Privacy Policy

At Maison Automotive we take the privacy and protection of your personal data very seriously. This Privacy Policy describes how we process the information you provide to us through this website, in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

1. Data controller

Maison Automotive is not required to appoint a Data Protection Officer (DPO). Nevertheless, for any matter relating to privacy you may write to the address indicated above: info@maisonautomotive.es.

2. Data we collect

Through the contact and appointment request form, as well as through the communication channels you open with us (telephone, WhatsApp, email), we may collect the following data:

• Identifying and contact data: name, email address and telephone number.
• The content of your enquiry: the message and any details you choose to include (for example, the vehicle of interest, the model to be sourced, an indicative budget or any information you provide voluntarily).
• Browsing data: IP address, device and browser type and information about your use of the site, collected through cookies and similar technologies, as detailed in our Cookie Policy.

We do not request special categories of data (sensitive data). We ask that you do not provide such information through the forms. This site is likewise not directed at minors.

3. Purposes of processing

We process your personal data for the following purposes:

• To handle your appointment and information requests, respond to your enquiries and keep in touch with you in relation to the vehicles and services of Maison Automotive.
• To deliver our services: the private sale of premium vehicles and the sourcing or importing of vehicles on request, including carrying out the necessary pre-contractual and contractual steps.
• To send you communications relating to your enquiry and, where applicable, commercial information about vehicles or services that may be of interest to you, provided we have the appropriate legal basis.
• To analyse the use of the website on an aggregate basis in order to improve our content and services, and to display measurable advertising, on the terms of the Cookie Policy and subject to your prior consent.
• To comply with the applicable legal obligations (tax, accounting, administrative, etc.).

4. Legal basis for processing

The processing of your data is based on the following legal grounds under Article 6 of the GDPR:

• Your consent (Art. 6.1.a), which you give when completing and submitting the form by ticking the relevant box, as well as for the installation of non-technical cookies and the sending of commercial communications. You may withdraw it at any time.
• The performance of pre-contractual measures taken at your request and, where applicable, the performance of a contract (Art. 6.1.b), where the purpose of your enquiry is the purchase of a vehicle or a bespoke sourcing service.
• The legitimate interest of the controller (Art. 6.1.f) in responding to enquiries received, managing the commercial relationship, safeguarding the security of the site and, where appropriate, sending communications about similar services to existing clients.
• Compliance with legal obligations (Art. 6.1.c) in tax, accounting and administrative matters.

5. Retention period

We will keep your personal data for as long as the purpose for which it was collected remains:

• Data provided through enquiries and appointment requests will be kept for as long as necessary to deal with your request and, thereafter, for a reasonable period in case further communications arise, unless you request its erasure.
• Where a contractual relationship exists, the data will be kept for the duration of that relationship and, once it ends, for the periods required by law (in particular, the limitation periods for tax, accounting and commercial liabilities).
• Data processed on the basis of consent will be kept until you withdraw that consent.

Once these periods have elapsed, the data will be blocked and, finally, securely erased.

6. Recipients and data processors

Your data will not be disclosed to third parties, except where required by law. However, in order to deliver our services we rely on providers that act as data processors and access your data on behalf of the controller, with the appropriate safeguards and under the corresponding contract (Art. 28 GDPR). These providers deliver, among others, the following services:

The list of providers must be kept up to date. Whenever a service is replaced or a new one is added, it must be reflected in this table.

7. International data transfers

Hosting, email and lead automation (n8n) are provided within the European Economic Area (EEA). We use Google Analytics 4 for analytics purposes, subject to your consent, which may involve the processing of data by Google outside the EEA (for example, in the United States). Advertising services (Meta Pixel) are not yet active; if we activate them in the future, that provider could likewise process data outside the EEA.

In such a case, those international transfers will be carried out with the appropriate safeguards provided for in Chapter V of the GDPR, such as the Standard Contractual Clauses approved by the European Commission or the provider’s adherence to the EU-U.S. Data Privacy Framework, as applicable.

8. Your rights

As the data subject, you may exercise at any time the following rights recognised by the GDPR and the LOPDGDD:

• Access: to know what personal data of yours we are processing.
• Rectification: to request the correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request that we delete your data where, among other reasons, it is no longer necessary.
• Objection: to object to the processing of your data on grounds relating to your particular situation, as well as to the receipt of commercial communications.
• Restriction of processing: to request that we suspend the processing in certain cases.
• Portability: to receive your data in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
• Withdrawal of consent: to withdraw the consent given at any time, without affecting the lawfulness of the prior processing.

To exercise these rights you may write to us at info@maisonautomotive.es or by post to the controller’s address, stating the right you wish to exercise and enclosing, where applicable, a copy of a document proving your identity. Exercising these rights is free of charge.

Likewise, if you consider that the processing of your data does not comply with the applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), with offices at C/ Jorge Juan, 6, 28001 Madrid, or through its electronic register at www.aepd.es.

9. Security measures

The controller has adopted the appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, in accordance with Article 32 of the GDPR, in order to protect personal data against unauthorised destruction, loss, alteration, disclosure or access. These measures include, among others, the encryption of the website’s communications (HTTPS/SSL protocol), access controls and the formalisation of the corresponding data processing agreements with the providers that access the data.

10. Accuracy of the data

The user warrants that the data provided is truthful, accurate and up to date, and is responsible for notifying any change to it. Where the user provides third-party data, the user declares that they have that party’s consent and undertakes to convey to them the information contained in this Privacy Policy.

11. Changes to the Privacy Policy

The controller reserves the right to amend this Privacy Policy in order to adapt it to legislative or case-law developments, as well as to industry practices. In such cases, the changes introduced will be announced on this page with reasonable notice before they take effect.