Last Updated: August 17, 2026
While flux-mesa operates primarily within Canada, we recognize that customers traveling from the European Union deserve the same data protection standards established by the General Data Protection Regulation. We have implemented practices that align with GDPR principles regardless of your residency.
We process your personal data under the following legal bases:
Contractual Necessity: Processing your name, contact information, and rental preferences is essential to fulfill the bike rental service you requested. Without this information, we cannot execute the rental agreement.
Legitimate Interest: We maintain rental history records to prevent fraud, manage equipment maintenance schedules, and improve service quality. These interests do not override your fundamental rights and freedoms.
Legal Obligation: Canadian business regulations require us to retain certain transaction records for tax and liability purposes.
Right to Access: You may request a complete copy of all personal data we hold about you. We will provide this information in a structured, commonly used format within 30 days of your request.
Right to Rectification: If any personal information we hold is inaccurate or incomplete, you have the right to request immediate correction.
Right to Erasure: You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, subject to legal retention requirements.
Right to Restrict Processing: You can request that we limit how we use your data while we verify accuracy or assess whether we have legitimate grounds for processing.
Right to Data Portability: You may request transfer of your data to another service provider in a machine-readable format.
Right to Object: You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
For all GDPR-related inquiries, contact our data protection representative at [email protected]. Include "GDPR Request" in the subject line to ensure priority handling.
Your personal data is stored exclusively on servers located within Canada. We do not transfer data outside Canadian jurisdiction except when legally compelled to do so, in which case we ensure appropriate safeguards are in place.
We do not use automated decision-making or profiling that produces legal effects or similarly significant impacts on customers. All rental approvals and customer service decisions involve human review.
In the unlikely event of a data breach that poses risk to your rights and freedoms, we will notify affected customers within 72 hours of becoming aware of the breach. Notification will include the nature of the breach, likely consequences, and measures taken to address it.
While we operate under Canadian privacy law, EU residents retain the right to lodge complaints with their local supervisory authority if they believe our processing violates GDPR provisions.
Our services are not directed at individuals under 16 years of age. We do not knowingly collect data from children. If we become aware that we have collected information from someone under 16, we will delete it promptly.