PERSONAL DATA PROTECTION POLICY
This Personal Data Protection Policy (hereinafter, the “Privacy Policy”) governs the processing of the personal data of users and visitors of the website www.moovecars.com, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Ley Orgánica 3/2018 de Protección de Datos Personales y Garantía de los Derechos Digitales (Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, LOPDGDD) and the applicable national transposition provisions in each country in which MOOVE CARS MOBILITY SPAIN, S.L. operates (France, Italy and the Netherlands).
We hereby inform you that browsing this website does not require you to provide personal data. Only the data that you voluntarily provide to us through the forms and contact channels indicated in this Privacy Policy will be collected. In any event, you may exercise your rights as described in section 8.
All transfers to the United States indicated in the table above are conditional upon your express consent in the Cookie Settings Panel. If you do not accept analytics and marketing cookies, or if you withdraw your consent at any time, no data will be transferred to these providers. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
Providers within the EEA (no international transfer):
If you have any queries regarding a specific transfer or consider that the safeguards offered are insufficient, you may contact the DPO (dpo@moovecars.com) in order to obtain a copy of the applicable safeguards or information on the supplementary measures implemented.
Limitation periods and statutory retention periods by country:
As we operate in several EEA countries, the statutory retention periods vary according to the national legislation applicable to the data subject:
Blocking and erasure:
Once the relationship legitimising the processing has come to an end, your data will be blocked and stored with restricted access, solely in order to comply with legal obligations, to establish and defend claims, or to respond to requests from the competent authorities. Upon expiry of the statutory periods indicated, the data will be permanently erased.
Safeguards for the user:
These advertising profiling activities are subject to a number of safeguards intended to protect your rights and to ensure effective control over your personal data. In the first place, they are based exclusively on your consent, in accordance with Article 6(1)(a) GDPR, given through the Cookie Settings Panel. Accordingly, if you do not accept marketing cookies, these processing activities will not be carried out.
Furthermore, the profiling carried out does not produce legal effects concerning you, nor does it give rise to consequences which similarly significantly affect you. Its sole purpose is to display advertisements that may be more relevant or better suited to your interests on third-party platforms.
Likewise, you may withdraw your consent at any time through the Cookie Settings Panel or by means of the “Cookie settings” link available in the footer of the website. Such withdrawal will take effect immediately from the moment it is processed.
Lastly, the profiling activities are carried out by the third parties identified in this Privacy Policy, including Meta, Google and LinkedIn, which will act as processors or as independent controllers, as applicable in each case, in accordance with their respective privacy policies and processing terms.
Right to lodge a complaint with the supervisory authority (Article 77 GDPR):
In addition to the rights set out above, you have the right to lodge a complaint with the data protection authority of the Member State of your habitual residence, your place of work or the place of the alleged infringement (Article 77 GDPR). It is not necessary to exhaust prior complaints before MOOVE CARS MOBILITY SPAIN, S.L. in order to lodge your complaint. The supervisory authorities of the countries in which Moove Cars operates are set out below:
The supervisory authority competent for MOOVE CARS MOBILITY SPAIN, S.L. as its main establishment is the AEPD (Spain). However, in accordance with Article 77 GDPR, you may address your complaint to the authority of the country where you reside, where you work or where the alleged infringement took place. The authorities will cooperate with one another in accordance with the one-stop-shop mechanism under the GDPR (Article 56).
Action in the event of data relating to minors:
In the event that MOOVE CARS MOBILITY SPAIN, S.L. detects or is informed that it has collected the personal data of a minor who has not reached the minimum age for validly giving digital consent in their country of residence, without the corresponding authorisation of their legal representative, it will adopt the necessary measures without undue delay in order to ensure the protection of their personal data.
To that end, it will proceed to erase the minor’s personal data from its systems and, where applicable, from the systems of the processors involved in the provision of the services, unless there is a legal obligation requiring its retention. Until such erasure is effectively carried out, the data may remain blocked and subject to the technical and organisational measures necessary in order to prevent any processing other than that strictly necessary for its deletion. Likewise, where the data has been disclosed to third parties, MOOVE CARS MOBILITY SPAIN, S.L. will notify them of the need to proceed with its erasure, in accordance with the provisions of Article 17(2) GDPR.
