Privacy Policy

RENTER EBIKE PRIM, headquartered in Romania, is the controller of your personal data. If you have questions regarding this Privacy Notice or wish to exercise your data protection rights, you can contact us at: 📧 admin@renter.bike You also have the right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) or the competent supervisory authority in your EU member state.

Depending on your relationship with us, we may process the following categories of personal data:

Identification data – Full name, Personal Identification Number (CNP), age (for eligibility verification), and signature. Legal basis: contract performance (Art. 6(1)(b) GDPR) – necessary for concluding and performing rental contracts; and fulfillment of legal obligations (Art. 6(1)(c)) – for compliance with record-keeping and archiving requirements.

Contact data – Address, email address, and phone number. Legal basis: contract performance (Art. 6(1)(b)) – for communications related to contract execution; and legitimate interest (Art. 6(1)(f)) – for customer support and security notifications.

Contractual and transaction data – Rental start and end date, payment method, payment status, issued invoices, and total number of rental days. Legal basis: contract performance (Art. 6(1)(b)); and legal obligation (Art. 6(1)(c)) – for accounting and tax record-keeping requirements.

Vehicle-related data – Bicycle number, brand, mileage, and any additional rented equipment. Legal basis: contract performance (Art. 6(1)(b)) – for fleet management and asset tracking; and legitimate interest (Art. 6(1)(f)) – for equipment monitoring and maintenance.

Lead and referral data – The source through which you contacted us (e.g., how you discovered us), any referral information, and the reason for service termination, if applicable. Legal basis: legitimate interest (Art. 6(1)(f)) – for business relationship management and service improvement; and consent (Art. 6(1)(a)) – if data is retained for future marketing.

Geolocation data – Real-time location of our bicycles, obtained through GPS devices (used exclusively for locating company property; GPS logs are not stored). Legal basis: legitimate interest (Art. 6(1)(f)) – for asset protection and theft prevention; and legal obligation (Art. 6(1)(c)) – when required for insurance requirements or cooperation with law enforcement authorities.

• Directly from you: when you contact us through the website, WhatsApp, or other communication channels; when you sign a contract with us; when you provide identification and payment data.
• Automatically: when our bicycles are equipped with GPS devices (for real-time location only).
• From third parties: when we receive referrals from existing customers or partners.

We currently do not send marketing communications. If this changes in the future, we will only do so with your explicit consent.

Our products and services are not intended for persons under 18 years of age and, therefore, we do not knowingly collect data about minors.

Affiliated company (Processor): When personal data is transferred outside the European Economic Area (EEA), including to the affiliated company in the Republic of Moldova, these transfers are carried out in accordance with Chapter V of the GDPR. Transfers are governed by the European Commission’s Standard Contractual Clauses (SCC) to ensure data protection in accordance with EU standards.

Third-party communication and storage service providers: We use third-party providers for secure storage and communication, such as cloud services and messaging platforms:

Crisp.chat (Crisp IM SAS, France) – used for live chat, website inquiries, and customer support. Crisp acts as a processor under a GDPR-compliant Data Processing Agreement. Data is hosted in the EU (Netherlands, Germany, Ireland), and Crisp’s sub-processors comply with European data protection standards. More details: Crisp GDPR Notice

Google Drive (Google Ireland Ltd.) – used for secure file storage and document collaboration. All data is managed in accordance with Google’s GDPR Terms. Access is restricted to authorized personnel.

WhatsApp Business (Meta Platforms Ireland Ltd.) – used occasionally for direct communication with customers regarding logistics or service support. Messages are end-to-end encrypted, and shared information is strictly minimal, only as necessary for service provision.

You have the following rights under the GDPR:

• Right of access – to receive a copy of the personal data held by us.
• Right to rectification – to correct incomplete or inaccurate data.
• Right to erasure – to request deletion of data when it is no longer necessary or there is no legal basis for processing.
• Right to restriction – to limit processing in certain situations.
• Right to portability – to receive data in a structured, commonly used, and machine-readable format.
• Right to object – to object to processing based on legitimate interest.

To exercise these rights, you can contact us at admin@renter.bike. We will respond within one month, in accordance with the law.

You may also file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – https://dataprotection.ro/

We apply appropriate technical and organizational measures to protect the data we manage against manipulation, loss, destruction, or unauthorized access.

We also have procedures in place to manage any personal data security incident and will notify you, along with the relevant authorities, when required by law.

We may periodically update this Privacy Notice. Updated versions will be published on our website, indicating the date of the last revision.