Privacy policy

Last updated: 11 November 2026

This policy follows the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on data protection (LOPDGDD).

1. Who is responsible for your data

2. What data we collect

• When you buy from us: your name, email, phone number, the trip you chose (dates, number of riders, level, base), any rider details you give us (such as height) and any comments you write.
• Payment: your card details are handled by our payment provider, which we name at checkout. We do not store card numbers.
• When you write to us: the content of your message and your contact details.
• Website statistics (only if you accept analytics cookies): pseudonymous identifiers, the pages you visit, the device and browser you use, your approximate location and how you arrived at the site, collected through Google Analytics 4, which we load through Google Tag Manager. See our cookie policy.
• Technical data: your IP address and basic browser data, which our servers record for security and to keep the site running.
• Your cookie choice, which we store on your device to remember it.

3. Why we use it and on what legal basis

• To process your purchase, send you your routes and trip checklist and organise your local buddy outings. Basis: performing our contract with you.
• To answer your questions. Basis: your consent or our legitimate interest in replying.
• To meet legal duties, such as invoicing and accounting. Basis: legal obligation.
• To measure and improve how the website is used. Basis: your consent, which you can withdraw at any time from "Cookie settings".
• To send you news or offers, only if you ask for them. Basis: your consent, which you can withdraw at any time.
• To keep the website secure and prevent fraud. Basis: our legitimate interest.

4. Who receives your data

• Companies that help us run the service as our processors: website hosting, email and payment processing.
• Google Ireland Limited, for Google Analytics 4 and Google Tag Manager, only if you accept analytics cookies.
• The local rider who joins your outing, who only receives what is needed to meet you.
• Booking.com, DiscoverCars and Fast Monkey. We do not send them your personal data automatically. When you follow a link we may pass trip details such as dates, the number of bikes and the delivery area. You give them your own personal data directly when you book with them, and they act as independent controllers under their own privacy policies.
• Public authorities, when the law requires it.

5. Transfers outside the European Economic Area

Google may process analytics data in the United States. Such transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses. We choose providers inside the European Union where possible. When data goes outside the EU, we rely on safeguards such as standard contractual clauses or the EU-US Data Privacy Framework.

6. How long we keep it

We keep your purchase data for as long as needed to provide the service and afterwards for the periods the law requires, for example for tax and accounting records. Analytics data is kept for 14 months. Messages and marketing data are kept until you ask us to delete them or withdraw your consent.

7. Your rights

You can ask us for access to your data, to correct it, delete it, limit its use, receive a copy in a portable format, or object to its use, by writing to [email protected] and proving your identity. You can withdraw any consent you gave at any time, without affecting what we did before. If you think we have not handled your data properly you can complain to the Spanish data protection authority, the AEPD.

8. Children

This website is not aimed at children under 14. Trips are bought by adults, who are responsible for any minors in their group.

9. Security

We take reasonable technical and organisational measures to protect your data. If a breach affects your rights, we will inform you and the authority as the law requires.

10. Changes

We may update this policy. The date at the top shows the latest version.