Privacy Policy

1. Data Controller

Mobemos Hub SL (trading as Castelier Mobility)
Marbella, Málaga, Spain
Email: castelier@mobemos.com

Mobemos Hub SL (“we”, “us”, “the operator”) is the data controller responsible for your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spain’s Ley Orgánica 3/2018 (LOPDGDD).

2. What Data We Collect

Booking data: full name, email address, phone number, country of residence.

Rental compliance data (RD 933/2021): as required by Spanish law, the lessor of each vehicle must report certain renter and vehicle data to the Dirección General de la Policía via the SES.HOSPEDAJES platform. This includes your full name, nationality, date of birth, and document number (passport or ID), together with vehicle and transaction details. Spanish law requires this record to be retained for three years.

Under implementation. Our automated SES reporting integration is being built and must be active before live rentals commence. This section describes the legal obligation as it will apply.

Vehicle usage data: mileage readings at pickup and return, delivery location, rental dates.

Communication data: messages exchanged via WhatsApp or email for booking confirmation and customer support.

Technical data: IP address, browser type, and language preference when visiting our website. We use cookies only for essential site functionality and analytics (see Section 7).

3. Legal Basis for Processing

Contract performance (Art. 6(1)(b) GDPR): processing necessary to fulfill your rental booking.

Legal obligation (Art. 6(1)(c) GDPR): compliance with RD 933/2021 (SES reporting to Spanish police) and Spanish tax regulations.

Consent (Art. 6(1)(a) GDPR): for optional marketing communications. You may withdraw consent at any time.

Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, dispute resolution, and service improvement.

4. How We Use Your Data

Your personal data is used to process and confirm your rental booking, deliver and collect the vehicle at the agreed location, comply with Spanish rental reporting obligations (SES/RD 933/2021), communicate with you about your booking via WhatsApp or email, issue invoices and process deposits, resolve disputes related to vehicle condition or rental terms, and improve our services.

5. Data Sharing

Spanish authorities: Dirección General de la Policía (via SES) as required by RD 933/2021.

Service providers: Supabase (database hosting, Frankfurt, Germany), Vercel (website hosting, EU region), Stripe (payment processing), WhatsApp/Meta (communication). All providers are GDPR-compliant with appropriate data processing agreements in place.

Insurance partners: if you select a protection package, your name and rental details may be shared with the relevant insurer.

We never sell your personal data to third parties.

6. Data Retention

Booking data: retained for 5 years after the rental period ends, as required by Spanish commercial and tax law.

SES compliance data (RD 933/2021): retained for three years as required by Spanish law, then deleted.

Communication records: retained for 2 years for dispute resolution purposes.

Website analytics: anonymized after 14 months.

7. Cookies

Our website uses only essential cookies required for site functionality (session management, language preference). We use Google Analytics 4 for anonymized usage statistics. No advertising or tracking cookies are used. You can disable analytics cookies via your browser settings.

8. Your Rights

Under GDPR, you have the right to:

Access your personal data and receive a copy.

Rectification of inaccurate or incomplete data.

Erasure (“right to be forgotten”) where no legal retention obligation applies.

Restriction of processing in certain circumstances.

Data portability — receive your data in a structured, machine-readable format.

Object to processing based on legitimate interest.

Withdraw consent at any time for consent-based processing.

To exercise any of these rights, contact us at castelier@mobemos.com. We will respond within 30 days.

9. Supervisory Authority

You have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.

10. International Transfers

Your data is processed within the European Economic Area (EEA). Our database is hosted in Frankfurt, Germany (Supabase). Our website is served from EU edge nodes (Vercel). No data is transferred outside the EEA without appropriate safeguards.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via our website. The “last updated” date at the top of this page indicates the most recent revision.

12. Contact

For any questions about this privacy policy or your personal data, contact:
Mobemos Hub SL
Email: castelier@mobemos.com
Marbella, Málaga, Spain