Reporting of incidents:
If you are the legal representative of a minor and consider that MOOVE CARS MOBILITY SPAIN, S.L. has processed a minor’s data without your authorisation, we kindly ask you to contact the DPO immediately at dpo@moovecars.com, stating the identity of the minor and your relationship with them. MOOVE CARS MOBILITY SPAIN, S.L. will handle the request as a matter of priority.
Your rights in relation to social media:
You may exercise your rights of access, rectification, erasure, restriction, portability and objection in respect of the data processed under the joint controllership of MOOVE CARS MOBILITY SPAIN, S.L. by contacting the DPO at dpo@moovecars.com. In respect of data processed exclusively by the platform, you must exercise your rights directly before that platform through its privacy settings.
1. Who is the Data Controller of your Personal Data?
Data Controller: MOOVE CARS MOBILITY SPAIN, S.L. Contact Details:Registered Office: Calle Luis I, número 54, CP 28031 Madrid, Spain N.I.F.: B87969390 Telephone: 910 72 66 88 General Email Address: info@moovecars.com Data Protection Officer (DPO): dpo@moovecars.com
2. What Data Do We Collect Through This Website?
MOOVE CARS MOBILITY SPAIN, S.L. collects the personal data that you voluntarily provide through the following channels: contact forms and information requests on the website, live chat widget (Trengo), the careers.moovecars.com recruitment platform (managed by Bizneo), email, telephone and direct messages or comments on the corporate social media profiles of MOOVE CARS MOBILITY SPAIN, S.L. The data that may be collected through those channels is as follows:- Name and surname
- Email address
- Telephone number
- Interested company or entity
- Subject matter or type of enquiry
3. For What Purposes Do We Process your Personal Data?
The specific purposes for which we process your personal data, and the legal basis legitimising each processing activity, are set out below.| PURPOSE | DESCRIPTION | LEGAL BASIS |
| Managing information enquiries | Responding to general enquiries from visitors regarding services, availability and informational questions. Where the enquiry constitutes a specific pre-contractual request (quotation, demonstration), the legal basis will be Article 6(1)(b) | Article 6(1)(f) (Legitimate interest: dealing with visitors’ enquiries for the proper operation of the public information service) |
| Formalising the contractual relationship | Processing requests for services, contracts and agreements | Article 6(1)(b) (Contract) |
| Maintaining the commercial relationship | Managing communications regarding contracted services, support and follow-up | Article 6(1)(b) (Contract) |
| Newsletter and marketing communications | Sending newsletters, updates and promotions (where you have given your consent) | Article 6(1)(a) (Consent) |
| Web analytics and service improvement | Measuring use of the website, pages visited, performance and statistics (Google Analytics) | Article 6(1)(a) (Consent) |
| Compliance with legal obligations | Disclosure to authorities, the Spanish Data Protection Agency (AEPD) and regulators where legally required | Article 6(1)(c) (Legal obligation) |
| Management of job applications | Management of the recruitment process for drivers and staff, through the employment forms on the website and the careers.moovecars.com platform | Article 6(1)(b) (Pre-contractual measures at the request of the data subject: management of the job application voluntarily submitted by the candidate) |
| Defence of claims | Retention of data for the statutory limitation periods for the establishment, exercise and defence of claims. This processing is carried out on the basis of the controller’s legitimate interest in protecting its rights, balanced against the rights of the data subject | Article 6(1)(f) (Legitimate interest: legal defence of the rights and interests of MOOVE CARS MOBILITY SPAIN, S.L. against possible judicial or extrajudicial claims) |
