Privacy Policy & GDPR Statement

1. Introduction

Ride and Rest ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform, in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the UK GDPR, the California Consumer Privacy Act (CCPA), and other applicable data protection laws worldwide.

By using Ride and Rest, you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of our services.

2. Data Controller

Ride and Rest is the data controller responsible for your personal data. For any privacy-related queries or requests, you may contact us at:

3. What Data We Collect

We may collect and process the following categories of personal data:

• Identity Data: full name, username or similar identifier
• Contact Data: email address, telephone number
• Profile Data: account preferences, user type (rider or owner), reward points
• Booking Data: property reservations, check-in/check-out dates, number of guests
• Financial Data: payment amounts, transaction history (we do not store full card details)
• Technical Data: IP address, browser type, device information, cookies and usage data
• Communications Data: messages, reviews, and correspondence through our platform

4. Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contract: processing is necessary to provide our services and fulfill bookings
• Legal Obligation: we must comply with applicable laws and regulations
• Legitimate Interests: to improve our platform, prevent fraud, and ensure security
• Consent: for marketing communications and non-essential cookies — you may withdraw consent at any time

5. How We Use Your Data

• To register and manage your account
• To process bookings and payments
• To communicate with you about your reservations and account
• To send service updates and, where consented, promotional content
• To detect, prevent, and address fraud or security incidents
• To comply with legal and regulatory obligations
• To improve and personalise your experience on our platform

6. Data Sharing & Third Parties

We do not sell your personal data. We may share your data with trusted third parties only where necessary, including:

• Payment processors (e.g. Stripe) to handle transactions securely
• Cloud infrastructure providers who store data on our behalf
• Property owners, strictly to facilitate your booking
• Legal or regulatory authorities where required by law

All third parties are required to handle your data in accordance with applicable data protection legislation.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms recognised by applicable law.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by applicable law. Booking and financial records may be retained for up to 7 years for tax and legal compliance. You may request deletion of your account and associated data at any time (subject to legal retention obligations).

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: to request a copy of the data we hold about you
• Right to Rectification: to correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): to request deletion of your data
• Right to Restriction: to limit how we process your data
• Right to Data Portability: to receive your data in a structured, machine-readable format
• Right to Object: to object to processing based on legitimate interests or direct marketing
• Rights related to automated decision-making and profiling
• California residents (CCPA): right to know, right to delete, right to opt-out of sale, and right to non-discrimination

To exercise any of these rights, please contact us at enquiries@rideandrest.info. We will respond within 30 days.

10. Cookies

We use cookies and similar tracking technologies to enhance your experience. Essential cookies are required for the platform to function. Non-essential cookies (e.g. analytics, marketing) are only set with your consent. You can manage or withdraw your cookie preferences at any time through your browser settings.

11. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption, access controls, and regular security reviews. However, no transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our platform following changes constitutes your acceptance of the updated policy.

14. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. In the EU/EEA, this is your national Data Protection Authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the US and other jurisdictions, equivalent authorities may apply.