Privacy policy

DUTCHFELLAS SL, CIF B24804486, Calle Ancla 42, La Cala del Moral, 29720 Málaga, Spain, is the controller of the personal data described here. DUTCHFELLAS SL trades as DutchFellas and operates bike rentals, guided tours and long term rentals in Málaga, Spain.

For any privacy question or request, write to rentals@dutchfellas.eu. Partner related privacy questions can go to partners@dutchfellas.eu.

Booking data: name, email address, phone number, language, the location, dates and times you selected, the bikes and accessories you booked, prices and the status of your booking.

Identity data: for rentals, tours and long term rentals that require it, an identity document that you upload or that we register at the counter. These documents are stored privately and are only visible to authorised staff.

Contract data: the version of the rental or tour document you accepted, the moment of acceptance and your signature where a signature is required.

Payment references: the payment status and the identifiers returned by our payment provider. DutchFellas never receives or stores your full card number or bank credentials.

Account data: for staff and partner accounts, the email address, role and authentication data managed by our authentication provider.

Partner data: application details, contact data, the referral codes assigned to you, the bookings attributed to you, commission records and payout records.

Referral data: when you arrive through a partner link or QR code we store the referral code, an anonymous visitor key and the landing page, so a booking can be attributed correctly.

Support data: the content of contact requests you send us.

Technical data: server and security logs, and the technical storage described below.

To prepare and perform your rental, tour or long term rental agreement, including availability, allocation of a physical bike, handover and return. Legal basis: performance of a contract.

To take payment, issue refunds where they apply and keep the corresponding records. Legal basis: performance of a contract and legal obligations.

To verify identity and age where our rental or tour conditions require it, and to protect our fleet against theft and misuse. Legal basis: performance of a contract and legitimate interest.

To run the partner programme, attribute bookings, calculate commissions and prepare payouts. Legal basis: performance of a contract.

To answer questions you send us. Legal basis: legitimate interest.

To keep the platform secure and to prevent abuse and fraud. Legal basis: legitimate interest.

To meet accounting and tax obligations. Legal basis: legal obligation.

Our payment provider, Stripe, processes card and wallet payments and holds the payment data itself. We only receive the result and a reference.

Our email provider, Resend, delivers booking confirmations, contract copies, account emails and partner emails.

With your analytics consent only, Google Analytics 4 and Microsoft Clarity (project yai2i6ccvp) measure anonymised website use. Clarity records masked, anonymised session replays and heatmaps of public pages, never staff, partner portal, identity, contract or booking confirmation pages, and all form input stays masked. Microsoft explains its handling at https://privacy.microsoft.com/privacystatement.

Our hosting, database and authentication infrastructure stores the platform data described above and runs the website.

Authorised DutchFellas staff use an internal administration to prepare handovers, returns, contracts and support.

We do not sell your personal data and we do not share it for third party advertising.

Our providers may process data outside the European Economic Area. Where that happens, the transfer relies on the safeguards offered by those providers, such as the European Commission standard contractual clauses.

Booking, contract, payment and commission records are kept for as long as the agreement runs and afterwards for the period required by Spanish accounting and tax law.

Identity documents are kept only while they are needed for the rental or tour they belong to, plus the period needed to settle damage, loss or a legal claim.

Referral and technical log data is kept for a limited period for attribution and security purposes.

In general we keep personal data only for as long as it is necessary to provide the service, manage the customer or partner relationship, handle disputes, prevent fraud and protect our systems, and comply with applicable accounting, tax and other legal obligations. When it is no longer necessary, the data is deleted or anonymised.

Access to customer, contract and partner data is restricted by role and enforced on the server, not only in the interface. Identity documents are stored in private storage that is not publicly reachable. Payment credentials never reach our systems.

The website uses technical storage that is necessary for it to work: your language choice, your session when you are logged in, and a first party referral attribution value when you arrive through a partner link.

We do not use advertising cookies and we do not build advertising profiles.

You can ask for access, correction, deletion, restriction, portability, and you can object to processing based on a legitimate interest. Where processing is based on consent, you can withdraw it at any time.

Write to rentals@dutchfellas.eu and we will answer within the period required by law. You also have the right to complain to the Spanish data protection authority.

When this policy changes we publish the new version on this page with a new date.

We use necessary cookies and browser storage for your session, language routing, booking and checkout state, security and first party partner referral attribution. Optional preferences, analytics and embedded media technologies only run after you accept them, and you can change or withdraw that choice at any time through Cookie settings in the footer.

Each technology, its purpose and its retention are listed in our cookie policy.