Privacy Policy

HELIA, turistična agencija, d.o.o.
Trubarjeva cesta 8, 4260 Bled, Slovenia
Company registration no. 1789317000, VAT ID SI19015178
Email: info@helia.si, phone: +386 31 544 544
Last updated: 31 July 2026

This Privacy Policy applies to rentabike.si and to bicycle rentals, delivery, repair and related services offered by HELIA. It is intended to provide transparent information required under applicable EU data protection law, including the General Data Protection Regulation (GDPR).

1. Who we are

HELIA, turistična agencija, d.o.o. acts as the controller for personal data processed in connection with our websites, enquiries, bookings, bicycle rentals, deliveries, repairs, transfers and related services.

2. What data we process and why

We process personal data only where there is a lawful basis and only to the extent needed for the relevant purpose.

Enquiries and bookings

Name, contact details, trip details, participants, accommodation and transfer information, correspondence and booking documentation. Legal basis: steps before entering into a contract and performance of a contract.

Payments

Payment status, transaction references, invoice data and payment provider records. We do not store full payment card details. Legal basis: contract performance and accounting or tax obligations.

Health and safety data

Health, fitness, allergy, dietary or safety-related information, where needed to organise the service safely. Legal basis: explicit consent and, where applicable, protection of vital interests.

Direct marketing

Newsletter subscriptions and similar messages based on consent or legitimate interest where legally permitted. You can unsubscribe at any time.

Website usage

Cookies, analytics, server logs and similar technical data, as described in our Cookie Policy. Non-essential cookies are used only according to your consent choices.

Legal claims

Data needed to establish, exercise or defend legal claims, handle complaints or comply with legal obligations.

3. Who receives your data

We share personal data only where needed for the services or where required by law. Recipients may include accommodation providers, transfer providers, guides, bicycle rental and repair providers, payment providers, IT providers, booking tools, analytics tools, professional advisers, insurers, public authorities and other service providers needed to organise the services.

Where we use processors, they process personal data according to our instructions and only to the extent needed for the agreed services.

4. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where this happens, we use appropriate safeguards, such as adequacy decisions, standard contractual clauses or other mechanisms recognised by applicable data protection law.

5. How long we keep data

We keep personal data only for as long as needed for the purpose for which it was collected, unless a longer retention period is required by law or necessary for legal claims.

Invoices and accounting records

10 years after the end of the year of issue.

Booking documents and correspondence

Up to 5 years after the trip.

Health data on risk forms

3 months after the activity.

Newsletter data

Until unsubscribe or withdrawal of consent.

Enquiries where no booking is made

Up to 2 years.

Bike handover and return photos

6 months after return of the bike.

6. Your rights

You may request access to your personal data, correction, deletion, restriction of processing, data portability and objection to processing where applicable. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You can exercise your rights by contacting info@helia.si. You also have the right to lodge a complaint with the Slovenian Information Commissioner (www.ip-rs.si).

7. Children, photographs and marketing images

Children

Our services are not directed at children without involvement of a parent or legal guardian. Where a minor participates in a tour or rental, the parent or legal guardian is responsible for providing the required information and consents.

Photographs and marketing images

We may use photographs, videos or similar materials for service documentation, safety, communication and marketing where there is a lawful basis, such as consent or legitimate interest where legally permitted. You may object to such use or withdraw consent where the use is based on consent.

8. Automated decision-making and changes

Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

Changes

We may update this Privacy Policy from time to time. The current text is published on our website. Where appropriate, we will communicate material changes separately.