Privacy Policy

# Privacy Policy

**Last updated:** [DATE]

This Privacy Policy explains how **[LEGAL NAME / TRADING NAME]**, operating as **FuerteBay**, collects and processes personal data in connection with our website **[www.fuertebay.com]** and our services: **bike rentals**, **key drop & pick-up service**, and **parcel receiving**.

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD).

---

## 1. Data Controller

| | |

|---|---|

| Legal name | [LEGAL NAME, S.L. / autónomo name] |

| Tax ID (NIF/CIF) | [NUMBER] |

| Registered address | [STREET, POSTAL CODE, Puerto del Rosario, Fuerteventura, Spain] |

| Email | [privacy@fuertebay.com] |

| Phone | [+34 XXX XXX XXX] |

| Data Protection Officer | [Not appointed / contact details] |

---

## 2. What data we collect and why

### 2.1 Website visitors and contact forms

- **Data:** name, email address, phone number, message content, language, and technical data (IP address, browser, device, pages visited).

- **Purpose:** to answer enquiries, send quotes, and keep the website secure and functional.

- **Legal basis:** your request / steps prior to entering into a contract (Art. 6.1.b GDPR) and our legitimate interest in website security (Art. 6.1.f GDPR).

### 2.2 Bike rentals

- **Data:** full name, date of birth, nationality, ID card or passport number, driving licence (where applicable), address, email, phone, accommodation address in Fuerteventura, rental dates, equipment rented, height/weight where needed for correct bike setup, payment and deposit details, damage or accident reports, insurance information.

- **Purpose:** to conclude and perform the rental contract, verify identity and age, manage deposits, handle returns, damage, theft, accidents and insurance claims, and issue invoices.

- **Legal basis:** performance of a contract (Art. 6.1.b), legal obligations in tax and accounting matters (Art. 6.1.c), and our legitimate interest in protecting our property and pursuing claims (Art. 6.1.f).

### 2.3 Key drop & pick-up service

- **Data:** name and surname of the guest collecting or returning the keys, contact details, identity document number (for verification at handover), booking reference, apartment/property identification, arrival and departure times, name and contact details of the property owner or manager.

- **Purpose:** to hand over and receive keys securely, verify that the person collecting the keys is entitled to do so, coordinate check-in and check-out with the owner, and keep a record of each handover.

- **Legal basis:** performance of a contract or of a service requested by the guest or owner (Art. 6.1.b) and our legitimate interest in preventing unauthorised access to properties and in proving that a handover took place (Art. 6.1.f).

- **Note on roles:** where we act on the instructions of an apartment owner or property manager, that owner or manager is the data controller and FuerteBay acts as a **data processor** under a written agreement (Art. 28 GDPR). Where guests contract our service directly, FuerteBay is the controller.

- **Traveller registration:** we do not carry out the traveller registration required from accommodation providers under Spanish law unless expressly agreed in writing with the property owner. Where we do, that data is kept and transmitted only as required by the applicable regulations.

### 2.4 Parcel receiving service

- **Data:** name and surname of the recipient, contact details, identity document number shown at collection, signature, delivery address used, sender and carrier details, tracking number, parcel dimensions/weight, dates of receipt and collection, storage period and any related fees. We do **not** open parcels or record their contents unless required by law or by the carrier.

- **Purpose:** to receive, store and release parcels to the correct person, notify recipients, manage storage fees, and resolve disputes about deliveries.

- **Legal basis:** performance of a contract (Art. 6.1.b), legal obligations (Art. 6.1.c), and our legitimate interest in ensuring parcels are released only to the rightful recipient (Art. 6.1.f).

### 2.5 Payments

Card payments are processed by our payment provider **[Stripe / Redsys / PayPal / other]**. We do not store full card numbers. We retain transaction references, amounts, dates and invoicing data.

