PRIVACY POLICY

Last updated: 11 August 2026.

1. Data controller

Bardón y Rufo 67, S.L. (hereinafter, MalagaCarOcasion.com), tax ID B92286947, registered address at Calle Tucídides, 66, 29004 Málaga, Spain, is the controller of your personal data. You can contact us at info@malagacarocasion.com or at the postal address above.

2. Data processed and its source

We process information you provide directly through our forms, by telephone, email, WhatsApp or during our business relationship: name, email address, telephone number, enquiry, vehicle of interest and any other information required to deal with your request. We may also process technical and browsing data collected through cookies and similar technologies according to your preferences.

3. Purposes and lawful bases

• Responding to enquiries, information requests, appointments and pre-contractual steps: taking steps at your request before entering into a contract and, where applicable, performance of a contract.
• Managing vehicle sales, finance, warranties and administrative duties: performance of a contract and compliance with legal obligations.
• Security, fraud prevention and legal claims: legitimate interests and compliance with legal obligations.
• Analytics, measurement and advertising using cookies or online identifiers: consent provided through the cookie settings mechanism where required.
• Personalised advertising and audience creation: only if you voluntarily tick the relevant box. We may use your email address and telephone number to create audiences in Google Ads and Meta, measure campaigns and show more relevant advertising. Refusing does not prevent you from submitting an enquiry or receiving our services.

4. Customer Match, audiences and profiling

If you give advertising consent, your contact identifiers may be normalised and cryptographically hashed before being disclosed to Google Ireland Limited and/or Meta Platforms Ireland Limited. These platforms compare the identifiers with their users in order to create audiences, exclude customers from campaigns, measure results or display personalised advertising. Hashing reduces exposure but remains processing of personal data.

Profiling is limited to grouping users according to their relationship with us, vehicle of interest or campaign interactions. We do not make decisions producing legal or similarly significant effects based solely on this profile.

5. Recipients and processors

Service providers supporting hosting, email, security, customer management, analytics and advertising may access data under the appropriate contractual safeguards. We may also disclose data where legally required or where necessary to complete a transaction requested by you.

Where you consent to personalised advertising, Google Ireland Limited and Meta Platforms Ireland Limited may receive identifiers for the purposes described above. See how Google uses business data and Meta's privacy policy.

6. International transfers

Some providers may process data outside the European Economic Area. Where this occurs, safeguards required by the GDPR will be used, such as adequacy decisions, the EU-US Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses.

7. Retention

Enquiries are retained for as long as necessary to respond and subsequently for applicable limitation periods. Contract and invoicing data are retained for statutory periods. Data used on the basis of advertising consent are processed until consent is withdrawn and reviewed or refreshed periodically. Customer Match lists will be refreshed in line with the platforms' current limits and requirements.

8. Your rights and withdrawal of consent

You may request access, rectification, erasure, restriction, objection and portability and may withdraw advertising consent at any time by emailing info@malagacarocasion.com or writing to our postal address with “Data protection” in the subject. Withdrawal does not affect earlier lawful processing. You may also lodge a complaint with the Spanish Data Protection Agency.

9. Required information

Fields marked as required are necessary to deal with your request. Consent to personalised advertising is optional and does not affect how your enquiry is handled.

10. Children

Our services are intended for people aged 18 or over. We do not knowingly request children's data for advertising activities.

Cookie policy

We use technical cookies required for the website and, according to user preferences, measurement and advertising technologies from Google (including Google Analytics and Google Ads) and Meta. They may measure visits and interactions, attribute conversions, limit advertising and create or use advertising profiles.

Where required by law, non-essential cookies and related purposes must be based on user consent. You can accept, reject or change your choices through the available cookie controls and can also delete cookies in your browser. Withdrawal does not affect processing carried out beforehand.

Cookie consent is separate from the optional checkbox concerning the use of contact details for Customer Match and personalised audiences.

11. Changes to this policy

We may update this policy to reflect legal or processing changes. We will publish the date of the latest update and request fresh consent where required.