Privacy policy

1. Data controller

The controller of the personal data collected through the Website is Paula Ruiz i Contreras (the “Owner”), trading as VELOX RS:

Controller

Paula Ruiz i Contreras

Trading name

VELOX RS

Spanish tax ID (NIF)

48020395Y

Address

Rambla Nostra Senyora, 25, 08720 Vilafranca del Penedès (Barcelona), España

Email

automocion@veloxrs.com

Telephone

+34 696 063 394

2. Personal data processed

Only the data that the User voluntarily provides through the Website’s forms is processed:

• Contact form and vehicle enquiries: name, telephone number or email address, preferred reply channel, the content of the message and, where applicable, the reference of the vehicle concerned and whether information about leasing is requested.
• Valuation requests: the contact details above, the vehicle details (make, model and version, year, mileage, fuel and general condition), comments and any photographs the User chooses to attach.
• Technical data: the IP address from which a form is sent is used temporarily to prevent abusive submissions and is not stored with the request.

Fields marked as required are needed to handle the request, and at least a telephone number or an email address must be provided so that a reply can be sent. Users should not include identity documents, special categories of personal data or unnecessary third-party data in the forms.

If the User contacts the Owner by WhatsApp, Instagram or email, the data provided in those communications will be processed for the same purposes.

3. Purposes of processing

• To handle and reply to enquiries about vehicles and any other request for information.
• To manage valuation requests: reviewing the vehicle, preparing a valuation and, where applicable, taking steps prior to its possible purchase.
• To ensure the security of the Website and prevent fraudulent or abusive use.

No commercial profiles are created and no decisions are taken based solely on automated processing. The data will not be used to send marketing communications.

4. Legal basis

• Vehicle enquiries and valuation requests: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
• Other enquiries: the Owner’s legitimate interest in responding to the communications received (Article 6(1)(f) GDPR).
• Website security: the legitimate interest in protecting the service against abusive use (Article 6(1)(f) GDPR).
• Retention of records of completed transactions: compliance with legal obligations (Article 6(1)(c) GDPR).

5. Retention period

Data will be kept for as long as necessary to handle the request and any follow-up. If no transaction takes place, the data will be deleted within a maximum of 12 months of the last communication with the User.

If a sale or purchase is completed, the data will be kept for the periods required by tax, commercial and consumer protection legislation and, in any event, for as long as liability may arise from the transaction. The data will be deleted once those periods have ended.

6. Recipients

Data will not be disclosed to third parties except where required by law or by a competent authority.

Technology providers acting as data processors, such as the Website’s hosting provider, may access the data solely to provide their services to the Owner, under the confidentiality and security commitments required by Article 28 GDPR.

7. International transfers

If the User chooses to communicate by WhatsApp, Instagram or email, the data will also be processed by the providers of those services — WhatsApp Ireland Limited for WhatsApp, Meta Platforms Ireland Limited for Instagram and Google Ireland Limited for email — in accordance with their own privacy policies. These providers may transfer data outside the European Economic Area with the appropriate safeguards provided for in Articles 44 et seq. of the GDPR.

If any provider engaged by the Owner were to process data submitted through the forms outside the European Economic Area, the transfer would likewise be made with those safeguards, such as European Commission adequacy decisions or standard contractual clauses.

8. Your rights

The User may at any time exercise the rights of access, rectification, erasure, objection, restriction of processing and data portability, as provided for in Articles 15 to 22 of the GDPR.

To do so, the User may contact the Owner by email at automocion@veloxrs.com or by post at the address given in section 1, with the reference “Data protection”. If there are reasonable doubts as to the User’s identity, additional information may be requested to confirm it. Requests will be answered within one month, which may be extended in the cases provided for in Article 12(3) GDPR.

Users who consider that the processing of their data does not comply with the law may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of the Member State in which they habitually reside.

9. Security measures

The Owner applies appropriate technical and organisational measures to protect data against loss, alteration or unauthorised access. These include restricting access to the management area to authorised staff with individual credentials, storing passwords protected by cryptographic algorithms and ensuring that photographs attached to requests are not publicly accessible.

10. Minors

The Website is not directed at children under 14. If the Owner becomes aware that a child under that age has provided personal data without the authorisation of their legal representatives, the data will be deleted.

11. Changes to this privacy policy

The Owner may update this policy to reflect legislative changes or changes in the processing carried out. The version in force is always the one published on the Website, showing the date of its last update.