GDPR & Your Data Rights
Last updated: 16 May 2026
1. Our commitment
DETAILCAR FRANQUICIAS, S.L. is fully committed to complying with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Spain's Organic Law 3/2018 on Data Protection and Digital Rights (“LOPDGDD”).
Our management has adopted a formal Corporate Data Protection Commitment that applies privacy-by-design and privacy-by-default principles, data minimisation, lawful and transparent processing, purpose limitation, and security across the full data lifecycle. All personnel are required to understand and apply this commitment.
2. Data controller
| Company | DETAILCAR FRANQUICIAS, S.L. |
| CIF | B98355530 |
| Registered address | Calle Bello 9, Bajo Izquierda, 46024 Valencia, España |
| Commercial Registry | Registro Mercantil de Valencia — Tomo 9345, Libro 6627, Folio 114, Hoja V-144277, Inscripción 1ª |
| Phone | +34 961 059 959 |
| Data Protection Officer | AUDIDAT |
| Data protection contact | administracion@detailcar.es |
DetailCar is the data controller for all personal data collected through the Platform. Individual franchise Centres may act as joint controllers for data processed locally at their premises (e.g. CCTV footage, on-site records).
3. Legal bases for processing
| Legal basis | When we rely on it |
|---|---|
| Contract (Art. 6(1)(b)) | Bookings, account management, payments, confirmations and receipts. |
| Consent (Art. 6(1)(a)) | Marketing emails, non-essential cookies, SMS promotions. Withdrawable at any time. |
| Legitimate interest (Art. 6(1)(f)) | Service improvements, fraud prevention, support, internal analytics. |
| Legal obligation (Art. 6(1)(c)) | Tax records, compliance with Spanish commercial law, lawful authority requests. |
4. Your rights under GDPR
You can exercise any of the following by emailing administracion@detailcar.es. We will respond within 30 days.
- Access (Art. 15) — receive a copy of your data and information on processing.
- Rectification (Art. 16) — correct inaccurate or incomplete data.
- Erasure (Art. 17) — the right to be forgotten, subject to legal retention.
- Restriction (Art. 18) — freeze processing in certain circumstances.
- Portability (Art. 20) — receive data in a machine-readable format.
- Object (Art. 21) — to processing based on legitimate interest or direct marketing.
- Withdraw consent (Art. 7(3)) — at any time, without affecting prior processing.
- No automated decisions (Art. 22) — we do not make purely-automated decisions with legal effect.
5. Data processors & international transfers
| Processor | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, storage | EU (Frankfurt) | N/A (EU) |
| Stripe | Payment processing | US / EU | SCCs + DPF |
| Twilio | SMS & WhatsApp notifications | US | SCCs + DPF |
| Resend | Transactional email | US | SCCs |
| Google (Maps, Analytics) | Maps and anonymised analytics | US | SCCs + DPF |
International transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, the EU-US Data Privacy Framework (DPF).
6. Data breach notification
- Notify the AEPD within 72 hours of becoming aware, if the breach is likely to pose a risk (Art. 33).
- Notify affected individuals without undue delay if the risk to their rights is high (Art. 34).
- Document all breaches in our internal register.
7. Children's data
Our services are not directed at children under 16. We do not knowingly process minors' data. Under Spanish law (LOPDGDD Art. 7) the minimum age for digital consent is 14.
8. Data retention summary
| Category | Retention | Reason |
|---|---|---|
| Account profile | Active + 12 months | Service provision |
| Booking history | 5 years | Spanish commercial law |
| Payment / invoice records | 7 years | Spanish tax law |
| Contact form messages | 12 months | Legitimate interest |
| Marketing consent records | Consent + 3 years | Proof of consent |
| Analytics (raw) | 26 months | Website improvement |
9. Supervisory authority
If you believe your data protection rights have not been respected:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan 6, 28001 Madrid
www.aepd.es
Tel: 901 100 099