Privacy policy

Data controller

GSP Garage, S.L., with Tax ID (NIF) B00000000 and address at Calle Ejemplo, 12, 38108 San Cristóbal de La Laguna, Santa Cruz de Tenerife. For any question about your data, write to info@gspgarage.es.

Contact form

What data. Your name, your phone number, your email address and number plate if you give them, the reason for your enquiry and your message. Alongside the message we store the page you sent it from and a reference code, to link it to the visit in the statistics.

What for. To reply to you and give you an appointment or a quote. We do not use it to send you advertising.

Legal basis. Taking steps, at your request, before entering into a repair contract (Article 6(1)(b) of the General Data Protection Regulation, GDPR).

How long. The message reaches the workshop by email and is stored in the website's database, which deletes it automatically after one year. If it leads to a repair, the data needed passes to the job card and the invoice and is kept for as long as tax and commercial law require.

Checking the status of your repair

What data. When you drop off your car, the workshop creates a tracking record with the number plate, the repair status and its dates, a short note with no personal data and, if you choose, the car model. You get a 6-digit code on your drop-off receipt and a personal link by WhatsApp.

How it is protected. The code and the link are not stored as they are: the website combines them with a secret key (HMAC) and keeps only the result, which is enough to find your repair but cannot be turned back into the code or link. Only the workshop sees the number plate, in its own panel. The status page never shows your name, your phone number or the price.

Failed attempts. To stop anyone guessing codes at random, the website counts failed attempts for each number plate (also transformed with HMAC) and, if there are too many, blocks checks for a while. These counters are deleted after 24 hours. Your IP address is not stored: it is only used at that moment to limit requests.

Legal basis. Performance of the repair contract (Article 6(1)(b) GDPR) for the status check, and our legitimate interest in protecting the website and your data (Article 6(1)(f)) for limiting attempts.

How long. The tracking record is deleted 30 days after the car is collected, and also if it goes 90 days without any change. Automatic backups of the database (Cloudflare D1) keep deleted data for 7 more days and then it is gone.

WhatsApp updates. If you give us your mobile number, we let you know about status changes on WhatsApp. The message is sent from the workshop's phone and goes through WhatsApp (Meta), which has its own privacy policy.

“Remember this device”

If you tick this box when checking your car, your browser saves the access code for your tracking in its local storage, so you do not have to type the number plate and code again. It does not save the number plate or the receipt code.

The box is unticked by default. The data is deleted when you press “Forget this device”, when the tracking record expires or if you clear this site's data in your browser. There is more detail in the cookie policy.

Visit statistics

What we measure. Which pages are visited and for how long, which website and campaign you came from, the type of device, operating system and browser, your approximate country, region and city, and the network operator, which helps tell visits from people apart from automated programs. We also count clicks on call, WhatsApp, the map and Instagram, and contact form submissions and status checks, without their content.

No cookies and no stored IP address. The statistics are our own, not Google's or any other company's. Your visit is identified by a code that only exists in the tab's memory and disappears when you close it. Cloudflare works out the location and operator from the connection. Your IP address is not stored. Nothing you type in the status check is recorded.

If you do not want your visit measured, turn on Global Privacy Control or Do Not Track in your browser. With either one, the website sends no statistics at all.

Legal basis and retention. Our legitimate interest in knowing how the website is used so we can improve it (Article 6(1)(f) GDPR). The data is not used for profiling or advertising. It is deleted automatically after one year.

Who else has access to your data

Cloudflare, Inc. hosts the website and the database, which sits in the European Union jurisdiction, and delivers contact form messages to the workshop, as a data processor. Cloudflare is certified under the EU-US Data Privacy Framework and offers the European Commission's standard contractual clauses for international transfers.

Zelerix, the studio that built and maintains the website, has access to contact form messages and statistics for maintenance and so the workshop can view them, as a data processor under a contract as required by Article 28 GDPR.

We do not share your data with anyone else, unless the law requires it.

Your rights

You can ask for access to, rectification, erasure or portability of your data, object to its processing or ask for it to be restricted by writing to info@gspgarage.es. If you think your rights have not been respected, you can complain to the Spanish Data Protection Agency, the AEPD (aepd.es (opens in a new tab)).