Privacy Policy

At CUPRA we know that you care about your personal data and you want to know how we will handle with them. This Privacy Policy follows the provisions of regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, "GDPR"); as well as the Spanish Data Protection Spanish Act 3/2018; and other local regulations that complement it.

  • Personal data is all information that relates to an identified or identifiable natural person.
  • Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means.

Therefore, we are going to explain to you below, in a clear and transparent manner, in our Privacy Policy how and when we access, collect, share and protect your personal data.

1. Who is the Data Controller of your data?

Data Controller:

SEAT, S.A.U. (hereinafter, “CUPRA”) tax identification number A-28049161

Address:

Autovía A-2, Km. 585, 08760 Martorell (Barcelona) Spain

Email address:

customercare@cupraofficial.com

 

2. What type of data do we process and what is the origin?

When you login or access to our services, we process the following personal data through the following sources: 

If you are representing a merchant or CUPRA partner, we collect and process the following data from you:

  • Identification/Employee data: name and surname, nationality, role/position.
  • Contact and communication data: telephone number, e-mail, and postal address.
  • Product data: product’s description, contract stipulations and obligations, price, extras, warranties, financial services, call center channel etc.

If you are an user or purchaser: we collect and process the following data from you:

  • Identification data: name and surname, date of birth, nationality.
  • Contact and communication data: telephone number, e-mail address and postal address.
  • Purchase data: products purchased, financial services, contract date, purchase price, extras, warranties, etc.
  • Transactional data: credit card number, and other payment related information.

Data we collect automatically:

  • Browsing data: the Services' servers may automatically detect your IP address, domain name, unique device identifier, browser fingerprint, device fingerprint, location data while using our Services (geolocation), camera image data and cookie IDs where you have set this in your browser.

Data we obtain from third parties:

  • Cookie data: inserted in the Website and/or in the Services, if applicable, and the use of similar technologies (see Cookie Policy for more information).

3. For what purpose do we process your data and what is the legitmate basis for the processing them?

We may only process your personal data if we have an adequate legal basis for doing so. We may process your personal data for any or all of the purposes specified below:

PROCESSING ACTIVITY

PURPOSE

LAWFUL BASIS

To manage your registration as a merchant of CUPRA Marketplace

If you decide to become a registered merchant of our platform, CUPRA Marketplace need to process your data to identify you as a merchant and grant you access to the platform.

Performance of the contractual

relationship with the Merchant

To manage your registration as user/custumer of CUPRA Marketplace

If you decide to become a registered user of our platform, CUPRA Marketplace need to process your data to identify you as a user and grant you access to the platform.

Performance of the contractual

relationship with the User

For the development, performance and execution of the purchase that you executed with Us on the platform

We will process your data, mainly:

• To manage the purchase, the payment and the delivery of the products that you purchase, regardless of the payment procedure used. For this, CUPRA will need to communicate your data to the CUPRA Merchant which sell the corresponding product you have selected. 

• To contact you for updates or informative notices related to your purchases, including quality surveys to be able to establish the degree of customer satisfaction with the provided service;

• To manage potential exchanges, returns after you have purchased and manage requests of availability information for articles, reservations of products through the platform, depending on the availability of such options from time to time.

 

We process your data because their processing is necessary for us to the performance of the purchase or services contract with you.

 

We consider that we have a legitimate interest to carry out the necessary verifications to detect and prevent potential fraud or fraudulent uses of the Platform, for example when you make a purchase. In addition, we consider  that we have a legitimate interest in sending you surveys to collect your opinion.

To meet requests or applications that you make through the Customer Services channels

We only process the personal data that are strictly necessary to manage or resolve your request or application. If you contact us via telephone, the call may be recorded for quality purposes and so that we can respond to your request.

We consider that we have legitimate interest in answering the queries or consultations raised by you through the existing different contact channels. We understand that the processing of these data is also beneficial to you to the extent that it enables us to assist you adequately and answer to the queries raised. If your query is related to your order or the product/service acquired through the Platform, the processing of your data is necessary to perform the purchase contract. Finally, If your query is related to the exercise of your rights on which we inform you below, or to claims on our products or services, we are legally permitted to process your data for compliance with our legal obligations.

For communications  and marketing purposes

 

We will send you relevant information about your orders and your account status. Addiiontally, we will send informations about our news, products or services. We will be able to contact you through various means (such as e-mail or SMS), based on your contact data.

 

We are legally permitted to process your data for communication purposes, based on the performance of the contractual relationship; as well as for marketing purposes based on your previous consent.

