Trasteros Carrús Back

Privacy policy

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), this is how personal data collected through this website — and, once the site is operating, on the premises themselves — is processed.

Data controller

  • Controller: Elisabet García Martínez (NIF 03886397H)
  • Trading name: Trasteros Carrús
  • Address: Peña las águilas 351
  • Premises: Calle Requena 4, Polígono Industrial de Carrús, 03206 Elche (Alicante)
  • Email: hola@trasteroscarrus.es

What data we process, what for, and on what legal basis

  • Waiting list: email and, if you tell us, the size you are interested in. Purpose: to notify you of the opening and availability. Basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time.
  • Unit booking: name, email and optional phone. Purpose: to manage your booking, verify your email (double opt-in) and notify you of the opening. A booking whose email is not confirmed within 72 hours expires automatically and its data is processed only as a record of the request. Basis: pre-contractual measures at your request (art. 6.1.b GDPR).
  • Customer area: if you create an account, we process your login email; if you sign in with Google, we receive from Google your email and your profile name — nothing more. If you complete your details, we process your full name, ID/tax number, phone and address, which are needed to prepare the future contract and its invoicing. Basis: pre-contractual measures and performance of a contract (art. 6.1.b GDPR).
  • Change history of your details: we keep an internal record of changes to customer data (what changed, when and from which account) for security and fraud prevention. Basis: legitimate interest (art. 6.1.f GDPR).
  • Contact and WhatsApp: the data you send us so we can deal with your enquiry. Basis: pre-contractual measures or legitimate interest in replying to you.
  • CCTV (once the site is operating): the premises will be under video surveillance for the security of people, goods and facilities (art. 22 LOPDGDD), with signage at the entrances. Images will be kept for a maximum of one month unless they document an incident, and will only be disclosed to law enforcement or the courts. Basis: legitimate interest and public interest in security.

Retention

  • Waiting list: until you withdraw consent or, at most, one year after opening.
  • Bookings: while they are active; cancelled or expired ones are deleted unless there is a legal obligation.
  • Account and customer details: for as long as you keep the account; with a contract, contractual and invoicing data is kept for 6 years (Spanish Commercial Code) after termination.
  • CCTV: one month maximum, except for incidents.

Web analytics

We use the strictest mode: no Google script loads until you accept in the cookie notice. If you do not accept, not a single piece of data reaches Google — not even anonymously. If you do accept, Google Analytics measures in aggregate which pages are visited; we do not use the data for advertising or profiling. Detail in the cookie policy.

Recipients and processors

No data is disclosed to third parties for commercial purposes. The following provide services as data processors: Supabase (database and authentication, servers in the European Union — Ireland), Vercel (web hosting), Resend (sending transactional emails, European Union region), Google Ireland Limited (analytics only with your consent, and Google sign-in only if you choose it) and Functional Software, Inc. (Sentry) (technical error monitoring, with servers in the European Union — Germany, and configured not to receive personal data). Where a provider involves transfers outside the EEA, these rely on GDPR mechanisms (standard contractual clauses and the EU-US Data Privacy Framework).

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@trasteroscarrus.es, proving your identity. If you believe the processing is not compliant, you can complain to the Spanish Data Protection Agency (aepd.es).

Automated decisions

No automated decisions with legal effects are taken and no profiling is carried out. The automatic validations (email or ID document format) only check that the data is correct.

Last reviewed: August 2026.