Privacy Policy

1. Data controller

The controller responsible for processing your personal data is:

• EffiFlex S.L.
• Tax ID (CIF): [TODO: CIF number]
• Registered address: [TODO: Full address], Valencia, Spain
• Registered with the Commercial Registry of Valencia: [TODO: Volume, Book, Folio, Section, Sheet]
• Contact email: contacto@rutapart.es
• Data Protection Officer: privacidad@rutapart.es

2. Data we collect

Through this website, we may collect the following categories of personal data:

• Identification data: name, surname, email address (provided voluntarily when signing up for the waiting list, contact forms, or account registration).
• Browsing data: IP address, browser type and operating system, pages visited, time spent, referral source, and other usage data collected automatically through cookies and similar technologies.
• Communication data: content of messages sent through the contact form or email.
• Transaction data (when the marketplace is operational): purchase history, shipping data, payment information processed by Stripe (Rutapart does not store complete credit card data).

3. Purpose of processing

We process your personal data for the following purposes:

• Waiting list and pre-registration management: sending notifications about the platform launch and service updates.
• Commercial communications: sending offers, promotions, and news related to automotive spare parts (with your express consent).
• Web traffic analysis: understanding website usage to improve user experience and optimize our services.
• User support: managing inquiries and requests received through our contact channels.
• Purchase management (future): processing orders, shipments, returns, and warranties when the marketplace is operational.

4. Legal basis for processing

The processing of your data is based on the following legal grounds:

• Consent (Art. 6.1.a GDPR): for sending commercial communications and activating analytical and marketing cookies.
• Performance of a contract (Art. 6.1.b GDPR): for managing the contractual relationship arising from purchases on the marketplace and the provision of services.
• Legitimate interest (Art. 6.1.f GDPR): for statistical analysis of website usage with aggregated data and fraud prevention.
• Legal obligation (Art. 6.1.c GDPR): for compliance with tax and commercial obligations.

5. Data recipients

Your personal data may be shared with the following recipients:

• Cloudflare, Inc. (USA): CDN provider, web security, and bot protection (Turnstile).
• Google LLC (USA): web analytics services (Google Analytics) and advertising (Google Ads).
• Microsoft Corporation (USA): user behavior analysis (Microsoft Clarity).
• Meta Platforms, Inc. (USA): advertising conversion tracking (Meta Pixel).
• TikTok (Ireland/Singapore): advertising conversion tracking (TikTok Pixel).
• LinkedIn Corporation (USA): advertising conversion tracking (LinkedIn Insight).
• Stripe, Inc. (USA): secure payment processing (when the marketplace is operational).
• Shipping companies: for order shipment management (when the marketplace is operational).

6. International data transfers

Some of our service providers are located outside the European Economic Area. These transfers are carried out with appropriate safeguards in accordance with the GDPR:

• Google LLC, Microsoft Corporation, Cloudflare, Inc., Meta Platforms, Inc., LinkedIn Corporation, Stripe, Inc. (USA): covered by the EU-U.S. Data Privacy Framework, European Commission adequacy decision.
• TikTok: transfers covered by Standard Contractual Clauses approved by the European Commission.

7. Data retention period

We will retain your personal data for the following periods:

• Waiting list data: until platform launch plus 1 additional year, unless you request deletion beforehand.
• Contact data: 2 years from the last interaction.
• Transaction data: during the contractual relationship and legal retention periods (5 years for tax obligations).
• Browsing data: according to the duration of each cookie (see our Cookie Policy).

8. Data subject rights

You have the right to:

• Access: know what personal data of yours we are processing.
• Rectification: request the correction of inaccurate data.
• Erasure: request the deletion of your data when it is no longer necessary.
• Restriction: request that the processing of your data be limited in certain circumstances.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to the processing of your data in certain circumstances.
• Withdrawal of consent: withdraw your consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal.

To exercise any of these rights, you can contact contacto@rutapart.es or privacidad@rutapart.es, attaching a copy of your ID document.

9. Right to lodge a complaint with the supervisory authority

If you consider that the processing of your personal data violates current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), located at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es).

10. Changes to this policy

Rutapart reserves the right to modify this Privacy Policy to adapt it to legislative or judicial developments. Any changes will be published on this page and, if significant, we will notify you by email.