Information pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
Effective from 25 July 2026 | Version 2.0
The controller is Rampup s. r. o., Južná trieda 2881/4B, 040 01 Košice - mestská časť Juh, Company ID 57 692 327, Tax ID 2122883532. Contact e-mail for exercising rights: info@spisbike.sk; telephone: +421 949 233 894. The Controller has not designated a data protection officer because no such obligation arises from the nature and scope of the processing.
| Purpose | Scope of data | Legal basis | Retention |
|---|---|---|---|
| Enquiry and booking | First name, surname, telephone, e-mail, selected bicycle, rental period, price, contents of communications. | Steps prior to entering into a contract and performance of the contract - Art. 6(1)(b) GDPR. | During the booking and for 3 years after its completion or settlement. |
| Rental agreement and report | Identification and contact details, address, date of birth, type and number of identity document,signature, Rider details, bicycle, accessories and their condition. | Performance of the contract - Art. 6(1)(b); protection and enforcement of legal claims - Art. 6(1)(f). | Generally 3 years after full settlement; longer only for the duration of a specific legal claim or proceeding. |
| Payments and accounting | Information on the cash-register or accounting document, amount, date, transaction identifier. SpišBike does not store full payment card details. | Legal obligation - Art. 6(1)(c) GDPR, in particular accounting and tax legislation. | 10 years following the year to which the accounting record relates, unless the law requires a different period. |
| Complaints and legal claims | Contact details, booking, communications, photographs, service documents, information about damage, an accident or theft. | Legal obligation and legitimate interest in protecting and enforcing rights - Art. 6(1)(c) and (f). | During handling and generally 3 years after completion; longer during court, administrative or insurance proceedings. |
| Bicycle location | Location, time, device identifier and link to a particular rental where needed to address an incident. | Legitimate interest in protecting property, preventing theft and investigating failure to return - Art. 6(1)(f). | Ordinary history is not actively evaluated. Incident data for no more than 90 days after closure; longer only for a legal or insurance claim. |
| Website security and essential cookies | IP address, access time, technical log, session settings and cookie choice. | Legitimate interest in website security and operation; necessity for the requested service. | Security logs generally no more than 30 days; cookies according to the period stated in cookie settings. |
| Analytics and marketing tools | Online identifiers and website-use and campaign data only within the particular permitted category. | Consent - Art. 6(1)(a) GDPR and Section 109(8) of Act No. 452/2021 Coll. | According to the specific tool in cookie settings, no longer than until consent is withdrawn or the cookie expires. |
Identity documents: The Controller normally verifies an identity document by inspection and records only data necessary for the contract. A copy of the identity document is not a standard condition of rental. If, exceptionally, a copy is made on the basis of separate consent, that consent must be voluntary, specific and revocable, and the copy shall be deleted immediately when the purpose ceases, no later than within the period stated when consent was obtained.
For location tracking, protection of legal claims and website security, the Controller assesses the legitimate interest, the necessity of processing and the proportionality of the interference with the rights of data subjects. Access to location data is restricted to authorised persons and serious incidents. On grounds relating to their particular situation, the data subject has the right to object to processing under Article 21 GDPR. The Controller shall cease processing unless it demonstrates compelling legitimate grounds or the need for the establishment, exercise or defence of legal claims.
To the extent necessary, data may be disclosed to the following categories of recipients: website hosting and booking-system provider, e-mail and IT service provider, accountant, payment-terminal provider, bicycle service provider, location-technology provider, insurer, legal and tax advisers, courts, the police, the Slovak Trade Inspection, tax authorities and other public authorities where a legal basis exists. Processors process data only on the Controller's instructions and under an appropriate contract.
If a particular analytics, marketing or location-technology provider processes data outside the European Economic Area, the transfer shall take place only where an appropriate legal mechanism exists, in particular an adequacy decision of the European Commission or standard contractual clauses, and after the information obligation has been met. The particular provider, country and transfer mechanism must be stated in the cookie settings or in the information provided when the location technology is used.
Data marked as mandatory in the booking form is required to process the booking. Identification data in the rental agreement and identity verification are contractual requirements; the bicycle cannot be handed over without them. Consent to optional cookies, marketing or making a copy of an identity document is voluntary, and withholding such consent does not prevent booking or rental where identity can be verified by an appropriate, less intrusive method.
The Controller does not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them.
Subject to the conditions of the GDPR, the data subject has the right:
• to access and rectify their personal data;
• to erasure or restriction of processing;
• to data portability where processing is based on a contract or consent and is carried out by automated means;
• to object to processing based on a legitimate interest;
• to withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
• to lodge a complaint with the supervisory authority.
A request may be sent to info@spisbike.sk. The Controller may reasonably verify the applicant's identity and shall respond without undue delay, generally within one month.
The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Center II, Galvaniho 7/B, 821 04 Bratislava, www.dataprotection.gov.sk
© 2026 Spišbike
