Skip to main content
El Bujías
Try free

Privacy Policy

Last updated: 11 October 2026

1. Data controller

  • Company name: El Bujías (elbujias.es)
  • Contact email: [email protected]
  • Website: https://elbujias.es

2. Purposes of processing

We process your personal data for the following purposes:

  1. Service provision: Management of user accounts, workshops, customers, vehicles, work orders, invoicing and appointments.
  2. Communication with customers: Sending quotes, vehicle status notifications, and roadworthiness test (ITV) and service reminders via WhatsApp links, email or SMS.
  3. Management of the business relationship: Invoicing, technical support and communications related to the service.
  4. Service improvement: Usage analysis to improve the platform.
  5. Interest in the multi-workshop plan: if you leave your email under «I'm interested» on the pricing page, we use it only to tell you when the plan for several workshops exists.

3. Legal basis for processing

  • Performance of a contract (Art. 6.1.b GDPR): Processing is necessary for the provision of the contracted service.
  • Legitimate interest (Art. 6.1.f GDPR): Service improvement and fraud prevention.
  • Consent (Art. 6.1.a GDPR): For optional marketing communications.
  • Legal obligation (Art. 6.1.c GDPR): Compliance with tax and accounting obligations (invoicing, VeriFactu).

4. Categories of data processed

User data (workshop owners and mechanics)

  • First name, surname, email, password (encrypted)
  • Role within the workshop, time-tracking records

Workshop data

  • Name, CIF/NIF (tax ID), address, telephone, email, logo, opening hours

Workshop customer data

  • First name, surname, telephone, email, DNI/NIE (national ID)
  • WhatsApp contact preference

Vehicle data

  • Registration plate, make, model, year, VIN, fuel type, mileage, colour
  • Roadworthiness test (ITV) and service dates

Multimedia content

  • Diagnostic videos and photos uploaded to work orders

5. Retention periods

  • Account data: While the account is active, and up to 30 days after a deletion request.
  • Issued invoices: 10 years from issue, in accordance with Spanish tax legislation.
  • Multimedia content: While the associated work order exists in the system.
  • Time-tracking records: while the account is active, and up to 30 days after a deletion request. Keeping them for four years (Estatuto de los Trabajadores, art. 34.9) is the workshop's duty, which it can meet by exporting them before deleting the account.
  • Multi-workshop plan interest email: until we tell you the plan has launched, when the list is deleted, or earlier if you ask us to remove it.

6. Recipients and data processors

Your data may be disclosed to the following third parties:

  • Cloudflare, Inc. — Website delivery and protection network, and aggregate visit counting on the public pages (Cloudflare Web Analytics, no cookies).
  • Hetzner Online GmbH — Server hosting and storage (Germany/Finland, within the EEA).
  • Payment providers (future) — Stripe and/or GoCardless for payment processing.
  • WhatsApp API (future) — 360dialog for automated notifications.

No international transfers of data outside the European Economic Area are carried out.

7. Workshop-platform relationship

The mechanical workshop is the Data Controller of its customers' and vehicles' data. El Bujías acts as the Data Processor in accordance with Art. 28 of the GDPR, processing the data solely according to the workshop's instructions and for the provision of the service.

8. Rights of data subjects

In accordance with the GDPR (RGPD) and the LOPDGDD, you have the right to:

  • Access: Obtain confirmation of whether we process your data and access it.
  • Rectification: Request the correction of inaccurate data.
  • Erasure: Request the deletion of your data when it is no longer necessary.
  • Portability: Receive your data in a structured, commonly used format.
  • Objection: Object to the processing in certain circumstances.
  • Restriction: Request the restriction of processing.

To exercise these rights, contact us at [email protected] stating your name and the right you wish to exercise.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

9. Security

We apply appropriate technical and organisational measures to protect your data, including:

  • Password encryption using secure algorithms
  • Encrypted communications with HTTPS/TLS
  • Data isolation between workshops (multi-tenancy)
  • JWT tokens with expiry for API authentication
  • Regular backups

10. Cookies and local storage

This application does not use tracking or advertising cookies. We use the browser's local storage (localStorage) exclusively for essential technical functions. You can find the details in our Cookie Policy.

11. Amendments

We reserve the right to amend this Privacy Policy. Any change will be notified to registered users and published on this page with the date of the last update.