Privacy policy

This Privacy Policy governs the processing of personal data of users, customers, collaborating professionals and other persons who access or use the services offered through the Cerrajero Express website. Its purpose is to inform transparently about which personal data are collected, for which purposes they are used, the legal basis for each processing activity, with whom they may be shared, and which rights data subjects have.

Personal data are processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD), and other applicable Spanish and European rules.

1. Data controller

The controller of personal data collected through the website is:

Trading name: Cerrajero Express

Tax ID (NIF): B16684748

Address: C. Murillo, 5, 03184 El Chaparral, Alicante, Spain.

Email: info@cerrajero-express.es

Phone: +34 603 563 713

Website: https://cerrajero-express.es

For any enquiry about personal data processing or to exercise rights under data protection law, the data subject may contact the controller using the email address or other contact details above.

This Policy applies to processing carried out by Cerrajero Express in operating its intermediation platform. Locksmith professionals who receive requests and perform technical services may act as independent controllers for data they use to manage and provide their own services, in line with their legal obligations and any privacy information that applies to them.

2. Categories of personal data processed

Depending on the data subject’s relationship with the platform and the features used, Cerrajero Express may process the following categories of personal data:

Identification data: first and last name, username and, where necessary, professional or business identification data.
Contact data: phone number, email address and other communication means provided voluntarily.
Account and authentication data: protected access credentials, account identifiers, login information and data needed to reset passwords.
Job / service request data: property address, location, description of the incident, lock type, urgency, characteristics of the requested work and related communications.
Photos and files: images of locks, doors, cylinders, mechanisms and other elements related to the requested service. Personal data that appear incidentally in such files may also be processed.
Professional and business data: information about collaborating locksmiths’ activity, professional contact details, business documentation and documents submitted to verify their activity or professional status.
Economic and billing data: job amounts, intermediation commissions, invoices, supporting documents, settlement statements and bank details provided by professionals to receive payments or settlements.
Referral data: identifiers of participating users, referral codes or links, invitations and data needed to attribute and manage programme rewards.
Technical and browsing data: IP address, device or session identifiers, browser, operating system, access logs, technical events and data obtained via cookies or similar technologies according to the user’s preferences.

Cerrajero Express does not deliberately request special categories of personal data, such as health, ideology, religion or other specially protected data. Users are advised not to include such information in descriptions, messages, photos or documents unless it is strictly necessary for the locksmith request.

3. Purposes of processing and legal bases

Personal data are processed only for specified, explicit and legitimate purposes. Depending on the specific operation, the legal basis may be performance of a contract or pre-contractual measures requested by the data subject, compliance with legal obligations, the controller’s legitimate interest, or the data subject’s consent.

3.1. Registration and management of user accounts

Cerrajero Express processes identification, contact and authentication data needed to create, administer and maintain user accounts for both customers and locksmith professionals.

This includes registration, login, profile management, preference settings, password recovery and reset, handling access issues and account-related communications.

The legal basis is performance of the contractual relationship or pre-contractual measures requested by the data subject, under Article 6(1)(b) GDPR. Where appropriate, legitimate interest in maintaining the security, integrity and proper functioning of accounts may also apply.

3.2. Management of requests, jobs and leads

When a user requests a locksmith service, the platform may process their name, phone number, address or location, problem description, photos and other information needed to understand and handle the request.

These data are used to register the job, assess the needs communicated, manage the request, facilitate contact with professionals, follow up the intervention and handle related queries or complaints.

The main legal basis is pre-contractual measures at the data subject’s request and, once the relevant relationship is formalised, performance of the contract, under Article 6(1)(b) GDPR.

3.3. Matching, assignment and communication with collaborating professionals

To facilitate the requested service, Cerrajero Express may use job data to identify, select and assign the request to one or more collaborating professionals who can handle it based on availability, location, activity and job characteristics.

This may involve communicating to the assigned professional the customer’s name, phone number, service address or location, incident description and photos needed to assess or perform the intervention.

The legal basis is pre-contractual measures requested by the customer and performance of the contracted intermediation services, under Article 6(1)(b) GDPR.

Communications about requests may be made by email, phone, SMS, WhatsApp or Telegram, depending on available features and the channel chosen by the user. Using an external messaging channel may involve processing by that provider under its own terms and privacy policies.

