PRIVACY POLICY
Last update: 22 September 2026
1. Data controller
The person responsible for processing the personal data collected through this website is:
Person in charge: Petra Torres Robles
Trade name: Two Brothers CamperVan
NIF: 34063142G
Address: 12 San Francisco de Sales Street, 07004 Palma, Balearic Islands
Phone number: +34 633 260 050
Website: https://twobrotherscampervan.com/
2. Personal data processed
Depending on the relationship maintained with the user, the following categories of data may be processed:
Identification data: name, surname, DNI, NIE, passport or equivalent document.
Contact details: email, phone number and address.
Data related to the reservation: dates, vehicle chosen, number of occupants, additional services, place and time of delivery or return.
Data required for the rental: date of birth, driver's license, license expiration date, and details of additional drivers.
Economic and billing data: billing address, amounts, payments, deposits, guarantees and refunds.
Data related to incidents, accidents, penalties, damages or claims.
Communications maintained by email, form, phone, or WhatsApp.
Technical data: IP address, browser, device, access logs, and cookie identifiers.
Any other information that the interested person provides voluntarily.
When a payment or a deposit is processed through an external gateway, the full card details will be processed directly by the payment provider, unless explicitly stated otherwise.
3. Purposes and legal bases
Queries and requests for information
The data submitted through the form, email, phone, or WhatsApp will be used to answer inquiries, prepare quotes, and handle requests.
The legal basis is the application of pre-contractual measures requested by the interested party and, when the query is not related to a possible contract, the legitimate interest in addressing it.
Management of reservations and rental contracts
The data will be processed for:
Check availability.
Manage and confirm reservations.
Prepare and execute the rental agreement.
Verify that drivers meet the requirements.
Manage payments, deposits and guarantees.
Organizing the delivery and return of the vehicle.
Provide assistance during the rental.
Manage modifications, cancellations, and incidents.
The legal basis is the execution of the contract or the application of pre-contractual measures.
Billing and legal obligations
The data will be processed to issue invoices, keep accounting records, fulfill fiscal obligations, and comply with the requirements of the authorities.
The legal basis is the fulfillment of legal obligations.
Accidents, damages, penalties and claims
The data may be used to process accidents, damages, fines, violations, claims, insurance coverage, and roadside assistance.
The legal basis may be the execution of the contract, the fulfillment of legal obligations, and the legitimate interest in protecting the rights, vehicles, and assets of the responsible party.
Security and fraud prevention
Data may be processed to prevent fraudulent bookings, improper use, non-payment, and attacks against the website.
The legal basis is the legitimate interest in ensuring the security of the business and the website.
Commercial communications
When the interested person has given their consent, they may be sent news updates, promotions, and commercial communications.
If there is a previous contractual relationship, communications regarding similar services may be sent in cases permitted by law, always offering a simple and free objection procedure.
The legal basis will be consent or, when applicable, the legitimate interest recognized by commercial communications legislation.
Cookies and analytics
Data obtained through analytical or advertising cookies will only be processed when the user has given their consent.
The necessary technical cookies are used to enable the operation and security of the website and to remember consent preferences.
4. Mandatory data
The fields marked as mandatory are necessary to process the query or reservation.
If the essential data is not provided, it is possible that the request cannot be answered, the contract cannot be formalized, or the service cannot be provided.
The user guarantees that the data provided is accurate, complete and up-to-date. If they provide data from other people — for example, additional drivers — they declare that they have the necessary authorization to do so and undertake to inform them of the content of this policy.
5. Recipients of the data
The data may be communicated, when necessary, to:
Banking entities and providers of payment services or surety management.
Insurance companies and roadside assistance services.
Workshop technicians, repair services and other professionals involved in managing an incident.
Tax, accounting or legal advice.
Public administrations, law enforcement agencies and bodies, courts and tribunals when there is a legal obligation.
Web hosting, email, forms, booking system, maintenance and security technology providers.
These providers will process the data in accordance with the instructions of the controller when acting as data processors.
Personal data will not be sold to third parties.
6. External services and international transfers
The website may integrate Google services —such as Analytics, Ads, and reCAPTCHA—, WhatsApp, and other technology providers.
Some providers may process data outside the European Economic Area. In such cases, the processing will be carried out through an adequacy decision, standard contractual clauses, or other guarantees accepted by Articles 44 and following of the GDPR.
When the user contacts us voluntarily via WhatsApp, their data will also be processed by the provider of that service in accordance with their own privacy policy.
7. Data retention
The data will be kept for the following periods:
Consultations without contracting: for the time necessary to respond and, at most, one year from the last communication, unless there is a reason to keep them for longer.
Reservations and contracts: for the duration of the contractual relationship and thereafter during the applicable legal deadlines.
Accounting and commercial documentation: in general terms, for six years.
Tax documentation: during the applicable tax statute of limitations, normally four years.
Claims, accidents and damages: as long as legal or contractual responsibilities can be derived.
Commercial communications: until consent is withdrawn or the right of objection is exercised.
Cookies: during the periods indicated in the Cookie Policy.
Once these deadlines have expired, the data will remain blocked exclusively to meet possible legal responsibilities.
8. Automated decisions
No decisions that have significant legal effects for the persons concerned will be taken based solely on automated processing, unless explicitly informed and the legal requirements are met.
9. Rights of the interested parties
The interested person may exercise the following rights:
Access to your personal data.
Rectification of inaccurate data.
Deletion of your data.
Opposition to certain treatments.
Restriction of processing.
Portability of data.
Withdrawal of consent at any time, without affecting the legality of the previous treatment.
To exercise these rights, you can send a request to reservas@twobrotherscampervan.com or at Calle San Francisco de Sales, 12, 07004 Palma, Illes Balears.
The request must indicate the right that you wish to exercise and provide the necessary information to prove your identity. If there are reasonable doubts about the identity, additional documentation may be requested.
You can also file a complaint with the Spanish Data Protection Agency: https://www.aepd.es/.
10. Minors
Rental services can only be contracted by adults who meet the requirements for driving the vehicle.
People under 14 years of age must not provide data through the website without permission from their parents or legal guardians.
11. Security
The responsible person will apply reasonable technical and organizational measures to protect the data against loss, alteration, unauthorized access, disclosure or destruction.
However, no Internet transmission can be guaranteed to be completely secure. The user must avoid sending especially sensitive information through unprotected channels.
12. Changes to this policy
This policy may be modified to adapt it to legal, technical or service-related changes.
The current version will be the one published on the website, indicating its date of update.
