This English version is provided for convenience only. The Spanish version prevails in the event of any discrepancy.
1. Data controller
Company name: LINFOCA Profesionales Informáticos S.L.
Tax ID (CIF): B91428698
Registered address: P.I. El Muro, C/Las Ciencias, Nave 14, 41720 Los Palacios y Villafranca, Seville, Spain
Email: sales@optimaxpro.com
2. Data we process and purposes
LINFOCA Profesionales Informáticos S.L. processes the personal data you provide through the forms on the website and on the OptimaxPRO platform for the following purposes:
| Processing activity | Data processed | Legal basis | Retention period |
|---|---|---|---|
| Demo / free trial request | Company name, tax ID (NIF/CIF), name of the company's manager, phone number, email address, province and, as proof of consent, the date and the IP address from which the form was sent | Steps taken prior to entering into a contract (Art. 6(1)(b) GDPR) | Up to 2 years from the last interaction if no contract is signed |
| Provision of the OptimaxPRO service | Customer company data, registered users, data entered into the platform (customers, vehicles, work orders, etc.) | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the contract + 6 years for tax obligations |
| Commercial communications | Name, email address | Legitimate interest or consent (Art. 6(1)(a) and 6(1)(f) GDPR) | Until you withdraw your consent or object |
| Customer service and support | Name, email address, information provided in the request | Legitimate interest (Art. 6(1)(f) GDPR) | 3 years from the resolution of the incident |
3. Recipients
Your data will not be disclosed to third parties unless required by law. LINFOCA Profesionales Informáticos S.L. uses technology service providers (data processors) to host the platform, to provide the artificial intelligence features and to send communications. These providers process the data solely on our instructions and under data processing agreements that comply with the GDPR.
The data of the OptimaxPRO platform is hosted on Supabase, with servers in the European Union (Paris, France).
The artificial intelligence features of OptimaxPRO —damage estimation from photographs, importing assessment reports and reading purchase invoices and delivery notes— use the models of Anthropic, PBC (United States) as data processor. It only receives the photographs and documents that the user sends to be estimated or read, solely to return the result, and does not use them to train its models. The international data transfer is covered by the standard contractual clauses approved by the European Commission (Article 46 of the GDPR).
4. Connecting the workshop's email account (Google and Microsoft)
From Settings › Messages, a workshop can connect its own Gmail or Google Workspace account, or its Outlook or Microsoft 365 account, so that notices to its customers (vehicle ready, estimate, invoice, MOT reminder) are sent from its own address and appear in its Sent folder. Connecting is optional: without it, OptimaxPRO works the same and the message opens in the computer's email program.
Google: openid, email and https://www.googleapis.com/auth/gmail.send. Microsoft: openid, email, offline_access, User.Read and Mail.Send.
We use them only to know the address of the connected account and to send the message that a workshop user has written and confirmed on screen. OptimaxPRO does not read, list, search, modify or delete the account's email, and does not access its contacts, calendar or files.
- What we store: the connected email address, the provider, the dates of connection, disconnection and last sending, the reason for a failed sending and the authorization refresh token, encrypted with AES-256-GCM. We do not store passwords or copies of the account's messages.
- Where and how it is protected: in the platform database (Supabase, European Union), accessible only to the workshop that owns the account. All traffic travels over HTTPS/TLS. The refresh token is encrypted with a key that exists only on our servers, is used only to send the messages the workshop confirms and is never shown to anyone, not even to the workshop.
- Who it is shared with: nobody. Data obtained from Google or Microsoft is not sold, not transferred to third parties, not used for advertising or to train artificial intelligence models (it is only stored by the hosting providers that process it on our behalf, under a data processing agreement), and no person at LINFOCA reads it unless the workshop expressly asks us to in order to resolve an incident, or the law requires it.
- How long we keep it: the refresh token, only while the account is connected: disconnecting deletes it at once and revokes it with Google. The connected address and the dates stay in the workshop's history, so it can see which account sent each notice, for the period set out in section 2 for the provision of the service. When a workshop ends its contract, we disconnect its account (deleting and revoking the token) within 30 days.
- How to revoke it: with the "Disconnect" button in Settings › Messages, which deletes the token and revokes it with Google, or from the account itself (myaccount.google.com/permissions or account.live.com/consent/Manage). If the workshop leaves OptimaxPRO, it can ask us to delete this data by writing to sales@optimaxpro.com.
OptimaxPRO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Rights of data subjects
Under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD), you have the right to:
Know which personal data we process about you.
Request the correction of inaccurate or incomplete data.
Request the deletion of your data when it is no longer needed.
Request that the processing of your data be restricted in certain circumstances.
Receive your data in a structured, commonly used format.
Object to processing based on legitimate interest or for direct marketing purposes.
To exercise any of these rights, send an email to sales@optimaxpro.com stating the right you wish to exercise and attaching a copy of your identity document. We will reply within one month at the latest.
If you believe that the processing of your data infringes the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
6. Data security
LINFOCA Profesionales Informáticos S.L. applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of data in transit (HTTPS/TLS), role-based access control, regular backups and access monitoring.
OptimaxPRO is designed as a multi-tenant SaaS platform with data isolated per customer (tenant). No customer has access to another customer's data.
7. Children's data
OptimaxPRO's services are intended for businesses and professionals. We do not knowingly process data of children under 14. If you become aware that a child has provided data without parental consent, please let us know at sales@optimaxpro.com.
8. Changes to this policy
We reserve the right to update this Privacy Policy at any time to reflect changes in the law or in our services. We will notify you of any significant change by email to your registered address or through a notice on the platform.