Legal · Supercars Barcelona
Privacy policy
What personal data Supercars Barcelona collects when you book, why, who receives it (Stripe, the police rental register, our email provider), how long it is kept and your rights under the GDPR.
Last updated
This policy explains how Supercars Barcelona (the "controller") processes personal data on supercars.barcelona and in the course of a rental, under Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018. Contact for anything in this policy: [email protected].
What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, phone, delivery and return addresses, dates, notes you add | Taking, reviewing, confirming and performing your booking; answering you | Performance of a contract (art. 6.1.b) | 6 years after the rental (accounting and tax law) |
| Payment details | Charging the booking, the deposit pre-authorisation and any amounts due | Performance of a contract | Handled by Stripe; we keep only the Stripe identifiers and the amounts |
| Driving licence and identity document of each driver (copies or details) | Verifying eligibility; the police rental register; identifying the driver of a fine | Legal obligation (art. 6.1.c: RD 933/2021, traffic law) and contract | 3 years (RD 933/2021), then deleted unless a claim is open |
| Handover photographs, odometer and fuel readings | Evidence of the vehicle's condition | Legitimate interest in documenting the rental (art. 6.1.f) | 1 year after the rental, or until a claim is closed |
| Emails we send you and their delivery status | Proof of what was sent, and honouring opt-outs | Legitimate interest; legal obligation for opt-outs | 2 years |
| Technical data of the website (see the cookie policy) | Serving the site securely | Legitimate interest | See the cookie policy |
We do not use your data for automated decisions with legal effects, and we do not sell it.
Who receives it
- Stripe Payments Europe, Ltd. (Ireland) processes payments, the deposit pre-authorisation and refunds, and issues the invoice. Stripe is an independent controller for the payment itself and acts under its own privacy policy.
- Mossos d'Esquadra (Generalitat de Catalunya) receives the details of every rental — renter, drivers, licence numbers, pick-up and return places and dates — within 24 hours, under Royal Decree 933/2021.
- Traffic authorities receive the identity of the driver when a fine is notified to us, as the law requires.
- Our insurer receives the details needed to insure the rental and to handle a claim.
- Email and hosting providers (SendGrid for transactional email, DigitalOcean for hosting, in the EU where available) process data on our behalf under data-processing agreements.
- Google Maps may receive the address you type in the checkout, only to suggest completions, if that feature is enabled in your browser session.
Data may be transferred outside the EEA only under the European Commission's standard contractual clauses or an adequacy decision.
Your rights
You may ask us to access, correct, delete or export your data, to restrict or object to its processing, and you may withdraw consent where consent is the basis, by writing to [email protected]. We answer within one month. Data we must keep by law (the rental register, invoices) is retained even if you ask for deletion, and then deleted. You may complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).
Security
Data is stored in encrypted databases in the EU, accessible only to staff who need it; access to the back office is protected by a personal password and every sign-in is recorded. Payment card numbers never touch our systems.
Changes
We update this policy when our processing changes and show the date at the top. Material changes are announced by email to customers with an open booking.