Privacy Policy

This policy explains how we process the personal data we collect when you visit this website, contact us, book a bike or use any of our services. It is drafted in accordance with the General Data Protection Regulation (GDPR, EU 2016/679) and the Spanish Organic Act 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

Please read it carefully: everything the law requires you to know is included.

Data controller

The controller of your personal data is:

• Owner: David Javier Pintado Laruelo, sole trader (self-employed), trading under the commercial name Bicisendadeloso.
• Tax ID (NIF): 09394016B (Intra-Community VAT ES09394016B).
• Registered address: Calle Bermudo I el Diácono 3 Bajo, 33012 Oviedo (Asturias, Spain).
• Business address: Polígono de Pradacón Nave 1, 33111 Entrago, Teverga (Asturias, Spain).
• Telephone: +34 644 199 430.
• Email for privacy matters: reservas@bicisendadeloso.es.

We are not required to appoint a Data Protection Officer (DPO) under article 37 of the GDPR, as our activity does not fall within any of the cases that require one (public body, large-scale processing of special categories of data or large-scale systematic monitoring). For any privacy matter you can contact us directly using the email above.

What data we collect and how

We collect different types of data depending on the channel and service you use:

When you book a bike

• Identifying data: first name and surname.
• Contact data: telephone, email.
• Booking data: date, number of people, type of bike or accessory, planned route.
• Free-text comments you add to the form (allergies, dog weight, child size, etc.).

We collect this data via the form at /en/booking/, by phone, WhatsApp or email.

When you contact us

• The data you decide to provide in your message: name, email, telephone and content of your enquiry.

When you browse the site

Technical data collected automatically by the server and by audience measurement tools:

• IP address (partially anonymised when used in Google Analytics with IP anonymisation).
• Browser and device type, operating system, resolution.
• Pages visited, time on site, traffic source.
• Browser language.

This data is only collected if you have given your consent via the cookie banner for the analytics or marketing categories. Without consent, tracking scripts (Google Analytics, Google Ads, Microsoft Clarity) are not loaded.

When you pay at the shop

Payment is made in person in Entrago (cash, card or Bizum). For card payments, banking data is processed directly by the financial provider’s POS terminal and is not stored by us beyond the transaction receipt, which we keep as required by tax law.

What we use your data for

The specific purposes of each processing activity are:

We do not use your data to:

• Send you mass commercial communications or newsletters.
• Build profiles for automated decision-making purposes.
• Sell, rent or transfer them to third parties for commercial purposes.

Legal basis for processing

Each purpose is supported by a specific legal basis under article 6 of the GDPR:

• Performance of a contract (art. 6.1.b): management of your booking and provision of the rental service.
• Legal obligation (art. 6.1.c): invoicing, tax, accounting obligations, administrative requests.
• Consent (art. 6.1.a): analytics and marketing cookies, sending of any ad-hoc commercial communication (not common in our operation).
• Legitimate interest (art. 6.1.f): improvement of the service, IT security of the site and protection against fraudulent use of the form. We have carried out the balancing test and consider that your rights do not override this interest; you may object at any time by writing to us.

Retention periods

Retention periods are as follows:

• Booking and rental contract data: for the duration of the service and, once finished, for the periods laid down by tax and accounting rules (typically 6 years under the Spanish Commercial Code and 4 years under the General Tax Act; the longer applicable period applies).
• Enquiry data submitted via email, form or WhatsApp: for the time needed to handle your request and up to 12 additional months to resolve any derived incidents.
• Browsing data (cookies): as stated in the Cookie Policy — between the browser session and 24 months for persistent analytics cookies.
• Administrative documentation relating to the active tourism authorisation: as long as required by the Principality of Asturias.

Once the periods have elapsed, your data is securely deleted or, where legally necessary to retain it, blocked (kept with restricted access for the possible defence of claims).

