Privacy Policy & Legal Notice
Last updated: 3 October 2026. This page explains who runs this website and the Doctor Bicycles rental shop, which personal data we process, why and for how long, and what rights you have. It describes only what we actually do.
Last updated: 3 October 2026. This page explains who runs this website and the Doctor Bicycles rental shop, which personal data we process, why and for how long, and what rights you have. It describes only what we actually do.
Who we are (legal notice)
Doctor Bicycles is the trade name of Martin Kimla, self-employed (autónomo), NIE Z4311366K, Carrer de les Malgrats 17, 07160 Peguera (Calvià), Mallorca, Spain. E-mail: contact@doctorbicycles.com , phone: +34 613 360 563. Martin Kimla is the controller responsible for your personal data. Please send any privacy question or request to the e-mail address above.
Reservations and rental contracts
When you book online or at the shop, we process your name, e-mail address and phone number, the dates, bikes and extras you choose, your height, weight and saddle height (to set up the bike), your notes and, if you order delivery, the address or accommodation and its location. At handover we record the details of your identity document (type and number, nationality, date of birth, address) and keep a copy of it together with the rental contract, payments, the deposit and any damage report.
We need these data to make and fulfil the rental contract (Art. 6(1)(b) GDPR) and to keep invoices and accounting records as Spanish law requires (Art. 6(1)(c) GDPR). Checking and copying your identity document protects a high-value bike against fraud and theft (legitimate interest, Art. 6(1)(f) GDPR). If a rental ends with unpaid damage or a bike that was not returned, we keep a note so that we can decide on future rentals (legitimate interest).
E-mails about your booking
We send you a confirmation and practical information about your booking. A few days after the rental we may send one e-mail asking you to review our service; you can object to such e-mails at any time by replying to them (legitimate interest). Our e-mails are sent through Brevo (Sendinblue SAS, France).
Contact form, e-mail and phone
When you contact us, we use your name, contact details and message only to answer you. Messages sent through the contact form are deleted from our server after 12 months.
Chat assistant
The chat on our website answers questions about renting with the help of Google's Gemini service: the text you type is sent to Google to generate the answer. Please do not enter personal data in the chat; for bookings and personal matters, use the booking form, e-mail or phone.
Website statistics without cookies
We want to know which pages are useful, and for which dates and bike sizes people look for free bikes, so that we can plan our fleet. For this we keep our own anonymous statistics: when you view a page, search for available bikes, start or send a booking, or click our phone number or e-mail address, the site sends a short record to our server (the page, the searched dates and size, how many bikes were free, the booking step and its value, the type of device, the browser language and how fast the page loaded). No cookies are used and nothing is stored in your browser for this. We do not store your IP address or any identifier that could recognise you later; the records of one visit are linked only by a random number that disappears when you leave or reload the page. We keep these statistics for up to 26 months (legitimate interest, Art. 6(1)(f) GDPR).
We also use Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore), which counts visits and where they come from without cookies and without storing anything in your browser.
We do not use advertising or tracking cookies, so you will not see a cookie banner on our website.
Maps, delivery calculator and weather
Some pages load content directly from other services, which then receive your IP address, as with any website: map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom) and satellite images from Esri (USA). The address you type into the delivery calculator is sent to the Photon address search (komoot GmbH, Germany) and its coordinates to the OSRM routing service (FOSSGIS e.V., Germany) to calculate the driving time. Route pages load weather forecasts from Open-Meteo (Switzerland), some images come from Unsplash (USA) and video previews from YouTube (Google, USA). The reviews shown on our pages come from our public Google Business Profile.
Strava
If you connect your Strava account to our route leaderboard, we receive your Strava athlete ID, your name and the activities you ride on our routes from Strava Inc. (USA), and we show your times on the leaderboard. Connecting is your choice (consent, Art. 6(1)(a) GDPR) and you can disconnect at any time.
Hosting and security
The website and our booking system are hosted by WEDOS Internet, a.s. (Czech Republic), whose servers keep technical logs (such as the IP address, the time and the requested page) for a limited time for security reasons. All connections to our website are encrypted (HTTPS), our systems are protected by access controls and our backups are encrypted.
Storage in your browser
The website stores only what it needs to work, which requires no consent: the bikes in your trip and the dates you last searched (session storage, deleted when you close the browser tab), your chosen language (a cookie named preferred_locale, kept for one year) and, if you connect Strava, your Strava connection (local storage).
Who receives your data
Besides the providers named above, who process data on our behalf, we pass on your data only where necessary: to our tax advisor for accounting, to the tax authority, and, in the case of theft, an accident or unpaid damage, to the police, the courts or a lawyer. We never sell your data.
Transfers outside the EU
Some of the services above are based outside the European Union (United Kingdom, Switzerland, USA, Singapore). These transfers rely on an adequacy decision of the European Commission (United Kingdom, Switzerland, and US companies certified under the EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses.
How long we keep data
- Rental contracts, invoices and payment records: 6 years, as required for accounting and tax purposes.
- Identity document copies and booking details: as long as needed to settle the rental and any claims arising from it (deposit, damage, theft), within the statutory limitation periods.
- Original copies of online booking requests: deleted 6 months after the rental has ended.
- Contact form messages: 12 months.
- Anonymous website statistics: up to 26 months.
- Encrypted backups: up to 12 months.
Your rights
You can ask us for access to your data, its correction or deletion, restriction of processing and a copy of your data (portability), and you can object to processing based on legitimate interest. Where you gave consent (Strava), you can withdraw it at any time. Write to contact@doctorbicycles.com ; we answer within one month. Some data, such as invoices, we must keep by law even if you ask for deletion. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).
Changes to this page
We update this page when the way we process data changes; the date at the top shows the current version. The English version is the original; the other language versions are translations.