Spinly GDPR Information Clauses

General Provisions for GDPR Information Clauses

The controller of your personal data is Yaroslav Bulba, conducting business as a sole proprietor under his own name, Tax ID (NIP): 8943276263, REGON: 543567309, correspondence address: ul. Węgliniecka 21/12, 54-106 Wrocław, hereinafter referred to as “Spinly”.

For matters concerning personal data protection, you may contact us by email at: info@spinly.rent.

The Controller declares that it exercises special care to protect the interests of data subjects and, in particular, ensures that personal data is processed lawfully, fairly, and transparently for the persons concerned.

The Controller collects personal data for specific, explicit, and legally justified purposes and does not further process it in a manner incompatible with those purposes.

Personal data is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

Personal data is accurate and, where necessary, kept up to date.

The Controller stores personal data in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data is processed.

The Controller processes personal data in a manner ensuring appropriate security, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organizational measures.

Taking into account the nature, scope, context, and purposes of processing, as well as the risk of infringement of the rights or freedoms of natural persons of varying likelihood and severity, the Controller implements appropriate technical and organizational measures so that processing is carried out in accordance with GDPR. The Controller applies technical measures to prevent unauthorized persons from obtaining or modifying personal data transmitted by Customers.

Information Clause - Spinly Application, Account, and Rental

In connection with the use of the Website, Application, account, and rental services, the Controller processes Personal Data of Users and Renters for the purpose of creating and managing the account, authentication, profile management, submitting and assessing a rental application, identity verification, concluding and performing the Rental Agreement, assigning a bike, managing payments, Security Deposit, Recurring Subscriptions, and refunds, generating and storing documents, handling signatures submitted in the Application, support, complaints, notifications, returns, service, security, audit, abuse prevention, accounting, legal obligations, and pursuing or defending against claims.

The legal basis for processing is Article 6(1)(b) GDPR for steps taken before entering into an agreement and for performance of an agreement, Article 6(1)(c) GDPR for legal, accounting, and tax obligations, Article 6(1)(f) GDPR for the Controller’s legitimate interests, such as security, property protection, abuse prevention, support, audit, and claims, and, where consent is required, Article 6(1)(a) GDPR.

Providing data required for verification, conclusion, or performance of an agreement is a condition for using the rental service. Refusal to provide such data may prevent conclusion or performance of the agreement.

Information Provided When Placing an Order

In connection with submitting a rental application or managing a rental, the Controller may process first and last name, email, phone number, address, city, postal code, apartment number, date of birth, PESEL, identity document number, photo of the identity document, profile photo, selected plan, bike, battery, accessories, application status, rental dates, payment, Security Deposit, Recurring Subscription, refund data, signature submitted in the Application, and data necessary to generate and store rental documents.

The collected data is used to conclude and perform the agreement with the Customer, verify identity, protect property, manage payments and the Security Deposit, provide information about the rental, payments, return, support, and security, extend or end the rental, settle the bike return, pursue or defend against claims, and fulfill legal, accounting, and tax obligations.

Information will be stored for the period necessary to perform the agreement, settle payments, the Security Deposit, and refunds, fulfill legal obligations, and pursue or defend against claims, in accordance with the retention periods indicated in these clauses and in the Privacy Policy.

Processors, Recipients, and Transfers

Data may be processed by entities acting on behalf of the Controller, in particular providers of cloud infrastructure, authentication, databases, file storage, backend functions, payments, transactional emails, push notifications, hosting, Website analytics, technical support, accounting, legal, and service support. In particular, the Controller may use Firebase/Google, Stripe, Resend, and Firebase Cloud Messaging services if they are necessary for the operation of the Application and Spinly services.

Data may also be disclosed to public authorities, courts, entities handling claims, accounting, taxes, chargebacks, service matters, or other entities authorized by law.

If data is transferred outside the European Economic Area, the Controller applies the required protection mechanisms, in particular an adequacy decision, standard contractual clauses, or other bases provided for by GDPR.

