PRIVACY POLICY

Identity and Contact Information of the Controller

Our identifying information:

XTRA AUTO SLU

You can contact us

• By postal mail: AVDA ELS ARCS, 24 - 46940 MANISES (VALÈNCIA)
• By email: rgpd@grupoxtra.es
• Website: www.grupoxtra.es

We inform you that, in accordance with Article 37.1 of the GDPR, it is mandatory to appoint a Data Protection Officer to whom you may address any questions, doubts, suggestions, or exercise your rights under this Regulation regarding the processing of your personal data, either by email or by phone.

Our DPO's details:

• Vicente M. Sancho Rodríguez (Caler Consultores, S.L.)
• rgpd@grupoxtra.es

Categories of Personal Data

We process the following categories of personal data:

• Identification data – name and surname, ID card or equivalent.
• Administrative data – business name, address, banking details, and contact persons.
• Contact data – email, phone number, and address.
• Digital data – cookies, IP address, websites and social networks, and other data publicly accessible on the Internet, etc.
• Social media data – public profile data from social media followers and visitors.
• Ethics channel data – data on the incident or the person reporting it, related to the incidents received through the ethics channel.
• Business data – suppliers, clients, managers, and partners.
• Other data necessary for processing – for more information on the category of personal data within the scope of our Activity, you can consult our Record of Processing Activities.

How do we collect your data?

We collect information about you from the following sources:

From our website:

• Through the Contact form.
• Through the Job Board.
• Through the Subscription form.
• Through the ethics channel.

From other tools on the Internet:

• Through our social media platforms.
• Via email to Clients or Suppliers with whom there has already been a prior commercial relationship.
• Via email to Prospective clients or interested parties without a commercial relationship for whom we do not yet have explicit consent.
• Via email to Interested parties for whom we have consent through various contact forms.

From other sources:

• When we communicate or interact with you by phone, email, or through any other contact method of our company.
• When you visit our facilities.
• Through a commercial visit.

For more information on the different data collection mechanisms used in the course of our activity, you may consult our Record of Processing Activities.

How long do we retain your data? (Retention Period)

Data will be retained while there is a commercial, contractual, or professional relationship with the data subject and subsequently for the number of years necessary to comply with the relevant legal obligations in each case. Notwithstanding the foregoing, data will be retained as long as they are necessary for the processing and the data subject does not request their deletion.

Regarding accounting and tax documentation, for tax purposes, accounting books and other mandatory records according to applicable tax regulations (IRPF, VAT, Corporate Tax, etc.), as well as supporting documentation for the entries recorded in the books (including software and data files and any other document of fiscal relevance), must be retained for at least the period during which the tax authority has the right to audit and investigate, and therefore assess tax liabilities, according to Articles 66 to 70 of the General Tax Law, which is 4 years.

Regarding accounting and tax documentation, for commercial purposes, books, correspondence, documentation, and supporting documents related to your business, properly organized from the last entry made in the books, unless otherwise established by general or special provisions, this commercial obligation extends to both mandatory books (income, expenses, investment assets, and provisions), as well as documentation and supporting documents for the entries recorded in the books (issued and received invoices, receipts, credit notes, bank documents, etc.), according to Article 30 of the Commercial Code, which is 6 years.

For more information on data retention in the course of our activity, you can consult our Record of Processing Activities.

To whom do we disclose your data?

Depending on the purpose of the processing, your personal data may be disclosed or processed by different categories of recipients:

• External collaborators or professionals.
• Public administrations (those using it in the legitimate exercise of their powers).
• Tax, accounting, and labor consultancy
  • Purpose: Accounting, tax management, and compliance with tax and labor obligations.
  • Data disclosed: Identifying data of clients / suppliers / employees, financial data, billing and payroll.
  • Legal basis: Legal obligation (Art. 6.1.c GDPR).
• Insurance companies
  • Purpose: Contracting insurance related to rented vehicles and claims management.
  • Data disclosed: Identifying and contact information of the driver, driver's license number, claims history.
  • Legal basis: Contract execution (Art. 6.1.b GDPR) and, in some cases, legitimate interest (Art. 6.1.f).
• Maintenance, repair, and roadside assistance companies
  • Purpose: Assistance to the driver during the rental (e.g., in case of breakdown).
  • Data disclosed: Name, phone number, and location of the customer.
  • Legal basis: Contract execution.
• Financial institutions or payment platforms
  • Purpose: Processing of payments, collections, and refunds.
  • Data disclosed: Bank and card information, customer identification data.
  • Legal basis: Contract execution and compliance with legal obligations.
• Fleet control and geolocation companies
  • Purpose: Operational management of the rental, vehicle security, and location in case of theft.
  • Data disclosed: Vehicle geolocation data, associated with the contract.
  • Legal basis: Legitimate interest (security of the rented asset) and contract execution.
• Law enforcement authorities
  • Purpose: In case of judicial requirements, traffic fines, or investigations.
  • Data disclosed: Driver's identity, rental contract data, vehicle license plate.
  • Legal basis: Compliance with legal obligations.
• Software or hosting companies (technology providers)
  • Purpose: Technical support, data hosting, billing systems, or CRM management.
  • Data accessed: Remote access to systems where customer data is stored.
  • Legal basis: Contractual relationship with the provider as data processor (not a proper disclosure, but relevant).
• Marketing or satisfaction survey companies
  • Purpose: Customer loyalty and service improvement.
  • Data disclosed: Name, email address, phone number.
  • Legal basis: Consent or legitimate interest.

