Legal · Data Protection

Privacy Policy

Last updated: May 2025 · Version: 1.0 · Controller: DECRIDE – Decentralized Ride S.L.

Executive summary: DECRIDE only collects the data strictly necessary to process your investor interest request. We do not sell or share data with third parties for commercial purposes. We retain data for the minimum period required by law. You may exercise your rights at any time by writing to privacy@decride.com.

1. Data Controller

Company name: DECRIDE – Decentralized Ride S.L. (hereinafter "DECRIDE" or "we")

Registered address: Spain

Contact email: privacy@decride.com

Activity: Collaborative investment platform for private transport licences (taxi and PHV).

2. Data we collect and why

We collect exclusively the data that the user voluntarily provides through the interest request form. We do not collect data passively, we do not use third-party tracking cookies, and we do not integrate advertising pixels.

Data	Purpose	Legal basis
Full name	Identify the applicant and personalise communication	Explicit consent (Art. 6.1.a GDPR)
Email address	Contact the interested party with information on available licences	Explicit consent (Art. 6.1.a GDPR)
Estimated investment range	Tailor the participation proposal to the declared investment capacity	Explicit consent (Art. 6.1.a GDPR)
Consent record	Demonstrate consent given (legal obligation)	Legal obligation (Art. 6.1.c GDPR)

We do not collect special-category data (health, beliefs, racial origin, biometric data), data from persons under 18 years of age, or banking or credit card data through this form.

3. Who accesses your data

Access to personal data is restricted to:

DECRIDE internal staff with investor management and customer service functions, bound by confidentiality obligations.
Technology service providers (hosting, email, CRM) acting as data processors under contract, who may not use the data for their own purposes. All providers are located in the EU or in countries with an adequate level of protection recognised by the European Commission.

We do not share data with third parties for commercial, advertising or any other purpose. We do not sell personal data. Ever.

In the event of a legal obligation (court order, tax or investment regulation), we may be required to provide data to competent authorities, in which case we would do so to the minimum necessary extent and would inform the data subject unless prohibited by law.

4. International transfers

DECRIDE does not transfer personal data outside the European Economic Area (EEA). Should any technology provider require transfers outside the EEA, we would ensure that appropriate safeguards are in place (standard contractual clauses approved by the European Commission or another recognised mechanism) and would inform affected users in advance.

5. Retention periods

Interest requests not resulting in a formalised investment: 12 months from the last contact, unless the user requests deletion sooner.
Investors who formalise participation: for the duration of the contractual relationship and, once it ends, for the applicable civil, commercial and tax limitation periods (maximum 10 years for tax purposes).
Consent records: up to 5 years from withdrawal of consent, to demonstrate its granting in the event of a claim.

After these periods, data is securely deleted or irreversibly anonymised.

6. Security measures

TLS 1.2 or higher encryption for all web communications in transit.
Encryption at rest for databases containing personal data.
Restricted access with two-factor authentication for internal staff.
Periodic access reviews and least-privilege policy.
Documented security breach management procedure, with AEPD notification within 72 hours where required and prompt notification to data subjects when the risk is high.

7. Your rights

Under GDPR (EU) 2016/679 and Spain's LOPDGDD, you have the following rights:

Access

Obtain confirmation of whether we process your data and, if so, a copy.

Rectification

Request correction of inaccurate or incomplete data.

Erasure ("right to be forgotten")

Request deletion of your data when it is no longer necessary or you withdraw consent.

Objection

Object to processing in certain circumstances.

Restriction

Request that we suspend processing while a dispute is resolved.

Portability

Receive your data in a structured, machine-readable format.

To exercise any of these rights, write to privacy@decride.com stating your name, the right you wish to exercise, and, if possible, a copy of your identity document. We will respond within a maximum of 30 calendar days.

If you believe that the processing of your data infringes the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Cookies and tracking technologies

DECRIDE's website uses only the following cookies:

Strictly necessary technical cookies: essential for the form and session to function. No consent is required.

We do not use third-party analytics cookies (Google Analytics, Meta Pixel, etc.), advertising cookies, or fingerprinting technologies. There is no advertising on our platform.

9. Consent and withdrawal

The processing of your data is based on your free, specific, informed and unambiguous consent, given by ticking the checkbox in the form. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To withdraw consent, send an email to privacy@decride.com with the subject "Withdrawal of consent" and your name and email address. We will process your request within a maximum of 10 business days.

10. Minors

DECRIDE is an investment platform intended exclusively for persons aged 18 or over. We do not knowingly collect data from minors. If we detect that we have received data from a minor, we will delete it immediately. If you are a parent or guardian and believe a minor has provided us with data, contact us at privacy@decride.com.

11. Changes to this policy

We may update this Privacy Policy to reflect regulatory changes, new features, or improvements to our data protection practices. When changes are material, we will communicate them via a prominent notice on the website and, if we hold your email address, by that channel as well.

12. Applicable regulatory framework

Regulation (EU) 2016/679 (GDPR)
Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD)
Directive 2002/58/EC on privacy in electronic communications (ePrivacy)
Spanish Law 34/2002 on Information Society Services (LSSICE)

Any questions?

Our privacy team is available to answer any questions about how we process your data.

Email: privacy@decride.com

Response time: maximum 30 calendar days (usually less than 5 business days)