Privacy Policy

1. Data Controller

Mobemos Hub SL (trading as Castelier Mobility)
Marbella, Málaga, Spain
Email: castelier@mobemos.com

Mobemos Hub SL (“we”, “us”, “the operator”) is the data controller responsible for your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spain’s Ley Orgánica 3/2018 (LOPDGDD).

2. What Data We Collect

Booking data: full name, email address, phone number, country of residence.

Rental compliance data (RD 933/2021): as required by Spanish law, the lessor of each vehicle must report certain renter and vehicle data to the Dirección General de la Policía via the SES.HOSPEDAJES platform. This includes your full name, nationality, date of birth, and document number (passport or ID), together with vehicle and transaction details. Spanish law requires this record to be retained for three years.

Identity verification data: before vehicle handover, drivers complete an identity verification through our verification provider (Entrust/Onfido). This processes images of your identity document and driving licence, a live facial capture (video), and biometric facial comparison data used to confirm that the document belongs to you. Where you sign the driver declaration electronically, the signed document and its verification record are stored with your booking.

Vehicle usage data: mileage readings at pickup and return, delivery location, rental dates.

Communication data: messages and contact details you leave us — by phone, email or WhatsApp — for booking confirmation and customer support.

Technical data: IP address, browser type, and language preference when visiting our website. Essential cookies are always set; analytics cookies only if you accept them (see Section 7).

3. Legal Basis for Processing

Contract performance (Art. 6(1)(b) GDPR): processing necessary to fulfill your rental booking.

Legal obligation (Art. 6(1)(c) GDPR): compliance with RD 933/2021 (SES reporting to Spanish police) and Spanish tax regulations.

Consent (Art. 6(1)(a) GDPR): for optional marketing communications, and — as explicit consent under Art. 9(2)(a) GDPR — for the processing of biometric data during identity verification, collected at the start of the verification flow. You may withdraw consent at any time.

Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, dispute resolution, and service improvement.

4. How We Use Your Data

Your personal data is used to process and confirm your rental booking, verify the identity and driving licence of drivers before handover, deliver and collect the vehicle at the agreed location, comply with Spanish rental reporting obligations (SES/RD 933/2021), arrange any airport transfer you book with our transfer partner, communicate with you about your booking via WhatsApp or email, issue invoices and process deposits, resolve disputes related to vehicle condition or rental terms, and improve our services.

5. Data Sharing

Spanish authorities: Dirección General de la Policía (via SES) as required by RD 933/2021.

Service providers: Supabase (database hosting, Frankfurt, Germany), Vercel (website hosting), Stripe (payment processing), Entrust/Onfido (identity verification and electronic signing), Resend (transactional email), WhatsApp/Meta (communication), and Google Analytics (only where you have accepted analytics cookies — see Section 7). Each provider processes data under a data processing agreement; for transfers outside the EEA, see Section 10.

Transfer service partners: where you book an airport transfer, we share the details needed to perform the journey — your name, phone number, flight number, route and vehicle class — with the transfer operator carrying out the service (currently Luxury Transfer AO, Estepona/Marbella, Spain), solely for that purpose.

Insurance partners: your name and rental details may be shared with the relevant insurer where cover is arranged through a third party — for example third-party liability, which is included with every rental.

We never sell your personal data to third parties.

6. Data Retention

Booking data: retained for 5 years after the rental period ends, as required by Spanish commercial and tax law.

SES compliance data (RD 933/2021): retained for three years as required by Spanish law, then deleted.

Communication records: retained for 2 years for dispute resolution purposes.

Identity verification records and signed driver declarations: retained with your booking data (up to 5 years) to comply with rental obligations and to establish, exercise or defend legal claims.

Website analytics: where you have accepted analytics cookies, the data is anonymised and retained for at most 14 months.

7. Cookies

Essential cookies are always set, because the site cannot work without them: your session, your language, your light/dark preference, and your cookie choice itself. These require no consent under Spanish and EU law.

Analytics cookies (Google Analytics 4) are set only if you accept them in our cookie banner. Nothing is loaded before you choose — if you decline, or have not yet answered, no analytics script runs at all. Where analytics is active, your IP address is anonymised.

We use no advertising cookies and no cross-site tracking. You can change or withdraw your choice at any time from the cookie banner, or by clearing this site’s cookies in your browser.

8. Your Rights

Under GDPR, you have the right to:

Access your personal data and receive a copy.

Rectification of inaccurate or incomplete data.

Erasure (“right to be forgotten”) where no legal retention obligation applies.

Restriction of processing in certain circumstances.

Data portability — receive your data in a structured, machine-readable format.

Object to processing based on legitimate interest.

Withdraw consent at any time for consent-based processing.

To exercise any of these rights, contact us at castelier@mobemos.com. We will respond within 30 days.

9. Supervisory Authority

You have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.

10. International Transfers

Your data is stored within the European Economic Area (EEA): our database is hosted in Frankfurt, Germany (Supabase), and our website is served from EU infrastructure. Some of our service providers are, or belong to groups, established outside the EEA (for example in the United States or the United Kingdom), and their processing — including payment processing, identity verification, email delivery, analytics and support — may involve transfers of personal data outside the EEA. Where that happens, the transfer is protected by appropriate safeguards under Chapter V of the GDPR: a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified US providers, and the adequacy decision for the United Kingdom) and/or the European Commission’s Standard Contractual Clauses, with supplementary measures where required. You may request further details of the safeguards used, or a copy where applicable, at castelier@mobemos.com.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via our website. The “last updated” date at the top of this page indicates the most recent revision.

12. Contact

For any questions about this privacy policy or your personal data, contact:
Mobemos Hub SL
Email: castelier@mobemos.com
Marbella, Málaga, Spain