Privacy and personal data protection

Privacy Policy and GDPR Information

This Privacy Policy explains how Free2bike collects, uses, stores, and protects personal data when you visit our website, create a booking, rent a bike, contact us, use customer account features, upload rental photos, or communicate with Free2bike support.

Last updated: May 2026

1. Who we are

Free2bike is a self-service bike rental service in Sofia, Bulgaria.

The Free2bike services are commercially operated by:

  • Company: Photo Pro OOD
  • VAT / Company ID: BG200396110
  • Registered address: 130 Pirotska Str., Sofia, Bulgaria

For the purposes of applicable data protection law, including the General Data Protection Regulation (Regulation (EU) 2016/679), Photo Pro OOD is the data controller for the personal data processed in connection with Free2bike services.

2. How to contact us about privacy

If you have questions about this Privacy Policy, your personal data, or your GDPR rights, you can contact us:

3. What personal data we collect

Depending on how you use Free2bike, we may collect and process the following categories of personal data:

  • Identity and contact data: name, email address, phone number, billing details, account details, and communication history.
  • Booking and rental data: selected bike, rental type, booking date and time, pickup and return windows, order number, booking status, customer timeline, and rental notes.
  • Payment and transaction data: payment status, transaction reference, amount paid, deposit amount, refund amount, partial withholding information, and invoice or accounting data where applicable.
  • Security deposit and return review data: deposit status, return condition review, damage notes, withholding reason, refund records, and support correspondence.
  • Access and operational data: pickup PIN, return PIN, chain lock code, bike lock events, access timing, and other information needed to manage bike pickup and return.
  • Photo upload data: photos uploaded by the customer at pickup or return, and related metadata such as upload time and order association.
  • Support data: messages sent by email, WhatsApp, contact forms, or other support channels.
  • Technical data: IP address, device/browser information, cookies, website logs, security logs, and similar technical information.
  • Analytics and marketing data: page visits, clicks, booking-related events, referral source, approximate location, browser/device data, advertising identifiers, campaign data, and interaction data where optional analytics or marketing tools are accepted.
We do not intentionally ask customers to provide special categories of personal data, such as health information, political opinions, religious beliefs, biometric data, or other sensitive information. Please do not send such information unless it is strictly necessary.

4. Why we process personal data

We process personal data for the following purposes:

  • to create, confirm, manage, and complete bike rental bookings;
  • to process payments, security deposits, and refunds;
  • to provide pickup and return access information;
  • to identify the rented bike and manage availability;
  • to communicate with customers before, during, and after the rental;
  • to provide customer support by email, WhatsApp, or other channels;
  • to document pickup and return condition through customer-uploaded photos;
  • to review damage, late return, missing equipment, loss, theft, or deposit-related issues;
  • to keep accounting, tax, and legal records;
  • to protect the security of the website, rental office, access systems, bikes, locks, and customers;
  • to prevent misuse, fraud, unauthorized access, or prohibited use of Free2bike facilities;
  • to understand website performance and improve the booking experience where analytics cookies are accepted;
  • to measure advertising performance and support remarketing or retargeting where marketing cookies are accepted;
  • to comply with legal obligations or respond to lawful requests from authorities.

5. Legal bases for processing

Under GDPR, we rely on different legal bases depending on the purpose of processing. These may include:

  • Contract: processing needed to create, manage, and perform your bike rental booking.
  • Legal obligation: processing needed for accounting, tax, consumer protection, or legal compliance.
  • Legitimate interests: processing needed for security, fraud prevention, deposit review, customer support, operational management, website improvement, and protection of Free2bike property and legal rights.
  • Consent: processing where we specifically ask for your consent, such as optional analytics cookies, marketing cookies, remarketing, retargeting, advertising pixels, or certain non-essential website technologies.

6. Booking, payment, and security deposit data

When you make a booking, we process information needed to identify the order, selected bike, rental period, customer, payment status, security deposit, and access instructions.

Payments are processed through third-party payment providers, such as Stripe or WooCommerce-connected payment services. Free2bike does not store full payment card numbers on its website. Payment providers may process your payment data according to their own terms and privacy policies.

Security deposit information is processed to determine whether the deposit should be fully refunded, partially refunded, or withheld, depending on the return review and the Terms of Use.

7. Customer-uploaded photos

Free2bike may ask customers to upload photos at pickup and return. These photos are used to document the condition of the bike, lock, accessories, and return position.

