Website: www.zaironmotor.com
Last updated: April 22, 2026
In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data (hereinafter, "GDPR"), and Organic Law 3/2018 of December 5, on Personal Data Protection and guarantee of digital rights (hereinafter, "LOPDGDD"), ZAIRON MOTOR, S.L. informs you about the processing of your personal data.
1. DATA CONTROLLER
Company name: ZAIRON MOTOR, S.L.
Tax ID (NIF): B21950282
Address: Calle Retama, 7 – Planta 12, postal code 28045, Madrid, Spain
General email: info@zaironmotor.com
Email for data protection: legal@zaironmotor.com
Website: www.zaironmotor.com
ZAIRON MOTOR, S.L. is not obliged to appoint a Data Protection Officer (DPO). However, any query, request, or exercise of rights regarding data protection can be addressed to legal@zaironmotor.com.
2. PERSONAL DATA WE PROCESS
2.1. Data provided directly by the user
- When making a purchase or creating an account: name and surname, shipping and billing address, email, phone number.
- When using the contact form or requesting information or a quote: name, email, phone, and content of the query.
- When requesting a test drive or locating a dealership: name and surname, email, phone, vehicle of interest, preferred dealership, and postal code.
- When subscribing to the newsletter: email and, if applicable, name. Subscription is managed via double opt-in (email confirmation).
- When making payments: card data or other payment methods are processed directly by the payment gateway (Stripe, PayPal, or Shopify Payments). ZAIRON MOTOR, S.L. does not store or have access to full payment method data.
2.2. Automatically collected data
- Usage and browsing data: IP address (anonymized), browser type and version, operating system, pages visited, visit duration, access source, and other technical parameters, collected through cookies and similar technologies. For more information, please see our Cookie Policy.
3. PURPOSES, LEGAL BASES AND RETENTION PERIODS
The following table summarizes the purposes of processing, the legal basis that legitimizes it, and the data retention period:
| Purpose | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Order management and sales contracts | Name, address, email, phone, shipping address | Contract performance (Art. 6.1.b GDPR) | 5 years from the last transaction (commercial prescription); 4 years for tax obligations |
| Product shipping and logistics | Name, delivery address, phone | Contract performance (Art. 6.1.b GDPR) | 5 years |
| User account registration | Name, email, password (encrypted) | Contract performance / pre-contractual measures (Art. 6.1.b GDPR) | Until account deletion, plus 3 years for potential claims |
| Customer service | Name, email, phone, content of query | Legitimate interest (Art. 6.1.f GDPR) and/or contract performance | 3 years from the last interaction |
| Test drive request and dealership location | Name, surname, email, phone, vehicle of interest, dealership, postal code | Consent (Art. 6.1.a GDPR) and pre-contractual measures (Art. 6.1.b GDPR) | Until the request is fulfilled; 1 additional year unless the user objects |
| Newsletter and commercial communications | Email, name (optional) | Express consent via double opt-in (Art. 6.1.a GDPR; Art. 21 LSSI-CE) | Until the user withdraws consent (unsubscribe at any time) |
| Web analytics (Google Analytics 4) | Browsing data, cookies, anonymized IP | Consent (Art. 6.1.a GDPR) for analytical cookies | 14 months (user data in GA4); 2 months for Google signals |
| Personalized advertising and remarketing | Usage data, cookies, advertising identifiers | Consent (Art. 6.1.a GDPR) | Until consent is withdrawn or platform-specific deadlines expire |
| CRM management (Zoho) | Name, email, phone, interaction and purchase history | Legitimate interest (Art. 6.1.f GDPR) and contract performance | During the commercial relationship and up to 5 years from the last interaction |
| Compliance with legal obligations | Billing, accounting, and tax data | Legal obligation (Art. 6.1.c GDPR) | 4 years (tax, Art. 66 LGT); 5 years (commercial); 6 years (accounting, Commercial Code) |
| Management and processing of financing applications | Identification, contact, and financial data necessary for the application | Application of pre-contractual measures at the request of the interested party (Art. 6.1.b GDPR) | During the processing of the application and subsequently during the applicable legal periods |
3.1. Purchase financing
If the user requests financing for the acquisition of products or vehicles offered through the Website, ZAIRON MOTOR, S.L. may communicate their personal data to collaborating financial entities, such as Banco Cetelem, S.A.U., for the purpose of analyzing, managing, and, where appropriate, formalizing the requested financing operation.
The collaborating financial entity will act as an independent data controller for personal data and may carry out solvency checks, credit risk analysis, and consultations with common credit information systems, in accordance with its own privacy policy and applicable financial regulations.
ZAIRON MOTOR, S.L. does not make automated decisions regarding the approval or denial of the requested financing, this evaluation being exclusively the responsibility of the financial entity.
