PERSONAL DATA PROTECTION POLICY

Website Visitors and Users
www.moovecars.com

This Personal Data Protection Policy (hereinafter, the “Privacy Policy”) governs the processing of personal data of users and visitors to the website www.moovecars.com, in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and the national implementing provisions applicable in each country in which MC DIRECTORSHIP operates (France, Italy and the Netherlands).

 

We inform you that browsing this website does not require you to provide personal data. Only the data you voluntarily provide through the forms and contact channels indicated in this policy will be collected. In any case, you may exercise your rights as described in Section 8.

1. Who is the Data Controller?

Controller:

  • MC DIRECTORSHIP, S.L.U.
  •  

Contact Details:

  • Registered Office: Calle Luis I, número 54, CP 28031 Madrid, Spain
  • VAT number: B87969390
  • Telephone: 910 72 66 88
  • General Email: info@moovecars.com
  • Data Protection Officer (DPO): dpo@moovecars.com

2. What Data Do We Collect Through This Website?

MC DIRECTORSHIP collects the personal data you voluntarily provide through the following channels: contact forms and information requests on the website, live chat widget (Trengo), employment platform careers.moovecars.com (managed by Bizneo), email, telephone, and direct messages or comments on MC DIRECTORSHIP’s corporate social media profiles.

Data requested:

  • Name and surname(s)
  • Email address
  • Telephone number
  • Company or entity of interest
  • Subject or type of enquiry

Data NOT requested:

We do not under any circumstances request special category data (sensitive data) such as ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health data, sex life or sexual orientation, or criminal records.


If you send sensitive data without being requested to do so:

If you inadvertently provide data in these special categories, it will be deleted immediately and will not be used for any purpose, unless there is a valid and specific legal basis permitting it. In that case, you will receive detailed information at the time of collection.


Automatic collection — Cookies and similar technologies:

In addition to the data you provide, we collect information through cookies and similar technologies (Google Analytics, Meta Pixel, etc.) when you browse the website. For more details on how we use these technologies, storage duration, and how to withdraw your consent, please consult our Cookie Policy.

3. For What Purposes Do We Process Your Personal Data?

The following describes the specific purposes for which we process your personal data, the legal basis legitimising each processing operation, and whether processing is mandatory or voluntary.
PURPOSE DESCRIPTION LEGAL BASIS MANDATORY
Manage information enquiries Respond to general enquiries from visitors about services, availability, and informational questions. Where the enquiry constitutes a specific pre-contractual request (quote, demo), the basis is Art. 6.1.b) Art. 6.1.f) (Legitimate Interest: attending visitor enquiries for the correct operation of the public information service) Yes*
Formalise contractual relationship Processing of service requests, contracts, agreements Art. 6.1.b) (Contract) Yes
Maintain commercial relationship Managing communications about contracted services, support, follow-up Art. 6.1.b) (Contract) Yes
Newsletter and marketing communications Sending newsletters, updates, promotions (if you have given consent) Art. 6.1.a) (Consent) No
Web analytics and service improvement Measuring website usage, pages visited, performance, statistics (Google Analytics) Art. 6.1.a) (Consent) No
Compliance with legal obligations Disclosure to authorities, AEPD, regulators where legally required Art. 6.1.c) (Legal Obligation) Yes
Management of employment applications Managing the recruitment process for drivers and staff, via the employment forms on the website and the careers.moovecars.com platform (managed by Bizneo as data processor) Art. 6.1.b) (Pre-contractual measures at the request of the data subject: management of the employment application voluntarily submitted by the candidate) Yes**
Defence of claims Retention of data during statutory limitation periods for the submission, exercise and defence of claims. This processing is based on the legitimate interest of the controller in protecting its rights, weighed against the rights of the data subject Art. 6.1.f) (Legitimate Interest: legal defence of the rights and interests of MC DIRECTORSHIP against possible judicial or extrajudicial claims Yes*

* The legitimate interest of MC DIRECTORSHIP has been weighed against the rights of the data subject. You may exercise your right to object by contacting the DPO.
** Required in order to process your application. Without this data it will not be possible to evaluate your profile.

