Last drafted: 18 October 2026
1. Why this document exists
When using Rechnia, the company contracting the service (hereinafter, «the customer») enters personal data of third parties: its own staff —including identity documents, contracts, payslips, clocking records and absence certificates—, job applicants, contact persons of its suppliers and buyers, and private individuals acting as sellers or buyers in a sale.
With regard to that data, the customer is the controller and Pol Munné Martínez, a natural person trading as a self-employed individual (autónomo), with tax ID 48244334V and registered address at Vilafranca del Penedès (Barcelona), 08720, e-mail rechnia@rechnia.com, who provides the Rechnia service (hereinafter, «the provider»), is the processor: the provider processes the data on the customer's behalf and following the customer's instructions, not for the provider's own purposes. Their full identification details appear on the invoices they issue and are provided to anyone who requests them at rechnia@rechnia.com. This document sets out the conditions of that processing, in accordance with article 28 of Regulation (EU) 2016/679.
It forms part of the service contract and is accepted together with the terms and conditions.
2. Subject matter, duration and nature of the processing
Subject matter: the provision of the Rechnia service described in the terms and conditions.
Duration: for as long as the subscription is in force, plus the thirty (30) days of data recovery following termination.
Operations: collection, recording, organisation, storage, consultation, alteration, erasure, export and making available to the customer itself; and, when the customer uses the corresponding features, disclosure to the external services indicated in section 4.
Categories of data subjects: the customer's staff, job applicants, contact persons of its suppliers, carriers and buyers, and private individuals involved in sale transactions or interested in a vehicle.
Categories of data: identification and contact details, professional and payroll data, working hours (clocking records), identity documents, contracts, CVs and application data, absence and expense certificates, profile photos, postal addresses, registration plates and vehicle identification numbers, financial data of transactions and each person's monthly use of allowance-based queries.
Health data: the application allows staff sick leave to be recorded, with a free-text reason and an attached certificate. This is special category data under article 9 of the GDPR. The customer processes it as an employer to comply with its obligations under employment and social security law, to the extent authorised by Spanish law (art. 9(2)(b) GDPR, in connection with the obligations imposed on employers by employment and social security legislation), and undertakes not to record the diagnosis or any clinical information beyond what appears in the certificate the company receives. The application limits who sees it: the type of absence, the reason and the certificate are seen only by the administrator and the person concerned; the rest of the staff see only who is absent and on which dates, because this is needed to organise work. No other special category of data is expected to be processed, and the customer undertakes not to enter such data in fields not intended for it.
3. Obligations of the provider as processor
To process the data only on the customer's documented instructions, including with regard to international transfers, unless required by law.
Not to use the data for its own purposes, not to disclose it to third parties other than authorised sub-processors and the external services the customer authorises in section 4, and not to use it to train artificial intelligence systems.
To ensure that the persons authorised to process it have committed themselves to confidentiality.
To apply appropriate technical and organisational measures, including: access only with an identified account and a password meeting minimum requirements; a single open session per account, with expiry on inactivity and an absolute expiry; temporary blocking after failed attempts; strict separation of data between customer companies, verified by automated tests; passwords stored irreversibly; documents stored under random names and served only to those entitled; encrypted communications; and a daily backup of the database and of the uploaded files, of which the seven most recent are kept.
To assist the customer, taking into account the nature of the processing and the information available to it, in handling requests to exercise rights that it receives and in complying with its obligations regarding security, notification and communication of personal data breaches, data protection impact assessments and prior consultation of the supervisory authority (articles 32 to 36 of the GDPR).
To notify the customer without undue delay of any data security breach it becomes aware of, with the information available so that the customer can comply with its own obligations.
To make available to the customer the information necessary to demonstrate compliance with these obligations.
At the end of the processing, and at the customer's choice, to return its data —which it can obtain through the application's exports and the Settings › Account download while it retains access and, in the thirty (30) calendar days following termination, also through a complete copy including uploaded documents, on request— and to delete it together with any existing copies —backups disappear as they are renewed, within seven days at most—, except for data that must be kept by legal obligation.
To inform the customer immediately if, in its opinion, an instruction from the customer infringes data protection law.
