Privacy policy

DATA CONTROLLER : The company “ GEPERAUTO ANDALUCÍA, SL ” (hereinafter, “Santana Geperauto”) , with Tax Identification Number ( CIF) : B-23756570 , and registered office at Carretera de Granada, Km 336, Postal Code: 23003 – Jaén (Spain), Contact Email : pedromoreno@geperauto.es , informs users of its Internet portal (hereinafter, the “Users” and the “Portal”) about its policy on the protection of personal data (hereinafter, “Personal Data”) so that Users may freely and voluntarily decide whether they wish to provide Santana Geperauto with the Personal Data that may be requested or obtained from Users when visiting the website, sending a CV, subscribing to or registering for any of our newsletters, or requesting information as an official dealer of the Santana brand, authorized workshop, and supplier of spare parts and accessories. and related services , Santana Geperauto's profiles on social media, activities, events and promotions organized through our website.

Santana Geperauto reserves the right to modify this privacy policy to adapt it to new legislation or case law, as well as industry practices. In such cases, Santana Geperauto will announce the changes on this page with reasonable notice before they take effect. Certain specific offers for vehicles, products/accessories , and related services may contain specific terms and conditions regarding the protection of personal data.

Santana Geperauto, as the Data Controller of the personal data of ITS USERS, and other affected parties/owners with whom it maintains a relationship, informs you that this data will be processed in accordance with the provisions of Regulation (EU) 2016/679 of 27 April 2016 (GDPR) on the protection of natural persons with regard to the processing of personal data and the current LOPD-GDD 3/2018 of 5 December (LOPD-GDD) on the protection of personal data.

INFORMATION / DATA PROCESSED: purely identifying data (name + surnames) and contact data where applicable (address, telephone and email address), data necessary for certain contracts/participation in company events, registration in our corporate Newsletter service, CVs received by email, data provided at events or presentation acts, data supplied in the social media profiles owned by Santana Geperauto, training activities managed by the company.

responsible for the processing:

  • “ GEPERAUTO ANDALUCÍA, SL ”, CIF : B-23756570

  • Registered Office : Carretera de Granada, KM 336, CP: 23003 – Jaén

  • Contact email : pedromoreno@geperauto.es

  • Official Website: www.geperauto.es

  • Contact phone number: (+34) _______________

  • Record of Processing Activities available to the Supervisory Authority .

  • DPO contact designated to the Supervisory Authority : dpo@geperauto.es

  • In accordance with Article 30 of GDPR 679/2017, there is an Internal Record of Processing Activities available to the Supervisory Authority.





Intended processing purposes :

MAINTAINING THE RELATIONSHIP with Clients/suppliers, website users, employees, data processors, control and management of the relationship with employees and external collaborators, onboarding and offboarding, management of the existing contractual relationship with collaborators and sponsors, and the commercial relationship with suppliers, recruitment of Santana Geperauto staff , candidates in selection processes, followers on Santana Geperauto 's social media , users registered on our website, participants in activities and events, including the possibility of training activities managed or participated in by Santana Geperauto . In this regard, the planned processing operations are:

WHAT PERSONAL DATA DO WE PROCESS:  By filling out our contact form, or through the registration options offered on our website.

  • Contact Form: Link to the contact form

  • Request information: link to the “request information” form

  • Workshop Appointment Request: if enabled

Depending on the case, you may provide, among other things, the following personal data:

  • Your name and surname and contact details (address, telephone numbers and email), and a space for free text.

  • Other contact details and preferences, details of your vehicle, processing of warranties and claims, roadside assistance, geolocation for Towing service.

  • We collect your data if you contact us through the Site.

  • When you visit our website, we will collect your data if you fill out any of our data/contact forms, information requests, or newsletter subscriptions, whether current or future.

  • If personal data has been provided by users, it must be truthful, and Santana Geperauto must be notified of any changes that occur, being responsible in any case for the truthfulness and accuracy of the data provided at any time.

  • The interested party who provides their personal data to Santana Geperauto, declares that they are of legal age and is entirely responsible for said declaration.



