Privacy policy

1. Data controller

This policy applies to this website and to the PDR Nexus platform (web app at pdrnexus.app and apps for iOS and Android).

• Owner: [NOMBRE O RAZÓN SOCIAL DEL TITULAR]
• Tax ID (NIF/CIF): [NIF/CIF]
• Address: [DOMICILIO COMPLETO]
• Email: [EMAIL DE CONTACTO LEGAL]

2. What data we process

Depending on how you interact with us, we process these categories of data:

• Visitors to this website: technical connection data (IP address, browser type, date and time of the visit) that the server logs automatically for security reasons. This site does not use forms, analytics or advertising.
• People who write to us: name, email address and the content of the message.
• Registered platform users: account data (name, email address, phone number), company or workshop data (company name, tax ID, address, logo), billing data and technical usage data needed for the service to work and stay secure.
• Data the user enters about their own customers (name, contact details, vehicles, estimates, invoices, signatures and photos of the damage). For this data, see section 7.

3. Why we use it and on what legal basis

• Providing the service you have signed up for, managing your account, plans and payments, and giving you support. Legal basis: performance of a contract (Art. 6.1.b GDPR).
• Complying with legal, tax and accounting obligations. Legal basis: legal obligation (Art. 6.1.c GDPR).
• Keeping the site and the platform secure, and preventing fraud and unauthorised access. Legal basis: legitimate interest (Art. 6.1.f GDPR).
• Replying to the enquiries you send us. Legal basis: your consent and, where applicable, taking steps prior to entering into a contract.
• Sending you news about the service, only if you have agreed to it. Legal basis: consent (Art. 6.1.a GDPR), which you can withdraw at any time.

4. How long we keep it

Account data is kept for as long as you remain a user. When you close your account, it is blocked and kept only for the legal limitation periods (for example, six years for commercial records and four for tax records) and then deleted.

Technical server logs are kept only for as long as strictly necessary for the security of the service. Email enquiries are kept for as long as needed to deal with them.

5. Who we share it with

We do not sell or transfer your data to third parties. Only the providers we need to deliver the service (cloud hosting and infrastructure, email delivery and payment processing) have access to it, acting as data processors under a contract and with safeguards in line with the GDPR. Data will also be disclosed to the authorities when required by law.

If any provider is located outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or by standard contractual clauses.

6. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections, encryption of stored data, access control by user and by work group, and cloud backups. No system is infallible; if a security breach affecting your data were to occur, we would act and inform you as required by the GDPR.

7. Your customers’ data

When you record your own customers’ data in PDR Nexus, you are the controller of that processing and PDR Nexus acts as the processor: we process it only to provide you with the service, following your instructions, and we do not use it for any purpose of our own.

It is your responsibility to inform your customers and to have a legal basis for processing their data. Before closing your account you can download your estimates and invoices as PDFs; after that, the data will be deleted in accordance with section 4.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to [EMAIL DE CONTACTO LEGAL] and stating which right you wish to exercise. We may ask you to prove your identity.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Minors

PDR Nexus is a professional service aimed at people over 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy to reflect legal or service changes. The current version will always be published on this page with its date and, if the change is significant, we will let you know within the platform or by email.