4. Sub-processors and external services
The customer gives general authorisation for the involvement of the sub-processors necessary to provide the service. There are four: the hosting provider, Render Services, Inc. (a United States company; servers in Frankfurt, European Union), which hosts the application, the database, uploaded files and backups; the network and security provider, Cloudflare, Inc. (United States), which acts through the hosting provider and whose network carries all traffic between the browser and the application, including forms and uploaded documents, which it processes in transit to protect and deliver the service, and which, from 28 October 2026, also keeps, contracted directly by the provider, a daily copy of the database in its R2 storage service, in a bucket located in the European Union jurisdiction, where each copy is kept for seven (7) days; the built-in help provider, Mistral AI (France), which receives only what the person types in the question field and the previous turns of that conversation; and the provider's e-mail provider, Zoho Corporation B.V. (Netherlands, European Union), which receives and stores the correspondence that the customer and the people with access accounts maintain with the provider, including the e-mail copy of the messages they send from the application's support section, and through which the application sends the e-mails it sends by itself to those people (the link to reset a forgotten password, the link to confirm a change of an account's e-mail address and the notice of that change to the previous address, the invitation link to complete registration, the welcome e-mail, the e-mail confirming that the plan is active, the notice of changes to these legal texts, the advance notice of the renewal of an annual subscription, the notices of the cancellation of the subscription and of its resumption, the notice of the early withdrawal of the promotional first month and the notice that the provider has replied to a support message, without the reply). The international transfers each of them involves, and their safeguards, are those indicated in section 7 of the privacy policy.
In addition, when certain screens are used, the application communicates postal addresses and coordinates to third parties that are not sub-processors and do not access the stored data: to Google LLC (Google Routes and Google Geocoding), which processes them under its own terms. These communications occur when a project is opened —to estimate the transport of each candidate vehicle— and when an address is placed on a screen with a map, also while it is being typed in the form, and the addresses are those the customer itself has entered to locate a vehicle or calculate a route; the customer expressly authorises them by accepting this agreement, as a documented instruction. So as not to repeat paid queries, the distance returned by Google is stored with the two addresses in a table shared by all customers, with no reference to the company or the vehicle, which only the server reads to reuse a distance already calculated; each entry is deleted twelve (12) months after it was calculated. Vincario is sent only the vehicle identification number and, for the market value, the vehicle's mileage, when a person presses the button to request the valuation or the history. Apart from those addresses, that VIN and that mileage, the application sends none of them any staff or contact data.
Screens with a map load the frame from Google Maps in the browser of the person opening them, so that the map provider receives the coordinates of the point and that browser's IP address and may set its own cookies; the customer authorises this by accepting this agreement and is responsible for informing its staff of it.
The provider will give notice of any planned change of sub-processors or external services sufficiently in advance for the customer to object. If the customer objects on reasonable grounds, either party may terminate the contract without penalty.
The provider will impose on each sub-processor, by contract, obligations equivalent to those in this document, and will be liable to the customer for their compliance.
5. Obligations of the customer as controller
To have a valid legal basis for the processing it carries out through the application, and to inform data subjects —its staff, applicants and contacts— in accordance with the law.
To enter only the data necessary for the intended purpose, and in particular not to upload documents containing more personal information than required.
To manage its staff's access accounts diligently, assigning the administrator role only to those who need to see invoicing, accounting and staff data, and removing accounts that are no longer needed.
To bring the provider's privacy policy, which explains how the data of their access accounts is processed, to the attention of the people to whom it gives access to the application.
Not to send the provider personal data about its staff or contacts by e-mail: that channel is not part of this processing, and support concerning that data is provided within the application.
To communicate to the provider the instructions it wishes to give and any relevant change to them.
6. Audit
The customer may request, with reasonable notice and without interfering with the provision of the service or with the confidentiality of other customers, the information necessary to verify compliance with this agreement, and carry out, itself or through an authorised auditor, the audits and inspections permitted by law.
Prevailing version
This document is an English translation of the original Spanish text, which is the one accepted and the one with contractual effect. In the event of any discrepancy between the two versions, the Spanish version prevails.