Art. 6.1.b = Performance of a contract or pre-contractual measures | Art. 6.1.a = Consent | Art. 6.1.c = Legal Obligation | Art. 6.1.f = Legitimate Interest

Consequences of not providing data: Data marked as mandatory in the forms are necessary to process your request or manage your application. If you do not provide them, MC DIRECTORSHIP will not be able to process your enquiry, formalise the requested contractual relationship, or evaluate your employment application. Refusal to provide data for optional processing (newsletter, web analytics, marketing) has no consequence whatsoever on your relationship with MC DIRECTORSHIP or on access to services.

4. To Whom Will We Disclose Your Data?

MC DIRECTORSHIP will disclose your personal data to the following entities, only where necessary for the purposes described above:

Internal access:

Data will be accessible internally by MC DIRECTORSHIP staff who need to know it in order to manage your request, subject to confidentiality obligations.

 

Moove Cars Group companies:

Other Moove Cars Group companies affiliated with MC DIRECTORSHIP, where strictly necessary to provide the requested service. The legal basis is Art. 6.1.b) GDPR (performance of contract) or Art. 6.1.f) GDPR (legitimate interest in the operational management of the group). You may request the DPO for an updated list of group entities.

 

External recipients — Sponsors and Co-organisers:

If you register for events, seminars, training sessions or conferences sponsored by Moove Cars Partners, your data will be shared only with Sponsors and Co-organisers if you have given your explicit consent on the registration form. If you do not give consent, your data will not be shared. The purpose is to allow you to receive additional information from speakers and co-organisers.

 

External recipients — Public authorities:

Public authorities, regulators, governmental bodies, courts, AEPD, and tax administrations, only if required by law or in compliance with legal or regulatory obligations.

 

Data processors:

MC DIRECTORSHIP works with technology service providers that access personal data as data processors (Art. 28 GDPR), with whom the corresponding data processing agreements have been executed. The categories of processors are: web analytics and digital advertising providers (Google LLC, Meta Platforms Inc., LinkedIn Corporation), cookie consent management provider (CookieScript), live chat provider (Trengo B.V.) and recruitment management provider (Bizneo). Details of each provider, their location and applicable safeguards are described in Section 5.

 

Data portability:

If you request the exercise of your right to data portability, your data will be transferred to the entity you designate, in accordance with your instruction.

5. International Transfers of Data

As a general rule, MC DIRECTORSHIP processes the personal data of users within the European Economic Area (EEA). However, certain web analytics and digital advertising tools involve transfers of data to the United States. These transfers occur only where the user has given consent through the Cookie Configuration Panel and are subject to the safeguards set out below.

Providers with transfers to the United States:

PROVIDER DATA TRANSFERRED PRIMARY SAFEGUARD SUPPLEMENTARY SAFEGUARD
Google Analytics (Google LLC) Browsing data: pages visited, session duration, device type, source of visit. IP anonymised via GA4 EU-US Data Privacy Framework (European Commission Adequacy Decision 10/07/2023). Google LLC is certified under the DPF Standard Contractual Clauses (SCCs) updated post-Schrems II. Supplementary measures: IP anonymisation in GA4, encryption in transit and at rest, Google Data Processing Terms
Meta Pixel / Facebook (Meta Platforms, Inc.) Navigation events, conversions, interactions with advertising content EU-US Data Privacy Framework. Meta Platforms, Inc. is certified under the DPF Standard Contractual Clauses (SCCs). Supplementary measures: Meta Business Tools Data Processing Terms, encryption in transit
Google Ads / YouTube (Google LLC) Conversion events, ad clicks, impressions EU-US Data Privacy Framework (same Google LLC certification) Standard Contractual Clauses (SCCs). Google Ads Data Processing Terms
LinkedIn Insight Tag (LinkedIn Corporation) Data of visitors coming from LinkedIn, interactions with ads EU-US Data Privacy Framework. LinkedIn Corporation is certified under the DPF Standard Contractual Clauses (SCCs). LinkedIn Pages Joint Controller Addendum