Rights of Data Subjects

The data subject has the right to:

• access Personal Data, including obtaining information about which Personal Data is processed, and to update it
• request rectification and restriction of processing of Personal Data, for example if it is inaccurate
• erase Personal Data, for example where it has been processed unlawfully
• withdraw consents previously granted
• receive a copy of Personal Data undergoing processing, with the exercise of data subject rights generally free of charge. If a request is manifestly unfounded or excessive, in particular because of its repetitive nature, the Controller may charge a reasonable fee based on administrative costs or refuse to act on the request, in accordance with Article 12(5) GDPR
• object to the processing of Personal Data based on necessity for the purposes of legitimate interests pursued by the Controller or by a third party, including in particular processing for marketing purposes
• lodge a complaint with the President of the Personal Data Protection Office

Right to Erasure of Personal Data (“Right to Be Forgotten”)

In cases provided for by law, you have the right to request erasure of Personal Data, and an Application User may also request account deletion.

A request to erase data or delete an account may not be fulfilled in full or may be deferred if further processing is necessary to perform an agreement, settle an active rental, manage an active or unsettled application, handle overdue payments, return or settle the Security Deposit, handle an open support case, fulfill legal, accounting, or tax obligations, prevent abuse, or pursue or defend against claims.

After successful account deletion, the Controller deletes or anonymizes profile data to the possible extent and may delete selected profile and document files if there is no obligation or justified need to retain them further.

Data concerning agreements, signatures, rental history, payments, Security Deposit, refunds, invoices, support, audit logs, security, claims, and legal obligations may continue to be stored for the required period despite account deletion.

Where processing was based on consent, withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Data Retention Period

Where Personal Data is processed on the basis of consent, that consent may be withdrawn at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

In every case, your Personal Data may also be processed for the period necessary to fulfill the Controller’s obligations arising from applicable law and to pursue or defend against potential claims for the limitation period specified by applicable law.

Depending on the scope of Personal Data and the purposes of processing, your Personal Data may be stored for different periods. In every case, the longer retention period applies.

We store limited data to satisfy legal retention requirements for a maximum period of 10 years and documentation of consents granted to us by users for five years in order to ensure compliance and document adherence to applicable law.

We also retain data on the basis of our legitimate interest where there is an unresolved or potential issue, claim, or dispute requiring us to retain data, in particular if we receive a legally binding request or preservation request, or if the data would be necessary in court proceedings.

Detailed Retention Criteria for the Application and Rental

With respect to the Application and rental services, the following retention criteria apply in particular:

• account and profile data are stored for the duration of account use and, after successful account deletion, are deleted or anonymized to the possible extent
• PESEL, identity document number, photo of the identity document, and verification data are stored for the period needed for verification, performance of the agreement, security, property protection, abuse prevention, and claims
• agreements, signatures, PDF files, acceptance history, rental history, checklists, protocols, and service records are stored for the period required for settlements, claims, and legal obligations
• payment, Security Deposit, refund, invoice, Recurring Subscription, chargeback data, and Stripe identifiers are stored for the period required by accounting, tax, regulatory rules, the Payment Processor, and the needs of claims and fraud prevention
• support messages and attachments may be stored as support history, evidence of service performance, or evidence in a matter
• push tokens and notification preferences are stored for the period needed to deliver notifications or until notifications are disabled, the User logs out, the account is deleted, or the token expires
• technical logs, webhook logs, audit logs, administrator roles, and administrative action history are stored for the period needed for security, accountability, technical support, audit, claims, and legal obligations
• backups may contain data for a limited period resulting from the backup cycle

Administrative Panel, Service Records, and Audit Logs

For the purpose of service operation, security, settlements, equipment servicing, access control, and accountability, the Controller processes data in the Administrative Panel, including data concerning users, applications, rentals, bikes, payments, refunds, support, service records, administrative action history, administrator roles and permissions, and audit logs.

Access to the Administrative Panel, identity documents, rental documents, signatures, and payment data should be limited to authorized persons and to the scope necessary to perform their tasks.

Information Clause - Video Surveillance on the Service Provider’s Premises

Pursuant to Article 13(1) and 13(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, we inform you that the controller of the video surveillance system is Yaroslav Bulba, conducting business as a sole proprietor under his own name, Tax ID (NIP): 8943276263, REGON: 543567309, correspondence address: ul. Węgliniecka 21/12, 54-106 Wrocław, hereinafter referred to as “Spinly”.

For matters concerning video surveillance, you may contact us by email at: info@spinly.rent.

Video surveillance consists of recording images, including a Customer’s face and behavior, and is used to protect property and ensure the safety of persons located in the monitored area.

The surveillance system does not record Customer audio.

Surveillance recordings are stored for a maximum period of 90 days.

By using the Service Provider’s premises, the Customer acknowledges that video surveillance is conducted on the premises.

