Privacy Policy - CostaDrive.top - Alquiler de coches en Benidorm

1. Introduction

This Privacy Policy describes how CostaDrive (“we”, “us”, or the “Operator”) collects, uses, stores, and protects personal data when you use the website costadrive.top (the “Website”) and related car rental booking and partner services (together, the “Services”).

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Spanish data protection legislation (LOPDGDD).

2. Data controller

The data controller responsible for your personal data is:

CostaDrive
Av. de Alfonso Puchades, 8
03502 Benidorm, Alicante, Spain
Email: costadrive2025@gmail.com
Phone: +34 672 30 02 10

If you operate a business entity with a distinct legal name and tax identification number (NIF/CIF), you should update this section accordingly on your live deployment.

3. Categories of personal data we collect

Depending on how you use the Services, we may process:

Identity and contact data: name, email address, telephone number, postal address;
Booking and rental data: dates, vehicle selection, preferences, messages relating to a reservation;
Account data (e.g. vehicle owners / partners): login credentials (stored in hashed form where applicable), profile and vehicle information, bank or payment details as necessary for settlements;
Technical data: IP address, browser type, device information, approximate location derived from IP, cookies and similar technologies (see our Cookie Policy);
Payment-related data: payments may be processed by our payment service provider (e.g. Stripe); we do not store full card numbers on our servers where processing is delegated to such providers;
Communications: content of emails or messages you send to us.

4. Purposes and legal bases

We process personal data for the following purposes, on the following legal bases under GDPR:

Purpose	Legal basis
Providing the Website, processing bookings, managing accounts	Performance of a contract (Art. 6(1)(b) GDPR); steps prior to contract
Compliance with legal obligations (e.g. tax, accounting)	Legal obligation (Art. 6(1)(c))
Security, fraud prevention, improvement of the Services	Legitimate interests (Art. 6(1)(f)), where not overridden by your rights
Marketing communications (where applicable)	Consent (Art. 6(1)(a)) or legitimate interests, as required by law

5. Recipients and processors

We may share data with:

Hosting and infrastructure providers;
Payment processors (e.g. Stripe);
Email or communication tools;
Professional advisers (lawyers, accountants) where necessary;
Public authorities when required by law.

We use processors only under written agreements that require them to protect personal data in line with GDPR.

6. International transfers

If personal data is transferred outside the European Economic Area, we ensure appropriate safeguards (e.g. Standard Contractual Clauses approved by the European Commission) unless an adequacy decision applies.

7. Retention

We retain personal data only as long as necessary for the purposes described, including to satisfy legal, accounting, or reporting requirements. Typical retention periods depend on the nature of the data and statutory limitation periods in Spain.

8. Your rights

Subject to applicable law, you have the right to:

Access your personal data;
Rectify inaccurate data;
Request erasure (“right to be forgotten”) in certain cases;
Restrict processing in certain cases;
Data portability, where processing is based on consent or contract and automated;
Object to processing based on legitimate interests or for direct marketing;
Withdraw consent at any time, where processing is consent-based, without affecting prior lawful processing;
Lodge a complaint with a supervisory authority.

In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD) — www.aepd.es.

To exercise your rights, contact us at costadrive2025@gmail.com. We may need to verify your identity before responding.

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission over the Internet is 100% secure.

10. Children

The Services are not directed at individuals under 16. We do not knowingly collect personal data from children. If you believe we have collected such data, please contact us so we can delete it.

11. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will be revised. Material changes may be notified via the Website or by email where appropriate. Continued use of the Services after changes constitutes acceptance of the updated Policy where permitted by law.