Privacy policy
Last updated: 10 September 2026
This policy explains what personal data we collect through beniautospremium.es, what we use it for, on what legal basis, how long we keep it and what you can do about it. It is written to be understood; if anything is unclear, write to us and we will explain it.
Who the controller is
- Controller: Albir Exotic Cars, S.L.
- Tax number (NIF): B02767176
- Registered office: Avda. de l'Albir, 106 · 03580 l'Alfàs del Pi · Alicante
- Telephone: +34 603 30 17 51
- Contact address, also for exercising your rights: cristianbeniautos@gmail.com
- Data Protection Officer: Not required in this case; none has been appointed.
What we process, why, and on what legal basis
We only process the data you give us voluntarily through the forms on this site. We do not buy databases, we do not track your browsing and we do not build profiles.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering your enquiry about a vehicle and arranging a test drive | Name, telephone, email (optional), your message and the vehicle reference | Steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR) | 3 years from the last contact |
| Valuing the vehicle you want to trade in | The above plus make, model, year and mileage of the car to be valued | Pre-contractual steps at your request (art. 6(1)(b) GDPR) | 3 years from the last contact |
| Answering a general enquiry | Name, telephone, email (optional) and message | Pre-contractual steps at your request (art. 6(1)(b) GDPR) | 3 years from the last contact |
| Evidencing that you were informed when submitting the form, and preventing automated submissions | Date and time, IP address, browser and the page the form was sent from | Legitimate interest in the security of the service and in being able to prove the origin of a request (art. 6(1)(f) GDPR) | 12 months |
| Answering you in the site assistant (the chat you type into) | The messages you type, the language, the date, the IP address and the page you opened the chat from | Legitimate interest in helping whoever asks and in detecting abuse of the service (art. 6(1)(f) GDPR) | 12 months |
| Knowing what is looked up in the frequent questions bot | Which buttons are pressed, the language and the page. There is no free text and the IP address is not stored | Legitimate interest in improving the information on the site (art. 6(1)(f) GDPR) | 12 months |
| Measuring the site audience | Pages viewed, approximate location, device type and a random browser identifier. Google truncates the IP address and it is not stored in full | Your consent, given in the cookie banner and withdrawable at any time (art. 6.1.a GDPR) | 14 months |
| Recording your cookie choice | A random identifier that does not identify you, the categories accepted, the policy version, the browser and the IP address stored as an irreversible cryptographic digest | Legal duty to be able to demonstrate consent (art. 7(1) GDPR and art. 22.2 LSSI) | 24 months |
Why we do not ask for your consent to answer you
Because it is not needed and it would mislead you. When you fill in a form asking about a car or asking us to value yours, you are asking us for a step prior to a possible contract. The Regulation covers that expressly as "steps taken at the request of the data subject prior to entering into a contract". If consent were the basis, withdrawing it would force us to delete your request and stop dealing with you — the opposite of what you asked for.
The box you tick before sending confirms that you have read this information; it does not authorise us to do anything. And you can ask us to stop processing your data and to delete it whenever you want.
The site assistant
The site has two bots. The frequent questions one is a list of buttons with answers written by us: nothing is typed into it and it processes no personal data, it only counts what is looked up. The assistant is a chat: what you type is sent to a language model that drafts the reply, and the conversation is stored so we can review it and improve the service.
The first thing you read when you open the assistant is that you are talking to an artificial intelligence system and not to a person. That is not politeness: it is required by Article 50 of Regulation (EU) 2024/1689 on artificial intelligence, applicable since 2 August 2026. You will see it in the panel title, in the first message and under the text box.
The frequent questions bot is not an artificial intelligence system: it is a list of buttons with answers written by the dealership, and it says so when you open it.
The assistant is set up not to ask you for personal details and to point you to the phone, WhatsApp or the form when you need a person. Even so, what you type is up to you: we recommend not putting anything unnecessary in there, and the chat itself says so before you start typing.
The conversation is not used to train any model, neither by us nor by the provider. If you want a particular conversation deleted, write to us and we will remove it.
What we ask for and what we do not
Only your name and telephone number are required: without them we cannot call you back. Email and message are optional. We do not ask for ID numbers, postal addresses, bank details or any special category data. If you send us information we do not need, we will delete it.
Who we share your data with
Nobody. We do not transfer or sell your data to third parties, except where required by law or by a competent authority.
One provider does process data on our behalf, as a processor and under a written contract:
- Dinahosting, S.L. (Spain) — website hosting, database and outgoing email. Data stays within the European Union.
- Google Ireland Ltd. (Ireland) — audience measurement with Google Analytics, only if you accept analytics cookies. If you decline, this provider receives nothing at all.
- Anthropic PBC (United States) — the language model that drafts the assistant's replies. It receives only the messages of the conversation, and only if you open the assistant and type into it. It does not receive your name, telephone number or email, because the assistant does not ask for them.
International transfers
The ones there are depend entirely on you, because both involve services from Google Ireland Ltd., which processes data in the United States under the EU-US Data Privacy Framework:
- Google Analytics, if you accept analytics cookies in the banner. If you decline or simply do not accept, nothing is sent.
- The YouTube player, if you choose to load the video on a vehicle listing. It does not load by itself: until you press the button, your browser never contacts Google.
There is a third one, with Anthropic PBC (United States), which only happens if you open the assistant and write to it: their servers process your message to draft the reply. The transfer relies on the standard contractual clauses approved by the European Commission, incorporated into the processing agreement. If you do not use the assistant, this provider receives nothing.
Details are in the cookie policy.
How long we keep your data
The periods are in the table above. Once they expire, the data is deleted automatically. If a claim or proceeding had been started in the meantime, the data would be kept for as long as it lasts and until any resulting liability lapses.
Your rights
You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent where consent is the basis, without affecting processing carried out before the withdrawal.
To exercise them, simply write to cristianbeniautos@gmail.com stating which right you wish to exercise. You do not need to send a copy of your ID: we will only ask you to prove your identity if we have reasonable doubts that you are who you say you are.
We will reply within one month of receiving your request. If the matter is complex, that period may be extended by two further months, and we will tell you within the first month and explain why.
If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid (www.aepd.es). Before that, feel free to write to us: we can probably sort it out.
Automated decisions and profiling
There are none. No decision affecting you is taken automatically, we do not build profiles and we do not cross-reference your data with external sources. The finance calculator runs entirely in your browser and sends us nothing.
Nor is the site assistant one: it drafts replies about our stock, it decides nothing about you. It does not assess your creditworthiness, it does not approve or refuse finance — the lender does that, with a person behind it — and it builds no profile of you. If it tells you something that does not match the car listing, the listing is what counts, and you can ask us to have a person confirm it.
Security
The site is served entirely over HTTPS with a valid certificate. Management panel passwords are stored using one-way cryptographic functions, access to the data is limited to staff who need it, and the site applies security headers that prevent unauthorised third-party resources from loading.
Forms are protected against automated submissions by our own means — a hidden trap, a timing check and a session token — without resorting to third-party services such as "I am not a robot" systems, which would require sending your activity to another company.
Changes to this policy
If anything relevant changes — a new purpose, a new provider, a different retention period — we will update this page and change the date above. If the change affects you significantly and we have your email address, we will let you know.