Uploaded photos may be used for:

  • confirming bike pickup and return;
  • checking whether the bike was properly locked;
  • reviewing damage, missing equipment, or return disputes;
  • supporting deposit refund or withholding decisions;
  • protecting Free2bike’s legal and operational interests.

Customers should avoid including unnecessary people, documents, private information, or unrelated objects in uploaded photos.

8. Access codes and lock-related information

Free2bike may process access-related information such as pickup PINs, return PINs, chain lock codes, lock identifiers, pickup/return windows, and access events. This data is used to provide the self-service rental process and to protect the bikes, rental location, and customers.

Access data may also be used to investigate misuse of access codes, unauthorized third-party access, prohibited storage of objects, late return, theft, loss, or security incidents.

9. Cookie Policy

This Cookie Policy explains how Free2bike uses cookies and similar technologies on the Free2bike website. It should be read together with this Privacy Policy and our Terms of Use.

What are cookies?

Cookies are small text files stored on your device when you visit a website. They help the website remember information about your visit, such as your cart, login session, preferences, or cookie choices.

Similar technologies may include local storage, session storage, pixels, tags, scripts, device identifiers, browser identifiers, advertising identifiers, or other tools that help the website function, measure performance, or support advertising where enabled.

Why Free2bike uses cookies

Free2bike may use cookies and similar technologies for the following purposes:

  • to make the website work correctly;
  • to keep products and bookings in the cart;
  • to support checkout, payment, and order confirmation;
  • to allow customer account login and account features;
  • to remember cookie preferences;
  • to protect the website from fraud, spam, abuse, or security threats;
  • to understand how visitors use the website, where analytics cookies are accepted;
  • to support marketing, advertising, campaign measurement, remarketing, or retargeting, where marketing cookies are accepted.

Types of cookies we may use

Necessary cookies

Necessary cookies are required for the website and booking process to work. These cookies support functions such as cart, checkout, payment flow, account login, security, fraud prevention, and remembering your cookie preferences.

These cookies cannot be disabled through the Free2bike cookie banner because the website may not work properly without them.

Analytics cookies

Analytics cookies help Free2bike understand how visitors use the website, which pages are visited, and where improvements may be needed. These cookies are optional and should only be used if you accept analytics cookies.

If analytics tools such as Google Analytics are enabled, they may collect technical information such as page visits, browser type, approximate location, device information, referral source, visit duration, and interaction events.

Marketing cookies

Marketing cookies may be used to measure advertising campaigns, show more relevant ads, create audiences, or support retargeting through advertising platforms. These cookies are optional and should only be used if you accept marketing cookies.

If marketing tools such as Meta Pixel, Google Ads, or similar advertising technologies are enabled, they may collect information about your website visit and interactions for advertising, conversion tracking, campaign measurement, remarketing, and retargeting purposes.

Analytics, advertising, remarketing, and retargeting tools

Free2bike may use analytics, advertising, remarketing, retargeting, conversion tracking, and similar technologies to understand how visitors use the website, measure advertising performance, improve the booking experience, and promote Free2bike services.

These tools may include, without limitation:

  • Google Analytics – to measure website visits, page views, traffic sources, user interactions, device/browser information, approximate location, and general website performance.
  • Google Ads – to measure advertising conversions, understand campaign performance, and support remarketing or retargeting campaigns where enabled.
  • Meta Pixel – to measure website actions, improve Facebook and Instagram campaign performance, create audiences, and support remarketing or retargeting campaigns where enabled.
  • Cookie banner and consent-management tools – to collect, store, and manage your cookie preferences and consent choices.
  • Other remarketing or retargeting tools – to show or measure advertising based on previous interactions with the Free2bike website, where such tools are enabled and allowed by your consent choices.

These tools may use cookies, pixels, tags, scripts, device identifiers, browser identifiers, local storage, or similar technologies. They may collect or receive information such as your IP address, browser and device data, pages visited, links clicked, booking-related events, referral source, approximate location, advertising identifiers, and interaction data.

Free2bike does not intentionally use these tools to collect special categories of personal data, such as health data, religious beliefs, political opinions, or biometric data.

Google Analytics

If Google Analytics is enabled, Free2bike may use it to understand how visitors use the website and how the website can be improved. Google Analytics may collect information about visited pages, visit duration, traffic source, device type, browser type, approximate geographic location, and website interactions.