The recipient of Personal Data will be solely the Controller.

Surveillance recordings will be secured and transferred upon the explicit request of public authorities.

Surveillance recordings may be secured and copied to an electronic or physical data carrier to secure the Controller’s civil claims against dishonest Customers or to refer the matter for criminal proceedings before the Police, Prosecutor’s Office, or another law enforcement authority if there is a suspicion that the Customer has violated criminal law.

In such a situation, recordings will be transferred to the competent public authorities and stored by the Controller as evidence in the case until its final conclusion. Recordings will also be transferred to competent public authorities at their request.

The legal basis for processing in the described circumstances is Article 6(1)(c) GDPR in the case of a request from authorities and Article 6(1)(f) GDPR in the case of claims of the Controller or other persons who may have been harmed by the actions of a given person, as well as to ensure the safety of the Controller’s employees and contractors.

You have the right to request access to Personal Data from the Controller, the right to erase or restrict the scope of its processing, and the right to object to its processing.

You have the right to lodge a complaint with the supervisory authority in the event of a breach of GDPR provisions.

Rooms in which surveillance is conducted have been marked visibly and legibly with appropriate graphic signs.

Personal Data collected through video surveillance will not be used for automated decision-making.

Processing of data recorded by video surveillance, even despite consent given by a person present on the premises, is justified by the need to protect the interests of other persons present on the premises and the Controller’s property, which constitutes the legal basis under Article 6(1)(f) GDPR.

The Controller has removed the technical possibility of recording sound using cameras installed in the marked rooms.

All questions concerning the policy or doubts related to Personal Data processing should be sent to: info@spinly.rent.

Information Clause - Ordering Spare Parts and/or Performing an Additional Service

Pursuant to Article 13(1) and 13(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, we inform you that the controller of your Personal Data is Yaroslav Bulba, conducting business as a sole proprietor under his own name, Tax ID (NIP): 8943276263, REGON: 543567309, correspondence address: ul. Węgliniecka 21/12, 54-106 Wrocław, hereinafter referred to as “Spinly”.

For matters concerning Personal Data, you may contact us by email at: info@spinly.rent.

Your Personal Data will be processed on the basis of Article 6(1)(b) GDPR for the purpose of fulfilling an order for spare parts and/or performing the ordered service and on the basis of Article 6(1)(c) GDPR for issuing an invoice and including the invoice in the Controller’s accounting documentation.

The Controller may contact the Customer using the contact details provided by the Customer, in particular phone number, email address, and internet messengers such as WhatsApp, Viber, and Telegram, for the purpose of properly performing the ordered service, including in particular confirming the service date or confirming extension of the rental period. The legal basis for such processing is necessity for performance of a service agreement in accordance with Article 6(1)(b) GDPR.

Recipients of your Personal Data will be the Controller’s employees within the scope of their official duties on the basis of authorization, and entities authorized to obtain Personal Data under generally applicable law.

Your Personal Data will be processed until completion of the services or withdrawal of your consent to processing, and issued invoices within accounting documentation will be retained for the period required by law.

Providing your Personal Data for the purpose of placing an order or performing a repair is voluntary, but necessary to perform the service or order spare parts.

You have the right to access your Personal Data and rectify it, restrict processing, data portability, and withdraw consent to data processing at any time.

Refusal to consent to Personal Data processing will make it impossible to conclude a service agreement and the related order for spare parts.

You have the right to lodge a complaint with the supervisory authority if you consider that Personal Data processing violates generally applicable GDPR provisions.

Final Provisions

The Controller reserves the right to amend this policy in the future, which may occur, among other reasons, due to changes in applicable laws, in particular in the area of Personal Data protection, telecommunications law, electronic services, and regulations governing consumer rights, affecting the rights and obligations of the Controller or the user of the website or application.

Changes may also result from the development of functionality or electronic services driven by progress in internet technology, including the use or implementation of new technological or technical solutions affecting the scope of the policy.

The Controller will each time publish information about changes to the policy on the website and in the application. With each change, a new version of the policy will appear with a new date.

An integral part of the policy consists of information clauses concerning the use of Personal Data provided in connection with placing an order and obtained through video surveillance.

This version of the policy applies from July 7, 2026.

Contact

If you have questions about the Privacy Policy, please contact us by email at: info@spinly.rent.

If you have complaints concerning Personal Data processing, please contact us at: info@spinly.rent.