Where the user voluntarily chooses an external channel, their data may be communicated through that channel as needed to process the request. Users should note that those providers may process certain technical data, identifiers and communication metadata under their own terms.

3.4. Verification of professionals and KYC documentation

To admit and manage collaborating professionals, Cerrajero Express may request and process business or professional documentation submitted by the collaborator through the platform.

This may include identification of the activity, business information, professional accreditations, company documents and data about persons who represent or manage the activity where they appear in submitted documents.

The purpose is to check the professional information provided, verify the collaborator’s activity, prevent impersonation, detect irregularities and manage the collaboration relationship.

The legal basis will be pre-contractual measures and performance of the contractual relationship with the professional under Article 6(1)(b) GDPR, as well as Cerrajero Express’s legitimate interest in maintaining a reliable collaborator network and preventing fraud. Where a specific legal provision requires certain checks or document retention, processing will additionally be based on compliance with that legal obligation under Article 6(1)(c) GDPR.

Submitted documents should be limited to information needed for verification. Including personal data of third parties unrelated to that purpose is not recommended.

3.5. Price estimates using artificial intelligence

The platform may offer an indicative price-estimate feature using artificial intelligence systems. For this, the user may provide photos of locks, doors, cylinders or other elements related to the incident.

Images are processed to obtain relevant visual information about the possible type of mechanism, apparent characteristics of the photographed element and circumstances that may affect a preliminary service estimate.

Processing may include receipt, temporary storage, automated analysis and generation of an indicative result from the images and information provided by the user.

The legal basis will be pre-contractual measures requested by the user where the estimate forms part of the service request process, under Article 6(1)(b) GDPR. Where it is an additional feature not required to process the job, use may be conditioned on the user’s consent where applicable.

Estimates generated by artificial intelligence are indicative only and do not constitute binding quotes, contractual offers or guarantees of the final price. The final assessment depends on the actual property conditions, lock type, complexity of the work, materials needed, travel and other circumstances that the relevant professional must confirm.

The automated result does not replace a professional assessment and does not by itself determine contracting or performance of a service. No decisions producing legal effects concerning the user, or similarly significantly affecting them, will be based solely on this automated estimate.

Users are advised to photograph only what is needed for the assessment, avoiding faces, documents, number plates, private interiors or other data of persons irrelevant to the requested service.

3.6. Billing, commissions and settlements to professionals

Cerrajero Express may process job data, amounts, operations, invoices, intermediation commissions, supporting documents and movements related to platform activity.

In the relationship with collaborating professionals, the platform may calculate and manage the applicable commissions, which may be around 15 % on an indicative basis, according to the commercial and contractual terms accepted by each professional.

Account statements, operation summaries or settlements (statements) may also be generated to inform collaborators about managed jobs, corresponding amounts, applied commissions and pending or settled sums.

Where a professional provides bank details to receive payments or settlements, these may be processed only as needed to administer the corresponding payments, reconciliations and accounting obligations.

The legal basis for these processing activities is performance of the contractual relationship with the professional and compliance with applicable accounting, tax and commercial legal obligations, under Articles 6(1)(b) and 6(1)(c) GDPR.

3.7. Referral programme

Where the platform operates a referral or recommendation programme, it may process identification data, referral codes, invitation links and information about actions taken through those links.

The purpose is to identify the source of recommendations, correctly attribute referrals, check compliance with programme terms and manage applicable rewards or benefits.

The legal basis will be performance of the programme terms accepted by the participant and, where appropriate, legitimate interest in preventing fraudulent use, duplicates or manipulation of the referral system.

Where a user provides another person’s personal data to invite them, they must ensure they have a legitimate basis to do so and that the invited person receives the relevant privacy information. Participation in the referral programme does not by itself imply the invited person’s consent to receive advertising or commercial communications.

3.8. Cookies, analytics and advertising technologies

The website may use cookies and similar technologies to enable its operation, remember preferences, analyse browsing and, where authorised by the user, measure campaigns or manage advertising activities.

Strictly necessary technical cookies may be used without consent where legally exempt. Analytics, advertising or tracking cookies that require prior authorisation will not be installed or used until the user has given valid consent.