Google Analytics data is used for aggregated website analysis and performance improvement. Free2bike should not load Google Analytics before you accept analytics cookies, unless a different lawful configuration applies.

Google Ads and conversion tracking

If Google Ads tools are enabled, Free2bike may use them to measure whether advertising campaigns lead to useful actions, such as visiting a page, clicking a button, starting checkout, or completing a booking.

Google Ads tools may also support remarketing or retargeting, meaning that visitors who have interacted with the Free2bike website may later see Free2bike-related advertising on Google services or partner websites, where permitted by law and consent.

Meta Pixel and Meta advertising tools

If Meta Pixel or similar Meta advertising tools are enabled, Free2bike may use them to measure website activity, improve Facebook and Instagram advertising campaigns, understand campaign performance, and create advertising audiences.

Meta Pixel may collect information about page views, button clicks, booking-related events, device/browser data, referral data, and other website interactions. Meta may process this information according to its own terms and privacy policies.

Meta Pixel and similar advertising technologies should not be loaded before you accept marketing cookies, unless a different lawful configuration applies.

Remarketing and retargeting

Remarketing and retargeting allow Free2bike to show advertising to people who previously visited the Free2bike website or interacted with Free2bike content. For example, a visitor who views bike rental pages may later see a Free2bike ad on another platform.

Remarketing and retargeting may involve profiling or audience creation based on website activity. Free2bike uses these tools only where enabled and where the required cookie or marketing consent has been given.

Cookie banner and consent management

Free2bike may use a cookie banner or consent-management tool to ask for your cookie choices, store your preferences, and control whether optional analytics and marketing scripts are loaded.

The cookie banner may allow you to:

  • accept all cookies;
  • reject non-essential cookies;
  • choose analytics and marketing preferences separately;
  • change your preferences later.

Necessary cookies are used because they are required for website functionality, cart, checkout, payment, account login, security, and cookie-preference storage. Analytics and marketing cookies are optional and should be used only according to your consent choice where consent is required by law.

Third-party cookies and processing

Some cookies or similar technologies may be placed by third-party service providers used by Free2bike. These may include payment providers, website security services, analytics providers, advertising platforms, embedded content providers, communication tools, or cookie-consent tools.

Analytics, advertising, remarketing, retargeting, payment, security, and consent-management providers may process data as independent controllers, joint controllers, or processors depending on the specific tool and configuration.

Third-party providers process information according to their own privacy and cookie policies. Free2bike does not control all third-party cookies or all further processing performed by those providers once their tools are enabled.

Changing your cookie preferences

You can change your cookie preferences at any time by using the cookie settings link below:

Change cookie preferences

If the cookie settings panel does not open, you can also clear your browser cookies for free2bike.com and reload the website. The cookie banner should then appear again.

Managing cookies in your browser

You can also control cookies through your browser settings. Most browsers allow you to block cookies, delete cookies, or receive a warning before cookies are stored.

Please note that blocking all cookies may affect website functionality, including cart, checkout, login, booking, and customer account features.

How long cookies are stored

The storage period depends on the type of cookie:

  • Session cookies are deleted when you close your browser.
  • Persistent cookies remain on your device for a defined period or until you delete them.
  • Consent preferences may be stored so that we can remember your cookie choice.

Free2bike aims to keep optional cookies only for as long as necessary for the purpose for which they are used.

Change cookie preferences

10. Who we share personal data with

We may share personal data with service providers and partners where this is necessary for Free2bike operations. These may include:

  • website hosting and technical service providers;
  • WooCommerce, WordPress, and website plugin providers;
  • payment processors, such as Stripe or other enabled payment gateways;
  • email delivery or customer communication providers;
  • WhatsApp or messaging services used for customer support;
  • bike lock, access, or smart-lock service providers;
  • analytics providers such as Google Analytics, where enabled and accepted;
  • advertising platforms such as Google Ads or Meta, where enabled and accepted;
  • cookie banner or consent-management providers;
  • accounting, legal, tax, or professional advisers;
  • public authorities, police, courts, regulators, or other competent authorities where required or permitted by law.

We do not sell customer personal data.

11. International transfers

Some service providers may process personal data outside Bulgaria or outside the European Economic Area. Where this happens, Free2bike aims to rely on appropriate safeguards required by GDPR, such as adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms where applicable.

