Bimba Privacy Policy

1. Scope and Costa Rican privacy law

We process personal information in accordance with Costa Rica Law No. 8968, the Law on Protection of the Person concerning the Processing of Personal Data, its implementing regulations, and other applicable law. This Policy describes our current practices and does not limit any non-waivable right available to you.

2. Information you provide

We may collect account and profile information such as your name, email address, telephone number, date of birth, preferred language, password or authentication credentials, and emergency or support information you choose to provide.

We may collect a government-issued identification document, document number, photograph, selfie, or related verification result when reasonably necessary to confirm identity, age, eligibility, prevent fraud, investigate misuse, or comply with law. Please do not send identification documents through ordinary email unless Bimba specifically instructs you to use an approved secure method.

When you contact us, report an accident, submit a complaint, participate in a survey, or send photographs, we collect the content of your communication and the information needed to investigate and respond.

3. Ride, vehicle, and location information

The app and Bimba vehicles may collect precise or approximate location information, including GPS coordinates, ride start and end points, route, time, duration, speed, parking location, and vehicle status. Vehicle location may continue to be collected when a vehicle is not rented because Bimba must locate, secure, charge, maintain, and recover its equipment.

With device permission, the app may access location, Bluetooth, camera, photographs, or other device functions needed to find, unlock, operate, park, or document the condition of a vehicle. You may change device permissions, but doing so may prevent important service features from working.

4. Payment and transaction information

We collect transaction records, applicable charges, credits, refunds, authorization holds, billing contact information, and limited payment-method details supplied by our payment processor, such as card brand, expiration date, and masked digits. Full card information is generally collected and processed by third-party payment providers rather than stored directly by Bimba.

5. Device, website, and app information

We automatically collect information such as IP address, device and advertising identifiers, operating system, browser and app version, language, referring page, pages or screens viewed, clicks, timestamps, crash logs, diagnostic data, network information, and interactions with messages or advertisements.

We use cookies, pixels, software development kits, local storage, and similar technologies for essential functions, security, preferences, analytics, performance, and—where enabled—advertising. Browser or device controls may allow you to reject non-essential technologies, though essential functions cannot operate without certain storage or identifiers.

6. Information from other sources

We may receive information from payment processors, identity and fraud-prevention providers, app stores, login providers, mapping services, analytics and advertising partners, customer-support providers, municipalities or public authorities, fleet contractors, insurers, and persons who report an incident involving you or a Bimba vehicle.

7. How we use information

We use personal information to create and secure accounts; verify identity and age; locate, unlock, rent, park, maintain, and recover vehicles; calculate and process charges; provide receipts, support, safety notices, and service communications; investigate accidents, complaints, fraud, theft, misuse, and prohibited riding; enforce agreements; comply with legal, tax, accounting, insurance, and regulatory obligations; and establish, exercise, or defend legal claims.

We also use information to analyze demand, improve routes, parking, vehicle availability, safety and product performance, develop new features, measure communications, and send marketing where permitted. You may opt out of promotional email or messages using the provided mechanism, but you will continue to receive transactional, safety, account, and legal notices.

8. Legal bases and consent

Depending on the activity, we process information because it is necessary to provide the service or perform a contract, because you have given informed consent, because we must comply with law, or because Bimba has a legitimate and proportionate operational, safety, security, fraud-prevention, or legal interest. Where consent is required, you may withdraw it prospectively, subject to processing already lawfully completed and information Bimba must retain.

9. How we disclose information

We may disclose information to vendors that provide payment processing, cloud hosting, app infrastructure, communications, customer support, mapping, analytics, advertising, identity verification, fraud prevention, security, professional advice, accounting, insurance, collections, maintenance, and fleet operations. They may use information only for authorized services or as otherwise disclosed under their own applicable notices.

We may disclose relevant information to Bimba-affiliated companies; municipalities, transport authorities, emergency services, police, courts, regulators, tax authorities, or other government bodies when authorized or required; insurers and parties involved in an accident or claim; and a buyer, investor, lender, successor, or adviser in a proposed or completed business transaction. We may also disclose information with your direction or consent.

We may provide aggregated or de-identified mobility information for planning, research, safety, sustainability, or service improvement when it is not reasonably capable of identifying you. Bimba does not sell personal information for money. Advertising and analytics technologies may nevertheless transmit device or interaction data to their providers; available consent and opt-out controls apply.

10. International processing

Bimba and its service providers may store or process information outside Costa Rica. Where information is transferred internationally, we use reasonable contractual, technical, and organizational safeguards and require handling consistent with applicable Costa Rican requirements.

11. Retention

We retain information only for as long as reasonably necessary for the purposes described here. Account, ride, location, payment, and support records may remain while your account is active and afterward when needed for legal, tax, accounting, safety, fraud-prevention, collections, dispute, insurance, or enforcement purposes. Identity documentation is retained only as long as reasonably necessary for verification and related legal or security purposes. When retention is no longer necessary, information is deleted, anonymized, or securely isolated.

Deleting an account does not necessarily delete every record immediately. Transaction, safety, dispute, and legal-compliance records may be preserved for the applicable limitation or statutory period. Backup copies may remain for a limited period until overwritten under normal retention cycles.

12. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information, including access controls, confidentiality obligations, secure transmission where appropriate, monitoring, and vendor controls. No system is completely secure. Protect your credentials and notify us promptly if you suspect unauthorized access.

13. Your rights and choices

Subject to Law No. 8968 and applicable exceptions, you may ask whether we hold personal information about you and request access, correction, updating, or deletion. You may withdraw consent where processing depends on consent, object to certain uses, and opt out of direct marketing. We may need to verify your identity before acting and may retain information where deletion is restricted or a legal basis requires continued retention.

Send requests to hello@gobimba.com or WhatsApp/call +506 6358-1026. Describe the request and use the email address or phone number associated with your account. Bimba will respond within the period required by applicable law. You may also contact Costa Rica’s data protection authority, PRODHAB, regarding rights under Law No. 8968.

14. Children

Bimba rental services are intended only for persons 18 years of age or older. We do not knowingly permit minors to create rider accounts or rent vehicles. Contact us if you believe a minor has provided personal information without appropriate authorization.

15. Third-party services

The service may link to or integrate third-party maps, payment services, app stores, authentication tools, social networks, or websites. Their privacy practices are governed by their own notices. Bimba is not responsible for an independent third party’s practices, except to the extent required by law.

16. Changes and contact

We may update this Policy to reflect changes in law, technology, vendors, or services. We will post the updated version and effective date and provide additional notice or request consent when required for a material change.

Privacy contact and responsible operator: 3-102-968605 S.R.L., Costa Rica. Email: hello@gobimba.com. Phone/WhatsApp: +506 6358-1026. Website: gobimba.com.