 

4. How is your data protected and whom are they communicated to? 

CUPRA guarantees that your data will be processed with absolute confidentiality, undertaking to keep them secret and guaranteeing the duty to store them by adopting all necessary and reasonable measures to prevent their alteration, loss and unauthorised access or processing, in accordance with the provisions of the applicable legislation. Our security measures are continuously updated and reviewed in order to improve them in accordance with new technological advances.

We do not share the personal information you provide to us with other organisations without your express consent, except as described in this Privacy Policy. In this regard, we disclose your personal information to third parties in the following circumstances:

CUPRA Marketplace partners or merchants: in case of purchasing through CUPRA Marketplace, we may disclose your personal data to CUPRA’s partners to ensure the delivery of the purchase and to handle complaints, as well as for invoicing and warranty activities.

  • Partners who provide services on behalf of CUPRA for the purpose of managing the provision of services. In this case, such access to data on behalf of third parties will be regulated in the corresponding data processing agreement in compliance with applicable regulations, which will state that they will process your data on our behalf and under our instructions, and in no case will they have your data for their own purposes.
  • Compliance with legal obligations: we may share certain strictly necessary information with authorities such as the police, tax authorities or other authorities, if required by law.

5. Will your data be transfered outside the European Union?

In general, your data will be processed within the European Economic Area. However, some of our suppliers may process your data outside the European Economic Area, such as Amazon Web Services, which provides our virtual infrastructure on a "cloud computing" model. This entity is established in the United States of America. CUPRA regulates in accordance with the applicable regulations the relationship with these suppliers in order to guarantee and maintain the adequate level of protection in accordance with European standards. Therefore, in the event that the country receiving the data is not considered to have an adequate level, it will regulate the relationship with the third party recipient by means of the corresponding Standard Contractual Clauses adapted by the European Commission, the content of which can be consulted here.

6. How long we will keep your data?

Your personal data will be kept for the time strictly necessary for the purposes of the processing for which they have been provided, and, in any case, following the principle of data minimisation and the retention periods provided for in the applicable regulations, for a maximum period of 10 years for legal liabilities may arise in relation to the product sold. Your data will be kept for as long as they are necessary to fulfil the corresponding purpose and from the moment you exercise your right of deletion, your data will be kept blocked solely for the purpose of meeting any legal responsibilities that may arise.

7. What are your rights as a data subject?

Right

Content

Access

You can obtain confirmation as to whether CUPRA processes your personal data, as well as consult your personal data included in our files.

Rectification

You can modify your personal data if they are inaccurate, as well as complete if they are incomplete.

Erasure

You can request the elimination or erasure of your personal data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

Object to processing

You can request that your personal data not be processed. CUPRA will stop processing the data, except for compelling legitimate reasons, or the exercise or defence of possible claims.

Restrict of processing

You can request the limitation of the processing of your data in the following cases:

• As long as the accuracy of your data is contested;

• When the processing is unlawful, you object to the deletion of your data, and request the limitation of its use;

• When CUPRA does not need to process your data, but you need them for the exercise or defence of claims;

• When you have objected to the processing of your data for the fulfilment of a public interest mission or for the satisfaction of a legitimate interest, while it is being verified whether the legitimate grounds for the processing outweigh yours.

Portability

You can receive, in electronic format, the personal data that you have provided to us and those that have been obtained from your contractual relationship with CUPRA, as well as transmit them to another entity.

Withdraw consent

In case you have given us your consent to process your data for any purpose, you also have the right to withdraw such consent at any time.

 

The exercise of these rights is free of charge except in the case of manifestly unfounded or excessive requests. In the event of reasonable doubt as to your identity, you may be asked for additional information necessary for CUPRA to confirm your identity and thus be able to respond to your right.

8. How can you excercise your rights?

You can exercise these rights by submitting a written request to SEAT, S.A.U., [CUPRA Marketing], Autovía A-2 Km. 585, Martorell (Barcelona) or to the e-mail address customercare@cupraofficial.com. The exercise of these rights shall not entail any cost unless the exercise of these rights proves to be unfounded or excessive. In the event that you consider that CUPRA has not processed your personal data in accordance with the applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency (via the website www.aepd.es or the competent supervisory authority.

9. Data Protection Officer

If you have any questions about data protection or wish to contact our data protection officer ("DPO"), you can contact him/her by sending an e-mail to dataprotection@seat.es.

10. Privacy Policy changes

We may update our Privacy Policy from time to time. We encourage you to review the Privacy Policy periodically for any changes. Changes become effective when they are posted on the website.

 

September 2023