Analytics, advertising, remarketing, retargeting, payment, security, communication, and consent-management providers may process data internationally depending on their technical infrastructure and legal terms.

12. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Typical retention periods may include:

  • Booking and order records: kept for the period needed for customer service, accounting, tax, and legal compliance.
  • Payment and refund records: kept for accounting, audit, dispute, and legal purposes.
  • Customer-uploaded pickup and return photos: kept for the time needed to review the rental, deposit, damage, or dispute, and then deleted or archived according to operational/legal needs.
  • Support messages: kept for the time needed to handle the request and maintain a reasonable customer service and dispute history.
  • Technical and security logs: kept for a limited period needed for security, troubleshooting, and fraud prevention.
  • Cookie consent records: kept for the time needed to remember and document your cookie choices.
  • Analytics and marketing data: kept according to the settings of the relevant analytics or advertising platform and your consent choices.
  • How long we keep accounting and tax records

    Free2bike keeps accounting, tax, payment, invoice, refund, and order records for the periods required by Bulgarian law. Depending on the type of document, this may include:

    • Accounting ledgers and financial statements: generally kept for 10 years.
    • Tax and VAT documents, including sales invoices, purchase invoices, tax returns, VAT returns, and related tax-control documents: generally kept for 5 years after the expiry of the limitation period for the related public liability.
    • Payroll records, where applicable: generally kept for 50 years.
    • Other accounting information, such as certain agreements or bank statements: generally kept for 3 years, unless a longer period is required for accounting, tax, legal, audit, or dispute purposes.

    Where a longer retention period is required or justified by law, audit, tax inspection, legal claim, dispute, fraud prevention, or security reasons, Free2bike may keep the relevant records for the necessary longer period.

13. How we protect personal data

Free2bike uses reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include access controls, secure payment processing, website security tools, limited administrative access, data minimization, backups, and monitoring for technical or security issues.

No website or online service can guarantee absolute security. Customers should keep their login information and access codes private and contact Free2bike immediately if they suspect misuse.

14. Your GDPR rights

Subject to the conditions and limitations in applicable law, you may have the following rights regarding your personal data:

  • Right of access: to ask whether we process your personal data and receive a copy of it.
  • Right to rectification: to ask us to correct inaccurate or incomplete personal data.
  • Right to erasure: to ask us to delete personal data where there is no valid reason to keep it.
  • Right to restriction: to ask us to restrict processing in certain situations.
  • Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
  • Right to object: to object to processing based on legitimate interests or direct marketing.
  • Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time.
  • Rights relating to automated decision-making: where applicable, rights connected to decisions made solely by automated means.

15. How to exercise your rights

To exercise your rights, contact us at: support@free2bike.com.

To protect your data, we may need to verify your identity before responding to a request. We will respond within the time required by applicable law.

Some requests may be limited where we need to keep certain data for legal, accounting, tax, dispute, security, or contractual reasons.

16. Complaints to the supervisory authority

If you believe your personal data rights have been violated, you may contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with a competent data protection supervisory authority.

In Bulgaria, the supervisory authority is the Commission for Personal Data Protection.

17. Children and minors

Free2bike rentals may be booked only by customers who are at least 18 years old. Persons under 18 cannot rent bikes directly.

If a minor uses a rented bike under the supervision of the adult customer who made the booking, Free2bike may process data related to the booking, bike, return, photos, or support issue, but the adult customer remains responsible for the booking and supervised minor rider.

18. Direct marketing

If Free2bike sends marketing emails, promotions, or newsletters, we will do so only where we have a lawful basis. Where required, we will ask for consent and provide an option to unsubscribe.

Service messages related to bookings, payment, access codes, deposit review, safety, account activity, or support are not marketing messages.

19. Changes to this Privacy Policy and Cookie Policy

Free2bike may update this Privacy Policy and Cookie Policy from time to time, especially if website tools, cookies, analytics, marketing technologies, payment providers, or legal requirements change.

The latest version will be published on the Free2bike website. If changes are significant, we may take reasonable steps to notify customers, depending on the nature of the change.

20. Contact for privacy questions

For privacy or GDPR questions, contact:

  • Email: support@free2bike.com
  • Commercial operator: Photo Pro OOD, BG200396110, 130 Pirotska Str., Sofia, Bulgaria