In any case, we disclose your data only to the extent strictly necessary and in the form required to carry out the purposes described in this privacy policy, and only to entities with which we have signed agreements that protect your rights and freedoms regarding your personal data. These entities and/or professionals, considered Data Processors, are governed by Article 28 of the GDPR, and we ensure they take all necessary security measures in accordance with the mentioned regulation.

We also inform you that your data may be processed by companies within our group for commercial, administrative, statistical, and/or financial purposes. For more detailed information, you can consult the list of group companies at the beginning of this document.

For more information about third-party data disclosures in the course of our activity, you can consult our Record of Processing Activities.

Where do we process your data?

In order to carry out our activity, provide our services and/or sell our products, we process your personal data in accordance with the conditions established in this privacy policy within the European Union (EU).

For more information about where we process data in the course of our activity, you can consult our Record of Processing Activities.

For what purposes do we process your data?

Your data will be collected for processing operations relevant to the following purposes:

Purposes related to our website elements:

• Contact Form:
  • Receive contact information or other requests made by you.
  • Other purposes of the same form.
• Job Application Form:
  • Include your CV in our job pool.
  • Track your application.
• Subscription Form:
  • Receive our newsletter.
• Ethics Channel:
  • Follow-up and management of the incident.
  • Contact, if appropriate, with the person who reported the incident.
  • Use of the data provided for proper resolution.
• Specific processing on social networks (see social networks section).
• In the case of prospective clients or interested parties from whom we do not have explicit consent, it will be requested via email in order to maintain communication.

General purposes of our activity:

• Receive contact information or other requests made by you through any of our communication channels.
• Administrative tasks derived from the provision of our services.

For more information about the purposes of data processing in the course of our activity, you can consult our Record of Processing Activities.

You may withdraw your consent at any time free of charge by exercising your rights, sending your request in writing and properly identified with a supporting document, to our address AVDA ELS ARCS, 24 - 46940 MANISES (VALENCIA) or by email to rgpd@grupoxtra.es. For more detailed information on exercising your rights, you can consult our Record of Processing Activities.

Why can we process your data? (Legal Basis)

The use of your data under the conditions described above is permitted by European and Spanish data protection regulations in accordance with the following legal bases:

Art.6. GDPR

• The data subject has given consent to the processing of their personal data for one or more specific purposes.
• The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• The processing is necessary for compliance with a legal obligation to which the controller is subject.

Ethics channel

For the ethics channel, the processing is based on Law 2/2023 of February 20, governing the protection of persons who report regulatory violations and the fight against corruption.

For more information about the legal basis for data processing in the course of our activity, you can consult our Record of Processing Activities.

What are your rights?

Data protection regulations allow you to exercise your rights of access, rectification, objection, erasure ("right to be forgotten"), restriction of processing, portability, and not to be subject to individual automated decisions before the Data Controller.

Any data subject has the right to be provided, BEFORE their data is collected, with basic first-level information, in a summarized form, at the same time and by the same means in which their personal data is collected, and also to receive the rest of the information in a more appropriate format for presentation and understanding.

The layered or tiered information to be provided would be as follows:

First Layer Information

• The identity of the Data Controller.
• What data will be processed.
• For what purpose.
• Where and how the data was obtained.
• The legal basis for the processing.
• Whether the data will be communicated, shared, or processed by third parties.
• Reference to the procedure for exercising your rights.

Second Layer Information

• Contact details of the data controller. Identity and details of the representative (if applicable). Contact details of the Data Protection Officer (if applicable).
• Detailed description of the purposes of the processing. Data retention periods or criteria. Automated decisions, profiling, and applied logic.
• Detailed legal basis for processing, in cases of legal obligation, public interest, or legitimate interest.
• Whether it is mandatory to provide data and the consequences of not doing so.
• Recipients or categories of recipients. Adequacy decisions, safeguards, binding corporate rules, or applicable specific situations.
• How to exercise rights of access, rectification, erasure, and data portability, and how to restrict or object to processing.
• Right to withdraw previously given consent.
• Right to lodge a complaint with the Supervisory Authority.

(The following table shows what your rights are.)

These rights are characterized by the following:

• They can be exercised free of charge.
• You may exercise your rights directly or through a legal representative.
• If the request is submitted electronically, the information will be provided by the same means whenever possible, unless the data subject requests otherwise.
• Before exercising your rights, we must identify you to protect your personal data from fraudulent attempts.
• Your request will be resolved within one month.
• The controller is obliged to inform you about the means of exercising these rights. These means must be accessible, and the right cannot be denied just because another means is chosen.
• If the controller does not act on the request, they must inform you within one month of the reasons for not acting and the possibility to file a complaint with a Supervisory Authority.