Providers within the EEA (no international transfer):

PROVIDER LOCATION FUNCTION LEGAL BASIS
CookieScript UE Cookie Consent Management Platform (CMP) Art. 6.1.c) GDPR (legal obligation to manage consent)
Trengo B.V. Netherlands (EU) Live chat widget for visitor support. Acts as data processor under Art. 28 GDPR. Cookies associated with the widget require prior consent Art. 6.1.b) GDPR (management of enquiries)
BIZNEO – careers.moovecars.com UE Employment application management. Acts as data processor under Art. 28 GDPR Art. 6.1.b) GDPR (recruitment process management)

Conditionality of consent:
All transfers to the United States indicated in the table above are conditional on your express consent in the Cookie Configuration Panel. If you do not accept analytical and marketing cookies, or if you withdraw your consent at any time, no data will be transferred to these providers. Withdrawal does not affect the lawfulness of processing based on consent given prior to its withdrawal.

 

On the EU-US Data Privacy Framework:

On 10 July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, concluding that the United States ensures an adequate level of protection for personal data transferred to US companies certified under that framework. All providers indicated in the table above are certified under the DPF at the date of this policy. MC DIRECTORSHIP will periodically verify the maintenance of such certifications. In the event of invalidation of the DPF or loss of certification by any provider, transfers will be based on Standard Contractual Clauses as an alternative safeguard.

 

Right to additional information:

If you have questions about a specific transfer or consider that the safeguards offered are insufficient, you may contact the DPO (dpo@moovecars.com) to obtain a copy of the applicable safeguards or information about the supplementary measures implemented.

6. How Long Do We Store Your Data?

MC DIRECTORSHIP stores your personal data only for as long as is necessary to fulfil the purpose for which they were collected. The retention periods are specified below according to the type of data and purpose:
TYPE OF DATA STORAGE PERIOD BASIS
Contact form and general information data Duration of commercial relationship + 6 months after its end, for management of pending enquiries Art. 6.1.b) GDPR
Candidate data (employment form and careers.moovecars.com) Maximum 24 months from receipt of the application, unless the candidate consents to retention for a longer period Art. 6.1.b) GDPR. Labour legislation applicable in each country
Newsletter subscribers data Until consent is withdrawn. Deletion within a maximum of 72 hours from withdrawal Art. 6.1.a) GDPR
Data for defence of claims Statutory limitation period applicable in the data subject's country (see table below) + 1 additional year of margin Art. 6.1.f) GDPR
Analytical cookies (Google Analytics) Maximum 14 months (GA4 default configuration), revocable at any time from the Cookie Panel Art. 6.1.a) GDPR
Marketing cookies (Meta Pixel,LinkedIn, Google Ads) Variable by provider (maximum 2 years). Revocable at any time from the Cookie Panel Art. 6.1.a) GDPR
Chat widget data (Trengo) In accordance with Trengo B.V.'s retention policy as data processor. MC DIRECTORSHIP requests deletion of conversations after 12 months Art. 6.1.b) GDPR
Access and security logs Maximum 12 months, for security and incident detection reasons. This processing is based on the legitimate interest of the controller, weighed against the rights of the data subject Art. 6.1.f) GDPR (Legitimate Interest: ensuring information systems security, preventing unauthorised access and detecting potential security incidents)
Tax and billing data Statutory periods for accounting and tax obligations (see table below) Art. 6.1.c) GDPR

Limitation and statutory retention periods by country:

As MC DIRECTORSHIP operates in several EEA countries, statutory retention periods vary according to the national legislation applicable to the data subject:

CONCEPT SPAIN FRANCE ITALY NETHERLANDS
General limitation period for civil actions 5 years (Art. 1964 CC) 5 years (Art. 2224 Code Civil) 10 years (Art. 2946 Codice Civile) 5 years (Art. 3:307 BW)
Tax and accounting obligations 4 years (LGT) + 6 years (Commercial Code) 6 years (Code de Commerce) + 3 years (tax, Livre des Procédures Fiscales) 10 years (Art. 2220 CC) + 5 years (tax) 7 years (Art. 52 AWR)
Limitation period for data protection infringements (GDPR) 3 years (Art. 78 LOPDGDD) 5 years (Art. 226-20 Code Pénal) 5 years (general administrative limitation) 5 years (general administrative limitation)
Retention of candidate data (employment) 24 months (AEPD recommendation) 24 months (CNIL, Délibération 2002-17) 24 months (Garante Privacy practice) Not specifically regulated; minimisation principle applies

Blocking and erasure:

Once the relationship legitimising the processing has ended, your data will be blocked and stored with restricted access, solely to comply with legal obligations, submit and defend claims, or to respond to requests from competent authorities. Upon expiry of the statutory periods indicated, the data will be permanently deleted.

 

Exception — Commercial communications:

If you have given consent for commercial communications (newsletter, marketing) and the contractual relationship has ended, we will continue to process your data solely for this purpose for as long as you maintain consent. You may withdraw at any time by writing to dpo@moovecars.com or through the unsubscribe link included in each communication.

7. Automated Decisions and Profiling

Automated decisions:

MC DIRECTORSHIP does not carry out solely automated decisions based on your personal data that produce legal effects on you or similarly significantly affect you, pursuant to Article 22 GDPR. If in the future systems of automated decision-making with such effects are implemented, you will receive specific information and you will have the right to obtain human intervention, to express your point of view, and to contest the decision.

 

Profiling for advertising purposes (through third parties):

MC DIRECTORSHIP uses third-party tools that carry out a degree of profiling within the meaning of Article 4(4) GDPR (automated processing of personal data to evaluate certain personal aspects). Specifically:

TOOL TYPE OF PROFILING DATA USED EFFECT
Meta Pixel (Facebook/Instagram Ads) Advertising retargeting: shows Moove Cars ads to users who have previously visited the website Navigation events on moovecars.com (pages visited, actions taken) Display of personalised ads on Facebook and Instagram
Google Ads (remarketing) Advertising retargeting: shows Moove Cars ads on the Google network to previous visitors Navigation events, ad clicks Display of personalised ads on Google and YouTube
LinkedIn Insight Tag Advertising segmentation: enables targeting of ads to website visitors who have a LinkedIn profile Visits to moovecars.com cross-referenced with LinkedIn professional profile Display of segmented ads on LinkedIn
Google Analytics (GA4) Aggregate analysis of browsing behaviour. Not used to show personalised advertising directly Anonymised browsing data (anonymised IP, pages, sessions, device) Aggregate statistical reports for website improvement. No individual effect

Safeguards for the user:

These advertising profiling operations offer the following safeguards:

First, they are based exclusively on your consent (Art. 6.1.a GDPR), given through the Cookie Configuration Panel. If you do not accept marketing cookies, these processing operations do not take place.

Second, they do not produce legal effects or similarly significantly affect you. Their only effect is the display of more relevant advertisements to you on third-party platforms.

Third, you may withdraw your consent at any time from the Cookie Configuration Panel or from the “Configure cookies” link in the website footer. Withdrawal is immediate and effective.

Fourth, profiling is carried out by the indicated third parties (Meta, Google, LinkedIn) as processors or independent controllers as the case may be, in accordance with their respective privacy policies and processing terms.

8. What Are Your Rights?

Under the GDPR and the LOPDGDD, you have the following rights regarding your personal data:
RIGHT DESCRIPTION
Access (Art. 15) Request access to your personal data and obtain confirmation of whether your data are being processed
Rectification (Art. 16) Request that inaccurate or incomplete data be corrected
Erasure / Right to be forgotten (Art. 17) Request the erasure of your data, subject to exceptions (legal obligations, defence of claims)
Restriction of processing (Art. 18) Request that the way your data are processed be restricted in certain circumstances
Data portability (Art. 20) Receive your data in a structured format and transfer them to another controller
Objection (Art. 21) Object to processing based on legitimate interest (in this case, marketing and web analytics)
Withdrawal of consent (Art. 7.3) Withdraw at any time the consent given for processing based on Art. 6.1.a) GDPR (newsletter, analytical and marketing cookies, events). Withdrawal does not affect the lawfulness of processing prior to withdrawal. You may withdraw via the Cookie Panel or by contacting the DPO.
Not to be subject to automated decisions (Art. 22) Not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. See Section 7 for more information on how MC DIRECTORSHIP applies this right.

