Privacy policy

Which data we process

We only process the data needed to rent you the vehicle and to comply with the law. Depending on what you do, this may include:

• Identification and contact: first and last name, type and number of ID document (ID card, residence card or passport), issuing country and issue and expiry dates of the document, date of birth, nationality, address, phone number, email address and accommodation (hotel or other).
• Driving licence (motorbikes): licence category, number, country and issue and expiry dates.
• Drivers and passengers: the same identification data for additional drivers and, for passengers under 14, their relationship with the responsible adult.
• Booking and contract: dates, vehicle, insurance and extras, the handwritten digital signature of the contract and of the handover, payments, deposit and any incidents during the rental (damage, delays, fines, charges).
• Payment: online payment is made on the payment gateway (Redsys or Stripe, whichever is active). We do not store your card details; we only keep the amount, date, payment method and operation number.
• Contact form: first and last name, email, phone number and message.
• Technical browsing data (IP address, browser) generated when you visit the website. See also the cookie policy.

What we use your data for and the legal basis

• Managing your booking and rental contract, including payments, the deposit, vehicle handover and return, and handling incidents: performance of the contract (Art. 6.1.b GDPR).
• Reporting the renter's and contract data for motorbikes to the Ministry of the Interior (SES.Hospedajes, Royal Decree 933/2021), issuing invoices and meeting tax and accounting obligations: legal obligation (Art. 6.1.c).
• Checking that you meet the requirements to ride (licence, how long you have held it, age): performance of the contract and our legitimate interest in not renting a vehicle to someone who cannot ride it (Art. 6.1.b and 6.1.f).
• Identifying the driver to the authorities when they request it because of a fine or an accident during the rental: legal obligation (Art. 6.1.c).
• Answering your contact-form enquiries: your request and our legitimate interest in helping you (Art. 6.1.b and 6.1.f).
• Calculating the commission of partner hotels if you give an affiliate code: legitimate interest (Art. 6.1.f). The code is used only for that calculation.
• Sending you marketing communications: only if you give your consent (Art. 6.1.a), which you can withdraw at any time.

Reading documents with artificial intelligence

This tool is used only by office staff; the website does not ask you to upload photos of your documents. To avoid typing errors, staff may photograph your ID card, passport or driving licence and use an artificial intelligence tool (the Claude API, from Anthropic PBC) that reads the image and fills in the form. Staff always check the data before saving it: no automated decision is made about you.

The photos are not stored in our systems. Anthropic processes them as a data processor, under a contract that complies with Art. 28 GDPR and with standard contractual clauses for transfers outside the European Economic Area; by default it does not use this data to train its models and deletes it from its servers within 30 days.

If the address is printed on the document but the postal code is missing, we look it up in public address services (CartoCiudad, from Spain's National Geographic Institute, and OpenStreetMap). These services only receive the address (street, number and town), without your name or any other data that identifies you.

WhatsApp assistant

If you write to us on WhatsApp, a virtual assistant (an artificial intelligence: the Claude API by Anthropic PBC) answers first, using the company's information (prices, availability, requirements and rules). If you want to rent a bicycle or a scooter, the assistant can help you make the booking in the chat: it asks for your details (name, document, email and accommodation) and a photo of your ID or passport, shows you a summary with the amounts, the deposit and the insurance, and only creates the booking when you expressly accept it; payment is always made on our payment provider's payment page, never in the chat. The assistant does not change or cancel bookings, and it makes no decision with legal effects on you. If you ask, or if the matter requires it (complaints, breakdowns, changes to a booking), a member of our team takes over the conversation.

We process your phone number, your WhatsApp profile name and the content of your messages to deal with your enquiry (pre-contractual steps or performance of the contract, and our legitimate interest in assisting you: Art. 6.1.b and 6.1.f GDPR). Messages are sent to Anthropic to generate the reply, as a data processor, and go through the WhatsApp platform (Meta Platforms Ireland Limited), which processes them as an independent controller under its own terms. If you want to book with the assistant, the photo of your document is used only to read your details with artificial intelligence and fill in the booking: the image is not stored anywhere (it is discarded once read) and it is sent to Anthropic to be read, as a data processor. The details gathered for the booking are kept for 7 days at most if you do not finish it. Do not send card details over WhatsApp: we will never ask for them.

