Privacy policy

Version 2026-10 · Last updated: 20 October 2026

1. Data controller

2. What data we process

• Booking data: name, email, phone number, dates, size and number of bikes, whether you want a helmet, the amount, and the version of the terms you accept together with the date and time of acceptance.
• Payment data: payment is processed by Stripe. We neither see nor store your card number; we only receive confirmation that the payment was made.
• Anti-abuse technical data: an encrypted fingerprint (hash) of your IP address, used only to prevent people from blocking bikes with fake bookings. It is deleted when the booking is confirmed or expires.
• Communications: the messages you send us via WhatsApp, email or Instagram.

3. What we use it for and the legal basis

Purpose	Legal basis (GDPR)
Managing your booking, the payment, the rental contract and the return of your deposit	Performance of a contract (Art. 6(1)(b))
Sending you the confirmation and the information you need about your booking	Performance of a contract (Art. 6(1)(b))
Complying with tax and accounting obligations (invoices, records)	Legal obligation (Art. 6(1)(c))
Preventing abuse and fraud in online bookings	Legitimate interest (Art. 6(1)(f))
Answering your questions and complaints	Pre-contractual steps or contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f))

We do not make automated decisions that have legal effects on you and we do not build profiles.

4. How long we keep the data

We keep booking data for as long as the contractual relationship lasts and, afterwards, for the legal retention and limitation periods (for example tax and accounting obligations). After that we delete or anonymise it. The IP fingerprint is deleted when the booking is confirmed or expires.

5. Who else has access to your data

To provide the service we use providers that process data on our behalf (processors):

Provider	Purpose
Stripe	Processing the online payment
Supabase	Booking database (servers in the European Union)
Netlify	Website hosting and running the booking system
Resend	Sending confirmation emails
Meta (WhatsApp, Instagram)	Only if you contact us through those channels

We may also disclose data to public authorities where the law requires it. We do not sell your data.

6. International transfers

Some of these providers may process data outside the European Economic Area. If so, they do it with the safeguards required by the GDPR, such as the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to with your name and the right you want to exercise. If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Cookies and third-party services

These pages do not use tracking or analytics cookies. Payment takes place on Stripe’s secure page, which may use its own technical cookies. These pages also load fonts from Google Fonts: when you visit them, your browser connects to Google servers, which receive your IP address.

9. Security

The website uses an encrypted connection (HTTPS), access to the booking database is restricted and payments are handled by a specialised provider. No system is infallible, however; if we detect a breach that affects you, we will notify you as required by law.

10. Changes to this policy

If we change this policy, we will publish the new version here with its date.