Privacy policy

1. Data controller

The controller of the personal data collected through https://www.ridarentals.com and the “rida” rental service is COSTA ODN S.L. (Tax ID pending publication), with registered address at San Pedro de Alcántara, Málaga. You can contact us about any matter relating to your data at reservas@ridarentals.com.

This policy applies in compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

2. Data we process

Depending on your relationship with us, we process the following categories of data:

• Identification and contact data: first and last name, email, phone, country of residence and date of birth.
• Identity document: type (Spanish ID card, NIE, passport, TIE) and number. At pick-up, our staff complete from the original document the data required by the traveller registration rules: nationality, sex, date of birth, document support number, expiry date and address.
• Driving licence: number, categories, issue date and, at pick-up, expiry date and country of issue.
• We do not store images or copies of your documents. The original is checked in person at pick-up and we only record that it was verified, by whom and when. If, to avoid typing errors, our staff read the document data with the tablet camera, the image is processed only in memory and discarded instantly: it is never stored.
• Booking and contract data: vehicle, dates, amounts, booking status, handover and return reports (mileage, fuel, damage), incidents, fines related to the rental and communications.
• Photographs of the VEHICLE’s condition at handover and return (bodywork, wheels, odometer…), with the date, time and location of the premises. No people or documents are photographed.
• Payment data: we never store your card number or CVV. Payment is processed by PAYCOMET, the payment platform of Banco de Sabadell; we only keep a reference (token) that allows us to charge, pre-authorise or refund the amounts provided for in the contract, and the result of each operation.
• Electronic signature and its evidence: your signature stroke, IP address, browser (user-agent), date and time of signing and the version of this policy you accepted.
• Technical browsing and payment data: IP address, access logs required for the security of the service and the connection and device data communicated to your bank for 3-D Secure authentication.

These data are necessary to enter into and perform the rental contract and to comply with the lessor’s legal obligations: without them we cannot accept the booking.

3. Purposes and legal bases

• Managing the booking, the rental contract, the deposit, the handover and return of the vehicle, and communicating with you about them. Basis: performance of the contract (art. 6.1.b GDPR).
• Checking that you hold a valid driving licence for the vehicle, using the data you provide and the in-person verification of the original at pick-up. Basis: performance of the contract and the lessor’s legal obligation to hand over the vehicle only to authorised drivers (arts. 6.1.b and 6.1.c GDPR).
• Keeping the documentary register and reporting the rental data to the Spanish Ministry of the Interior through the SES.HOSPEDAJES platform, as required of companies renting motor vehicles without a driver by Royal Decree 933/2021 of 26 October (in connection with art. 25 of Organic Law 4/2015 on the protection of public safety). Basis: legal obligation (art. 6.1.c GDPR).
• Issuing invoices and complying with tax, accounting and traffic obligations, including identifying the driver to the DGT (Spanish traffic authority) or the local council in the event of a penalty (art. 11 of the consolidated text of the Traffic Law, Royal Legislative Decree 6/2015). Basis: legal obligation (art. 6.1.c GDPR).
• Making, with the tokenised card, the subsequent charges provided for in the General conditions (damage, fine handling, fuel, late return, extensions). Basis: performance of the contract (art. 6.1.b GDPR).
• Strong authentication of payments (3-D Secure) and prevention of card fraud. Basis: legal obligation (payment services regulations, PSD2) and legitimate interest (arts. 6.1.c and 6.1.f GDPR).
• Ensuring the security of the service, preventing non-payment and keeping evidence of the electronic signature, the transactions and the condition of the vehicle to defend against claims. Basis: legitimate interest (art. 6.1.f GDPR).
• Sending you the service’s transactional emails (confirmation, reminders, contract, invoice, charge notices). Basis: performance of the contract. We do not send marketing communications without your prior consent.

4. Recipients and processors

We do not sell or transfer your data to third parties for commercial purposes. The following providers access them as processors, under a contract in accordance with article 28 GDPR:

• Vercel Inc. (USA): website hosting and private storage of files (contracts, invoices and photographs of the vehicles’ condition). International transfer covered by the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Neon Inc.: database, hosted in the European Union (Frankfurt, Germany).
• Resend Inc. (USA): sending of transactional emails, with standard contractual clauses.

We also disclose data to the following recipients, who process them as independent controllers:

• PAYCOMET, the payment platform of Banco de Sabadell, S.A. (Spain), and the bank that issued your card: processing of payments, pre-authorisations, card tokenisation, refunds and 3-D Secure authentication, subject to payment services regulations.
• The Spanish Ministry of the Interior, through SES.HOSPEDAJES: data from the rental’s documentary register (Royal Decree 933/2021), which may be consulted by the law enforcement agencies.
• Other public authorities, courts and law enforcement agencies (DGT, Police, Guardia Civil) when the law requires it, for example to identify the driver responsible for a traffic offence committed during the rental; and the vehicle’s insurer in the event of an accident.

5. Retention periods

• Documentary register data reported to the Ministry of the Interior (identity, document, licence, contract and vehicle data): 3 years from the end of the service, as required by Royal Decree 933/2021.
• Signed contract and evidence of the electronic signature: 5 years from the end of the rental, the limitation period for personal actions (art. 1964 of the Spanish Civil Code).
• Photographs of the vehicle’s condition and handover and return reports: 1 year from the end of the rental if there are no incidents; if there is open damage, an accident or a claim, until it is resolved and the corresponding limitation period has expired.
• Card token: until the rental, the deposit and any pending claims are closed and, at the latest, 12 months after the end of the rental; earlier if you request it and no amounts are outstanding.
• Invoices and accounting data: 6 years (art. 30 of the Spanish Commercial Code) and, in any case, the tax limitation period.
• Audit log of operations on the booking (who did what and when): 2 years.
• Booking and customer data: for the duration of the relationship and, blocked, for the periods above; afterwards they are deleted or anonymised.
• Images of identity documents or driving licences: we do not keep them because we do not collect them. Any uploaded through earlier versions of the booking form are deleted automatically by the scheduled deletion process.

6. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and ask us to delete your stored card details (token) under the terms of the General conditions, by writing to reservas@ridarentals.com from the email address associated with your booking and quoting the booking code. If we cannot identify you with certainty, we may ask you for additional information to verify your identity; we will not ask for copies of your documents.

We will reply within one month at most. Please note that we cannot delete data we are legally required to keep (documentary register, invoices, contract) for as long as that period lasts; in that case they will be blocked and used only to deal with legal liabilities.

If you consider that the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would appreciate it if you wrote to us first so we can try to resolve it.

7. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit (HTTPS) and at rest; data minimisation (we do not store images of identity documents or licences); storage of vehicle photographs, contracts and invoices in a private repository accessible only through short-lived signed links; role-based staff access control with an audit log; and scheduled automatic deletion. Card details are entered and stored only within PAYCOMET’s secure environment; no member of staff has access to your full card number or CVV.

8. Cookies

This site uses only strictly technical cookies and local storage: the session cookie for authorised staff, the language preference and the theme preference (light or dark). We do not use analytics, advertising or third-party cookies, so, in accordance with article 22.2 of the LSSI-CE, it is not necessary to request your consent or display a cookie banner.

9. Minors

The service is aimed exclusively at people over 18. We do not rent vehicles to minors nor knowingly process their data. If we detect that a minor has provided data, we will delete it.

10. Changes to this policy

We may update this policy to adapt it to regulatory or service changes. We will publish the version in force on this page with its date and, if the change is substantial, we will notify you by email if you have an active booking. Current version: 2026-10. The contract you sign when booking records the version you accepted at that time.