Privacy Policy

RENTER EBIKE PRIM, headquartered in Romania, is the controller of your personal data. If you have questions regarding this Privacy Notice or wish to exercise your data protection rights, you can contact us at: 📧 admin@renter.bike You also have the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) or the competent supervisory authority in your EU member state.

Depending on your relationship with us, we may process the following categories of personal data:

Identification data – Full name, Personal Identification Number (CNP), age (for eligibility verification), and signature. Legal basis: contract performance (Art. 6(1)(b) GDPR) – necessary for concluding and performing rental contracts; and fulfillment of legal obligations (Art. 6(1)(c)) – for compliance with record-keeping and archiving requirements.

Contact data – Address, email address, and phone number. Legal basis: contract performance (Art. 6(1)(b)) – for communications related to contract execution; and legitimate interest (Art. 6(1)(f)) – for customer support and security notifications.

Contractual and transaction data – Rental start and end date, payment method, payment status, issued invoices, and total number of rental days. Legal basis: contract performance (Art. 6(1)(b)); and legal obligation (Art. 6(1)(c)) – for accounting and tax record-keeping requirements.

Vehicle-related data – Bicycle number, brand, mileage, and any additional rented equipment. Legal basis: contract performance (Art. 6(1)(b)) – for fleet management and asset tracking; and legitimate interest (Art. 6(1)(f)) – for equipment monitoring and maintenance.

Lead and referral data – The source through which you contacted us (e.g., how you discovered us), any referral information, and the reason for service termination, if applicable. Legal basis: legitimate interest (Art. 6(1)(f)) – for business relationship management and service improvement; and consent (Art. 6(1)(a)) – if data is retained for future marketing.

Geolocation data – Real-time location of our bicycles, obtained through GPS devices (used exclusively for locating company property; GPS logs are not stored). Legal basis: legitimate interest (Art. 6(1)(f)) – for asset protection and theft prevention; and legal obligation (Art. 6(1)(c)) – when required for insurance requirements or cooperation with law enforcement authorities.

• Directly from you: when you contact us through the website, WhatsApp, or other communication channels; when you sign a contract with us; when you provide identification and payment data.
• Automatically: when our bicycles are equipped with GPS devices (for real-time location only).
• From third parties: when we receive referrals from existing customers or partners.

We send marketing communications to people who have given us their explicit consent. These include offers, new products and news about our services. Legal basis: consent (Art. 6(1)(a)). You can withdraw your consent at any time, free of charge and without giving a reason, using the unsubscribe link included in every message or by writing to admin@renter.bike. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

Our products and services are not intended for persons under 18 years of age and, therefore, we do not knowingly collect data about minors.

Affiliated company (Processor): When personal data is transferred outside the European Economic Area (EEA), including to the affiliated company in the Republic of Moldova, these transfers are carried out in accordance with Chapter V of the GDPR. Transfers are governed by the European Commission’s Standard Contractual Clauses (SCC) to ensure data protection in accordance with EU standards.

Third-party communication and storage service providers: We use third-party providers for secure storage and communication, such as cloud services and messaging platforms:

Google Drive (Google Ireland Ltd.) – used for secure file storage and document collaboration. All data is managed in accordance with Google’s GDPR Terms. Access is restricted to authorized personnel.

WhatsApp Business (Meta Platforms Ireland Ltd.) – used occasionally for direct communication with customers regarding logistics or service support. Messages are end-to-end encrypted, and shared information is strictly minimal, only as necessary for service provision.

Our website uses cookies and similar technologies. Those strictly necessary to serve the site are always active. Cookies used for analytics and advertising measurement are set only after you accept them, and you can change or withdraw your choice at any time through the Cookie settings link in the footer.

Analytics and advertising measurement. We measure how the site is used, which includes heatmaps and recordings of how visitors move through a page, and we measure which of our adverts led to an enquiry. Our providers are Google, Microsoft and PostHog. Legal basis: consent (Art. 6(1)(a) GDPR). Google and Microsoft may process this data in the United States under the EU-US Data Privacy Framework; PostHog is hosted in the European Union. Retention: up to 14 months.

Before you make a choice. Google’s measurement scripts load on every visit, but until you accept they run in a restricted state: they store nothing on your device, read nothing from it, and create no identifier for you. In that state they send Google a basic signal that a page was viewed. That signal includes your IP address, the page address, your browser type and language, and the fact that consent has been refused or not yet given. It contains no cookie and no advertising click identifier, both of which we instruct Google to leave out, so it cannot be used to recognise you on a later visit. Google uses these signals only to estimate aggregate totals, such as how many visits our adverts produced. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring the effectiveness of our advertising without tracking individuals. Microsoft Clarity and PostHog do not load at all until you accept. If you refuse, this signal stays the same, but no cookie or identifier is ever created. We do not keep these signals ourselves.

Other providers. We use hosting and infrastructure providers, which log technical data including your IP address in order to deliver and secure the site, and a spam-protection service on our forms. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: up to 30 days.

Forms. Our quote form collects a name and a phone number so that we can call you back. Legal basis: consent (Art. 6(1)(a) GDPR). Retention: 24 months from your last contact with us.

You have the following rights under the GDPR:

• Right of access – to receive a copy of the personal data held by us.
• Right to rectification – to correct incomplete or inaccurate data.
• Right to erasure – to request deletion of data when it is no longer necessary or there is no legal basis for processing.
• Right to restriction – to limit processing in certain situations.
• Right to portability – to receive data in a structured, commonly used, and machine-readable format.
• Right to object – to object to processing based on legitimate interest.

To exercise these rights, you can contact us at admin@renter.bike. We will respond within one month, in accordance with the law.

You may also file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – https://dataprotection.ro/

We apply appropriate technical and organizational measures to protect the data we manage against manipulation, loss, destruction, or unauthorized access.

We also have procedures in place to manage any personal data security incident and will notify you, along with the relevant authorities, when required by law.

We may periodically update this Privacy Notice. Updated versions will be published on our website, indicating the date of the last revision.