4. To Whom Will We Disclose your Data?
MOOVE CARS MOBILITY SPAIN, S.L. will disclose your personal data only where this is necessary for the purposes described above. Companies of the Moove Cars Group: Where this is necessary in order to handle your request, provide the services requested or coordinate the Group’s business activity, we may disclose your data to other companies of the Moove Cars Group. Such disclosures are based on the performance of pre-contractual or contractual measures or on the legitimate interest consisting in the efficient and coordinated management of the Group’s activity. You may request an up-to-date list of the Group entities from the Data Protection Officer. External Recipients – Sponsors and Co-organisers: If you register for events, workshops, training sessions or conferences sponsored by Moove Cars Partners, your data will be shared with Sponsors and Co-organisers only if you have given your explicit consent in the registration form. If you do not give your consent, your data will not be shared. The purpose is to enable you to receive additional information from the speakers and co-organisers. External Recipients – Public Authorities: Public authorities, regulators, government bodies, courts, the Agencia Española de Protección de Datos (AEPD) and tax administrations, solely where required by law or in compliance with legal or regulatory obligations. Processors: MOOVE CARS MOBILITY SPAIN, S.L. engages technology service providers which access personal data in their capacity as processors (Article 28 GDPR), with whom the corresponding processing agreements have been entered into. The categories of processors are: web analytics and digital advertising providers (Google LLC, Meta Platforms Inc., LinkedIn Corporation), cookie consent management provider (CookieScript), live chat provider (Trengo B.V.) and job application management provider (Bizneo).5. International Transfers of Data
As a general rule, MOOVE CARS MOBILITY SPAIN, S.L. processes users’ personal data within the European Economic Area (EEA). However, certain web analytics and digital advertising tools involve transfers of data to the United States. Such transfers take place only where the user has given consent through the Cookie Settings Panel and are subject to the safeguards detailed below. On 10 July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework, concluding that the United States ensures an adequate level of protection for personal data transferred to US companies certified under that framework. All the providers listed in the table above are certified under the DPF as at the date of this Privacy Policy. MOOVE CARS MOBILITY SPAIN, S.L. will periodically verify that such certifications are maintained. In the event that the DPF is invalidated or that any provider loses its certification, the transfers will be based on the Standard Contractual Clauses as an alternative safeguard. Providers involving transfers to the United States:| PROVIDER | DATA TRANSFERRED | PRIMARY SAFEGUARD | SUPPLEMENTARY SAFEGUARD |
| Google Analytics (Google LLC) | Browsing data: pages visited, session duration, device type, source of the visit. IP address anonymised by means of GA4 | EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10/07/2023). Google LLC is certified under the DPF | Standard Contractual Clauses (SCCs) updated following Schrems II. Supplementary measures: IP anonymisation in GA4, encryption in transit and at rest, Google Data Processing Terms |
| Meta Pixel / Facebook (Meta Platforms, Inc.) | Browsing events, conversions, interactions with advertising content | EU-U.S. Data Privacy Framework. Meta Platforms, Inc. is certified under the DPF | Standard Contractual Clauses (SCCs). Supplementary measures: Meta Business Tools Data Processing Terms, encryption in transit |
| Google Ads / YouTube (Google LLC) | Conversion events, clicks on advertisements, views | EU-U.S. Data Privacy Framework (same Google LLC certification) | Standard Contractual Clauses (SCCs). Google Ads Data Processing Terms |
| LinkedIn Insight Tag (LinkedIn Corporation) | Data relating to visitors coming from LinkedIn, interactions with advertisements | EU-U.S. Data Privacy Framework. LinkedIn Corporation is certified under the DPF | Standard Contractual Clauses (SCCs). LinkedIn Pages Joint Controller Addendum |
| PROVIDER | LOCATION | FUNCTION | LEGAL BASIS |
| CookieScript | EU | Cookie consent management (CMP) | Article 6(1)(c) GDPR (legal obligation to manage consent) |
| Trengo B.V. | the Netherlands (EU) | Live chat widget for visitor support. Acts as processor in accordance with Article 28 GDPR | Article 6(1)(b) GDPR (management of enquiries). The cookies associated with the widget require prior consent |
| BIZNEO – careers.moovecars.com | EU | Management of job applications. Acts as processor in accordance with Article 28 GDPR | Article 6(1)(b) GDPR (management of the recruitment process) |
