Privacy and Data Protection Policy

  1. Who is the data controller responsible for processing the personal data?
  2. What personal data do we collect Online, through the App or other channels?
  3. For what purpose and in what lawful capacity do we process Users’ personal data?
  4. For how long does MOBILITY keep Users’ contact data?
  5. To whom may the controller provide Users’ data?
  6. What rights do Users have when they provide us with their personal data?
  7. Additional information

In accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and other regulations in force on matters relating to Data Protection, ACCIONA MOBILITY, S.A. (hereinafter, MOBILITY); makes the Privacy Policy, which will apply to the processing of personal data, available to all those (hereinafter, "Users") who, through their interaction with us, provide personal information via the website (hereinafter, the Website) or its corresponding mobile application (hereinafter, the APP).

Personal data may only be obtained for processing when such data are adequate, relevant and not excessive in relation to the scope and specific, explicit and legitimate purposes for which they have been obtained. Users expressly consent to MOBILITY processing the personal data provided by them for the purposes expressed in this Privacy Policy.

MOBILITY adopts the technical and organisational measures necessary to guarantee the security of personal data and to prevent the alteration, loss or unauthorised processing of or access to such data, taking into account the state of the art, the nature of the data and the risks to which the data are exposed. You may also confirm the presence of the SSL certificate by checking the Website’s properties in your browser. A connection will be secure when "https://" appears in the browser's address bar instead of "http://" and a padlock symbol is displayed. You can look up more features of the SSL certificate in the Legal Notice section.


1. Who is the data controller responsible for processing the personal data?

Company name:
Tax Code:
Avenida de Europa, number 18, La Moraleja Business Park, 28108, Alcobendas (Madrid).
+34 91 663 28 50
Contact email:

The Data Protection Officer is a point of contact between you and the data controller; for any questions relating to the processing of personal data, you may if you wish contact him at:

2. What personal data do we collect Online, through the APP or other channels?

Personal data are considered to be data that identify persons or that may be used to identify them. Channels through which we can collect personal data:

Website.Sometimes personal data is obtained from the User when they visit our website. This website, in addition to using necessary cookies, will use its own and third-party analytical cookies to learn how our website is used; to evaluate and improve its operation; analyse traffic; personalise content and advertisements; or offer social media functions, only if the User configures it this way and depending on the selection the User makes (see our Cookies Policy).

Mobile APP. Through the APP we can receive the personal data provided directly by the User when downloading and using the APP to register and when using our service.

Upon registration, we can process the following data categories:

Identification and contact data. First name and surname, valid national ID or identification document, user ID, driving licence, address, country of residence, telephone number, email, IP address OR ID.
Data relating to personal characteristics: Age and gender
Geographical data City

If to register for our service and to use it, you use the authentication services of a third party based on federated identity, such as those provided by some social networks, we will receive personal data from this third party if you authorize it to share data with us.

The SDK IDs that are currently implemented are ID Salesforce, Appsflyer, Firebase and to provide determined features to the App.

When using the service, we may process the following data categories:

Special data In the case of accidents or claims, and for the management of these, some health data could be collected, included in the medical reports.
Financial data associated to the service Billing information, type of credit/debit card, expiration date and only certain card numbers.
Data related to the service provided Number of trips, vehicle, minutes of use, date and time of start and end of each service per journey, billing information or traffic fines, if applicable.
Geographical data City, GPS location, place of start and end of the service provided

Social networking sites. Data from the User could be obtained indirectly when they subscribe to any of the MOBILITY profiles on the different social networks or interacts with us through them, either with comments, opinions or by sharing the content published in each profile. In social networks, we act as the data controller responsible for what we publish, always processing such data in accordance with the conditions established in each one of the social networks.

Other channels. Users may also receive personal data when they contact the User Service Centre (USC) or the Customer Service Centre (CSC), either by email or by phone, when they request information from us, send requests or complaints, report incidents, etc.

In any event, Users are solely responsible for the veracity and lawfulness of the personal data provided.

