Privacy policy

1. Who processes your data NOSTRUM BIKES SL (Cycles 17001), NIF B66194952, Gran Via de Jaume I, 5, 17001 Girona. Privacy contact: cycles@cycles17001.com.

2. What data we process, why and on what legal basis

• Online purchases: name, email, phone, address and order details, to manage the order, payment, delivery, invoice and warranties. Card details are processed directly by the payment gateway; we never see them. Legal basis: performance of the contract and legal obligations, such as tax.
• Bike rental: name, ID card, NIE or passport number, nationality, address, phone, email, dates and rented bike, to prepare and sign the contract and manage pickup, return and deposit. Legal basis: performance of the contract.
• Online contract signature: date, time, IP address and browser used to sign, to be able to prove who signed the contract and when. Legal basis: legitimate interest in keeping proof of the contract.
• Contact and complaints: the data you send us by email, WhatsApp or form, to reply to you. Legal basis: your request and, for complaints, legal obligation.
• Email news: your email, to send you news and offers, only if you tick the box. Legal basis: your consent, which you can withdraw at any time.
• Browsing: technical data and cookies. See the Cookie policy.

We do not ask for or keep a copy of your ID: we only note its number and check it at the shop when you pick up the bike.

3. Automation and artificial intelligence Some processes are automated to make things faster:

• When you rent a bike, we automatically email you the contract with your details and, if you sign it online, the signed copy as a PDF.
• When you buy, our team receives an internal notice to record the sale and, if you ask for it, we email you the invoice.

These automations only send documents and notices. No automated decisions with legal effects are made about you and no profiling takes place. There is always a person behind it.

We use artificial intelligence tools only to help us write bike descriptions and prepare their photos. Your personal data is not sent to any artificial intelligence tool.

4. How long we keep data

• Purchases, rentals and contracts: for as long as the relationship lasts and then for the legal periods (generally 6 years for accounting and tax records).
• Online signature record: for as long as the contract is kept.
• Enquiries: for the time needed to deal with them.
• Email news: until you unsubscribe.

5. Who else has access to the data We do not sell or share your data. We only disclose it to public authorities when required by law, for example the tax authorities. To provide the service we use these providers, which process data on our behalf under a data processing agreement:

• Shopify International Ltd. (Ireland, EU): online shop and orders. It may transfer data to Canada and the USA with appropriate safeguards.
• Shopify Payments (Stripe Payments Europe, Ltd.) (Ireland, EU): order payments.
• cdmon (10DENCEHISPAHARD, S.L.) (Spain): shop email.
• Hostinger International Ltd. (Cyprus, EU): server running the contract, notice and invoice automations.
• BikeCRM (Spain): invoicing and shop management.

6. Your rights You can request access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw your consent, by writing to cycles@cycles17001.com. We will reply within one month. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

7. Minors You must be of legal age to buy or rent. For rentals for minors, the contract is signed by their mother, father or guardian.

8. Security and changes We apply technical and organisational measures to protect your data. We may update this policy; the current version is always the one published on this page. Last updated: 27 October 2026.