Important notes on limitations of rights:

Right to erasure: This right cannot be exercised where statutory retention obligations exist (defence of claims, tax obligations) or where erasure would prevent compliance with legal obligations.

Withdrawal of consent: You may withdraw at any time consent for newsletter, web analytics and marketing without affecting the lawfulness of prior processing. To withdraw, access the Cookie Panel or contact the DPO.

Right to lodge a complaint with the Supervisory Authority (Art. 77 GDPR):

In addition to the above rights, you have the right to lodge a complaint with the data protection authority of the Member State in which you have your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR). You are not required to exhaust prior complaints before MC DIRECTORSHIP before lodging your complaint. The supervisory authorities in the countries where Moove Cars operates are listed below:

COUNTRY SUPERVISORY AUTHORITY WEBSITE CONTACT
Spain Agencia Española de Protección de Datos (AEPD) https://sedeaepd.gob.es C/ Jorge Juan 6, 28001 Madrid
France Commission Nationale de l'Informatique et des Libertés (CNIL) https://www.cnil.fr 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Italy Garante per la Protezione dei Dati Personali https://www.garanteprivacy.it Piazza Venezia 11, 00187 Roma
Netherlands Autoriteit Persoonsgegevens (AP) https://www.autoriteitpersoonsgegevens.nl Bezuidenhoutseweg 30, 2594 AV Den Haag

The competent supervisory authority for MC DIRECTORSHIP as lead establishment is the AEPD (Spain). However, pursuant to Art. 77 GDPR, you may direct your complaint to the authority of the country where you reside, work, or where the alleged infringement took place. The authorities will cooperate with each other pursuant to the GDPR one-stop-shop mechanism (Art. 56).

9. How Can You Exercise Your Rights?

You may exercise your rights (access, rectification, erasure, restriction, portability, objection) by contacting us in the following ways:

Option 1 — Email (Recommended):

Send your request to: dpo@moovecars.com

Include: (1) your name, (2) the right you wish to exercise, (3) a description of the reason.

Option 2 — Postal mail:

Send a signed letter with a copy of your identity document to: MC DIRECTORSHIP, S.L.U., Calle Luis I, número 54, CP 28031 Madrid (Spain).

Response period:

MC DIRECTORSHIP will respond to your request within a maximum period of one month from receipt. If the request is complex or a high number of requests has been received, this period may be extended by two additional months, pursuant to Art. 12.3 GDPR, with a reasoned notification within the first month.

Identity verification:

If we consider it necessary to protect your privacy, we may request additional documentation to verify your identity before processing your request.

10. Security Measures

MC DIRECTORSHIP applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR and Title VII of the LOPDGDD. These measures are designed to protect your personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage.

Technical measures:

Encryption of data in transit via TLS/SSL protocol for all website communications (active HTTPS certificate). Encryption of data at rest in storage systems containing personal data. Role-based access control systems, with reinforced authentication for access to personal data. Regular backups with verified recovery procedures. Monitoring of information systems and activity logs in accordance with Section 6 of this policy. Regular updates of software, operating systems and applications for the remediation of vulnerabilities.

Organisational measures:

Internal data protection policy with assignment of responsibilities. Regular training of staff with access to personal data on confidentiality obligations and security best practices. Confidentiality clauses and data processing agreements (Art. 28 GDPR) with all providers accessing personal data. Procedures for managing security incidents and personal data breaches.