4. RECIPIENTS AND INTERNATIONAL TRANSFERS
Your data may be communicated to the following categories of recipients, under the terms indicated:
- Shopify Inc. (USA) — E-commerce platform on which the Website is hosted. Acts as a data processor in accordance with Shopify's Data Processing Addendum. The international transfer is covered by the European Commission's Standard Contractual Clauses (SCCs) and certification under the EU-US Data Privacy Framework (adopted on July 10, 2023).
- Google LLC / Google Ireland Limited (USA / Ireland) — Provider of Google Analytics 4 (web analytics) and Google Ads (advertising and remarketing). International transfer covered by SCCs and EU-US Data Privacy Framework.
- Meta Platforms Ireland Limited / Meta Platforms, Inc. (Ireland / USA) — Provider of Meta pixel (Facebook and Instagram) for conversion tracking and remarketing. Transfer covered by SCCs and EU-US Data Privacy Framework.
- TikTok Technology Limited (Ireland) / TikTok Inc. (USA) — Provider of TikTok pixel for conversion tracking and advertising. Transfer covered by SCCs.
- The Rocket Science Group LLC d/b/a Mailchimp (USA) — Platform for newsletter management and sending commercial communications. Acts as a data processor. Transfer covered by SCCs and EU-US Data Privacy Framework.
- Zoho Corporation / Zoho Corporation Pvt. Ltd. (USA / India) — CRM platform (customer relationship management). Acts as a data processor. Transfer covered by SCCs.
- Payment gateways (Stripe, PayPal, Shopify Payments) — Secure payment processing. Act as independent data controllers for payment data. Transfer covered by SCCs and EU-US Data Privacy Framework.
- Banco Cetelem, S.A.U. — Collaborating financial entity for the management of financing applications linked to purchases made through the Website. Acts as an independent data controller for personal data communicated for this purpose.
- Network of collaborating dealerships — In case of a test drive request or dealership location, your data will be transferred to the dealership of your choice, who will act as an independent data controller from that moment.
- Logistics and transport providers — For the management of shipping and delivery of purchased products.
- Public administrations and regulatory bodies — When required by applicable regulations (e.g., Tax Agency, Courts and Tribunals).
For more information on the safeguards adopted for international transfers, please contact us at legal@zaironmotor.com.
5. RIGHTS OF DATA SUBJECTS
In accordance with the GDPR and the LOPDGDD, you have the right to:
- Access your personal data and obtain information about the processing we carry out.
- Request the rectification of inaccurate or incomplete data.
- Request the erasure of your data when, among other reasons, they are no longer necessary for the purpose for which they were collected or when you withdraw your consent.
- Request the restriction of the processing of your data in certain circumstances; in that case, we will only retain them for the exercise or defense of claims.
- Object to the processing of your data when it is based on the legitimate interest of the Controller, unless there are compelling legitimate grounds or it is necessary for the exercise or defense of claims.
- Request the portability of your data in a structured, commonly used and machine-readable format, when the processing is based on consent or the performance of a contract and is carried out by automated means.
- Withdraw consent at any time and without any cost, without affecting the lawfulness of processing based on consent before its withdrawal.
- Not be subject to automated individual decisions, including profiling, that produce legal effects concerning you or similarly significantly affect you.
- Lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority, through its electronic headquarters at www.aepd.es or by writing to C/ Jorge Juan, 6, 28001 Madrid.
To exercise any of these rights, you can send your request to:
ZAIRON MOTOR, S.L.
Calle Retama, 7, Planta 12, 28045 Madrid, Spain
Email: legal@zaironmotor.com
You must prove your identity by attaching a copy of your ID, NIE (Foreigner Identification Number), or other valid identification document. We will respond to your request within a maximum period of one month from its receipt, extendable for two additional months in cases of particular complexity, upon prior notification.
6. MINORS
The services of this Website are not aimed at children under 14 years of age. In accordance with Article 7 of the LOPDGDD, consent for the processing of personal data of children under 14 years of age requires the consent of their parents or legal guardians. If we become aware that we have collected data from a minor of that age without the verifiable consent of their legal representatives, we will proceed to delete such information as soon as possible.
7. DATA SECURITY
ZAIRON MOTOR, S.L. has adopted the necessary technical and organizational measures to guarantee the security, integrity, and confidentiality of the personal data processed, and to prevent their loss, alteration, unauthorized processing or access, in accordance with Article 5.1.f of the GDPR and Article 32 of the GDPR. However, the user must be aware that no security measure on the Internet is absolutely impenetrable.
8. CHANGES TO THE PRIVACY POLICY
The Owner reserves the right to modify this Privacy Policy to adapt it to regulatory or jurisprudential changes, or business practices. In case of substantial modifications affecting the rights and freedoms of users, we will communicate it visibly on the Website and, where appropriate, by email. We recommend that you review this page periodically.
Reference regulations: Regulation (EU) 2016/679 (GDPR); Organic Law 3/2018 (LOPDGDD); Law 34/2002 on Information Society Services (LSSI-CE).