6. For How Long Do We Store your Data?
MOOVE CARS MOBILITY SPAIN, S.L. stores your personal data only for as long as this is necessary in order to fulfil the purpose for which it was collected. The retention periods according to the type of data and purpose are specified below:| TYPE OF DATA | STORAGE PERIOD | BASIS |
| Data from contact forms and general information requests | For as long as the commercial relationship remains in force + 6 months following its termination, for the management of pending enquiries | Article 6(1)(b) GDPR |
| Candidate data (employment form and careers.moovecars.com) | A maximum of 24 months from receipt of the application, unless the candidate consents to retention for a longer period | Article 6(1)(b) GDPR. Employment legislation applicable in each country |
| Newsletter subscriber data | Until you withdraw your consent. Erasure within a maximum period of 72 hours from withdrawal | Article 6(1)(a) GDPR |
| Data for the defence of claims | Statutory limitation period for actions under the applicable legislation of the data subject’s country (see table below) + 1 additional year as a margin | Article 6(1)(f) GDPR |
| Analytics cookies (Google Analytics) | A maximum of 14 months (GA4 default setting), revocable at any time from the Cookie Panel | Article 6(1)(a) GDPR |
| Marketing cookies (Meta Pixel, LinkedIn, Google Ads) | Variable depending on the provider (a maximum of 2 years). Revocable at any time from the Cookie Panel | Article 6(1)(a) GDPR |
| Chat widget data (Trengo) | In accordance with the retention policy of Trengo B.V. as processor. MOOVE CARS MOBILITY SPAIN, S.L. requests the erasure of conversations after 12 months | Article 6(1)(b) GDPR |
| Access and security logs | A maximum of 12 months, for reasons of security and the detection of incidents. This processing responds to the controller’s legitimate interest, balanced against the rights of the data subject | Article 6(1)(f) GDPR (Legitimate interest: ensuring the security of information systems, preventing unauthorised access and detecting possible security incidents) |
| Tax and invoicing data | Statutory accounting and tax retention periods (see table below) | Article 6(1)(c) GDPR |
| ITEM | SPAIN | FRANCE | ITALY | THE NETHERLANDS |
| General limitation period for civil actions | 5 years (Article 1964 Código Civil (Spanish Civil Code)) | 5 years (Article 2224 Code Civil) | 10 years (Article 2946 Codice Civile) | 5 years (Article 3:307 BW) |
| Tax and accounting obligations | 4 years (LGT, Spanish General Tax Act) + 6 years (Código de Comercio, Spanish Commercial Code) | 6 years (Code de Commerce) + 3 years (tax, Livre des Procédures Fiscales) | 10 years (Article 2220 Codice Civile) + 5 years (tax) | 7 years (Article 52 AWR) |
| Limitation period for data protection infringements (GDPR) | 3 years (Article 78 LOPDGDD) | 5 years (Article 226-20 Code Pénal) | 5 years (general administrative limitation period) | 5 years (general administrative limitation period) |
| Retention of candidate (employment) data | 24 months (AEPD recommendation) | 24 months (CNIL recommendation, Délibération 2002-17) | 24 months (Garante Privacy practice) | Not specifically regulated; the data minimisation principle applies |
7. Automated Decision-Making and Profiling
Automated decisions: MOOVE CARS MOBILITY SPAIN, S.L. does not take decisions based solely on automated processing of your personal data which produce legal effects concerning you or similarly significantly affect you, in accordance with Article 22 GDPR. Should systems of automated decision-making with such effects be implemented in the future, you will receive specific information and will have the right to obtain human intervention, to express your point of view and to contest the decision. Profiling for advertising purposes (through third parties): MOOVE CARS MOBILITY SPAIN, S.L. uses third-party tools which carry out a degree of profiling as defined in Article 4(4) GDPR (automated processing of personal data in order to evaluate certain personal aspects). Specifically:| TOOL | TYPE OF PROFILING | DATA USED | EFFECT |
| Meta Pixel (Facebook/Instagram Ads) | Advertising retargeting: displays Moove Cars advertisements to users who have previously visited the website | Browsing events on moovecars.com (pages visited, actions performed) | Display of personalised advertisements on Facebook and Instagram |
| Google Ads (remarketing) | Advertising retargeting: displays Moove Cars advertisements on the Google network to previous visitors | Browsing events, clicks on advertisements | Display of personalised advertisements on Google and YouTube |
| LinkedIn Insight Tag | Advertising segmentation: makes it possible to target advertisements at website visitors who have a LinkedIn profile | Data relating to visits to moovecars.com cross-referenced with the LinkedIn professional profile | Display of targeted advertisements on LinkedIn |
| Google Analytics (GA4) | Aggregate analysis of browsing behaviour. Not used to display personalised advertising directly | Anonymised browsing data (anonymised IP address, pages, sessions, device) | Aggregate statistical reports for the improvement of the website. No individual effect |