If you wish to exercise any of the described rights, you may contact us through our Data Protection Officer:

• By postal address:

  XTRA AUTO SLU

  Attn. Data Protection Officer

  AVDA ELS ARCS, 24 - 46940 MANISES (VALENCIA)

• Or by email at: rgpd@grupoxtra.es

We inform you that in accordance with Article 37.1 of the GDPR, the appointment of a Data Protection Officer is mandatory, who can be contacted by email at the indicated address for any questions, concerns, suggestions, or to exercise your rights, duly identified with a supporting document, regarding the processing of your personal data under this Regulation.

Supervisory Authority

If you wish to file a complaint regarding the processing of your data by XTRA AUTO SLU, we inform you that you can contact the Spanish Data Protection Agency, C/ Jorge Juan, 6 28001-Madrid www.agpd.es

Cookies

Cookies are files that are downloaded to your computer to collect standard Internet log information and visitor behavior data. This information is used, for example, to track visitor usage of the website and to compile statistical reports on website activity.

You can configure your browser not to accept cookies. However, some first-party cookies are necessary to allow the website session to use our services.

For more information, visit the site's Cookie Policy. (politica-cookies)

Social Networks

XTRA AUTO SLU is present on social networks such as: Twitter, WhatsApp, YouTube, LinkedIn, and Instagram, with the purpose of processing personal data as defined within the terms and conditions of each service. If registration for certain services is done through personal data associated with a user account, you are informed that certain information contained in your account will be shared. XTRA AUTO SLU reminds you to be familiar with the privacy policies of these media or social networks where you are registered in order to avoid sharing unwanted information.

You have privacy and account management settings on social networks to manage preferences for privacy, identity, advertising, and other related matters.

If registration for certain services is done through personal data associated with a user account, you are informed that certain information contained in your account will be shared.

The purposes of the data collected on the different social networks are:

• Advertising and commercial prospecting.
• Management of customer databases from campaigns or promotions related to the dissemination of our activities and services among our followers.
• Management related to e-commerce and order tracking.
• Communication with clients or interested parties.

Regarding Twitter, when a user follows our profile by clicking the 'Follow' button, we gain access to the profile page of those followers, specifically, the username, photo (if provided), and tweets or replies made by the user or others mentioning them, as well as other public profile information such as followed accounts, followers, or favorites. The data of users who follow our Twitter profile is used solely to manage and respond to the tweets or messages exchanged. Twitter's privacy policy can be consulted at the following link: www.twitter.com/privacy.

Regarding WhatsApp, when a user adds us as a contact, we will have access to the public data provided and their status updates. We may also communicate with them through this platform. The privacy policy can be consulted at www.whatsapp.com/legal/.

Regarding Instagram, when a user follows our profile by clicking the 'Follow' button, we gain access to their profile page, including the username, photos (if provided), and posts made by the user, as well as other public profile information such as followed accounts or followers. The data of users who follow our Instagram profile is used solely to manage the information exchanged. The privacy policy governing this social network can be consulted at: help.instagram.com/

Similarly, regarding YouTube, we gain access to information about people who subscribe to our channel, specifically their username, profile photo (if provided), comments made on videos, subscriber videos, playlists, and other channels they are subscribed to.

Regarding LinkedIn, when a user publishes their professional profile, we will have access to the public data shared by the user on that network. We may also communicate with them through it. The privacy policy governing this social network can be consulted at: www.linkedin.com/legal/privacy-policy?_l=es_ES

Unsubscribe Request

To request unsubscription from any service you are subscribed to, please note that you can exercise your right to erasure or objection to the processing of your data by writing to AVDA ELS ARCS, 24 - 46940 MANISES (VALENCIA) or sending an email to rgpd@grupoxtra.es with the subject UNSUBSCRIBE REQUEST and including your personal data and the email address with which you are registered. We will respond to your request indicating its status or requesting further information if necessary.

Minors

The user certifies that they are over 14 years of age and therefore have the legal capacity to give consent regarding the processing of their personal data, in accordance with this Privacy Policy.

If you wish to use our services through the website and are 14 years old or younger, we will need the consent of your legal guardian to store your data. If we do not have this consent, we may block or delete your data.

Security

XTRA AUTO SLU adopts organizational and technical measures to ensure the security of personal data and to prevent its alteration, loss, unauthorized processing or access, considering the state of technology, the nature of the data stored, and the risks to which they are exposed.

Updates

We keep our privacy policy under review and may change it from time to time (mainly to comply with legal and data protection practices).

Updated versions will be published on our website.

Applicable Law and Competent Courts

The terms and conditions governing this website, as well as any relationships that may arise, are protected and subject to Spanish law. To resolve any type of dispute, litigation, or disagreement that may arise between the user and XTRA AUTO SLU regarding the use of this website, both parties agree to submit to the Courts and Tribunals of VALENCIA, Spain.