Other treatments:

  • Sending electronic commercial communications via email, SMS, WhatsApp, social media, or any other electronic or physical means, present or future, that allows for commercial communications. These communications will be sent by the CONTROLLER and will relate to its own vehicles and services as an official dealership of the brand, authorized workshop, and related spare parts, accessories, activities, and events, or those of its partners or suppliers with whom it has reached a promotional agreement. In this case, third parties will never have access to personal data.

  • Actions requested by the User : Processing requests/orders for vehicles, spare parts, repairs, workshop appointments and services as an official dealer of the Santana brand, authorized workshop and spare parts and accessories and related services , or any request that, through the Santana Geperauto website, is made by the user/customer through any of the contact methods that are made available to him/her, events, presentations organized by/with the participation of Santana Geperauto.

  • To process registrations for promotional events and activities in which users wish to participate. In this case, images or videos taken of participants during these events , provided that express and unequivocal consent has been obtained, may be published on the entity's website, social media, corporate publications and brochures, notice boards, and any other similar communication medium owned by the company, for the purpose of promoting such activities or events. In the case of tournaments or similar activities, participants' data (name, surname, and age) may be published in the same media to publicize participation or results of any prizes or activities organized by the company . If express consent is not given for this data processing, the data will only be shared internally with tournament participants so they can see the corresponding rankings, a necessary requirement for the proper conduct of the tournament (legitimate interest).


  • DATA STORED DURING YOUR VISIT : When you visit our website, our web servers generally store, among other data, information about the browser and operating system you are using, the website from which you visited us, the pages you visit on our website, and the date of your visit. For security reasons—for example, to detect potential attacks on our website—the IP address assigned to you by your Internet service provider is also stored for a period of seven days. With the exception of the IP address, personal data is only stored if you provide it to us, for example, when registering, participating in a survey, requesting a quote, creating a user account, or participating in a marketing promotion. Santana Geperauto uses your personal data for the technical administration of the website, customer management, conducting surveys on Santana brand vehicles and services, authorized workshops, spare parts and accessories, and related services, and for marketing purposes, only to the extent necessary, and always after informing the user and data subject beforehand.

  • NEWSLETTER SUBSCRIPTION : By subscribing to any of our current or future newsletters, you consent to the use of your personal data for sending advertising or carrying out other marketing activities. This data will be stored and used continuously for these purposes, such as sending the aforementioned newsletters about our vehicles and services as an official Santana dealership, authorized workshop, and for spare parts, accessories, and related services, through communication channels such as email, postal mail, or any other channel you authorize. We may use your data to create and maintain your user profile and send you personalized information about advertising campaigns. We may also use the data you provide to analyze and improve the effectiveness of our website services, advertising, marketing, market research, and sales activities.

  • SUBMISSION OF CVs BY CANDIDATES : By submitting a CV to Santana Geperauto 's email address or via the provided web form, the applicant authorizes Santana Geperauto to analyze the submitted documents, all content directly accessible through search engines (Google), profiles maintained on professional social networks such as LinkedIn or similar platforms, data obtained from entrance exams, and information disclosed during the job interview, for the purpose of evaluating the candidate's candidacy and, if applicable, offering a position. If the candidate is not selected, Santana Geperauto may retain their CV for consideration in future job openings, unless the candidate objects.



  • Santana Geperauto – AUTOGEX GROUP COMPLAINTS CHANNEL : " AUTOGEX RETAIL, SL " , with Tax Identification Number (CIF): B-23802036 , as a holding company providing services to its subsidiaries , and with registered office, for these purposes, at Ctra. de Granada km 336.6, Postal Code: 23003 - Jaén (hereinafter, the " Company " or " Autogex Group "). By signing this document, you guarantee that the information provided is true, accurate, complete, and up-to-date. Any changes to your information must be reported as soon as possible.

  • PURPOSE OF PROCESSING : Grupo Autogex will process the data collected in this form and that generated as a result of investigations carried out, for the sole purpose of processing and deciding on the admissibility of complaints received within the framework of the crime prevention management model of the Company and its subsidiaries (also, " Grupo Autogex "), analyzing them, preparing the files, and carrying out the actions necessary for this purpose. The data requested is the minimum necessary for the stated purpose; refusal or partial provision of the data could mean that the complaint cannot be admitted for processing*.

