Privacy Policy

Identity and contact data: name, email, phone number, preferred contact method, pickup and delivery addresses, and handoff recipient details.

Order and device data: order reference, device type, brand, model, reported fault, visible condition, accessories, diagnosis, quotation, authorization, repair notes, parts, quality checks, warranty information, device photos, and customer-safe communications.

Transaction and evidence data: invoice and payment status, agreement versions, acceptance timestamps, signatures or handoff evidence, relevant IP address and user-agent evidence, and complaint or cancellation records.

Security and service data: rate-limit events, audit logs, delivery status for transactional emails, and scoped tracking-link activity. Clickpas does not create customer login accounts.

Pre-contract and contract performance (GDPR Article 6(1)(b)): receive and assess a request, arrange collection, diagnose, prepare and manage a quotation, perform authorized repairs, take payment, deliver the device, provide tracking, and handle warranty support.

Legal obligations (Article 6(1)(c)): issue and retain invoices and repair documents, maintain consumer guarantees, respond to lawful authorities, and provide complaint procedures.

Legitimate interests (Article 6(1)(f)): protect the platform and devices, prevent duplicate or abusive requests, maintain audit evidence, improve operational reliability, and establish, exercise, or defend legal claims. Clickpas balances these interests against customer rights.

Consent (Article 6(1)(a)) is used only where a genuinely optional activity requires it. The booking privacy checkbox records that the notice was read; it is not consent to marketing.

Authorized Clickpas owner, admin, support, technician, and courier users receive only the data needed for their role and active assignment.

Service providers may process data on Clickpas instructions for hosting and application infrastructure, database and file storage, transactional email, maps or address support, payment processing when enabled, security, and professional support. Current technical providers include Vercel, Supabase, and Resend.

Data may also be disclosed where legally required, to protect a device or person, or for professional legal, accounting, insurance, or claims support. Clickpas does not sell personal data.

Some providers may process data outside the European Economic Area. Where an adequacy decision does not apply, Clickpas relies on an appropriate GDPR safeguard such as the European Commission’s Standard Contractual Clauses and evaluates supplementary protections offered by the provider.

Open repair and handoff information is kept while the service, payment, warranty, complaint, or dispute is active. Core contracts, acceptance evidence, invoices, and accounting records are normally retained for six years where Spanish commercial or claims requirements justify that period.

Complaint records include the source, facts, requested resolution, assignment, evidence timeline, reasoned response, and mediation or arbitration position. They are retained only for the active handling period and the applicable consumer-law or legal-claims limitation period, then deleted or minimized unless a legal hold applies.

Unsuccessful enquiries and duplicate-request evidence are removed or anonymized when no longer necessary, normally within 12 months. Short-lived abuse-prevention events expire according to their configured security window.

Device photos, detailed diagnostic evidence, email delivery logs, and staff audit entries are reviewed under the same necessity principle and deleted or minimized when they are no longer needed for the service, warranty, security, or legal claims. Legal holds may extend a relevant record.

Customers track repairs with the order reference plus the normalized booking email, or a scoped link already issued for that order. Keep these details private. Staff access requires Supabase authentication and role-based authorization.

Clickpas uses access controls, row-level database policies, scoped storage, audit events, input validation, rate limiting, and server-only privileged credentials. No online service can promise absolute security; suspected incidents are assessed and notified where law requires.

You may request access, rectification, erasure, restriction, portability, or objection where the GDPR conditions apply. You may withdraw a consent at any time without affecting processing already lawful before withdrawal. You may also ask about a decision that appears automated; Clickpas does not use solely automated decisions with legal or similarly significant effects in the V1 repair workflow.

Send a request to the privacy contact below and identify the relevant order where possible. Clickpas may request proportionate proof of identity and normally responds within one month. You may complain to the Agencia Española de Protección de Datos at aepd.es.

The current public experience does not use optional analytics or advertising cookies. Strictly necessary storage may be used for security and core functionality. If optional tracking is introduced, Clickpas will add an appropriate consent mechanism before enabling it.

Material policy changes receive a new version date. The version acknowledged at booking remains attached to the order evidence.