8. What Are your Rights?
In accordance with the GDPR and the LOPDGDD, you have the following rights in respect of your personal data:| RIGHT | DESCRIPTION |
| Access (Article 15) | To request access to your personal data and to obtain confirmation as to whether or not data concerning you is being processed |
| Rectification (Article 16) | To request the correction of inaccurate or incomplete data |
| Erasure / Right to be Forgotten (Article 17) | To request the erasure of your data, subject to exceptions (legal obligations, defence of claims) |
| Restriction of Processing (Article 18) | To request that the manner in which your data is processed be restricted in certain circumstances |
| Data Portability (Article 20) | To receive your data in a structured format and to transmit it to another controller |
| Objection (Article 21) | To object to processing based on legitimate interest (in this case, marketing and web analytics) |
| Withdrawal of Consent (Article 7(3)) | To withdraw at any time the consent given for processing based on Article 6(1)(a) GDPR (newsletter, analytics and marketing cookies, events). Withdrawal does not affect the lawfulness of prior processing. You may withdraw your consent from the Cookie Panel or by contacting the DPO. |
| Not to be subject to automated decision-making (Article 22) | Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you. See section 7 for further information on how MOOVE CARS MOBILITY SPAIN, S.L. applies this right. |
| COUNTRY | SUPERVISORY AUTHORITY | WEBSITE | CONTACT |
| Spain | Agencia Española de Protección de Datos (AEPD) | https://sedeaepd.gob.es | C/ Edificio Cuzco IV, Paseo de la Castellana, 141, planta 9 28046 Madrid |
| France | Commission Nationale de l’Informatique et des Libertés (CNIL) | https://www.cnil.fr | 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 |
| Italy | Garante per la Protezione dei Dati Personali | https://www.garanteprivacy.it | Piazza Venezia 11, 00187 Roma |
| the Netherlands | Autoriteit Persoonsgegevens (AP) | https://www.autoriteitpersoonsgegevens.nl | Bezuidenhoutseweg 30, 2594 AV Den Haag |