  • LEGAL BASIS FOR PROCESSING : The processing will be carried out on the basis of: (i) the public interest in the prevention of crime and the existence of applicable law: Law 2/2023, of February 20, regulating the protection of persons who report regulatory infringements and the fight against corruption; ( ii ) the legitimate interest of the Autogex Group in preventing irregularities and/or non-compliance with the provisions set forth in its Protocol and in the overall management of human resources within the Autogex Group; ( iii ) if you are an employee of the Autogex Group, the entity's authority to manage its workforce and, where appropriate, to adopt the relevant disciplinary measures within the framework of the employment contract signed between both parties; ( iv ) the express consent of the reporting data subject upon accepting this Privacy Policy.

  • DATA COMMUNICATIONS : The recipients of the information are the EXECUTIVE COMMITTEE and its designated representatives, as well as other individuals or entities whose collaboration is necessary within the framework of an investigation or for auditing the operation of the Whistleblowing Channel, in accordance with the Whistleblowing Channel Protocol, which is available to its users/interested parties. Furthermore, in order to carry out the necessary investigative tasks, to determine the responsibilities arising from the proceedings, or to implement internal organizational policies of the Autogex Group in response to the reported incidents, your personal data may be communicated to the various subsidiaries that comprise the Group and that may be related to the investigated incidents. Depending on the reported incidents, the Autogex Group may also be obliged to disclose or communicate your personal data, and the information you provide, to the State Security Forces and Corps, other Public Administration bodies with jurisdiction in the investigation of the reported incidents, as well as to the Courts of Justice and other jurisdictional bodies. Notwithstanding the foregoing, if a complaint is found to be false, the complainant's information may be shared with the accused so that they may, if they deem it appropriate, initiate any legal action to which they are entitled as a result of the false complaint, as well as with any persons involved in legal proceedings initiated as a consequence of the investigation. If the complainant chooses to remain anonymous, their identifying information will not be disclosed to third parties during the handling and processing of the complaint and subsequent investigation.

  • DATA RETENTION PERIODS : The personal data you provide will be processed for the time necessary to decide whether to initiate an investigation into the reported events and, if so, for the processing of said investigation. If the investigation concludes with its closure, the data will be deleted. In any case, after THREE (3) MONTHS have elapsed since the filing of the complaint, Grupo Autogex will delete your data, without prejudice to its continued processing, if necessary, for the completion of the investigation, as well as to address any irregularities detected through, among other things, judicial, administrative, or labor measures. Furthermore, the information may be retained, after the data has been anonymized, for the purpose of conducting any audits of the Grupo Autogex Whistleblowing Channel.

  • EXERCISE OF GDPR RIGHTS : You may exercise your rights of access, rectification, restriction of processing, erasure, data portability, and objection, as applicable, in accordance with the regulations governing the protection of personal data. You may exercise these rights by sending a dated and signed written communication, indicating "GDPR Rights" in the Subject field, accompanied by a photocopy of your national identity document (DNI) if necessary for proper identification (and, where applicable, of your representative) and an address for notification purposes. This communication should be sent to the registered office of Grupo Autogex at: Carretera de Granada, Km 336.6, Postal Code: 23003 - Jaén, or by email to: dpo@autogex.es . If you believe your right to the protection of personal data has been violated, you may file a complaint with the Spanish Data Protection Agency (AEPD) ( www.aepd.es ). Additional information on privacy is available on our website: www. geperauto.es In this sense, the exercise of their rights by the accused is guaranteed, without this implying providing the accused with the complainant's data.



DATA RETENTION CRITERIA : In general, the data provided will be kept as long as there is a mutual interest in maintaining the purpose of the processing and when it is no longer necessary for that purpose, it will be deleted with appropriate security measures to guarantee the pseudonymization of the data or the total destruction of the same.

following possible variations are considered :

  • ( i ) Disaggregated Data: will be kept indefinitely,

  • ( ii ) Data of users, companies and suppliers, etc … Santana Geperauto : retention period of 4 years (Art. 66 et seq. of the General Tax Law), retention period of 6 years Art. 30 of the Commercial Code on accounting books and invoices)

  • ( iii ) Data provided for the purpose of subscribing to our newsletter: from the time the User gives their consent, until they withdraw it

  • ( iv ) Documentation of a labor or social security nature: 4 years Article 21 of Royal Legislative Decree 5/2000, of August 4, which approves the consolidated text of the Law on Infringements and Sanctions in the Social Order, ( v ) data supplied by candidates through the submission of their C. Vitae: the C. Vitae may be kept for a maximum of two years for future selection processes unless the candidate states otherwise

  • ( vi ) Images obtained by the video surveillance systems installed in the offices owned by Santana Geperauto, for security, access control and internal production control: 30 days, in accordance with the instruction of the AEPD.