Who we share your data with

We do not sell or rent your data. We only share it with third parties where strictly necessary to provide the service or by legal obligation. The processors we work with are:

• Nicalia Internet S.L. (Tax ID B67044230, Calle Tomás A. Alonso 162, 2.º 7.ª, 36208 Vigo, Pontevedra) — hosting of the website and operational mail. Spain (European Union).
• Google LLC (Google Analytics 4 and Google Ads): audience measurement and digital advertising. Only receives data if you have accepted the corresponding cookies. See details in the Cookie Policy.
• Microsoft Corporation (Microsoft Clarity): behaviour analysis tool on the site to improve usability. Consent required.
• Meta Platforms Ireland Ltd (Facebook, Instagram): to the extent you interact with our social accounts. Their terms apply to content published on their platforms.
• Banking entities providing the POS terminal for card payments at the shop.
• Public administrations and, where applicable, Law Enforcement Agencies, Judges and Courts, where there is a legal obligation.

We have the data processing agreements required by article 28 of the GDPR in place with all private-company processors.

International transfers

Some providers (Google, Microsoft, Meta) are companies with headquarters in the United States. Transfers of data to these entities take place under the safeguards provided for in the GDPR:

• EU–US adequacy decision (Data Privacy Framework, DPF) for entities that are enrolled in that framework. The enrolment status can be checked at https://www.dataprivacyframework.gov/.
• Subsidiarily, Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914).

We do not carry out transfers to countries without safeguards equivalent to the GDPR.

How we protect your data

We apply reasonable technical and organisational measures to protect your data:

• TLS encryption on the website (https://).
• Access to data restricted exclusively to the necessary personnel.
• Internal data protection training.
• Regular backups.
• Secure deletion of data once retention periods have elapsed.

No system is 100% invulnerable. In the event of a security breach that entails a risk to your rights, we will inform you without undue delay and, where applicable, notify the AEPD within 72 hours in accordance with article 33 of the GDPR.

Your rights and how to exercise them

As the data subject, you have the following rights:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request deletion when data is no longer necessary.
• Objection: to object to processing based on legitimate interest or to receiving any commercial communication.
• Restriction: to request that we stop processing your data in certain cases.
• Portability: to receive your data in a structured, commonly used format, or to have it transmitted to another controller.
• Not to be subject to automated decisions with significant legal effects.
• To withdraw consent at any time, without affecting the lawfulness of prior processing.

How to exercise them:

Send us an email to reservas@bicisendadeloso.es stating the right you wish to exercise and attaching a copy of your ID or equivalent document to verify your identity. You may also do so by post to our registered address.

We will reply within a maximum of one month from receipt of your request, extendable by up to two additional months due to complexity, pursuant to article 12.3 of the GDPR.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD):

• C/ Jorge Juan 6, 28001 Madrid.
• Phone: 901 100 099 · 912 663 517.
• Website: https://www.aepd.es.
• Electronic office: https://sedeagpd.gob.es.

Minors

This site is not aimed at minors under 14. We do not knowingly collect personal data from minors of that age without the verifiable consent of their parents or legal guardians (art. 7 LOPDGDD). If you are a parent or guardian and discover that a minor has provided us with data without your authorisation, please write to us and we will delete it.

For family bookings, the data you provide about minors (age, weight, assigned equipment) is collected by the parent or guardian making the booking and is used exclusively to prepare the right bike, seat or trailer.

Social networks

You can interact with us on Facebook, Instagram and YouTube. When you do so, the terms and privacy policies of those platforms apply to you, in addition to this policy in relation to the content we publish.

We have no control over the data that Meta or Google collect through their platforms. To limit such collection, adjust your account privacy settings directly on those networks.

Changes to this policy

We may update this policy to adapt it to regulatory changes or to changes in our services. Where the change is substantial, we will announce it prominently on the site. The version in force will always be the one published at this URL with its date.

Contact and complaints

For any query or request relating to your personal data, write to reservas@bicisendadeloso.es or call +34 644 199 430.

If you are not satisfied with our response, remember that you may lodge a complaint with the AEPD (contact details above).