1. Data controller
The controller of the personal data collected through this website and through the workshop’s contact channels is:
- Registered company name: PDP Racing 2006 S.L.U.
- Trading name: PDP Racing
- Spanish tax ID (CIF): B93738698
- Registered address: Cortijo Los Palmas 11, 29738 Torre de Benagalbón, Málaga (España)
- Telephone: +34 627 239 284
- Email: pdpracingcorp@gmail.com
- Website: https://pdpracing.com
- Activity: motor vehicle maintenance and repair (mechanic workshop).
- Company registry details: Registro Mercantil de Málaga — Tomo 5922, Libro 4829, Folio 198, Sección 8, Hoja MA-154850, Inscripción 1
2. What data we process and how we obtain it
This website has no contact forms, user registration or payment gateway. We do not collect personal data automatically through the site itself, beyond the technical browsing information described in the Cookie Policy.
We process personal data only when you choose to contact us or engage a service. Depending on the channel, we may process:
- Identification and contact data: full name, telephone number, email address and, where applicable, postal address.
- Vehicle data: registration plate, make, model, chassis number, mileage and the details shown on the vehicle registration document.
- The content of your communications: messages, photographs, voice notes or documents you send us via WhatsApp or email to describe a fault.
- Billing and payment data: that required to issue an invoice for the service provided, in accordance with tax legislation.
- Browsing data: IP address, device type and browser, processed by our hosting provider for technical and security purposes.
3. Purposes and legal bases
Each processing activity relies on a specific legal basis set out in Article 6 of Regulation (EU) 2016/679 (GDPR):
- We do not send marketing communications or newsletters, and we do not use your data for profiling or for automated decision-making producing legal effects.
| Purpose | Legal basis |
|---|---|
| Responding to your enquiries and appointment requests received via WhatsApp, telephone or email. | Consent of the data subject and pre-contractual measures taken at the data subject’s request (Art. 6(1)(a) and 6(1)(b) GDPR). |
| Preparing quotes and providing the vehicle repair or maintenance service. | Performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR). |
| Issuing invoices and complying with accounting, tax and statutory warranty obligations. | Compliance with a legal obligation to which the controller is subject (Art. 6(1)(c) GDPR). |
| Handling complaints, repair warranties and defence against potential liabilities. | Legitimate interest of the controller in defending its rights (Art. 6(1)(f) GDPR). |
| Ensuring the security, availability and technical operation of the website. | Legitimate interest of the controller in keeping the service operational and secure (Art. 6(1)(f) GDPR). |
4. Retention periods
We retain data for as long as is strictly necessary to fulfil the purpose for which it was collected and, thereafter, blocked for the applicable statutory limitation periods:
- Enquiries that do not lead to a service: deleted once dealt with, unless retention is necessary to evidence our response.
- Contract and repair data: for the duration of the relationship and thereafter for the limitation periods applicable to contractual claims and the statutory warranty.
- Accounting and invoicing records: six years under Article 30 of the Spanish Commercial Code, and four years for tax purposes under the Spanish General Tax Act.
5. Data recipients
We do not sell or transfer your personal data to third parties for commercial purposes. It is accessed only by providers supplying services necessary for our activity, with whom we hold the corresponding data processing agreement under Article 28 GDPR:
- Our website hosting and infrastructure provider.
- Meta Platforms Ireland Ltd., where communication takes place via WhatsApp. Use of that application is additionally governed by its own terms and privacy policy.
- Google Ireland Ltd., only where you give your consent to load the location map.
- Tax and accounting advisers, and financial institutions, for invoicing and payment management.
- Public authorities and law enforcement bodies, where there is a legal obligation to disclose.
6. International transfers
Some of the providers listed belong to corporate groups whose parent companies are established in the United States and may process data outside the European Economic Area.
In such cases, transfers rely on the safeguards provided for in Chapter V GDPR, principally the EU–US Data Privacy Framework adequacy decision and, failing that, the Standard Contractual Clauses approved by the European Commission.
7. Your rights
You may exercise the following rights at any time and free of charge by writing to pdpracingcorp@gmail.com or by post to Cortijo Los Palmas 11, 29738 Torre de Benagalbón, Málaga (España), stating the right you wish to exercise and enclosing a copy of a document evidencing your identity:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to request deletion of data when it is no longer necessary.
- Objection: to object to processing based on our legitimate interest.
- Restriction: to ask us to suspend processing while a claim is verified.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand.
8. Complaints to the supervisory authority
If you believe that the processing of your data does not comply with current legislation, or that we have not properly handled the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
9. Security and accuracy of data
We apply appropriate technical and organisational measures to ensure a level of security appropriate to the risk, preventing loss, alteration or unauthorised access to data, in accordance with Article 32 GDPR.
Users warrant that the data provided is accurate and undertake to notify us of any changes. If you provide us with third-party data, it is your responsibility to have informed those people of the contents of this policy beforehand.
10. Minors
The services on this website are aimed at persons over 18 years of age. We do not knowingly collect data from minors. If we become aware that we have processed a minor’s data without the authorisation of their legal guardians, we will delete it.