Communication of data : Your personal data may be communicated to:

  • Companies and entities and other organizations that have been contracted to provide services, such as: hosting, marketing services, collaborators, related companies, market analysis and information society services.

  • Partner/sponsor companies with which Santana Geperauto has reached a collaboration or sponsorship agreement.

  • Companies or other organizations to which you have requested or agreed that we may share your personal data , or those other companies, distributors of the Santana brand to which we must supply your data for legitimate interest or contractual obligation, for warranty management, vehicle software updates, etc.

  • Existence of a Business Group: Within the framework of the existing corporate relationship within the business group, GEPERAUTO ANDALUCÍA, SL may communicate personal data to its HOLDING COMPANY (AUTOGEX RETAIL, SL – Tax ID: B-23802036) and/or subsidiaries when such communication is necessary for internal administrative management, compliance with regulatory obligations, or the optimization of group resources (centralized services), always based on the legitimate interest recognized in Article 6.1.f) of Regulation (EU) 2016/679 (GDPR). Such communication will be carried out guaranteeing at all times the security and confidentiality of personal data, applying appropriate technical and organizational measures and respecting the principles of minimization and proportionality.

  • For certain internal company activities/services, specific services must be subcontracted to third parties. These subcontractors may be external providers both within and outside the EU. Santana Geperauto guarantees that all subcontractors comply with the obligations and requirements assumed by Santana Geperauto in its Data Access Agreement ; specifically, that their level of data protection meets the standard required by relevant data protection laws. If a jurisdiction is outside the EU and is not on the European Commission's approved list of satisfactory levels of data protection under the GDPR, then a specific agreement is established between Santana Geperauto and the subcontractor to ensure that all personal data is kept in accordance with the requirements of applicable EU data protection laws.

  • The purpose of communicating the data to the aforementioned companies, which comprise and are integrated with the controller, will be the same as those previously announced, as companies in charge of processing for the controller.

  • Professional service providers, such as transporters, lawyers, solicitors, arbitrators, notaries, registrars or other similar professionals involved in operations specific to Santana Geperauto.

  • Public bodies, courts, regulators and other administrative authorities, when we consider it necessary to comply with a legal or regulatory obligation, or otherwise to protect ourselves from claims against us or third parties, or the safety of people, as well as to prevent, or otherwise combat, fraud or for security or protection reasons.

  • Any third party that buys, or to whom we transfer, all or a substantial part of our assets and business. In the event of such a sale or transfer, we will make all reasonable efforts to ensure that the entity to which we transfer your personal data uses it in accordance with this Privacy Policy.

In such cases, we will ensure that your data is used for appropriate purposes in accordance with this Privacy Policy and the corresponding contracts or clauses for the processing of data will be signed, applying the same or similar security measures to those applied by Santana Geperauto .

The data will be processed based on the explicit consent of the person providing it. This consent may be withdrawn at any time, although this will not affect the lawfulness of any processing carried out prior to its withdrawal. Providing the data is voluntary, but if it is not provided, it cannot be processed for the purposes indicated. If third-party data is provided through this website, the person providing it assumes responsibility for having obtained prior consent and informing them of everything stipulated in Article 14 of the General Data Protection Regulation.

INTERNATIONAL DATA TRANSFERS:

On July 10, 2023, the European Commission adopted a new adequacy decision to enable international transfers of personal data between entities in the European Union (EU) and the United States ( US ) under the EU-US Data Privacy Framework . Following the judgment of the Court of Justice of the European Union (CJEU) of July 16, 2020, known as the Schrems II ruling , international transfers of personal data to the US were called into question due to the problems identified by the CJEU related to US surveillance practices and the lack of mechanisms for European citizens to address interference with their rights.