We keep WhatsApp conversations for 90 days after the last message and then delete them, unless they relate to a booking or an ongoing claim.

Is providing the data mandatory?

Identification, contact, driving licence and payment details are necessary to enter into the contract and to meet legal obligations (for example, reporting to the Ministry of the Interior): if you do not provide them, we cannot rent you the vehicle. The data in the contact form is voluntary, but without it we cannot reply to you. Consent to receive advertising is voluntary and does not affect the rental.

Booking confirmation emails, reminders and the sending of the contract are part of the service you have contracted and are not commercial communications.

Other people's data

If you give us the details of other people when booking (additional drivers, passengers), we process them for the same purposes as yours: managing the contract and complying with the accommodation-reporting rules. Before giving them to us you must inform those people of this policy and, if they are minors, be their parent, guardian or person responsible. We process their identification data, the driving licence (drivers) and, for passengers under 14, their relationship with the responsible adult. Online booking can only be made by an adult.

Who we share your data with

We do not sell your data. We only share it in these cases:

• Authorities: the Ministry of the Interior (traveller register for motorbikes) and, where the law requires it or it is necessary because of a fine, an accident or an insurance claim, traffic authorities, the police, courts, town councils and insurers.
• Providers that process data on our behalf (data processors), under a contract that complies with Art. 28 GDPR: hosting of the application and database (Neon, with infrastructure in the United Kingdom, and our web hosting provider), storage of files such as signed contracts and invoices (Cloudflare), sending of confirmation and contract emails (Resend), assisted reading of documents (Anthropic, see the previous section), and advisers such as our accountants or insurer.
• Payment gateway: Redsys and the bank, or Stripe Payments Europe Ltd. (Ireland) if the payment is made with Stripe, which process your card data as independent controllers. Stripe may process data outside the European Economic Area with the safeguards it publishes in its privacy policy.
• Services you use while browsing: the contact page includes a Google Maps map; the routes section shows an OpenStreetMap map, whose servers receive your IP address when it loads; and the WhatsApp, Instagram and “Open in Google Maps” links take you to third-party services with their own privacy policies.

Transfers outside the European Union

Some of these providers (for example Anthropic, Cloudflare or Resend) may process data outside the European Economic Area, in particular in the United States. They operate under the appropriate safeguards required by the GDPR: standard contractual clauses of the European Commission or adequacy decisions (such as the EU–US Data Privacy Framework). You can ask us for more information at amorevesparental@gmail.com.

How long we keep your data

• General booking and customer data: 5 years from the last booking.
• Data required by the accommodation-registration rules: 3 years from the end of the rental. This is a specific period under those rules, independent of the one above.
• Invoices and accounting and tax records: for the periods set by commercial and tax law (generally 6 years).
• Photos of documents read with artificial intelligence: we do not keep them; Anthropic deletes them from its servers within 30 days.
• Contact-form messages: for as long as needed to answer your enquiry.

Once these periods have passed, we block the data for as long as liability may be claimed and then delete it.

Automated decisions

We do not make decisions about you based solely on automated processing.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent where processing is based on it, by writing to amorevesparental@gmail.com (state your name and attach a copy of your ID document so that we can verify you). We will reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Data protection officer

We have not appointed a data protection officer because the law does not require us to. For any question about your data you can write to amorevesparental@gmail.com.

Security

We apply technical and organisational measures to protect your data: access to the management panel only for authorised staff with a password, encrypted communications (HTTPS), documents accessible only through the application, and access limited to those who need it for their work.

Changes to this policy

We may update this policy. The current version is the one published on this page, with its update date at the top.