Data processing agreement

Applies to the Complete Reports API and to the vehicle Technical Data service (web and API).

1. Parties and purpose

Data controller: the company or professional that contracts the Complete Reports API or the Info Coche Technical Data service (hereinafter, the "Client").

Data processor: Info Coche, the infocoche.net platform, whose owner is identified at the end of this agreement (hereinafter, "Info Coche").

In accordance with Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), this agreement governs the processing of personal data that Info Coche carries out on the Client's behalf when providing those services. It forms part of the service conditions and is accepted together with them.

2. Nature of the engagement: Info Coche is a technical intermediary

2.1) At the Client's request and on its behalf, Info Coche looks up the official vehicle registers for the plates or VINs the Client indicates, delivers the result and keeps it in the Client's account so the Client can view, download and manage it.

2.2) It is the Client who decides which vehicles are looked up, for what purpose and for whom. Info Coche does not choose the requests, has no relationship with the Client's customers or users and does not use the data for its own purposes, except those strictly necessary to provide the service: invoicing and balance control, security and abuse prevention, compliance with legal obligations, and aggregated, anonymised statistics on how the service works.

3. Data, data subjects and duration

3.1) Data processed: plate and vehicle identification number (VIN), technical and administrative data of the vehicle and, in the case of DGT reports, the data of the current and previous owners shown in the report (identification, address, charges, seizure orders or other entries), plus any reference the Client adds to its requests.

3.2) Data subjects: owners, previous owners and other persons whose data appear in the registers looked up, and the Client's customers or users if the Client includes their data.

3.3) Operations: lookup, receipt, storage, retention, making available to the Client and deletion.

3.4) Duration: for as long as the Client keeps its account and access to the service. When it ends, point 7 applies.

4. Obligations of the Client as controller

The Client is the data controller towards its own customers and users, towards the data subjects and towards the Spanish Data Protection Agency. In particular, the Client undertakes to:

• Have a valid legal basis and, where applicable, a specific legitimate interest for each request, and be able to prove it if required.
• Inform its customers and users of the processing, including Info Coche's role as processor where applicable.
• Handle the rights of access, rectification, erasure, objection, restriction and portability that data subjects exercise before it.
• Set the retention period for the data it obtains and ask Info Coche to delete it when it no longer needs it.
• Be liable for the use that it, its employees, its customers or its users make of the data once delivered, including data downloaded, integrated into its systems or disclosed to third parties, which are outside Info Coche's control.
• Give Info Coche only instructions that comply with data protection law.

5. Obligations of Info Coche as processor

• Process the data only on the Client's documented instructions, which are the requests it makes through the platform or the API and those it communicates in writing. If, in its opinion, an instruction infringes the law, Info Coche will inform the Client.
• Ensure that the persons authorised to process the data have committed to confidentiality.
• Apply security measures appropriate to the risk (Article 32 GDPR), including: encrypted communications (HTTPS), account access through personal, revocable credentials or API keys, servers located in Spain, access control to the systems and backups.
• Notify the Client, without undue delay and in any case within 48 hours of becoming aware of it, of any security breach affecting its data, with the information the Client needs to meet its own notification obligations.
• Assist the Client, as far as possible, in responding to data subjects and in meeting its obligations on security, impact assessment and prior consultation.
• Make available to the Client the information needed to demonstrate compliance with this agreement.
• Not disclose the data to third parties except to the sub-processors in point 6, or where the law requires it.

6. Sub-processors

The Client gives Info Coche general authorisation to use the following providers to deliver the service, which are subject to data protection obligations equivalent to those in this agreement:

• Clouding.io (Spain): hosting of the servers and databases.
• Google Ireland Limited (Firebase): authentication and the Client's account data.

Info Coche will inform the Client of any change of sub-processors in advance, and the Client may object by ceasing to use the service. The public bodies the data come from (such as the Directorate-General for Traffic, DGT) are not sub-processors: they are the source of the information.

No international transfers of data outside the European Economic Area take place except with the safeguards provided for in Chapter V of the GDPR.

7. Deletion of the data

7.1) The data of each request are kept in the Client's account so it can view and download them while the account is active.

7.2) The Client may at any time ask for specific requests, or all of them, to be deleted by writing to info@infocoche.net from its account email. Info Coche will do so within 10 working days at most and confirm in writing that it has been done.

7.3) When the relationship ends, Info Coche will delete the data processed on the Client's behalf, or return it first if the Client so requests.

7.4) As the only exception, Info Coche will keep blocked, without the content of the report and only for the legally required periods, the data that a law or the access conditions of the source body oblige it to keep (for example, the record of which account looked up which vehicle and when) and those needed for invoicing, available exclusively to the competent authorities or for the defence of claims.

8. Relationship with the Client's customers and users

8.1) Info Coche has no relationship with the Client's customers or users. Towards them, the Client is solely responsible for GDPR compliance.

8.2) If a data subject contacts Info Coche to exercise their rights over data processed on the Client's behalf, Info Coche will forward the request to the Client within 5 working days at most, so that the Client resolves it, and will then carry out what the Client instructs.

9. Liability

Each party is liable for the breaches attributable to it. If Info Coche processed the data for its own purposes outside what this agreement provides, it would be considered the controller of that processing. The Client shall hold Info Coche harmless against claims, penalties or damages arising from the breach of its obligations as controller or from the use that it or its customers and users make of the data.

10. Acceptance, records and changes

10.1) The Client accepts this agreement electronically when it accepts the API conditions or buys a Technical Data pack. As evidence, Info Coche keeps the date and time, the IP address, the browser, the account and the version accepted.

10.2) Info Coche may amend this agreement to adapt it to changes in the law or the service. The new version will be communicated by email at least 15 calendar days in advance and the Client will be asked to accept it the next time it accesses the service.

10.3) This agreement is governed by Spanish law. For any dispute, the parties submit to the courts and tribunals of Info Coche's place of business.

Owner of Info Coche

Óscar Ramírez Jiménez, Spanish tax ID (NIF) 50.61.40.54 R, with address at Alhama 58, Lucena, Córdoba (Spain). Contact: info@infocoche.net.

Version 2026-10-21