If accepted, identifiers or tools associated with Google Tag Manager, Google Analytics and Ads services may be used, as well as other measurement or advertising identifiers actually configured on the website.

The legal basis for non-essential cookies and related processing that require consent is the user’s consent, under Article 6(1)(a) GDPR and Article 22.2 of the Spanish LSSI-CE. The user may change or withdraw preferences at any time through the available mechanisms.

For detailed information on cookies used, their purposes, duration and configuration options, please see the Cookie policy.

3.9. Security, technical logs and fraud prevention

Cerrajero Express may process IP addresses, access logs, session identifiers, technical events, device information and other operational data to secure the platform and prevent unauthorised access, impersonation, fraudulent use, cyberattacks and abusive behaviour.

Technical logs may also be used to diagnose errors, maintain service availability, investigate incidents and evidence certain operations where necessary.

The main legal basis is Cerrajero Express’s legitimate interest in protecting its systems, accounts, users, collaborators and services, under Article 6(1)(f) GDPR. Where certain logs must be retained to comply with a legal obligation or a competent authority’s request, the legal basis will be Article 6(1)(c) GDPR.

3.10. Handling queries, complaints and communications

Data provided by email, phone or forms may be used to answer queries, manage incidents, handle complaints and maintain communications related to platform activity.

The legal basis will be pre-contractual measures or performance of the contractual relationship, compliance with legal obligations or, where appropriate, legitimate interest in properly managing communications and protecting the rights of the controller and data subjects.

4. Mandatory or voluntary nature of data

Data requested during registration, job processing or onboarding of professionals are mandatory where they are indispensable to provide the requested feature, verify the collaborator or comply with a legal obligation.

Failure to provide necessary data may prevent creating an account, recovering access, processing a request, assigning a professional or completing a settlement.

Photos for AI estimates and other additional data are voluntary where they are not an essential requirement of the requested service. Not providing them should not prevent access to features that can be provided without that information.

The user guarantees that the data provided are accurate, up to date and relevant and undertakes to report any relevant change. Where they provide third-party information, they must have an adequate legal basis to do so and pass on the relevant information about processing of those data.

5. Recipients of personal data

Personal data may be disclosed to the following categories of recipients where necessary for the purposes described:

Assigned collaborating professionals and locksmith companies: may receive contact details, location, incident description and photos needed to assess and perform the requested service.
Hosting and technology infrastructure providers: may process data for storage, maintenance, availability and operation of the platform.
Email, SMS and communications providers: may be involved in sending notifications, confirmations, messages and operational communications.
Messaging tool providers: external channels chosen by the user, such as WhatsApp or Telegram, may receive the data needed to transmit the corresponding communications.
Artificial intelligence tool providers: where external services are used to process photos or generate estimates, they may access the images and information strictly necessary to provide that feature.
Administrative, accounting and financial service providers: may be involved in managing invoices, commissions, settlements and payments.
Analytics and advertising providers: may process identifiers and browsing data where the user has given the required consent.
Public authorities, authorities and courts: may receive data where there is a legal obligation, a valid request or it is necessary to bring or defend claims.

Technology providers acting as processors will, where applicable, be subject to the contracts and safeguards required by Article 28 GDPR. They must process data under the controller’s instructions and adopt appropriate security measures.

Disclosing data to a collaborating professional so they can manage and perform the requested service does not necessarily mean that professional acts as a processor for Cerrajero Express. For operations they carry out on their own account to organise, contract and provide the technical service, they may act as an independent controller and assume the data protection obligations that apply to them.

Data will not be sold to third parties or disclosed for commercial purposes unrelated to those described in this Policy without a valid legal basis. Any further disclosure must be covered by a legal obligation, a contractual relationship, a duly balanced legitimate interest or the data subject’s consent, as applicable.

6. International data transfers

As a general rule, Cerrajero Express will seek to use providers and services that allow personal data to be processed within the European Economic Area (EEA).

However, certain technology providers, messaging services, AI tools, analytics or digital infrastructure may be established outside the EEA or allow access to data from third countries.