9. How Can you Exercise your Rights?
You may exercise at any time the rights afforded to you by data protection legislation, including the right of access, rectification, erasure, restriction of processing, data portability and objection. To do so, you may send your request by email to dpo@moovecars.com, stating your name, the right you wish to exercise and a brief description of your request. Alternatively, you may also address your request by post to MOOVE CARS MOBILITY SPAIN, S.L., Calle Luis I, n.º 54, 28031 Madrid (Spain). Once received, your request will be dealt with within a maximum period of one month, in accordance with Article 12(3) GDPR. However, where the complexity of the request or the number of requests received so requires, that period may be extended by up to two further months, and you will be duly informed of that circumstance and of the reasons for the extension within the first month from receipt of the request.10. Security Measures
MOOVE CARS MOBILITY SPAIN, S.L. implements appropriate technical and organisational measures in order to ensure an adequate level of security. These measures are designed to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Technical measures: Encryption of data in transit by means of the TLS/SSL protocol in all website communications (active HTTPS certificate). Encryption of data at rest in the storage systems containing personal data. Role-based access control systems, with strengthened authentication for access to personal data. Periodic backups with verified recovery procedures. Monitoring of information systems and activity records (logs) in accordance with section 6 of this Privacy Policy. Periodic updating of software, operating systems and applications in order to remedy vulnerabilities. Organisational measures: Internal data protection policy with the allocation of responsibilities. Periodic training of staff with access to personal data on confidentiality obligations and good security practices. Confidentiality clauses and data processing agreements (Article 28 GDPR) with all providers that access personal data. Procedures for the management of security incidents and personal data breaches. Management of security breaches (Articles 33-34 GDPR): MOOVE CARS MOBILITY SPAIN, S.L. has in place a procedure for the detection, management and notification of personal data breaches. In the event of a security breach affecting your personal data which entails a risk to your rights and freedoms, MOOVE CARS MOBILITY SPAIN, S.L. will notify the breach to the competent supervisory authority within a maximum of 72 hours after having become aware of it (Article 33 GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, you will be informed without undue delay (Article 34 GDPR), unless any of the exceptions provided for in Article 34(3) GDPR applies. For security reasons, MOOVE CARS MOBILITY SPAIN, S.L. does not publicly disclose the specific technical details of the security measures implemented. If you wish to obtain further information on the security measures applied to your data, you may contact the DPO at dpo@moovecars.com.11. Protection of the Data of Minors
The services offered through www.moovecars.com are directed exclusively at persons of legal age and at professionals in the transport sector. MOOVE CARS MOBILITY SPAIN, S.L. does not direct its services at minors, nor does it intentionally collect the personal data of minors. Minimum age for digital consent: Article 8 GDPR allows Member States to establish the minimum age at which a minor may give valid consent to the processing of their data in relation to information society services. The minimum age varies according to the minor’s country of residence:| COUNTRY | MINIMUM AGE | LEGISLATION |
| Spain | 14 years | Article 7 LOPDGDD (Ley Orgánica 3/2018) |
| France | 15 years | Article 45 Loi Informatique et Libertés (Loi n° 78-17, as amended) |
| Italy | 14 years | Article 2-quinquies D.Lgs. 101/2018 (amending D.Lgs. 196/2003) |
| the Netherlands | 16 years | Article 5 UAVG (Uitvoeringswet AVG), which maintains the standard of Article 8 GDPR |
12. Social Media
MOOVE CARS MOBILITY SPAIN, S.L. maintains active corporate profiles on social media. In accordance with the case law of the Court of Justice of the European Union (Cases C-210/16 Wirtschaftsakademie and C-40/17 Fashion ID), MOOVE CARS MOBILITY SPAIN, S.L. acts as joint controller together with each platform in respect of certain processing of data arising from users’ interaction with those profiles (visits, reactions, comments, page statistics). MOOVE CARS MOBILITY SPAIN, S.L. is directly responsible for the content that it publishes and for the data that it receives through the platform’s functionalities (direct messages, comments). The underlying processing of data carried out by the platform (cookies, analytics, advertising profiling) is governed by the privacy terms of each platform. International transfers on social media: These platforms may have their servers outside the European Union and the European Economic Area, in particular in the United States. MOOVE CARS MOBILITY SPAIN, S.L. neither controls nor is responsible for the international transfers carried out by these platforms as independent controllers. We recommend that you consult their privacy policies before interacting with our profiles. Privacy policies of each platform:| SOCIAL NETWORK | LINK TO PRIVACY POLICY |
| X (formerly Twitter) | https://x.com/en/privacy |
| https://www.facebook.com/privacy/policy | |
| https://privacycenter.instagram.com/policy | |
| https://es.linkedin.com/legal/privacy-policy | |
| Google / YouTube | https://policies.google.com/privacy?hl=es |
| TikTok (EEA) | https://www.tiktok.com/legal/page/eea/privacy-policy/es |