With this adequacy decision, the European Commission recognizes that the US guarantees a level of protection equivalent to that offered by the EU, but only when international transfers occur with entities certified by the new privacy framework, the EU-US Data Privacy Framework .

Therefore, and in accordance with the above, personal data will circulate securely from the European Union to the participating US companies in the Framework, without the need to establish additional data protection guarantees.

Other international transfers to the US: Both the safeguards adopted and the legislative changes that have occurred in the US will facilitate the use of guarantees such as standard contractual clauses or binding corporate rules .

This does not preclude the continued need for a Transfer Impact Assessment (TIA ) on any data transfer carried out outside the EU- US Data Privacy Framework . The adequacy decision ensures that data transfers between the EU and the US are possible through a stable and reliable agreement that protects individuals and provides legal certainty for businesses.

Legal basis for the informed processing :

As a general rule, prior to processing personal data, Santana Geperauto obtains express and unequivocal consent from the data subject by incorporating informed consent clauses in the different information collection systems, and based on a legitimate interest of the User.

In cases where the data subject's consent is not required, the legal basis for the processing on which Santana Geperauto relies is the existence of a formalized vehicle order as an official dealer of the Santana brand.

Authorized workshop and spare parts and accessories and related services , COMMERCIAL AGREEMENTS WITH STRATEGIC COMPANIES (CRANE SERVICES, TRANSPORT/TRANSPORTERS, PROFESSIONAL MANAGEMENT AND SELF-EMPLOYED PROFESSIONALS), CUSTOMER REGISTRATION/SIGN-UP, collaboration document, Santana Geperauto data collection form .

Notwithstanding the foregoing , the bases for legitimacy are as follows:

  • When the processing is necessary for the performance of a contract to which you are a party or the data are necessary in the framework of a pre-contractual relationship .

  • When the use of your personal data is necessary for the satisfaction of our legitimate interests or those of the companies with which we have shared your personal data.

  • When the processing of data is necessary to comply with the legislation/regulations governing the legal obligations of the sector, GDPR and LOPD-GDD legislation and similar applicable legislation in force at any given time, including those relating to the placing on the market of services of Santana Geperauto or of third parties, defense of consumers and users, regulation of retail trade, and other applicable regulations.

  • In accordance with the provisions of the applicable Information Society Services regulations (LSSI-CE), if there is a demonstrable prior relationship , the data may be used for sending electronic commercial communications relating to that specific activity, unless you object to it in the manner provided for that purpose.

  • When we believe it is necessary to process your personal data to comply with a legal or regulatory obligation, or a vital interest.

  • When we have your consent, to, for example, collect technical information such as cookie data and similar technologies as described in: “Information on the Use of Cookies”.

  • Acceptance of a contractual relationship within the relevant social network environment, and in accordance with its Privacy policies in each case, when you visit any of our social profiles (Facebook, Instagram, LinkedIn, and YouTube).

EXERCISE OF GDPR Rights:

Santana Geperauto provides information on exercising your rights as an interested party or owner of personal data:

Right of access : You have the right to obtain confirmation from the company as to whether or not personal data concerning you is being processed. Santana Geperauto will, where applicable, provide a copy of the personal data being processed.

Right to rectification : You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure : You have the right to obtain the erasure of inaccurate personal data concerning you without undue delay. At Santana Geperauto, we are obliged to erase such personal data without delay when any of the following circumstances apply:

  1. personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

  2. You withdraw the consent on which the treatment is based and it is not based on another legal ground;

  3. you object to the treatment, provided that no other legitimate reasons for it prevail;

  4. your data has been processed unlawfully;

  5. your data must be deleted to comply with a legal obligation;

  6. or if your personal data has been obtained in connection with the offer of information society services to children (under 16 years of age).

Right of limitation Regarding the processing of your personal data: When the processing of your personal data has been restricted at your request, such data may only be processed, with the exception of storage, with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest. You have the right to obtain restriction of processing of your personal data when one of the following conditions applies:

  1. When you contest the accuracy of personal data, for a period that allows Santana Geperauto to verify its accuracy;

  2. the processing is unlawful and, as the interested party, you oppose the erasure of the personal data and request, instead, the restriction of its use;

  3. Santana Geperauto no longer needs the personal data for the purposes of processing, but you need it for the establishment, exercise or defense of claims;

  4. When you have objected to the treatment, while it is being verified whether Santana Geperauto's legitimate grounds prevail over those of the interested party.