Where an international transfer of personal data occurs, it will take place only where a valid mechanism under Chapter V GDPR exists. Depending on the circumstances, that mechanism may consist of:

An adequacy decision by the European Commission recognising that the country or recipient offers an adequate level of protection.
Standard contractual clauses approved by the European Commission, accompanied where necessary by an assessment of the destination country’s level of protection and appropriate supplementary measures.
Other safeguards or derogations expressly provided for under European law, where their requirements are met.

Where appropriate, the data subject may request further information about applicable international transfers and the safeguards used to protect their personal data via the controller’s contact details.

7. Data retention periods

Personal data are retained for the time strictly necessary to fulfil the purposes for which they were collected and thereafter for periods required by law or while legal liability may arise from the processing carried out.

On an indicative basis, the following criteria apply:

Customer accounts: while they remain active and for any additional time needed to manage incidents, claims or liabilities arising from their use. As a general rule, inactive accounts and associated data will be reviewed after prolonged inactivity.
Professional accounts: during the collaboration relationship and, after it ends, for the periods needed to meet contractual, accounting and tax obligations and possible claims.
Requests, jobs and leads: during processing of the request and thereafter for the period needed for follow-up, to evidence operations and to handle possible claims. Contacts that do not become an operation may be deleted or anonymised after an indicative period of twelve months from the last interaction, unless there is a legitimate reason to retain them longer.
Photos and data used for AI estimates: for the time needed to generate and manage the estimate and, where appropriate, for a limited subsequent period to resolve incidents or claims. As a general rule, these images will not be kept beyond twelve months from closure of the job, unless justified need or legal obligation.
Professionals’ KYC documentation: while needed to verify and maintain the professional relationship and, after it ends, only for legally required periods or as needed to defend claims. Documentation that need not be retained will be deleted or subject to restriction and erasure measures where appropriate.
Billing, commissions and accounting documentation: for applicable commercial, tax and accounting periods. This includes the general six-year period for books, correspondence, documentation and business supporting documents under Article 30 of the Spanish Commercial Code, and tax limitation periods, generally four years, under the Spanish General Tax Law.
Bank details for settlements: while needed to manage payments and corresponding accounting obligations, thereafter applying applicable legal retention periods.
Referral programme: during participation in the programme and any additional time needed to verify attributions, rewards, possible irregularities and claims arising from its operation.
Technical and security logs: for the time needed to monitor proper platform operation, investigate incidents and prevent fraud. As a general guide, they may be retained for up to twelve months, unless incidents or justified needs require a longer period.
Cookies and identifiers: for the periods set for each cookie or technology, as described in the Cookie policy.

Once applicable periods expire, data will be deleted, anonymised or blocked as appropriate. Blocking means preventing ordinary use while keeping them available only to competent authorities, judges and courts to address possible liabilities during statutory limitation periods.

The periods indicated are general criteria and may vary depending on the nature of the processing, the existence of claims, applicable legal obligations and the particular circumstances of each operation.

8. Data subject rights

Under the GDPR and LOPDGDD, any person whose personal data are processed by Cerrajero Express may exercise the following rights:

Right of access: obtain confirmation as to whether personal data concerning them are being processed and, where applicable, access those data and information about the processing.
Right to rectification: request correction of inaccurate or incomplete personal data.
Right to erasure: request deletion of their data where one of the legally provided grounds applies, for example where the data are no longer necessary for the purposes for which they were collected.
Right to object: object to certain processing based on legitimate interest, on grounds relating to their particular situation, unless compelling legitimate grounds prevail or processing is necessary to establish, exercise or defend claims.
Right to restriction of processing: request that use of their data be temporarily limited in the cases set out by law, for example while accuracy is checked or an objection is resolved.
Right to data portability: receive the personal data they have provided in a structured, commonly used and machine-readable format, and transmit them to another controller where legal requirements are met.
Right to withdraw consent: withdraw at any time consent given for processing based on that legal basis, without affecting the lawfulness of processing before withdrawal.

Where applicable, the data subject also has the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them, under Article 22 GDPR.

8.1. How to exercise rights

Rights may be exercised by a request addressed to Cerrajero Express through:

Email: info@cerrajero-express.es

Postal address: C. Murillo, 5, 03184 El Chaparral, Alicante, Spain.

The request must identify the data subject and clearly state the right they wish to exercise and the processing concerned. Where there are reasonable doubts about the requester’s identity, additional information strictly necessary to verify it may be requested.