Security breach management (Arts. 33–34 GDPR):

MC DIRECTORSHIP has a procedure for detection, management and notification of personal data breaches. Should a security breach occur that affects your personal data and poses a risk to your rights and freedoms, MC DIRECTORSHIP will notify the breach to the competent supervisory authority within a maximum period of 72 hours from becoming aware of it (Art. 33 GDPR). If the breach entails a high risk to your rights and freedoms, you will be informed without undue delay (Art. 34 GDPR), unless one of the exceptions set out in Article 34(3) GDPR applies.

For security reasons, MC DIRECTORSHIP does not publicly disclose the specific technical details of the security measures implemented. If you wish to obtain additional information about the security measures applied to your data, you may contact the DPO at dpo@moovecars.com.

11. Protection of Minors

The services offered through www.moovecars.com are directed exclusively at adults and professionals in the transport sector. MC DIRECTORSHIP does not direct its services at minors and does not intentionally collect personal data from minors.

Minimum age for digital consent:

Article 8 GDPR allows Member States to establish the minimum age at which a minor may give valid consent to the processing of their data in relation to information society services. The minimum age varies according to the country of residence of the minor:

COUNTRY MINIMUM AGE LEGISLATION
Spain 14 years Art. 7 LOPDGDD (Organic Law 3/2018)
France 15 years Art. 45 Loi Informatique et Libertés (Loi n° 78-17 as amended)
Italy 14 years Art. 2-quinquies D.Lgs. 101/2018 (amending D.Lgs. 196/2003)
Netherlands 16 years Art. 5 UAVG (Uitvoeringswet AVG), maintaining the standard of Art. 8 GDPR

Action in the event of data relating to minors:

If MC DIRECTORSHIP detects or is informed that it has collected personal data of a minor who has not reached the minimum age for digital consent in their country of residence, and does not have authorisation from their legal representative (holder of parental responsibility or guardian), it will take the following measures without delay:

First, the minor’s personal data will be erased from all MC DIRECTORSHIP systems and from the data processors, unless retention is legally required. Second, the data will be blocked until erasure is technically effective. Third, if the data has been disclosed to third parties, they will be notified of the obligation to erase in accordance with Article 17(2) GDPR.

Reporting incidents:

If you are the legal representative of a minor and consider that MC DIRECTORSHIP has processed the minor’s data without your authorisation, please contact the DPO immediately at dpo@moovecars.com indicating the identity of the minor and your relationship with them. MC DIRECTORSHIP will process the request on a priority basis.

12. Social Media

MC DIRECTORSHIP maintains active corporate profiles on social media. In accordance with the case law of the Court of Justice of the European Union (cases C-210/16 Wirtschaftsakademie and C-40/17 Fashion ID), MC DIRECTORSHIP acts as joint controller alongside each platform with respect to certain data processing operations arising from user interaction with those profiles (visits, reactions, comments, page statistics). MC DIRECTORSHIP is directly responsible for the content it publishes and for the data it receives through the platform’s functionalities (direct messages, comments). The underlying data processing carried out by the platform (cookies, analytics, advertising profiling) is governed by each platform’s privacy terms.

International transfers on social media:

These platforms may have their servers outside the European Union and the European Economic Area, particularly in the United States. MC DIRECTORSHIP does not control and is not responsible for international transfers made by these platforms as independent controllers. We recommend consulting their privacy policies before interacting with our profiles.

Privacy policies of each platform:

Your rights in relation to social media:

You may exercise your rights of access, rectification, erasure, restriction, portability and objection in respect of data processed under joint controllership with MC DIRECTORSHIP by contacting the DPO at dpo@moovecars.com. For data processed exclusively by the platform, you must exercise your rights directly with that platform through its privacy settings.

13. Amendments to This Privacy Policy

MC DIRECTORSHIP may amend this Privacy Policy in whole or in part at any time if required by applicable data protection legislation, changes to our services, or for other legitimate reasons.

Any amendment will be communicated through this website. If we make significant changes, we may notify you by email to the contact address you provided.

We recommend reviewing this Privacy Policy periodically to be informed of any changes.

Last updated: 28 February 2026

Privacy Policy — Website Visitors and Users | www.moovecars.com