I don't know about the "safest" way, but one method would be to turn on FileVault (unless you already use FileVault.)
Boot to Internet Recovery, then erase your encrypted drive.
Still in internet recovery, reinstall OS X. Turn off your rMBP when it gets to the new user setup.
Your old data can't be recovered (unless you are giving your laptop to the NSA --- then all bets are off. )
The internet recovery install also leaves the new owner with a fresh install of the OS, nothing else on your drive.