Privacy policy
Draft — under legal review.
This policy explains what personal data is processed through this website, for what purposes, on what legal basis, for how long, and what rights data subjects have, under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Portuguese law.
1. Data controller
Rosado & Mira Bicicletas, Lda, trading as BejaBikeStore.
- Tax and company number (NIPC): 513649123
- Address: Largo Escritor Manuel Ribeiro, n.º 12, 7800-421 Beja, Portugal
- Email: geral@bejabikestore.pt
- Telephone: +351 284 323 193
2. Data processed, purposes and legal bases
2.1 Rental booking requests and guided tour requests
- Data: name, email address, telephone number, requested dates, bikes or type of bike, number of people, and any notes the data subject chooses to add.
- Purpose: to review the request, check availability, reply, confirm or decline the booking and, once confirmed, perform the rental contract or the tour.
- Legal basis: steps taken at the data subject's request prior to entering into a contract, and performance of the contract (Article 6(1)(b) GDPR).
2.2 Contact form messages
This includes messages sent through the "I'm interested" button on a used bike.
- Data: name, email address, telephone number (optional), the message and, where applicable, the item it refers to.
- Purpose: to answer the request for information or for an appointment and, for a used item, to follow up on the interest shown.
- Legal basis: steps taken at the data subject's request prior to entering into a contract, where the message concerns a purchase, a rental or a service (Article 6(1)(b) GDPR); otherwise, BejaBikeStore's legitimate interest in replying to those who contact it (Article 6(1)(f) GDPR).
2.3 Technical data
- Data: IP address and technical request data (date, time and page requested).
- Purpose: website security, prevention of abuse and automated submissions, and limiting the number of requests from a single source.
- Legal basis: legitimate interest in keeping the website secure and available (Article 6(1)(f) GDPR). The IP address is used only briefly for these purposes.
2.4 Required fields
Fields marked as required are needed to respond to the request; without them, it cannot be dealt with. There is no automated decision-making: every request is reviewed by the shop.
3. What this website does not do
- It does not take payments or collect payment data. Payment is made at the shop on pick-up.
- It does not use analytics or visitor statistics tools, and it shows no advertising.
- It does not load scripts, fonts, maps or any other content from third parties, including Google, and it has no social media buttons or trackers.
- It does not send marketing communications.
4. Recipients
Data is processed by BejaBikeStore and may be disclosed to:
- the website hosting provider (server located in the European Union), acting as a processor;
- the email service provider, when replies are sent by email, also acting as a processor;
- public authorities, where required by law.
Data is not sold or disclosed to third parties for their own purposes.
5. International transfers
Data is not transferred outside the European Union or the European Economic Area.
6. Retention periods
| Data | Period |
|---|---|
| Booking or tour requests that did not lead to a rental or tour | up to 12 months after the request |
| Records of rentals and tours carried out | for as long as needed to perform the contract; thereafter, for the period required by tax and accounting law (up to 10 years for invoicing documents) |
| Contact form messages | up to 24 months after the last exchange |
| Technical security logs | up to 30 days |
At the end of these periods, data is deleted or anonymised.
7. Security
BejaBikeStore applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or improper disclosure, including encrypted connections (HTTPS) and access restricted to those who need it.
8. Data subjects' rights
Under the GDPR, data subjects have the right to:
- access the data concerning them;
- rectification of inaccurate or incomplete data;
- erasure of data that is no longer needed or has no legal basis for processing;
- restriction of processing;
- portability of the data they provided, in a structured, commonly used format;
- object to processing based on legitimate interest;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, write to geral@bejabikestore.pt or visit the shop. A reply will be given within one month, which may be extended in the cases provided for in the GDPR. Information may be requested to confirm the identity of the person making the request.
9. Complaints to the supervisory authority
Data subjects have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
10. Cookies
This website uses technical cookies only. Details are in the cookie policy.
11. Changes to this policy
This policy may be updated, for example if the website starts processing new data. The version in force is always the one published on this page.
12. Contact
For any question about this policy or about the processing of personal data:
- Email: geral@bejabikestore.pt
- Telephone: +351 284 323 193
- Address: Largo Escritor Manuel Ribeiro, n.º 12, 7800-421 Beja, Portugal
- Contact page