Privacy Notice
Draft notice — pending review by a qualified data protection advisor.
This notice explains what personal data Alicante e-MTB & Trail Rentals ("we", operated by Artur) collects when you book a rental, and what we do with it.
Data Controller
Artur, trading as Alicante e-MTB & Trail Rentals, Alicante, Spain. Contact for any privacy question or request: privacy@alicante-emtb-rentals.example.
What We Collect
When you complete the digital rental contract: your full name, passport/national ID number, a photo of your passport/ID, email, phone number, country of residence, and a digital signature — plus your booking details (bikes, dates, delivery point) and payment/deposit amounts. Separately, our bikes carry GPS trackers used for fleet/asset protection — these track the equipment, not you personally.
Why We Collect It
Your name, contact details, ID information and signature are needed to form and perform the rental contract (Art. 6(1)(b) GDPR), verify your identity, and establish who is liable for the equipment during the rental, consistent with standard short-term equipment rental practice in Spain. Booking and payment details are kept as our business record of the transaction. GPS tracking of the bicycles themselves is a legitimate interest in preventing theft and enabling emergency assistance on trails, disclosed to you in the rental contract.
Where It Is Stored
Your signed contract, passport/ID details, ID photo, signature, and booking/payment details are stored in a private server-side database and file storage, accessible only to Artur through a password-protected admin login — it is not publicly browsable or indexed. Before you sign, your in-progress selection is held only in your own browser and automatically expires after 48 hours if you do not complete the contract. Once you confirm your booking, a summary (your name and the last 4 digits of your passport/ID number — not the full number) is also sent in a WhatsApp message to Artur, processed by WhatsApp/Meta under their own privacy policy. If you download the signed contract PDF yourself, that copy is on your own device and outside our control from that point.
Third Parties
WhatsApp/Meta (booking confirmation message), Swikly (security deposit hold), and Stripe/Revolut/Bizum (rental payment, where selected) each process data under their own privacy policies once you interact with their services.
Retention
Your in-progress (unsigned) booking data expires automatically from your browser after 48 hours. Once a contract is signed, the record (including your ID details, signature, and PDF) is kept in our database and file storage until Artur deletes it — from the admin dashboard, on your request, or as part of routine record cleanup. We do not control retention of the WhatsApp message sent to Artur or of any PDF you download yourself.
Your Rights
Under GDPR you have the right to access, rectify, erase, restrict, or object to our processing of your data, and to data portability. Because signed bookings are held in a real database, we can act on these directly: contact us to request a copy of your record, a correction, or its deletion, and Artur can locate and permanently delete your record (including the stored ID photo, signature, and PDF) from the admin dashboard. On request we will also delete any retained WhatsApp message or downloaded PDF copy held by Artur where we can. To exercise any of these rights, or to lodge a complaint with the Spanish data protection authority (AEPD), contact privacy@alicante-emtb-rentals.example.