Privacy policy

Lanzarote Bike Rental is run by Nicolás Tabares Wiede in Lanzarote, Spain. We decide what happens with your data (the "controller" under the GDPR).

Questions about your data: [email protected]. We answer every day, 10:00–18:00.

When you email us: your name, your email address and what you write, usually your dates, the bike you want and where you're staying.

When you rent a bike: your name, email, the address where we deliver and pick up the bike, your rental dates, the bikes and extras, and what you paid. For the €100 deposit we only note that it was paid and returned.

When we deliver, we take a photo of your passport or ID card. It shows us you're 18 or over and the person who booked.

To answer your email, deliver and pick up your bike, and run the rental you booked. The legal basis is the contract with you, or the steps you ask for before it (GDPR Art. 6(1)(b)).

To check your ID at delivery, so we only hand bikes to adults who made the booking. The legal basis is our legitimate interest in protecting our bikes and the contract (GDPR Art. 6(1)(f)).

To keep invoices and accounting records, because Spanish law requires it (GDPR Art. 6(1)(c)).

We don't send newsletters or adverts, and we never sell your data.

Emails that don't lead to a rental: deleted 12 months after the last message.

The photo of your ID: deleted when we pick up the bike and everything is fine. If the bike comes back damaged or something is missing, we keep it until that's settled.

Rental details: until the rental is over and any open question about it is settled. Invoices and accounting records: as long as Spanish tax and commercial law requires, up to six years.

Only the companies that run the tools we use, under a contract that lets them use your data for us and nothing else: Microsoft 365 for our email, Stripe for card payments, and the company that hosts this website.

Stripe sees your card details, we don't. It also uses them to prevent fraud, under its own privacy policy.

Microsoft and Stripe are US companies. When your data leaves the EU, it's protected by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

The fonts load from our own server, not from Google.

Like every web server, ours logs each request: your IP address, the page, the time and your browser. We use these logs only to keep the site running and safe, and delete them after 14 days.

You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, to object, or to get it in a file you can take elsewhere. Email [email protected] and we'll reply within one month. We may ask you to confirm it's you.

We can't delete invoices before the legal period ends, but we'll tell you if that applies.

If you think we handle your data wrongly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority in your own country.

When online booking opens, this page will say what the booking form collects and who processes the payment. We change the date at the top whenever we update it.