**Legal basis:** contract and legal obligations (tax and accounting).

### 2.6 Video surveillance (if applicable)

If our office or storage area is monitored by CCTV, signage is displayed at the entrance. Images are used only for the security of people and property, are kept for a maximum of **30 days** (Art. 22 LOPDGDD), and are deleted thereafter unless required for an investigation or legal proceedings.

**Legal basis:** legitimate interest (Art. 6.1.f).

### 2.7 Marketing communications

If you consent, or if you are an existing customer and we are offering services similar to those you already purchased, we may send you offers and news by email. You can withdraw consent or object at any time via the unsubscribe link or by writing to us.

**Legal basis:** consent (Art. 6.1.a) or legitimate interest (Art. 6.1.f), in line with Art. 21 of Spanish Law 34/2002 (LSSI).

---

## 3. Providing your data is generally required

For rentals, key handovers and parcel collection, the data marked as mandatory is necessary to provide the service. If you do not provide it, we will not be able to rent you a bike, release keys, or hand over a parcel.

---

## 4. How long we keep your data

| Category | Retention period |

|---|---|

| Enquiries that do not lead to a contract | 12 months from last contact |

| Rental, key service and parcel records | Duration of the service plus **5 years** (limitation period for contractual claims in Spain) |

| Invoices and accounting records | **6 years** (Commercial Code) and at least **4 years** for tax purposes |

| Identity document numbers recorded at handover | [12 months] from the handover, unless needed for a claim |

| CCTV images | Maximum 30 days |

| Marketing consents | Until withdrawal, plus proof of consent for the limitation period |

After these periods, data is deleted or anonymised, or kept blocked and available only for authorities and courts for the applicable limitation periods.

---

## 5. Who we share data with

We do not sell personal data. We may share it with:

- **Property owners or managers** — for the key handover service, limited to what is needed to confirm check-in and check-out.

- **Carriers and postal operators** — to confirm receipt or return of parcels.

- **Payment providers and banks** — to process payments and refunds.

- **Insurers, loss adjusters and repair workshops** — in the event of accidents, damage or theft involving rented equipment.

- **IT and business service providers** — website hosting, booking software, email, accounting, all acting as processors under contract.

- **Public authorities, courts, the police and the Guardia Civil** — where required by law.

- **Lawyers and debt recovery agents** — where necessary to establish or defend legal claims.

---

## 6. International transfers

Our providers are located in the European Economic Area wherever possible. If any provider processes data outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses with additional safeguards. You may request a copy of the safeguards in place at **[privacy@fuertebay.com]**.

---

## 7. Your rights

You have the right to:

- **access** your personal data and obtain a copy;

- request **rectification** of inaccurate data;

- request **erasure** where the data is no longer necessary;

- request **restriction** of processing;

- **object** to processing based on legitimate interest, including direct marketing;

- request **portability** of data you provided to us;

- **withdraw consent** at any time, without affecting processing carried out before withdrawal.

To exercise these rights, write to **[privacy@fuertebay.com]** or to our postal address, indicating the right you wish to exercise. We may ask you to prove your identity. We will reply within one month, extendable by two further months for complex requests.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (**Agencia Española de Protección de Datos**, C/ Jorge Juan 6, 28001 Madrid, **www.aepd.es**).

---

## 8. Security

We apply technical and organisational measures appropriate to the risk, including access control to keys and parcels, restricted access to our systems, encrypted connections on the website, secure storage of paper records, backups and staff confidentiality commitments.

---

## 9. Minors

Our services are intended for persons aged **18 or over**. Bikes may be rented for minors only by a parent or legal guardian, who provides the minor's data and accepts responsibility for the rental. Keys and parcels are released only to adults, unless the owner or recipient has authorised otherwise in writing.

---

## 10. Cookies

Our website uses its own and third-party cookies. Details of each cookie, its purpose and duration, and how to accept, reject or withdraw consent, are set out in our **[Cookie Policy](/cookie-policy)**.

---

## 11. Changes to this policy

We may update this Privacy Policy to reflect changes in our services or in the applicable law. The version in force is always the one published on this page, with its date of last update.

---