name and for the associated weekend tour suggestion, we transmit the place name or the coordinates to the external service Open-Meteo (Open-Meteo, Switzerland). The place name can be changed or deleted at any time. A weekend tour suggestion generated from it is delivered exclusively privately to you.
Since user-generated content is publicly disseminated via the community, we provide a notice procedure in accordance with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act, DSA). Using the “Report” function, logged-in members can flag posts, comments and activities they consider unlawful or in breach of the rules (reasons include hate speech, unauthorised advertising, harassment, spam, illegal content). What is stored in the process is the account ID of the reporting person, the element reported, the reason given and an optional note (table content_reports).
We examine incoming notices carefully, promptly and without arbitrary discrimination. The reporting person receives an acknowledgement of receipt and is informed of the outcome of the examination (Art. 16(5) DSA). If we decide on a measure (e.g. removal of a post or a block), the members concerned receive a statement of reasons (Art. 17 DSA). If we become aware of content indicating a serious criminal offence against the life or safety of persons, we inform the competent authorities (Art. 18 DSA). Further details are set out in the community rules. You will find the DSA point of contact in the legal notice.
You can share saved routes with individual members, with all your friends or with one of your groups, publish them in the community stream or pass them on via a link. We store the route, your account ID, the target of the share (member, circle of friends or group) and the time. Recipients see the route name, its course and your display name according to the rules in section 5g. You can revoke shares and links at any time in the share window.
Sharing by e-mail: the route planner opens your own e-mail program with a prepared text and the share link. You send the message yourself from your mailbox; NBNL sends nothing and receives no recipient address.
You can create a tour checklist for a tour. For this we process the route, the motorcycle chosen from your garage (including model name, drive type, tyre pressure), a departure date you set, and the items and their status. For weather notes we request a forecast for points along the route from Open-Meteo on the server side (section 7); your browser does not contact Open-Meteo and no account data is transmitted.
Multi-day tours: You can group several of your saved routes into a private multi-day tour. For this we store a tour name you choose, optionally a description and a start date, and the order of the assigned routes of your own; the routes themselves are neither copied nor changed. A multi-day tour is visible only to you and is not shared with others. If you create a checklist for it, we request the weather per stage and travel day on the server side as described above. The multi-day tour and its checklist are deleted as soon as you remove it, at the latest with your account; your individual routes remain unaffected.
Like any other personal list, the checklist of a multi-day tour can also be made readable via “Share link”. That read-only view shows only the list’s name and its items — neither your daily stages and their order, nor a planned start time, your routes or the multi-day tour itself. Those remain private and visible to you alone.
If a route is shared with specific people, the checklist is a shared matter: all participants see the shared items, who is responsible for an item and who ticked it off — and they see each other's personal packing lists for this ride, that is the text, category and status of the items including self-added ones, each with the display name under section 5g. Not visible are your notes on individual items, your other lists and your garage. Nobody but you can change your list. A shared item is not removed by one person alone: it stays visible to everyone, struck through, until all participants have struck it. If the share is withdrawn, access ends in both directions; your personal list stays with you. Via “share link” a personal list can additionally be made readable by link: whoever has the link sees the name, the items and the reasons (e.g. the model name of your motorcycle) until you stop sharing. Such link pages are excluded from search engines.
Community templates: if you share a checklist as a template, we store a copy containing only the text, category and section of the items — without route, date, motorcycle, reasons or status. Logged-in members see the template with your display name according to section 5g and can adopt or report it (section 5k). You can withdraw the template at any time; it is deleted together with the list or the account. For notes on passes, closures, tolls and unpaved sections we analyse the route on our own servers (own routing service and own traffic data from official sources); no account data is passed on to third parties.
When you ride a shared tour together, you can open a voice link to the other participants in riding mode. It is never on by default: you start it yourself with a button, and your browser asks for microphone access first. Without that permission no voice is transmitted.
Your voice is sent live to our own voice server (intercom.nbnl.de, same location as described in section 3) and distributed from there to the other participants of the same tour. The transmission is encrypted in transit. We do not record conversations, store no audio and do not analyse their content — the server merely forwards the voice packets and discards them immediately.
So that engine and wind noise are not transmitted continuously, your device examines the microphone signal and only passes it on when you are actually speaking. This check runs solely on your device; while it is closed, no sound leaves your phone. You can mute yourself or end the connection at any time. Meanwhile the other participants see your display name as described in section 5g and whether you are currently speaking.
To join, we issue a short-lived signed ticket containing the tour's invitation code, your account ID and your display name; it expires after ten minutes. Only someone who is a participant of the shared tour at that moment receives one. When the tour ends or you leave the connection, your session on the voice server is closed; nothing is retained.
Please remember that everyone on the tour can hear you while your microphone is open — including conversations around you that you did not intend for the group. Anyone riding with you who might be overheard should know about it.
For technical product analysis we record usage events (e.g. page views, model/article views, searches, video starts, game results). In doing so we process, among other things, the path, the time, an anonymous identifier, optionally model/article references and shortened technical metadata. The recording takes place only if you have consented to analytics cookies via the cookie banner.
