Privacy Policy

1. Controller and contact

The Spanish company identified above is the controller of personal data used for Hola CAR Import and is also the contracting party and invoice issuer. Send privacy questions to the stated email or Spanish postal address. The Dutch address is an additional contact address. This notice covers the website, enquiries, callbacks, quotes, orders, invoicing and related communication. Authorities or independent providers processing for their own statutory purposes may be separate controllers.

2. Data and sources

We receive names, email addresses, optional telephone numbers, language, messages and service choices from you or your authorised representative. Callback requests require a reachable number. Vehicle enquiries include make, model, year, origin, registration details or their absence, declared value, relocation and ownership circumstances and transport locations.

Orders can add billing address, country, tax identifier, quote version, acceptance, amounts, invoices, payment confirmation, correspondence and necessary documents. Administration and security use authorised account information, protected sessions, IP-related security identifiers, request times and error or delivery status. Relevant information may also come from authorities, experts, transport providers or other participants in your assignment.

3. Necessary information

Without necessary contact, vehicle or billing details we may be unable to answer or perform the assignment. A phone number is not generally mandatory for the calculator but is needed for a callback. We ask only for necessary information. Do not submit health or criminal data, national identification numbers or unnecessary identity copies through the general form. Where identification is legally needed we arrange an appropriate transfer.

4. Purposes and legal bases

Responding, producing a requested cost breakdown or quote and performing services rely on contractual necessity or steps requested before a contract: GDPR Article 6(1)(b). Necessary status messages do not make an enquiry consent to advertising. Accounting, invoices and legally required disclosure rely on Article 6(1)(c).

Necessary security, fraud prevention, limited technical administration, complaints and legal claims may rely on legitimate interests under Article 6(1)(f), subject to balancing your interests and minimisation. Where consent is required we ask separately under Article 6(1)(a). You may withdraw it without affecting earlier lawful processing.

5. Calls, email and payments

A callback request is saved with contacts, an optional registration plate, explanation and the relevant page or service; authorised staff receive an internal notification and follow up your request. Request, quote, order and invoice messages are functional communications. Email handling can generate sending identifiers, delivery failures and replies.

Standard payment is by bank transfer, not card collection on the website. We record necessary billing and payment-verification information and do not publish it. Providing an email does not subscribe you to a newsletter or unrelated marketing.

6. Recipients

We use Google Firebase Hosting, Cloud Run, Firestore and Cloud Storage for hosting and technical processing, Firebase Authentication for authorised administration, Google Vertex AI/Gemini for vehicle advice and illustrations, and Resend for email. Appropriate processor arrangements apply where they act on our instructions; providers may separately control processing for their own statutory purposes.

Necessary assignment data may be shared with Spanish authorities, ITV stations, technical experts, transport providers, accounting or legal advisers and agreed participants. They do not automatically receive your entire file. Disclosures must be necessary for the assignment or a legal duty. We do not sell your personal data.

7. AI and human review

The standard Gemini advice prompt includes vehicle attributes and relevant import, relocation or transport circumstances. We do not deliberately include name, email or phone in that standard prompt. Standard image generation uses make, model and year. Do not place private information in free vehicle fields. Technical identifiers and results may be retained for the service.

AI can be wrong. Taxes, value, exemptions and documents require review before final agreement. This website does not make solely automated decisions producing legal or similarly significant effects on you. A calculation does not grant a tax exemption. You can ask for explanation and staff review.

8. International transfers

We do not claim all processing takes place only in the Netherlands, Spain or the EEA. Cloud, support, email and global AI services may involve other countries. Location depends on the service and applicable arrangements.

Transfers outside the EEA require an applicable GDPR mechanism, such as an adequacy decision or standard contractual clauses with supplementary measures where necessary. An adequacy certification is used only for a recipient and processing actually covered by it. Ask us for relevant safeguards and copies, with third-party confidential information appropriately protected.

9. Retention

Active enquiries are kept while needed for answering, requested follow-up or an ongoing proposal. After closure, continued retention requires a demonstrable purpose such as complaints, legal duties or claims. The applicable limitation period and an actual dispute determine that further period; submitting a form is not a reason for indefinite retention.

Records subject to Spanish commercial accounting retention are generally kept for six years, longer where another legal duty or proceedings require it. This does not make every vehicle field part of the fiscal archive. Security records are kept only as needed for security and abuse investigation. We review necessity and delete or anonymise when purposes and mandatory retention end. A valid erasure request is considered even if periodic housekeeping has not occurred.

Deletion from active systems does not instantly overwrite every protected backup. Remaining backup data is restricted until normal replacement and not used for new operational purposes. Legal preservation is limited to what is necessary.

10. Cookies, browser storage and external services

Functional browser storage can keep language and theme. Session storage may hold a personal result reference. A personal link can provide access to a result, so do not publish it and take care on shared devices. Authorised administration uses a secure HttpOnly session cookie with a maximum eight-hour session, unless logged out or revoked sooner.

Our current website code contains no advertising or marketing trackers. If non-essential tracking is added, information and legally required consent come first. Clearing browser storage may remove preferences or access to a saved result. The WhatsApp buttons for results and service requests open a prefilled message with your entered contacts, vehicle, plate and message and, where available, file reference, relevant circumstances, selected services and cost breakdown. Opening the link passes that information to WhatsApp. You can then review, edit and send the message yourself; the website does not send it automatically. Personal access tokens and signed file links are not included. Email, WhatsApp and other external services have their own terms and privacy rules; you choose whether to use them.

11. Photos and publication

Vehicle photos may identify people through faces, plates or locations. Public gallery use requires a valid legal basis and necessary usage rights; publication is not required for a normal enquiry. Request removal or object if you or your vehicle are improperly identifiable.

Gallery processing converts uploads to web format without retaining original EXIF fields by default. Visible personal details still need checking. Third parties can copy public images; removing an image from our website does not automatically erase such copies.

12. Security

Appropriate measures include restricted administration, secure connections, protected file storage, session safeguards and abuse controls. Access should be limited to people who need it. No security is absolute; report suspected incidents using our contact channel without unnecessary sensitive data.

We assess breaches and notify authorities and affected people when GDPR requires. Customer files are not listed in the sitemap. Asking search engines not to index legal pages is not access protection and does not prevent direct visits.

13. Your rights

You may request access, rectification, erasure, restriction and, where applicable, portability. You may object to legitimate-interest processing based on your situation and always object to direct marketing. Withdraw consent where it is the basis.

Email enough information to locate the file. Identity checks must be proportionate to reasonable doubts; do not send an unsolicited complete identity document. We normally respond within one month. Complex or numerous requests may permit up to two extra months; we explain this within the first month. Refusals and lawful exceptions are explained with complaint and remedy options. Requests are normally free; charges or refusal are possible only as GDPR allows.

14. Complaints and changes

You may contact us first, but need not do so before complaining to Spain's AEPD, www.aepd.es, or an applicable authority where you live or work, such as the Dutch Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl. Judicial remedies remain available.

We update this notice when processing or law changes and show the revision date. An update is not consent to an incompatible new purpose. Mandatory information or consent is arranged before that new processing.