This translation is provided for your convenience. The Spanish version is the legally binding one.
1. Who handles your data
The data controller is Isabell Waese, tax ID Z2782690V. For any question about your data, write to [email protected].
2. What data we process
- If you ask for an estimate or send an enquiry: your email and, if you give them, your name, the car, the country where it is registered, the origin of and reason for the import, and your question.
- If you ask for a market check on a car in Germany: your name, your email and the offer you have.
- If you open a case: full name, email, phone, ID card, NIE or passport number, the vehicle details (model, VIN, plate and country) and the documents you upload: ID, proof of address, registration certificate, invoice or purchase contract, certificate of conformity (COC) and, if applicable, proof of your change of residence.
- If you pay: you do so on Stripe's page. We never see your card number or your Bizum credentials; we receive your name, email, billing address, payment status and the invoice.
- When you visit the site: Cloudflare receives your IP address and the technical details of each request in order to serve the pages and protect them from attacks. We use no analytics and no advertising.
Required fields are marked on each form. Without them we cannot answer you or handle your case.
3. Purposes and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Answering your estimate request or enquiry | Pre-contractual steps at your request (6.1.b) |
| Reviewing your documents and handling the import and registration | Performance of the contract (6.1.b) |
| Payment, invoicing and accounting | Performance of the contract and tax and commercial law obligations (6.1.b and 6.1.c) |
| Keeping proof of what was agreed and defending against claims | Legitimate interest (6.1.f) |
| Protecting the site against fraud and abuse | Legitimate interest (6.1.f) |
The authorisation box on the case form records that you know what we use your documents for; the legal basis is the contract you ask us for. We do not send you marketing. If we ever wanted to, we would ask for your consent first.
4. Who we share it with
To carry out the procedure you ask for, we pass the necessary data to those involved in it: the Spanish traffic authority (DGT), the national and regional tax authorities, your town hall, the ITV inspection station, the engineering firm that issues the technical sheet, the manufacturer if the COC has to be requested, the licensed administrative agent (gestor administrativo colegiado) who files the applications and, for vehicles from outside the EU, customs. If you ask us to deregister the car in its country of origin, also that country's authority. For the search in Germany, the seller and the inspector who checks the car.
In addition, these providers process data on our behalf:
| Provider | What for | Where and under what safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosts the site and runs the forms | Global network; US under the EU-US Data Privacy Framework and standard contractual clauses |
| Supabase, Inc. | Database of enquiries and cases, and private document storage | Servers in Frankfurt (EU); support from the US under standard contractual clauses |
| Stripe Payments Europe, Ltd. | Takes payments and issues invoices | Ireland (EU). For fraud prevention and its own legal duties, Stripe processes some data as an independent controller |
| Resend (Plus Five Five, Inc.) | Sends confirmations and notices by email | US, under standard contractual clauses |
| Google Ireland Ltd. | Mailbox where we receive notices and reply to you | EU and US, under the EU-US Data Privacy Framework |
When a provider processes data outside the European Economic Area, it does so under an adequacy decision of the European Commission or standard contractual clauses (Art. 45 and 46 GDPR). We do not sell data to anyone.
5. How long we keep it
- Estimates and enquiries that do not become a case: 12 months from our last contact, then deleted.
- Documents you upload: while the case is open and for 12 months after it closes, in case a step has to be repeated. Then deleted.
- Case and contract data: for the duration of the service and then blocked for the 5-year limitation period (Art. 1964 of the Spanish Civil Code).
- Invoices and accounting data: 6 years, as required by Art. 30 of the Spanish Commercial Code.
6. Your rights
You can ask us for access to your data, to correct it, delete it, restrict or object to its processing, or receive it in a standard format. Write to [email protected] with the subject “Data protection”. We reply within one month. If we have reasonable doubts about your identity, we will ask you to confirm it.
You can complain to the Spanish Data Protection Agency, Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the supervisory authority of the country where you live.
7. Cookies and browser storage
matrikula.es sets no cookies of its own, neither for analytics nor for advertising. The case form keeps your answers in the browser's session storage so you do not lose them if you reload: they do not leave your browser until you click “Pay”, and they are deleted when you close the tab. Cloudflare may set technical cookies to filter automated traffic, which do not need consent.
Payment takes place on checkout.stripe.com, which uses its own cookies for payment and fraud prevention. See Stripe's cookie policy.
8. Security
Everything travels encrypted. Documents are kept in private storage that only our server can reach, and viewing one takes a signed link that expires. The database has no public access key.
9. Minors
Our services are for people aged 18 and over.
10. Changes
If we change this policy, we publish the new version here with its date. If the change affects an open case, we tell you by email. See also the legal notice and the terms of service.