If you are logged in to your NBNL account, we additionally store your account identifier (user_id) with the respective event. This makes the events attributable to your account. We evaluate this exclusively internally, in order to understand which features logged-in members actually use — there is no transfer to third parties, no profiling for advertising purposes and no automated decision-making. Without a login, the recording remains purely pseudonymous.
The legal basis is your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). You can withdraw your consent at any time via the cookie settings . When your account is deleted, the analytics events assigned to your account are deleted as well.
This website uses Matomo, an open source web analytics software which we host ourselves on our own server at matomo.nbnl.de . There is no transfer of the analytics data to third parties ; all data remain in Germany on our infrastructure.
Matomo is activated only after your express consent via the cookie banner. On withdrawal, the _pk_*cookies are removed and no further tracking takes place. Further information about Matomo: https://matomo.org/privacy/
On pages with map features (including the calendar, accident pages, route planner, navigator/riding mode, Best Routes, Live View, dealer and route maps) we use third-party map and geo services. Since August 2026, map tiles, fonts and symbols are loaded exclusively via our own server — your browser does not contact the tile providers in the process, and your IP address is not transmitted to them. Since August 2026 the same applies to the conversion of coordinates into place names and to queries of map objects: these too run via our server. To the services named we transmit the geo-coordinates queried, but not your IP address. With services expressly marked “directly from the browser”, your IP address is transmitted to the respective provider. The following are used in particular:
If you use location features (e.g. “Events near you”, navigator, riding mode, Live View), your location is processed only after your express browser/device permission. With providers established in the USA, a transfer to the USA may take place on the basis of the EU-US Data Privacy Framework or standard contractual clauses. Services connected exclusively via our server (including all map tiles, NASA GIBS, EUMETNET OPERA, DWD, official traffic data) receive no data from your device in the process. OpenStreetMap privacy: https://wiki.osmfoundation.org/wiki/Privacy_Policy
On the Travel, Catalogue and Community pages, videos from YouTube and Vimeo can be shown or embedded. Embedded videos are loaded only once you actively click the preview (two-click solution) — only then are data (including your IP address) transmitted to the respective provider. The preview images are fetched by our own server; your browser does not request them from the provider. When external content or social share links (e.g. WhatsApp, Facebook, Instagram) are started, the privacy provisions of the respective providers apply in addition. YouTube privacy: https://policies.google.com/privacy?hl=de
To find suitable videos (e.g. travel videos for a region or model videos in the catalogue) we additionally send search requests from our server to the YouTube Data API of Google LLC (USA). Only the search terms (e.g. region or model names) are transmitted in the process — no personal data of our users. A transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses.
Holders of a business account can have a provisional header image for their profile generated from a screenshot oftheir own website on file. For this we use the screenshot service thum.io (USA). The screenshot is created exclusively on the server and only at the express request of the respective account holder; only the address of the website to be depicted is transmitted to the provider — no personal data of our users and no IP addresses of visitors. A transfer to the USA takes place on the basis of standard contractual clauses or the EU-US Data Privacy Framework.
In event previews, no screenshots of third-party websites are used any longer; since August 2026 only our own, drawn graphics appear there.
In addition to cookies, we store some settings in the browser’s local storage, e.g. for UI views and feature states.
For transactional e-mails (password reset, change of e-mail address, emergency contact notifications as well as the community notifications described below) we use the service Brevo (Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France — formerly Sendinblue) as a processor. The recipient address and the e-mail content are transmitted to Brevo in order to carry out the dispatch technically. A data processing agreement is in place. Further information: https://www.brevo.com/de/datenschutz-und-sicherheit/
If you use the community, we send transactional notification e-mails on certain events to the verified account address concerned — never to non-members and never to the person who triggered the event:
These notifications are purely transactional (no marketing, no double opt-in) and are enabled by default. You can switch off each category individually and at any time in the account menu under “Account & privacy”. In the app you additionally receive notices about reactions, comments and shared posts (see section 5i); these do not leave the platform.
We send informational e-mails about news and features (marketing) only if you have expressly consented to this in the account settings (opt-in). The time of consent is logged. You can withdraw your consent at any time in the account settings or by e-mail to datenschutz@nbnl.de widerrufen.
Transactional e-mails additionally go in copy (BCC) to our internal mailbox info@nbnl.de, so that we can handle enquiries and document the dispatch. The copies are subject to the same deletion periods as the respective matter.
For paid Premium services we use the payment service provider Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). When you take out a paid subscription you are forwarded to the Stripe checkout page; you enter payment and invoicing data (e.g. card information, address data where applicable) directly with Stripe. From Stripe, NBNL receives exclusively the status information necessary to assign the subscription (e.g. customer/subscription IDs, payment status, term) — no complete card or account data.
A transfer of data to third countries may take place on the basis of the EU-US Data Privacy Framework or standard contractual clauses. Further information: https://stripe.com/de/privacy.
