Privacy Policy
Who we are
Mandry Cabrio (“we”, “us”) operates a car rental service in Tenerife, Canary Islands, Spain, and the website you are visiting. This policy explains what personal data we collect, why, and what rights you have under the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD) and Royal Decree 933/2021.
What data we collect
- Booking request data: name, email, phone/WhatsApp number, rental dates, pickup and return locations, hotel name, flight number, comments you send us.
- Rental contract data: when you collect a vehicle, Spanish law (Royal Decree 933/2021) requires us to register identity and rental details of the driver.
- Technical data: IP address and basic browser information when you visit the site; cookies as described in our Cookie Policy.
Why we process it (legal basis)
- To handle your booking and rental contract — performance of a contract (Art. 6(1)(b) GDPR).
- To report rental data to the Spanish Ministry of Interior (SES.HOSPEDAJES system) — legal obligation (Art. 6(1)(c) GDPR, RD 933/2021). This reporting is mandatory for all car rental companies in Spain.
- To send you occasional offers and travel tips — only with your separate, explicit consent (Art. 6(1)(a) GDPR). You can withdraw it at any time.
What we never do
- We do not request or store copies of your passport or ID card — in line with AEPD guidance, identity is verified visually at handover.
- We do not sell your data.
- We do not use your data for automated decision-making or profiling.
How long we keep data
Rental registration data is kept for 3 years from the end of the rental, as required by RD 933/2021. Booking requests that do not become rentals are deleted within 12 months. Marketing consent data is kept until you withdraw consent.
Who has access
Your data is processed by our team and the technical providers that host this website and our email (data processors under Art. 28 GDPR agreements). Rental data is transmitted to the Spanish Ministry of Interior as required by law. No transfers outside the EU/EEA take place unless the provider guarantees an adequate level of protection.
Your rights
You may request access, rectification, erasure, restriction, portability of your data, or object to processing at any time — write to us at the email address in the footer. You also have the right to lodge a complaint with the Spanish supervisory authority, AEPD (Agencia Española de Protección de Datos, www.aepd.es).
Contact
For any privacy question, contact us via the details on the Contact page.