Right to data portability : You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance from Santana Geperauto, when:

  1. the treatment is based on your consent, and

  2. the treatment is carried out by automated means.

Right to object : You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on public interest or the legitimate interests of the data controller. Where the processing of personal data is for direct marketing purposes, you have the right to object at any time to the processing of your personal data. If you object to the processing of your data for direct marketing purposes, your personal data will no longer be processed for such purposes.

We remind you that whenever the legal basis for processing your data is your consent, you have the right to revoke that consent at any time and in any case, and as easily as you gave it.

You also have the right to lodge a complaint with the relevant supervisory authority , usually the Spanish Data Protection Agency (AEPD). For more information, you can visit their website at this link: https://www.aepd.es

Finally, you have the right not to be subject to a decision by Santana Geperauto based solely on automated processing , including profiling, which produces legal effects concerning you or similarly significantly affects you.

Contact details to exercise your rights : Santana Geperauto , in compliance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR), and the recent LOPD-GDD 3/2018 of 5 December, has an internal designated manager, and a Data Protection Officer (DPO) appointed for the management of Data Protection and whose contact details are provided below:

Contact information to exercise your rights :

By Post : You can submit the document by sending it to the following postal address:

  • Address : Granada Road, Km 336, Postal Code: 23003 - Jaén

Online:

  • Email Address: You can submit the document to: dpo@geperauto.es

By Phone:

  • Landline: +34 _____________

In both cases, you must:

  • Provide sufficient data and information to process the request. For this purpose, you may use the form templates provided by the Spanish Data Protection Agency (AEPD) at https://www.aepd.es/es/derechos-y-deberes/conoce-tus-derechos

  • Sign the form by hand or, if applicable and if you have a recognized digital certificate, sign it electronically.

  • If acting on behalf of a third party, you must provide a document proving your representation of the interested party.

  • Send the form and documents proving your identity by any of the means mentioned above.

  • Note.- In case of reasonable doubt about the identity of the applicant, data subject, and/or their representative, a copy of ID card, passport, NIE or other equivalent identification document may be required.

Additional information upon request:

Santana Geperauto will analyze whether the request is legally valid. It will inform the requester of its decision and proceed accordingly: if the request is granted, it will take the appropriate measures based on the right exercised; if the request is denied, it will indicate the legally available appeals process. In cases where requests are manifestly unfounded or excessive (e.g., repetitive), Santana Geperauto may: (i) Charge a fee proportional to the administrative costs incurred; (ii) Refuse to act.

If a user/data subject believes there is a problem with how Santana Geperauto is processing their data, they can address their complaints to Santana Geperauto at the address indicated above, or through the Spanish Data Protection Agency (AEPD): www.aepd.es

MANDATORY OR OPTIONAL NATURE OF THE INFORMATION PROVIDED:

The data collected through any of the contact forms available on this Website, or even for the provision of information, or provided by Users in connection with their participation in activities/events organized by Santana Geperauto , will be incorporated, depending on their purpose, into the Internal Processing Activities Register (Article 30 of Regulation (EU) 2016/679 of 27 April 2016) . The Processing Activities Register is available to the Supervisory Authority.

By checking the corresponding boxes and entering data in the various fields marked with an asterisk (*) on the contact form or presented in download/contract forms, Users expressly and freely and unequivocally accept that their data is necessary for Santana Geperauto to process their request . Providing data in the remaining fields is voluntary. The User guarantees that the personal data provided is truthful and is responsible for communicating any changes to it .

Santana Geperauto expressly informs and guarantees users that their personal data will not be transferred to third parties under any circumstances. Whenever any transfer is planned in the future, the express, informed, and unambiguous consent of the users will be requested beforehand, informing them of the recipient's details and the purpose of the transfer. All data requested through the website is mandatory, as it is necessary for providing optimal service to the user. If all the required data is not provided, the information and services provided may not be fully tailored to the user's needs.

