Last updated: April 2026
1. Data Controller
| Company name | Tournride S.L. |
| Tax ID (CIF) | B70189816 |
| Registered address | Rúa de Laverde Ruiz, 5, Santiago de Compostela, 15702 A Coruña (Spain) |
| Commercial Registry | Santiago de Compostela, Volume 31, Sheet 193, Section 8, Page SC 44131 |
| GDPR contact | rgpd@tournride.com |
| General contact | info@tournride.com |
2. Data We Process and Purposes
2.1 Booking management and service delivery
Data collected: full name, identity document (ID card/passport), email address, phone number, delivery address, return address, payment data (processed by the payment provider; Tournride does not store card data).
Purpose: manage the booking, coordinate delivery and pickup of the equipment, communicate changes, incidents and operational notices related to the contracted service.
Legal basis: performance of a contract to which the data subject is a party (art. 6.1.b GDPR).
Retention period: for the duration of the contract and, once terminated, for the applicable legal periods (5 years for commercial obligations, 4 years for tax obligations).
2.2 Own commercial communications
Data collected: email address, name.
Purpose: sending commercial communications about Tournride’s products and services (offers, news, seasonal campaigns).
Legal basis: legitimate interest derived from a pre-existing contractual relationship (art. 6.1.f GDPR; art. 21.2 Spanish LSSI), with the right to object at any time. For users who have not previously contracted the service, processing is based on consent (art. 6.1.a GDPR).
Retention period: until the data subject withdraws consent or exercises their right to object.
2.3 Handling enquiries and contact requests
Data collected: name, email, phone and any data the user voluntarily includes in their message.
Purpose: responding to enquiries submitted via the contact form, email or phone.
Legal basis: data subject’s consent (art. 6.1.a GDPR) or, where the enquiry is pre-contractual, execution of pre-contractual measures at the data subject’s request (art. 6.1.b GDPR).
Retention period: the time necessary to resolve the enquiry and, afterwards, the statute of limitations period for any derived legal action.
2.4 Delivery location (third parties: accommodations and reception points)
Data collected: establishment name, address, contact name and email of the delivery or return location selected by the customer.
Purpose: coordinating with the reception point the delivery and pickup of the rented equipment, notifying them of the date and shipping method.
Legal basis: Tournride’s legitimate interest in performing the contract with the customer (art. 6.1.f GDPR). Communicating these data to the establishment is necessary for the correct delivery of the service.
Retention period: the time required to complete delivery and return of the equipment, unless incidents require additional retention.
2.5 Assistance call recordings (Tournride Full Assistance)
Data collected: voice of the data subject, details of the reported incident.
Purpose: recording assistance calls on the road to document the incident, ensure service quality and provide traceability in the event of a dispute.
Legal basis: Tournride’s legitimate interest (art. 6.1.f GDPR) and contractual obligation under the service terms, which the customer is informed about before the call.
Retention period: 1 year from the recording, unless an unresolved dispute requires further retention.
2.6 Web browsing and cookies
Data collected: IP address, browsing data, interaction data with the website.
Purpose: technical operation of the website, performance analysis and, subject to prior user consent, personalisation and advertising.
Legal basis: legitimate interest for strictly necessary technical cookies; consent (art. 6.1.a GDPR) for all other cookies.
For more information see our Cookies Policy.
3. Data Recipients
Tournride does not share personal data with third parties except in the following cases:
- Shipping carriers (SEUR, MRW or equivalent operators): strictly the data required to manage delivery and pickup of the equipment (recipient name, address, contact phone). They act as data processors or recipients, as applicable.
- Payment providers (payment gateway used in online booking): process payment data under their own privacy policies; Tournride does not access or store card data.
- Tournride Full Assistance insurer: when the customer has contracted this service and activates assistance, the data needed to manage the claim is shared.
- Partner travel agencies and tour operators: only when the customer has booked through these intermediaries and it is necessary to coordinate the service.
- Legal obligation: when required by law or judicial order.
Tournride does not sell, rent or share personal data for third-party commercial purposes.
4. International Data Transfers
As a general rule, Tournride does not carry out international data transfers outside the European Economic Area (EEA).
Where a technology service provider (web analytics, email services, etc.) involves a transfer to a third country, this is done exclusively with providers offering adequate safeguards under art. 46 GDPR (European Commission adequacy decisions, Standard Contractual Clauses or equivalent mechanisms). Details of transfers derived from cookies and social login (Google, Kakao, etc.) are set out in the Cookies Policy.
5. Data Subject Rights
The data subject may exercise the following rights at any time:
- Access: find out what personal data Tournride processes about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”): request deletion of your data when, among other cases, they are no longer necessary for the purpose for which they were collected.
- Restriction of processing: request suspension of processing in certain circumstances.
- Portability: receive your data in a structured, commonly used format and transmit it to another controller.
- Objection: object to processing based on legitimate interest, including the use of your data for commercial communications.
- Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
How to exercise them: send a written request to rgpd@tournride.com stating your full name, a copy of your ID and the right you wish to exercise. Tournride will respond within a maximum of one month from receipt of the request, extendable by two additional months in cases of particular complexity.
Complaint to the supervisory authority: if you consider that the processing of your data does not comply with the applicable regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es.
6. Security Measures
Tournride has implemented the technical and organisational measures required to guarantee the security of personal data and prevent their alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data stored and the risks to which they are exposed.
7. Minors
Tournride’s services are not directed to persons under 18. Tournride does not knowingly collect personal data from minors. If you become aware that a minor has provided personal data without parental consent, please notify rgpd@tournride.com for immediate deletion.
8. Changes to this Privacy Policy
Tournride reserves the right to amend this Privacy Policy to reflect legislative or case-law changes or updates to its services. Any material change will be communicated to users with sufficient notice via the website or email. The current version will always be available at www.tournride.com/es/politica-de-privacidad/.
9. Applicable Law
This Privacy Policy is governed by:
- Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), of 27 April 2016.
- Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).
- Spanish Law 34/2002, of 11 July, on Information Society Services and E-Commerce (LSSI-CE).
You may also consult our Cookies Policy and our Legal Notice.
Translations of this document are provided as a courtesy. The Spanish version is the only legally binding one.
