Privacy policy

1. Data controller

The controller is the owner of maquinaria.click, whose identifying details appear in the legal notice. For any privacy question you can write to privacidad@maquinaria.click.

2. What data we process

• Account: name, email address, password (stored encrypted — we never see it) and, if you provide them, phone number and region.
• Listings: title, description, photos, price, vehicle features and location.
• Contact between users: messages in the internal chat, and the details you share when you contact another user by phone, WhatsApp or email.
• Identity verification (optional): if you request it to get the verified badge, you are asked for your ID number, phone, bank and photographs of your ID document, kept in private storage with restricted access.
• Homologation and paperwork (optional): vehicle documents you upload for the homologation file or the registration service.
• Reservations: data needed to manage a reservation with a deposit.
• Credits: balance, transactions and the payment reference. We do not process card numbers: card payments are made on the payment provider’s checkout.
• Technical data: IP address, device and browser type, and pages visited, for security, abuse prevention and aggregate measurement of the service.

3. Why and on what legal basis

• Providing the service (account, publishing listings, chat, reservations): performance of the contract or terms of use.
• Moderation, security, fraud prevention and usage limits: legitimate interest in protecting the platform and its users.
• Identity verification, homologation and paperwork: consent and, where applicable, performance of the contracted service.
• Traffic measurement and push notifications: consent, which you can withdraw at any time (see the cookie policy).
• Invoicing and tax obligations for paid services: compliance with legal obligations.
• Essential service emails (account confirmation, security alerts): performance of the contract; they are not marketing.

4. How long we keep it

• Account data and listings: while the account is active. If you delete it, the data is erased and the listings are no longer visible.
• Identity verification: while the verified badge exists and, afterwards, for the minimum time needed to handle possible liabilities.
• Chat messages: while the listing is active and as long as needed to handle incidents.
• Invoicing of paid services: accounting and tax retention periods (generally six years).
• Technical and security logs: a short, proportionate period, no longer than needed to investigate abuse.

5. Who else processes your data

We do not sell your data. To operate we need providers that process data on our behalf (processors):

• Supabase (database, authentication and file storage), with servers in the European Union.
• Vercel (website hosting and aggregate traffic and performance measurement).
• Google (Google Analytics 4, website usage statistics), only if you accept measurement in the cookie notice; configured without Google Signals or ad personalization.
• Resend (sending service emails and alerts).
• Browser push notification services, only if you enable notifications.
• Telegram, only for internal moderation alerts: if you write contact details in a platform chat, the internal alert may include them.
• Payment providers, if you buy visibility services by card: they are independent controllers of the payment processing.
• Public authorities, where there is a legal obligation to disclose information.

6. International transfers

Some providers belong to groups headquartered in the United States. Where processing involves a transfer outside the European Economic Area, it relies on a European Commission adequacy decision or on standard contractual clauses, together with additional security measures.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time (without affecting the lawfulness of prior processing), by writing to privacidad@maquinaria.click from the address you registered with or from your dashboard, where you can edit your data and delete your account.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

8. Minors

The service is intended for people over 18. We do not knowingly collect data from minors; if you become aware of a minor’s account, let us know and it will be deleted.

9. Security

We apply technical and organisational measures proportionate to the risk: encrypted connections (HTTPS), row-level access control in the database, private storage for sensitive documentation and short-lived signed URLs for reviewing it. No system is infallible, but we collect only what is needed and restrict who can see each piece of data.

10. Cookies and local storage

We use cookies and browser storage that are essential to keep your session and remember your preferences; traffic measurement is only loaded if you accept it. Details and how to change your decision are in the cookie policy.

11. Changes to this policy

If we change how we process your data, we will update this policy and, where the change is significant, we will notify you by email or on the site before applying it.