Privacy Policy

Privacy Policy

Last updated: May 21, 2026 Version: 2.0

In compliance with Reglamento (UE) 2016/679 (GDPR) and of the Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), ZAMULE S.L. informs the user about the processing of their personal data on the site zamulecars.com.

1. Data Controller

• Company name: ZAMULE S.L. (operating entity of Grupo Illes Grupo Zamule)
• CIF: [CIF pending - operational entity pre-2025, to be completed]
• Registered office: C/ Gremi Fusters, 11 - Son Castelló Industrial Estate - 07009 Palma (Balearic Islands)
• Contact email: [email protected]
• Email Data Protection Officer (DPO): [email protected]
• Commercial Registry registration: Commercial Registry of Palma de Mallorca

2. Site services that involve processing

The site zamulecars.com offers the following services which may involve the processing of personal data:

• Online appointment booking for workshop services (mechanics, ITV, oil, AC, DPF, EGR, keys, headlights, etc.)
• Request for a personalized preliminary quote
• Purchase of services via payment gateway (where applicable)
• Post-service communication and reminders (maintenance, ITV)
• Zamule Club Management (loyalty program with monthly fee)

3. Purposes of processing

• Handling inquiries and requests received via web forms, WhatsApp, email or phone.
• Contractual execution and provision of services contracted (mechanical workshop, maintenance, ITV, ECU remapping, spare parts and B2C automotive services in Palma de Mallorca).
• Administrative, accounting, and tax management of the contractual relationship.
• Sending of commercial communications about similar services or promotions, with express consent or based on legitimate interest (existing customers).
• Website usage analysis using analytical cookies, with prior consent.
• Compliance with legal obligations applicable to the responsible party.
• Platform security and fraud prevention.

4. Legal basis for processing

• Customer Consent (Art. 6.1.a GDPR): forms, subscriptions, commercial communications without prior contractual relationship, non-essential cookies.
• Contractual execution (Art. 6.1.b GDPR): provision of contracted services.
• Legal obligation (art. 6.1.c RGPD): accounting, tax, and labor retention.
• Legitimate interest (art. 6.1.f GDPR): network security, fraud prevention, communications about similar services to existing clients.

5. Categories of data processed

• Identification details: name, surname, NIF/NIE, postal address.
• Contact details: phone, email, WhatsApp number.
• Vehicle details (where applicable): license plate, make, model, VIN, mileage.
• Professional / business data: Tax ID, company name, contact person (when the user acts as a company).
• Navigation data: IP address, device identifiers, cookies (see Cookie Policy).
• Transaction data: service history, amounts, invoices. Payment details (card number, CVV) are not stored by the responsible party: they are processed directly by the payment gateway (Stripe) in PCI-DSS certified environments.

The responsible party does not process special categories of data (health, ideological, biometric data, etc.).

6. Retention periods

• Contact details without contracting: up to 12 months since the last interaction.
• Contract and billing information: 6 years (art. 30 Commercial Code, art. 66 General Tax Law).
• Data for commercial communications: until consent is withdrawn.
• Analytical cookies: according to the period defined in the Cookie Policy.
• Security logs: 12 months.

7. Recipients / Data Transfer

ZAMULE S.L. does not share data with third parties except:

• Legal obligation: Tax Agency, General Treasury of Social Security, Security Forces and Bodies, or judicial authorities.
• Zamule Group Companies (Illes Grupo Zamule S.L., Zamule S.L., Zamule Diamond S.L. and future ones), exclusively for the coordinated provision of contracted services.
• Data Processors under contract (DPA) in accordance with Art. 28 GDPR.

7.1 Data Processors

7.2 International transfers

When a data processor is located outside the European Economic Area (EEA), ZAMULE S.L. guarantees the adoption of Standard Contractual Clauses (SCC) approved by the European Commission, or adherence to the EU-US Data Privacy Framework, in accordance with Art. 46 GDPR.

8. User rights

• Right of access (art. 15 RGPD).
• Right to rectification (art. 16 RGPD).
• Right to erasure or erasure (Art. 17 GDPR).
• Right to restriction of the processing (art. 18 GDPR).
• Right to data portability (art. 20 GDPR).
• Right to object (art. 21 RGPD).
• Right to withdraw consent at any time (art. 7 RGPD).
• Right not to be subject to automated decisions (Art. 22 GDPR), including profiling.

To exercise these rights, send an email to [email protected] with:

• First and last name.
• Copy of DNI/NIE/passport (identity verification).
• Right you wish to exercise and specific data it applies to.
• Notification address.

Maximum response time: 30 calendar days (art. 12.3 RGPD).

9. Claim before the AEPD

The user has the right to file a complaint with the Spanish Data Protection Agency (AEPD):

• Web: www.aepd.es
• Address: C/ Jorge Juan, 6, 28001 Madrid
• Phone: 901 100 099 / 912 663 517

10. Safety measures

ZAMULE S.L. applies technical and organizational measures in accordance with art. 32 GDPR, including encryption in transit (HTTPS/TLS 1.3), encryption at rest for sensitive credentials, access control based on minimum privileges, activity logging, periodic review of providers, and an incident response plan.

11. Minors

This site is not intended for users under 14 years of age. ZAMULE S.L. does not knowingly collect data from minors. If you discover that a minor's data has been collected without parental consent, we will proceed with its immediate deletion.

12. Modifications

ZAMULE S.L. reserves the right to modify this Policy when necessary to adapt to legal, jurisprudential changes or criteria from the AEPD. Any modification will be published with the visible last update date.

13. Contact

For any queries regarding this policy, please contact the DPO at [email protected].

Policy drafted with advice from Ático 34 and revised on May 21, 2026.