SECURITY MEASURES:

In accordance with the provisions of current regulations on the protection of personal data, and in particular Regulation (EU) 2016/679 of 27 April 2016 , and the LOPD-GDD 3/2018 for the processing of personal data under your responsibility, and expressly with the principles described in Article 5 of the GDPR, by which they are processed lawfully, fairly and transparently in relation to the data subject and adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.



In any case, Santana Geperauto has implemented sufficient mechanisms to:

  1. Ensure the ongoing confidentiality, integrity, availability, and resilience of treatment systems and services.

  2. Restore the availability and access to personal data quickly, in the event of a physical or technical incident.

  3. Regularly verify, evaluate and assess the effectiveness of the technical and organizational measures implemented to ensure the security of the treatment.

  4. Pseudonymize and encrypt personal data, where applicable.

Santana Geperauto guarantees that it has implemented appropriate technical and organizational policies to apply the security measures established by GDPR 679/2016 and LOPD-GDD 3/2018 in order to protect the rights and freedoms of Users and has provided them with the necessary information to exercise those rights. Santana Geperauto has implemented all available technical means and measures to prevent the loss, misuse, alteration, unauthorized access, and theft of Personal Data provided by the data subject to Santana Geperauto . However , Users should be aware that internet security measures are not infallible.

Personal data included in the Internal Processing Activities Register will be treated with the utmost confidentiality and security. The Data Controller may send you commercial information regarding NEWS ABOUT OUR vehicles and workshop services as an official Santana brand dealer, authorized workshop, and related spare parts, accessories, and services. In this case, the sender undertakes to indicate its advertising purpose when sending the information and to coordinate a simple, clear, and free system for you to stop receiving them.

The services/vehicles of Santana Geperauto contained on the website are intended exclusively for adults. In the event that Santana Geperauto offers any promotional activity, event, contest or similar, in which the collection of Personal Data of minors may occur, Santana Geperauto will always request parental consent for minors to access them and for their Personal Data to be subject to automated processing as provided in this Data Protection Policy notice.

As previously informed, the collection and automated processing of Personal Data is intended to maintain the contractual relationship, if any, established with Santana Geperauto , manage the existing relationship with our company, handle information requests that the User decides to make, register, or use the services, adapt these services to the preferences and tastes of the Users, study the use of the services by the Users, design new SERVICES/ACCESSORIES related to the activity of our company, send technical information updates, and send, by traditional and electronic means, technical, operational and commercial information about Santana Geperauto .

USE OF PUBLIC PROFILES ON DIFFERENT SOCIAL MEDIA PLATFORMS:

Santana Geperauto maintains a presence on the main social media platforms and is responsible for processing the data of its followers, fans, subscribers, commenters, and other user profiles (hereinafter, followers). The processing of this data by Santana Geperauto will be limited to what the social media platform allows for corporate profiles.

Santana Geperauto may inform its followers about its news, activities, and events through any means permitted by the social network. Under no circumstances will Santana Geperauto extract data from social networks unless it obtains the user's explicit and specific consent to do so. When, due to the inherent nature of social networks, the effective exercise of a follower's rights depends on modifying their personal profile, Santana Geperauto will assist and advise them to the best of its ability.

For what purposes will we process your personal data?

  • To answer your questions, requests, or petitions.

  • Manage the requested service, answer your request, or process your petition.

  • Connecting with you and a community of followers.

Details of social media profiles :

Santana Geperauto's Social Media Profiles:

  • Santana Geperauto on Instagram: https://www.instagram.com/santana_geperauto/

What is the legal basis for processing your data?

  • For more information about Instagram, click here .

Acceptance of a contractual relationship within the relevant social network environment, and in accordance with its Privacy policies:

Santana Geperauto is responsible for the processing of data belonging to its followers, fans, subscribers, commenters, and other user profiles (hereinafter, followers). The processing of this data by Santana Geperauto will be limited to what the social network allows for corporate profiles. Therefore, Santana Geperauto may inform its followers about its news and activities through any means permitted by the social network. Under no circumstances will Santana Geperauto extract data from social networks unless it has obtained the user's explicit and specific consent to do so. When, due to the inherent nature of social networks, the effective exercise of a follower's rights depends on modifying their personal profile, Santana Geperauto will assist and advise them to the best of its ability.