Dealers, route operators and other businesses can create a business account (the “NBNL Business” area). In doing so we process the data provided during registration and profile maintenance (in particular company name, business e-mail address, contact person, address/location, logo or profile images, submitted content such as events, POI suggestions and test-ride offers). Verification is carried out by an e-mail confirmation link sent to the business address on file.
Our operating team is notified internally about certain business events (e.g. registration, activation, login) via the service Discord (Discord Netherlands B.V., Amsterdam, Netherlands; parent company Discord Inc., USA). The company name and, where applicable, masked contact details may be transmitted in the process.
Test-ride and booking enquiries: If you make a test-ride or booking enquiry via NBNL, we forward the details required for this (name, e-mail address, telephone number, address where applicable, licence category and your message) to the dealer or provider you have selected, so that they can process the enquiry and contact you. The recipient processes the data on their own responsibility (Art. 6(1)(b) GDPR).
Paid business packages: If a business account books a paid package, payment runs via Stripe (see section 10a). We store with the account the Stripe customer and subscription identifier, the package status, the price variant booked as well as the start and end of the billing period — no complete card or account data. Invoice records remain with Stripe and are subject to the statutory retention periods.
In the “NBNL Business” area we publish a directory of motorcycle businesses in Germany, Austria and Switzerland. The entries do not predominantly come from the businesses themselves, but from publicly accessible sources: OpenStreetMap (via the Overpass API), the dealer searches of the manufacturers and importers and trade directories (in particular 1000PS). As soon as a business has taken over its entry via a business account, only its own details apply.
What is published is the name of the business, address, location coordinates, telephone number, website, brands carried and opening hours. We do not show e-mail addresses on file publicly — they serve exclusively as an invitation to take over the entry. Names of contact persons do not appear in the directory. These are company data; a personal reference exists only insofar as the business is derived from the name of a natural person (for instance in the case of sole traders).
Businesses concerned can object to the publication at any time and without giving reasons (Art. 21 GDPR) or request rectification (Art. 16 GDPR) — via the form on the respective dealer page or informally toinfo@nbnl.de. A removed entry is permanently blocked and is not reinstated even if the business continues to be listed in the original sources. Origin, purposes, recipients and rights in detail (collective information under Art. 14 GDPR) as well as the licence notice for OpenStreetMap (ODbL) can be found atnbnl.de/business/haendler/datenquellen.
Visibility counter: So that businesses can see whether their entry is being used, we count for each dealer page and day how often it was viewed and how often telephone, website or route links were clicked. What is stored is exclusively a numeric value per day, business and type of event — no IP address, no identifier, no session. Nothing is stored on your device for this and nothing is read from it (no cookie, no local storage), which is why no consent under § 25 TDDDG is required for it. Any inference about individual persons is ruled out; the daily rows are deleted after 400 days.
Data are transmitted to service providers and external platforms only insofar as this is necessary for the features provided (hosting, maps, video, social networks on an active click, e-mail dispatch via Brevo, payment processing via Stripe, AI services, object storage for uploaded images and documents). Web analytics with Matomo takes place on our own server in Germany; no transfer to third parties occurs in this context. There is no disclosure for other purposes.
NBNL uses AI-supported features (motorcycle advisor, Tour Buddy, route recommendations, NBNL MCP server, the specification and manual search in the Garage, tyre pressure notes, the automatic completion of technical data when adding a motorcycle, the vehicle registration document scan, the valuation in the Garage as well as automatically created mountain-pass descriptions in the route planner). In doing so, your input and relevant context data (e.g. the motorcycle model concerned, for the valuation the year of construction and mileage, for the registration document scan the uploaded image) are transmitted to the external AI provider used, in order to provide the respective feature:
Only content relevant to the feature is transmitted (your search queries, filter details, vehicle preferences, vehicle data of the motorcycle concerned and — only for the vehicle registration document scan and only at your instigation — the image you uploaded). No plain data such as passwords or payment information. Personal data are transmitted only insofar as you enter or upload them yourself.
Under Regulation (EU) 2024/1689 (EU AI Act), the AI systems used are classified as minimal or limited risk . AI-generated answers are identified as such and do not replace individual professional advice. The transfer to providers in the USA takes place on the basis of the EU-US Data Privacy Framework and standard contractual clauses (Art. 46 GDPR).
We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations exist. In detail, the following benchmarks apply:
You have the right at any time to access, rectification, erasure, restriction of processing and data portability. You can also object to the processing of your data insofar as it is based on Art. 6(1)(f) GDPR. Consent you have given can be withdrawn at any time with effect for the future.
Please address enquiries to datenschutz@nbnl.de. We generally deal with data protection enquiries within one month (Art. 12(3) GDPR).
If an identifiable person who has not consented to publication appears in an uploaded image, please also report this to datenschutz@nbnl.de or via the “Report image” function. We examine the matter and remove unlawful content without delay, at the latest within 30 days.
You also have the right to lodge a complaint with a supervisory authority (for Bavaria: the Bavarian State Office for Data Protection Supervision, BayLDA, Promenade 18, 91522 Ansbach).
This policy is adapted when features and processes change. Last updated: September 2026.