3. For what purpose and in what lawful capacity do we process Users’ personal data?

Management of registration as a registered User and account maintenance. Administration and management of the accounts of Users of the service, including checking compliance with the necessary requirements for the rental of vehicles without a driver. In these cases, the treatment is necessary for the execution of the contract for the provision of the service and the established legal relationships, this being the basis of legitimacy. In some cases, when responding to requests for information, claims, complaints, etc. the processing of data could be based on the consent of the User.
Service management. Including the visualization and reservation of vehicles that adjust to the User's location.
Management of collections, payments, defaults, and/or billing of the services provided, including the referral to the email address provided, of the invoices and information of the trips made, and/or penalties for non-compliance or sanctions that may be imposed on traffic offenses
To attend to and process requests for information, claims, complaints, suggestions, incidents and/or enquiries received through the User Service Centre or the Customer Service Centre.
All vehicles are geolocated, and it is not possible to deactivate it during the provision of the service, since this allows to locate the start and end point of each service provided. In this case, the treatment of this data is necessary for the execution of the contract for the provision of the service and the established legal relationships, this being the basis of legitimacy.
The vehicle geolocation system also makes it possible to protect the property of the vehicle fleet from vandalism and/or fraudulent use, either by Users or third parties.
The functionalities of the APP in turn allow the location of the device on which it is installed to be disclosed when the service is about to be used, in order to show available nearby vehicles.
Management of fines or administrative penalties by identifying the driver. In these cases, the treatment is necessary for the fulfilment of a legal obligation applicable to the person responsible for the treatment; this is the basis of legitimation.
Steps related to insurance and, where appropriate, claims, accidents or claims for vehicle damage.
Other legal obligations of a commercial, fiscal, accounting or administrative nature.
Protect, detect and prevent fraud and other illegal activities, unauthorised transactions, claims or incidents, manage the quality and risks associated with the business. In these cases, the treatment is necessary for the fulfilment of a legal obligation applicable to the person responsible for the treatment; this is the basis of legitimation.
Investigate incidents, illegal activities and potential violations of our terms of service and policies.
In order to optimize our services, we can use the vehicle usage data for statistical purposes to carry out mobility studies or to carry out studies related to vehicle consumption that, for example, allow us to plan the loading of vehicles. In these cases, the legitimate interest is the basis of legitimation.
2 voluntary checkboxes are available both in the registration and registration form for the service, as well as in the User profile already registered, to accept the sending of commercial communications. The segmentation and profiling tasks that are carried out, in order to send you communications based on the user profile, are based on the information on the use of our service, through marketing cookies and/or preferences on IPs or through the Mobile IDs, in order to personalize the treatment according to your characteristics or needs and, thus, be able to direct you the most convenient commercial actions. The purposes for which consent is requested are as follows: The profiles that are made in these cases are sociodemographic, making segmentations based on the favourite city and age range or, behavioural based on the volume of trips made and/or the use of minute bonuses.
Receiving commercial communications, free codes and other promotions based on the user's profile, and/or information regarding MOBILITY raffles by any means of communication (email, SMS, in-App notifications). In these cases, the legal basis of the treatment is the consent for the treatment provided by the User by checking the corresponding boxes of acceptance of these specific purposes
Receive promotional information on services and products through any channel (email, SMS, in-App nottifications), marketed by third parties, with which MOBILITY establishes collaboration agreements. Your data will not be transferred.

4. For how long does MOBILITY keep Users’ personal data?

In general, the data will be kept i) for as long as is necessary for the purpose for which the data were collected and ii) during the applicable limitation periods, if liabilities might be incurred as the result of the processing.


5. To whom may the Controller provide Users’ data?

Depending on the activity performed by MOBILITY, the following data transfers are provided for, whenever necessary:

6. What rights do Users have when they provide us with their personal data?

Data subjects may exercise their rights of access, rectification, erasure, portability and restriction or objection by writing to the Data Protection Department of ACCIONA MOBILITY, S.A. at Avenida de Europa18, 28108 de Alcobendas (Madrid), or by sending an email to the following email address: When necessary, to be able to identify you, we may request that you provide a copy of your national ID or other identification document.

Likewise, you may at any time withdraw the consent given by writing to the address indicated above, and by complaining to the Supervisory Authority (Spanish Data Protection Agency ).

In addition, specifically for commercial communications sent by MOBILITY, you can configure the consents given, where appropriate, or unsubscribe from them, by accessing your user profile on the APP, in the "My Data" section. Here you can configure your choice, if you accepted at any time, the sending of these types of communications.

You can also unsubscribe from these communications through the opt-out system included in each of the communication of this type that you receive (for example, a link in which you can unsubscribe).

Observation: During periods of an exceptional nature such as States of Alarm or Emergency, which imply periods of confinement, or other external disturbances such as natural disasters, extreme weather conditions or wars, rights which are exercised by ordinary mail rather than through the email account will have a longer response time than usual, with response times being re-established once the recommended confinement period has been lifted.

7. Additional information

We have provided you below with a series of links where you can obtain additional information that might be of use to you in relation to any other processing of personal data,

You can obtain more information on
Ethical channel
We have a reporting channel, known as the Ethical Channel, in which both employees and providers or third parties can confidentially report any breach of which they are aware. You can examine all the information on this processing in full at


Any change made to the Privacy Policy and to information management practices will be reflected in a timely manner, with the Data Controller being permitted to add, modify or remove the said Privacy Policy whenever it deems this necessary.

This Privacy Policy is published in Spanish, Catalan and English; in the case of discrepancy between both versions, the Spanish version will prevail.

Last updated on April 16 2021