Right to Information.

Following the corresponding request, Santana Geperauto We will inform you immediately in writing, in accordance with applicable law, if we have stored any of your personal data, and if so, what that data is. If you are registered as a user, we offer you the possibility of personally accessing your data and, where applicable, deleting, modifying, and/or updating it.

DESCRIPTION OF MEASURES ADOPTED BY Santana Geperauto derived from the GDPR:

Santana Geperauto informs its Users/clients and suppliers that, in accordance with the GDPR and LOPD-GDD regulations applicable to the activity carried out by the company, the measures adopted to obtain an optimal level of compliance are detailed below:

  • Prepare a record of processing activities in accordance with Article 30 of the GDPR.

  • Identify the legal bases for the processing of data, in accordance with Articles 6 and 9 of the GDPR.

  • Audit the channels for receiving information and internal forms/documents and inform interested parties regarding the processing of their data, in accordance with Articles 13 and 14 of the GDPR.

  • To address the rights of interested parties, in relation to their rights of: access, rectification and erasure, limitation of processing, data portability (Article 20 of the GDPR), objection and automated decisions, establishing a direct channel of attention: dpo@geperauto.es

  • Audit and request compliance guarantees from the company's data processors, and sign a data processing agreement, in accordance with Article 28 of the GDPR. Santana Geperauto facilitates this process by making the following documents accessible through our Data Protection Officer (DPO): 1) a compliance guarantee document and details of the measures adopted, and 2) a sample data access agreement from Santana Geperauto.

  • Carry out a risk analysis and, where applicable, an impact assessment; to facilitate compliance with these obligations, you can consult the AEPD website: https://www.aepd.es/es/prensa-y-comunicacion/notas-de-prensa/la-aepd-publica-un-modelo-de-informe-para-ayudar-las-empresas .

  • Santana Geperauto, as a responsible company committed to regulatory compliance, recommends that its clients, users and interested parties subscribe to the alert newsletters of INCIBE ( www.incibe.es ), OSI ( www.osi.es ) and CERT ( www.incibe-cert.es ).

The links to subscribe to the different portals mentioned will allow you to know in advance about possible threats and incidents:


  • INCIBE ALERTS: https://www.incibe.es/newsletter/subscriptions

  • OSI ALERTS: https://www.osi.es/es/boletines/subscribe

  • Incibe-Cert alerts: https://www.incibe-cert.es/newsletter/subscriptions


  • There is an internal protocol in place for notifying data security breaches to the data protection authorities (Article 33 of the GDPR) and to the individuals whose data has been compromised (Article 34 of the GDPR). To this end, in the event of any incident that poses a risk to the rights and freedoms of those affected, Santana Geperauto will notify the CLIENT as soon as possible and will assist them in making such notifications.

  • The company has officially appointed a Data Protection Officer (DPO) and registered with the Spanish Data Protection Agency (AEPD) ( www.aepd.es ) in accordance with Articles 37, 38, and 39 of the GDPR. Santana Geperauto provides customers, users, and interested parties with the following email address for contacting the designated DPO regarding data protection matters and exercising their rights: dpo@geperauto.es

  • Santana Geperauto, in compliance with current regulations, also informs you of your right to file a complaint/request further information from the supervisory authority ( www.aepd.es )

Related regulations :

If you would like more information about the regulations that support, protect, and define your rights, we provide you with the regulations that have inspired this privacy policy and that are relevant to you:

  • Regulation (EU) 2016/679

  • Organic Law 3/2018, of December 28, on data protection and guarantee of digital rights

  • Law 34/2002, of July 11, on information society services and electronic commerce

CONTACT: Should you require any clarification regarding this Privacy Policy, wish to ask a question or make a complaint, or exercise your rights, please contact our internal Data Protection Officer in writing using the contact details shown below, indicating "Data Protection" in the subject line.

  • Address : Granada Road, Km 336, Postal Code: 23003 - Jaén .

  • Contact email address : dpo@geperauto.es

  • Contact phone number: +34 ____________

Privacy Policy updated and revised as of April 23, 2026.