Privacy policy

Last updated: 7 July 2026

1. Data controller

Owner: More Solutions Málaga Consulting S.L. (hereinafter, "GridRyde").
Tax ID (NIF/CIF): B72804891.
Address: Solluve 1, 9E · 29010 Málaga, Spain.
Contact and data-protection email: info@malaga-consulting.com.

2. What GridRyde is

GridRyde is a platform (marketplace) that connects people or businesses offering items for rent (the "providers"; for example, a empresa offering bikes to its guests) with people who want to rent them (the "customers"). GridRyde handles registration, booking, payment and, where the item allows it, its unlocking and location.

This policy explains what personal data we process, for what purpose, for how long and what rights you have.

3. What data we process

From customers who rent: name, email, phone, payment identifiers (via Stripe), booking and rental history and, where the item has a device (for example, bike locks), location/geolocation data during the rental.
Identity verification: for certain rentals or deposits we may ask for an image of an identity document (for example, a passport) for the sole purpose of verifying your identity.
From providers: contact name, email, phone, address and bank account details (IBAN) to settle payments.
From those who contact us or request information: name, email, phone and the content of the message.
Technical browsing data: IP address, device and browser type, and cookies (see the Cookie policy).

4. Purposes and legal basis

To manage registration, booking and rental, and the relationship with providers — basis: performance of the contract.
To process payments, deposits and refunds through Stripe — basis: performance of the contract.
To verify your identity when the rental or deposit requires it — basis: legitimate interest in preventing fraud and, where applicable, legal obligation.
To manage and locate the rented item when it has a device (Bluetooth unlocking, geolocation) — basis: performance of the contract and legitimate interest in preventing theft and loss.
To issue invoices and comply with accounting and tax obligations — basis: legal obligation.
To ensure the security of the platform and prevent fraudulent use — basis: legitimate interest.
To handle your enquiries and complaints — basis: legitimate interest.
To send commercial communications — basis: consent. We currently do not send commercial communications; if we do so in the future, we will ask for your consent and you will be able to unsubscribe at any time.

5. Retention periods

Booking, rental and invoicing data: for the duration of the relationship and, afterwards, as long as needed to address legal responsibilities (up to 6 years, for commercial and tax obligations).
Identity document image: deleted as soon as the corresponding rental ends.
Your account data: while you keep the account; you may request its deletion at any time.
Location/geolocation data: only during the rental and for a short period afterwards to resolve incidents.
Enquiries and information requests: as long as needed to handle them and for the limitation period of any liabilities.

6. Recipients and processors

We do not share your data with third parties except by legal obligation. To provide the service we work with providers that process data on behalf of GridRyde, under contract and with safeguards in line with the GDPR:

Stripe — processing of payments, deposits and refunds.
Mapbox — maps and geolocation on the website and app.
iLockit — unlocking and locating locks and items (data hosted in the European Union).
IONOS — hosting of the service and files (servers in Germany, EU).
Resend — sending transactional emails related to your booking.
In addition, when you book an item, the relevant provider receives the minimum data needed to provide the service.

7. International transfers

The hosting of the service and the lock data are located in the European Union. Some providers (for example, Stripe or Mapbox) may process data outside the European Economic Area; in those cases the safeguards provided for by the GDPR apply (adequacy decisions or standard contractual clauses).

8. Your rights

You may exercise your rights of access, rectification, erasure ("right to be forgotten"), objection, restriction of processing and portability by writing to info@malaga-consulting.com, stating the right you wish to exercise.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

9. Security

We apply appropriate technical and organisational measures (art. 32 GDPR) to protect your data against unauthorised access and against accidental loss or disclosure.

10. Minors

The service is intended for adults. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy to adapt it to legal or service changes. We will publish the current version on this page, indicating its update date.

12. Sellers (businesses and individuals)

If you register as a provider (business or individual) to offer goods for rent, we also process the data needed to manage your seller account and to comply with our legal obligations.

Data we process: identity and contact details, tax ID (NIF/CIF), and the data of your account and payouts managed through Stripe (which verifies your identity and bank account).
Purpose and legal basis: management of your seller account and payments (performance of the contract); and reporting seller information required by DAC7 / Form 238 to the Spanish Tax Agency (legal obligation).
Recipients: the Spanish Tax Agency (AEAT), in compliance with the DAC7 obligation; and Stripe as payment and identity verification (KYC) provider.
Retention: for the duration of your relationship as a seller and, afterwards, for the applicable legal tax and commercial retention periods.