IBERIA TRACKS / PRIVACY

Privacy Policy

Revision: 20 September 2026

This notice explains how we handle information submitted to the vehicle-sourcing inquiry form. Sending an inquiry does not place an order, authorize a purchase or subscribe you to marketing.

Who handles your information

Iberia Tracks is operated by Almazbek Esenaliev. Privacy contact: esenaliyev@gmail.com

What we receive

• Your name and at least one contact: email, WhatsApp number or Telegram username; preferred contact method and language.
• Destination country, vehicle category, brand/model, year, mileage requirements, budget and the message you choose to submit. An inquiry about a listed vehicle also references that item.
• Consent confirmation, submission time, inquiry reference and a retry identifier that helps prevent duplicate submissions. These identifiers are not advertising profiles.
• Hosting providers may process IP addresses, request times, browser/network information and security logs to deliver and protect the service. Staff authentication uses account and session information.

Please do not include passwords, payment-card details, identity-document copies or sensitive personal information in the free-text message.

Why and on what basis

We use your inquiry to understand your requirements and respond through your chosen contact method. The form asks for your explicit consent for that use. You can withdraw it by contacting us; withdrawal does not change the lawfulness of earlier consent-based processing. We also have a legitimate interest in protecting the service against abuse and keeping necessary security records. Any later transaction, new purpose or separate disclosure needs its own appropriate information and basis.

Providing a name and a usable contact is necessary to respond; without them the form cannot accept an inquiry. We do not sell inquiry data, use it for advertising profiles or make automated purchase decisions about you.

Access, providers and location

Authorized Iberia Tracks staff can access inquiries for their work. Netlify delivers the website and server functions; Supabase provides database, authentication and private image storage services. Their infrastructure and support can involve processing outside your country. Selecting an EU database region does not mean that every provider operation stays in that region.

Provider terms describe their processing and transfer arrangements: Netlify data processing agreement and Supabase data processing agreement. Contact us for information about the arrangements applicable to your inquiry. A sourcing inquiry does not automatically send your details to dealers, carriers or other commercial providers; any necessary sharing must be considered separately with you. If you choose email, WhatsApp or Telegram, that provider also handles the communication under its own terms.

How long we keep information

Our operational retention baseline for inquiries is 24 months after the last meaningful business interaction. Spam, invalid or abusive inquiry records are reviewed for deletion within 30 days where practical. Staff activity records have a 24-month baseline. These are business retention choices, not claims about statutory periods.

Soft-deleted inventory becomes eligible for final removal after 90 days, and orphan image objects after 30 days. Synthetic testing records have a maximum of 30 days after the relevant test stage. Live published images are not treated as orphans. A documented active transaction, dispute or legal obligation may justify a hold; its reason and continued need must be reviewed.

Retention is subject to operational review; we do not claim that an automatic purge is running. Eligible personal data should be deleted or anonymized, with unnecessary copies removed. Hosting/security logs follow provider-controlled retention; incident evidence is kept only while needed. Auth sessions follow the actual authentication and revocation settings. Backup copies follow their separate expiry and recovery controls.

Your choices and requests

Use the contact above to ask about access, correction, deletion, restriction, objection or portability where applicable, or to withdraw consent. We may need proportionate identity verification before disclosing information. You can complain to the relevant data-protection authority, including Spain's AEPD. Do not send credentials with a privacy request.

Cookies, browser storage and security

The public application uses local browser storage to remember your selected language. Inquiry fields and retry state stay in page memory until you send them or leave; optional copy/download saves a copy under your control. No advertising or profiling scripts are included in the reviewed public application. Netlify may add platform access or preview controls; this notice does not certify every provider response as cookie-free.

Staff management uses a necessary authentication cookie, separate from public tracking. Access controls and encrypted connections reduce risk, but cannot guarantee absolute security. Images or information already downloaded by a visitor cannot be recalled. We will update this notice when the service's processing changes.