Privacy policy

Data controller

The controller within the meaning of article 4(7) GDPR is:

• EQUIVAN REMOLQUES, S.L.
• Polígono Industrial El Pinar, nave 14
• 41500 Alcalá de Guadaíra (Sevilla)
• España
• Email: contacto@remolquecaballos.com
• Phone: +34 955 000 000

Data protection contact

For any question about your data, write to privacidad@remolquecaballos.com or by post to the registered office marked “Data protection”. Appointing a data protection officer is not mandatory for a business of this size; this address remains the single point of contact.

Data processed when you order

To process an order we collect the following data:

• Title, first name and surname
• Billing address and, where applicable, delivery address
• Email address
• Phone number, needed to agree a delivery slot
• Order contents, amounts and chosen payment method
• IP address and timestamp of the order confirmation

Purposes and legal bases

Each processing operation rests on an identified legal basis:

• Performance of the sales and delivery contract — article 6(1)(b) GDPR
• Compliance with legal obligations, in particular accounting and tax — article 6(1)(c)
• Fraud prevention and site security — legitimate interest, article 6(1)(f)
• Sending marketing communications — consent, article 6(1)(a), revocable at any time

Customer account

Creating an account is optional: ordering as a guest remains possible, in line with the data minimisation principle in article 5(1)(c) GDPR. The password is stored only as a non-reversible hash and is never readable, including by our own team.

Recipients

Your data is disclosed only to recipients necessary for performing the contract:

• The carrier, for transport and scheduling
• The payment provider, for collection
• Our accountant and the tax authorities, under statutory obligations
• The site host, as a processor within the meaning of article 28 GDPR

Retention periods

We keep your data only as long as necessary:

• Order data and invoices: ten years from the close of the financial year (article L123-22 of the French Commercial Code) and six years under the right of disclosure (article L102 B of the French Tax Procedure Code)
• Customer account: until you delete it, then erased within thirty days
• Prospects and marketing recipients: three years from the last contact
• Connection logs: twelve months

Cookies and trackers

The site uses only cookies strictly necessary for it to work: sign-in session, cart and language preference. Such cookies are exempt from consent under article 82 of the French Data Protection Act, as interpreted by the CNIL.

No third-party analytics, advertising or social media cookie is set without your prior consent. Should such trackers be added, a consent banner would be introduced and this page updated.

Your rights

Under the conditions laid down by the GDPR, you have the following rights:

• Right of access — article 15
• Right to rectification — article 16
• Right to erasure — article 17
• Right to restriction of processing — article 18
• Right to data portability — article 20
• Right to object — article 21
• Right to withdraw consent at any time, without retroactive effect

Exercising your rights

Send your request to contacto@remolquecaballos.com or by post to the registered office. We reply within the one-month period laid down in article 12(3) GDPR, extendable by two months for complex requests.

From your customer account you can also export your data as JSON and delete your account without going through us.

Limits to erasure

Deleting an account does not delete orders already fulfilled: invoices and accounting records are subject to the statutory retention periods set out above, a case expressly covered by article 17(3)(b) GDPR. Orders are then detached from the account and any contact details not required on the invoice are removed from them.

Complaint to the supervisory authority

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the French data protection authority — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Security

Traffic with the site is encrypted using TLS. Access to data is limited to those who need it, back-office authentication requires a second factor, and technical secrets are encrypted at rest. These measures are reviewed regularly under article 32 GDPR.