Exercising these rights is free of charge, except in the exceptional cases under Article 12(5) GDPR where requests are manifestly unfounded or excessive.

Cerrajero Express will respond within one month of receipt. That period may be extended by a further two months where necessary because of the complexity or number of requests, informing the data subject of the extension and reasons within the first month.

8.2. Complaint to the supervisory authority

If the data subject considers that processing of their personal data infringes applicable law or that they have not received a satisfactory response when exercising their rights, they may lodge a complaint with the Spanish Data Protection Agency (AEPD).

Information on complaint procedures is available on the official website of the Spanish Data Protection Agency: www.aepd.es.

9. Minors

Cerrajero Express services are not specifically directed at minors. The platform does not deliberately request personal data of minors that are not necessary for the legitimate purposes of the service.

Under Article 7 LOPDGDD, where processing is based on consent, it may be given directly by persons aged fourteen or over, except where the law requires assistance of holders of parental authority or guardianship for the relevant act or legal transaction.

For minors under fourteen, consent-based processing is lawful only where the consent of their parents or legal guardians is obtained, as required by law.

Where a minor needs to request a locksmith service, it is recommended that the request and communications be managed by their parents, guardians or legal representatives where required by the circumstances and applicable law.

If Cerrajero Express becomes aware that personal data of a minor have been collected contrary to the law, it will take reasonable steps to review the situation and erase the data where legally required.

10. Security and confidentiality

Cerrajero Express applies technical and organisational measures that are reasonable and appropriate to the risk to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or any other form of unlawful processing.

Depending on the nature of the systems and information processed, protection measures may include access controls, permission management, credential protection, communications security measures, backups, incident monitoring and internal information-management procedures.

Access to data will be limited to persons and providers who need to know them to perform their functions or provide the corresponding services, subject to applicable confidentiality and data protection obligations.

Collaborating professionals must use personal data received exclusively to manage requests and provide the corresponding services, respecting their own security, confidentiality and data protection obligations.

Despite the measures adopted, no technological system can guarantee absolute security. In the event of a personal data breach, Cerrajero Express will act in accordance with the notification obligations to the supervisory authority and, where applicable, communication to data subjects under Articles 33 and 34 GDPR.

11. Commercial communications

Contact data may be used to send communications strictly related to managing accounts, requests, jobs, incidents, settlements and other services requested by the data subject.

Sending electronic commercial communications will comply with applicable law, particularly the LSSI-CE. Where prior consent is required, it will be requested specifically and separately. Merely creating an account or requesting a service does not by itself authorise receiving advertising.

The user may withdraw consent or object to commercial communications at any time via the unsubscribe mechanism in the communications or by contacting info@cerrajero-express.es, without that withdrawal affecting operational communications needed to manage contracted services.

12. Links and third-party services

The website may contain links or integrations with external services, messaging platforms, communication tools, payment services or other technology resources.

When the user accesses third-party services, processing of their data may be subject to those providers’ privacy policies and terms. Cerrajero Express does not necessarily control processing those third parties carry out under their own responsibility.

Users are advised to consult the relevant privacy policies before using such services or providing personal information through them.

13. Changes to this Privacy Policy

Cerrajero Express may amend this Privacy Policy to adapt it to legislative changes, supervisory authority guidance, technological changes or variations in how the platform and processing activities operate.

The current version will always be available on the website. Where a change involves material updates to purposes, legal bases, recipients or data subject rights, adequate information will be provided by available means and, where legally required, consent will be requested again.

Users are advised to consult this Policy periodically to stay informed of the updated conditions for processing of their personal data.

14. Contact and privacy enquiries

For any question, enquiry or request related to this Privacy Policy, personal data processing or exercise of rights under the GDPR and LOPDGDD, you may contact Cerrajero Express using:

Controller: Cerrajero Express
Tax ID (NIF): B16684748
Email: info@cerrajero-express.es
Phone: +34 603 563 713
Postal address: C. Murillo, 5, 03184 El Chaparral, Alicante, Spain.
Website: https://cerrajero-express.es

This Privacy Policy provides general information on personal data processing via the Cerrajero Express platform, without prejudice to additional information that must be provided at the time of collection for certain processing activities or features.