Privacy Policy

Who we are

Ride BCN (“we”, “us”) operates the website at ridebcn.com and offers private e-bike tours in Barcelona. This policy explains how we process personal data when you contact us, request availability, or use our services.

Data we collect

When you submit a reservation or inquiry form, we may collect: your name, email address, phone or WhatsApp number, preferred tour date and time, number of people, tour type, and any message you provide. We may also receive technical data such as your IP address and browser information when you use the site, to help prevent abuse and improve security.

How we use your data

We use this information to respond to your request, confirm availability, organise your tour, and communicate with you about your booking. We do not sell your data. We do not use it for automated profiling. If you contact us by WhatsApp, email, or phone, we will use those channels only in connection with your inquiry or booking.

Legal basis (GDPR)

If you are in the European Economic Area, we process your data where necessary to take steps at your request before a contract, to perform a contract, or where we have a legitimate interest in operating our business and responding to inquiries — balanced against your rights. Where we ask for your consent (for example, via a checkbox on our form), you may withdraw it at any time.

How long we keep data

We retain reservation and contact records for as long as needed to provide our services, handle disputes, and meet legal or accounting obligations, typically up to a few years unless a longer period is required by law.

Your rights (GDPR & LOPDGDD)

If you are in the EEA — and especially in Spain — you have the following rights regarding your personal data:

• Access — ask us what data we hold about you.
• Rectification — correct anything that is wrong.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — limit how we use your data.
• Objection — object to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email hello@ridebcn.com. We will reply within one month.

If you believe we are not handling your data properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with any other supervisory authority in the EEA country where you reside.

How we share your data

We do not sell or rent your personal data. We share it only with the service providers that help us run the site, on a need-to-use basis and under appropriate contracts:

• Hosting: InMotion Hosting — application server and database in their EU/US datacentres.
• Email: InMotion outbound SMTP to send your booking confirmation and our internal notifications.
• Analytics (if enabled): Umami — a cookie-less, EU-hosted analytics service that does not track individuals across sites or collect personal data.

Cookies and similar technologies

We use only the cookies that are strictly necessary to run the site:

• Authentication cookies for the private admin panel (set only after a successful admin sign-in — they never touch the public site).

We do not use marketing, advertising, or cross-site tracking cookies. Because our cookies are strictly necessary (or set only on opt-in actions like signing into the admin panel), no consent banner is required under the Spanish guidance on cookies (AEPD, July 2023).

Security

We apply reasonable technical and organisational measures to protect your data: HTTPS everywhere, hashed passwords (bcrypt) for any account we keep, rate limits on the booking and login forms, and access controls on the admin panel. No system can guarantee absolute security, but we will tell you without undue delay if we become aware of a breach affecting your data.

Contact

Questions about this policy: hello@ridebcn.com · +34 934 39 46 59 · Barcelona, Spain