Privacy Policy
This website collects personal data only with the knowledge and informed consent of users.
In this document, we explain in detail who will process your data, how it will be used, and what rights you can exercise, among other important points. If you would like more information, you may read this Privacy Policy, as well as the Legal Notice and the Cookie Policy.
1. DATA CONTROLLER – WHO WILL PROCESS YOUR DATA?
- Identity: Seraya Rodríguez Ledesma
- Address: Avenida Milán 71, 38260, Tejina, San Cristóbal de La Laguna, Santa Cruz de Tenerife
- Email: info@kirayabikes.com
2. WHAT PERSONAL DATA DO WE PROCESS AND WHERE DOES IT COME FROM?
In the course of our relationship with you, we may process various categories of personal data, depending on the product or service contracted. These data may be collected by any of the channels offered by Seraya Rodríguez Ledesma, both online and in person.
The categories of data we may process include:
- Identification data of natural persons: name and surname, ID/passport, telephone number, email address, physical address, signature, electronic signature, and image.
- Special category data: only if voluntarily provided in free-text fields (e.g., health information).
- Banking data: bank account number, credit card number.
3. PURPOSE & LEGAL BASIS – WHY AND ON WHAT GROUNDS DO WE USE YOUR DATA?
Seraya Rodríguez Ledesma may process your personal data for the purposes outlined below, provided there is a legal basis for doing so.
The General Data Protection Regulation (GDPR) and Spanish LOPDGDD establish that data processing must be justified under a specific legal basis, such as:
- Consent
- Contractual relationship
- Vital interests of the data subject or others
- Compliance with a legal obligation
- Public interest or exercise of official authority
- Legitimate interests of the controller or third parties
In certain cases, Seraya Rodríguez Ledesma processes your data based on legitimate interest under Article 6.1(f) of the GDPR, ensuring it does not override your personal data protection rights. In such cases, you have the right to:
- Request more information about the legitimate interest involved
- Know how we assessed that your rights are not harmed
- Object to the processing (as described in Section 7: “YOUR RIGHTS”)
Below are the main purposes and legal bases:
a) Legal Obligations
Purpose: Compliance with accounting, legal, tax, and administrative obligations, including registration of guests and communication with law enforcement under public security regulations.
Legal basis: Contract execution and compliance with legal obligations (e.g., Organic Law 4/2015, Royal Decree 933/2021, Order INT/1922/2003)
b) Service Provision – Bike Rental and Excursions
Purpose: Manage bike rentals and excursions, send quotes, and invoice services.
Legal basis: Pre-contractual and/or contractual necessity.
c) Service Provision – Holiday Rentals
Purpose: Manage reservations, payments, check-in/out, and provide related services. If health data is voluntarily provided in free-text fields (e.g., for accessibility), it will only be processed to meet specific requests.
Legal basis: Pre-contractual and/or contractual necessity, and consent for special category data.
d) Video Surveillance (at the workshop/pick-up location)
Purpose: Monitor internal and external premises to ensure safety, prevent risks, and comply with security protocols.
Legal basis: Public interest (e.g., Law 5/2014 on Private Security).
e) Image Use
Purpose: Capture and publish audiovisual content (photos, videos) on websites, social media, printed materials, or other media.
Legal basis: Consent.
f) Unsolicited Marketing Communications
Purpose: Send offers for products/services related to those previously contracted. Users may opt out in each message.
Legal basis: Legitimate interest.
g) Inquiries, Requests or Suggestions
Purpose: Handle user communications.
Legal basis: Consent (for non-registered users), contract execution (for registered users), or legal obligation (for data subject rights requests).
h) Submission of CVs
Purpose: Include applicants in current or future recruitment processes.
Legal basis: Pre-contractual measures.
4. DATA RETENTION – HOW LONG DO WE KEEP YOUR DATA?
Personal data will be retained only for the necessary time to fulfill the purpose for which they were collected. Once that period ends, they will be securely stored for the time required by applicable laws and then deleted.
5. WHO DO WE SHARE YOUR DATA WITH?
To fulfill the purposes above, we may share your data with service providers, such as:
- Financial institutions
- Technology service providers
- Business consultancy firms
- Social Security
- Tax Agency
Apart from the above, Seraya Rodríguez Ledesma will not share your personal data with third parties unless legally required or with your express prior consent.
All parties involved in processing your data (internally or externally) are bound by professional confidentiality and must implement adequate technical and organizational security measures to protect your data.
6. YOUR RIGHTS – WHAT RIGHTS DO YOU HAVE?
You can exercise the following rights at any time, simply by stating your request and the specific right you wish to exercise. We may request proof of identity to verify your request.
You have the right to:
- Access your personal data
- Rectify your data if inaccurate or outdated
- Delete your data when no longer necessary
- Restrict processing in specific circumstances
- Port your data to another entity in a structured, machine-readable format
- Object to processing when based on legitimate interest
How to exercise your rights:
- By postal mail: Avenida Milán 71, 38260, Tejina, San Cristóbal de La Laguna, Santa Cruz de Tenerife
- By email: info@kirayabikes.com
We will respond within one month of receiving your request (extendable by two months for complex cases).
You may withdraw your consent at any time by emailing info@kirayabikes.com. Withdrawal will not affect processing carried out prior to the withdrawal.
If you believe your rights have been violated, you may file a complaint with the Spanish Data Protection Agency at www.aepd.es.
7. WHAT IF YOU PROVIDE THIRD-PARTY DATA OR SOMEONE PROVIDES YOURS?
If you provide third-party data (e.g., emergency contacts), you confirm that you have informed them of the purposes and processing involved.
If a third party provides your data, it will be processed according to this Privacy Policy.
8. ARE MY DATA SECURE?
Seraya Rodríguez Ledesma has implemented appropriate measures to ensure the confidentiality and security of your data in compliance with Regulation (EU) 2016/679 (GDPR).
All data submitted through our platform is collected over a secure protocol.
Our website:
Uses an SSL certificate, which encrypts all data exchanged with our website.
Is hosted by DinaHosting S.L., whose privacy policy can be consulted here.
9. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to comply with new legal or case law developments. If the changes significantly affect your privacy, we will inform you via the website or directly by email.
10. QUESTIONS ABOUT THIS POLICY OR YOUR RIGHTS?
If you have any questions about this Privacy Policy or how we manage your personal data, feel free to contact us at:
