Skip to Content

Privacy Policy

Last updated: 11 May 2026

At Bicicletes Sancho, S.L. (hereinafter, "Sancho Bikes") we value your privacy and are committed to protecting your personal data in accordance with EU Regulation 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data (LOPDGDD) and Law 34/2002 on Information Society Services (LSSI-CE).

1. Data controller

  • Company name: Bicicletes Sancho, S.L.
  • Spanish Tax ID: B07864325
  • Address: C/ Es Molins, 30 — 07560 Cala Millor (Son Servera, Balearic Islands, Spain)
  • Phone: +34 971 813 760
  • Email: info@sanchobikes.com

You can exercise your rights or resolve any privacy-related question by writing to info@sanchobikes.com.

2. Data we collect and purposes

We process your personal data only when necessary and always on a legal basis. The specific purposes are:

2.1. Bookings (bike rental, tours and services)

  • Data: first name, last name, email, phone, dates and time slot of the booking, language, payment data (handled by our payment gateway; we do not store card numbers).
  • Purpose: manage the booking, contact you to confirm availability, charge the service and issue the invoice.
  • Legal basis: performance of a contract (art. 6.1.b GDPR).
  • Retention: for the duration of the contractual relationship and afterwards for the periods required by tax and commercial law (up to 6 years, Spanish Commercial Code).

2.2. Contact form / email

  • Data: name, email, message.
  • Purpose: answer your enquiry.
  • Legal basis: consent (art. 6.1.a) or legitimate interest in responding (art. 6.1.f).
  • Retention: 12 months after last communication, unless it leads to a commercial relationship.

2.3. Newsletter and commercial communications

  • Data: email, name, language.
  • Purpose: send you news, offers and content about cycling tourism in Mallorca.
  • Legal basis: explicit consent (art. 6.1.a GDPR and art. 21 LSSI-CE).
  • Retention: until you withdraw your consent. You can unsubscribe from every email we send.

2.4. Website navigation and analytics

  • Data: IP address, browser type, pages visited, time on site, referral source.
  • Purpose: measure audience, improve the website and prevent security incidents.
  • Legal basis: consent through analytics cookies (see Cookie Policy) and legitimate interest in security.
  • Retention: 14 months (Google Analytics).

2.5. Social media interactions

  • Data: public identifier of your profile, comments, likes, direct messages.
  • Purpose: manage our presence on Facebook, Instagram, YouTube, LinkedIn and X, respond to your interactions and measure the impact of our publications.
  • Legal basis: consent when you follow our profiles and legitimate interest in commercial outreach.
  • Retention: while you keep the interaction or the platforms retain the data.

3. Recipients and data processors

We do not sell or assign your data to third parties for commercial purposes. We do share strictly necessary data with the following suppliers, acting as data processors under contract pursuant to art. 28 GDPR:

  • Joystree (booking engine embedded in the website).
  • Payment gateways (Stripe / Redsys, depending on the payment flow).
  • Google LLC (Google Analytics, YouTube embed, Google Maps; with Standard Contractual Clauses and EU-US Data Privacy Framework).
  • Meta Platforms Ireland Ltd. (Facebook, Instagram).
  • LinkedIn Ireland Unlimited Company and X Corp.
  • Transactional email provider for booking confirmations and communications.
  • Tax and accounting advisor for fulfilling tax obligations.

Some providers are located outside the European Economic Area (United States). In those cases, transfers are made under the safeguards provided in arts. 44 et seq. of the GDPR (Standard Contractual Clauses of the European Commission or EU-US Data Privacy Framework).

4. Your rights

You can exercise the following rights at any time:

  • Access: know which of your data we process.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure ("right to be forgotten"): have us delete your data when no longer necessary.
  • Object: object to processing for reasons relating to your particular situation.
  • Restriction: request that we limit processing in specific cases.
  • Portability: receive your data in a structured, commonly used format.
  • Not be subject to automated decisions, including profiling.
  • Withdraw consent at any time, without retroactive effect.

To exercise these rights, email info@sanchobikes.com stating which right you are exercising and attaching a copy of your ID document. We will respond within one month.

If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan, 6 — 28001 Madrid.

5. Security and retention

We apply appropriate technical and organisational measures to ensure data security: TLS encryption on the website, database access control, periodic backups and access restricted to authorised personnel only.

We keep your data for the periods stated for each purpose and, in any case, for the legally required terms. After that period, data is irreversibly deleted or anonymised.

6. Minors

Our services are aimed at people aged 14 and over. If you are under 14, we need parental or legal guardian consent to process your data. We do not knowingly collect data from minors under 14; if we detect that a minor has provided data without parental consent, we will delete it.

7. Changes to this policy

We may update this Privacy Policy to reflect legal or operational changes. The current version will always be published on this page with the update date. We recommend you check it periodically.

See also our Legal Notice, Cookie Policy and Data Deletion page.