Drive & Deal Autos › Privacy Policy

Privacy Policy

How we collect, use and protect your personal data — in plain English. (also known as Política de Privacidad)

Last updated: May 7, 2026

1. Data Controller

The data controller responsible for the processing of your personal data is:

Drive & Deal Autos, S.L
CL. LAS PALMERAS , S/N C2 11312 San Roque, CADIZ
VAT / NIF: B88679436
Email: oficina@drivedealautos.es
Phone: +34 683498156

For full company details and registration information, see our Legal Notice.

2. What data we collect

We process the following categories of personal data, depending on how you interact with us:

  • Contact information — name, email address, phone number, postal address. Collected when you submit an enquiry, request a vehicle reservation, or sign up for updates.
  • Identification documents — passport or NIE, driving licence, proof of address. Collected only when required to register a vehicle in your name (a legal requirement under Spanish DGT rules).
  • Transaction data — vehicle purchased, sale price, payment method, invoice number. Required to issue invoices and meet our tax obligations.
  • Technical data — IP address, browser type, device, pages visited, referring URL. Collected automatically through cookies and server logs (see our Cookie Policy).
  • Communications — emails, WhatsApp messages, phone-call transcripts (if recorded with consent), and any documents you upload to us.

3. Why we use your data — and the legal basis

Under Article 6 of the GDPR we may process your data for the following purposes:

  • To respond to your enquiries — legal basis: pre-contractual measures at your request (Art. 6(1)(b)).
  • To complete a vehicle sale or rental — legal basis: performance of a contract (Art. 6(1)(b)).
  • To register a vehicle with the DGT, arrange ITV, transfer insurance, or pay road tax on your behalf — legal basis: performance of a contract and our legal obligations (Art. 6(1)(b) and (c)).
  • To issue invoices and keep accounting records — legal basis: legal obligation under Spanish tax law (Art. 6(1)(c)).
  • To send you service updates about a transaction (delivery confirmation, paperwork status) — legal basis: performance of a contract (Art. 6(1)(b)).
  • To send marketing communications (newsletters, new arrivals matching your interest) — legal basis: your consent (Art. 6(1)(a)). You can withdraw consent at any time.
  • To improve our website and prevent fraud — legal basis: our legitimate interest (Art. 6(1)(f)).

4. Who we share your data with

We share your data only when necessary, and only with parties bound by appropriate confidentiality obligations:

  • Spanish public authorities — DGT (Dirección General de Tráfico) for vehicle registration, Hacienda for tax reporting, ITV stations for inspections.
  • Notaries and gestores — only when handling NIE applications, vehicle transfers, or other paperwork on your behalf.
  • Insurance companies — when arranging your motor insurance, if you ask us to do so.
  • Payment processors — Stripe, PayPal, or our acquiring bank, to take card payments. They act as independent controllers for fraud and AML purposes.
  • Hosting and email providers — our IT vendors (currently AWS within the EU) acting as data processors under GDPR Art. 28 contracts.
  • Professional advisors — accountants, lawyers, and auditors, bound by professional confidentiality.

We do not sell your personal data, and we do not use it for automated decisions with legal effects on you.

5. International transfers

Your data is stored within the European Economic Area (EEA). Where a sub-processor operates outside the EEA (rare, and only for technical infrastructure), the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard under GDPR Art. 46.

6. How long we keep your data

  • Enquiry data with no follow-up: 12 months from last contact, then deleted.
  • Customer transaction data: 6 years after the end of the financial year (Spanish Commercial Code, Art. 30) — invoices, contracts, payment records.
  • Identification documents: only for as long as needed to complete registration; copies deleted within 30 days of completion unless retention is required by AML rules.
  • Marketing consent: until you unsubscribe.
  • Server logs and cookie data: see our Cookie Policy for retention periods.

7. Your rights under the GDPR

You have the following rights regarding your personal data:

  • Access (Art. 15) — request a copy of the data we hold about you.
  • Rectification (Art. 16) — ask us to correct inaccurate or incomplete data.
  • Erasure (Art. 17) — ask us to delete your data, subject to our legal-retention obligations.
  • Restriction (Art. 18) — ask us to limit how we use your data.
  • Portability (Art. 20) — receive your data in a structured, machine-readable format.
  • Objection (Art. 21) — object to processing based on our legitimate interest, including direct marketing.
  • Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email oficina@drivedealautos.es. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Spanish Data Protection Authority — Agencia Española de Protección de Datos (AEPD).

8. Security

We protect your data with technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), encrypted backups, access controls, secure password hashing, and staff training. Despite this, no transmission over the Internet is 100% secure. We will notify you and the AEPD without undue delay in the event of a breach affecting your rights and freedoms (GDPR Art. 33–34).

9. Children

Our services are intended for adults aged 18 or over. We do not knowingly collect data from minors. If you believe a minor has submitted data to us, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy when our practices or the law change. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated by a banner on the site and, where required, by direct notice to active customers.

11. Contact

For any privacy question, write to us at oficina@drivedealautos.es or by post at the address above. We do not currently appoint a Data Protection Officer because we are not required to under GDPR Art. 37 — but the email above reaches the person responsible for data protection at Drive & Deal Autos, S.L.