Privacy Policy

INTRODUCTION

In accordance with the General Data Protection Regulation (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), we present this Privacy Policy in order to inform you clearly and transparently about the collection and processing of your personal data through the Website www.joinup.es, the APP and any other established contact channel.

DATA CONTROLLER

JOINUP GREEN INTELLIGENCE S.L. (hereinafter, “JOINUP”);
Registered address: C/Núñez de Balboa 120, 28006 Madrid
Data Protection Officer email address: privacy@joinup.es

SCOPE OF THE POLICY

By accessing and using this website, making use of our services or using any other means involving the processing of personal data, you accept this Privacy Policy, together with the provisions set out in the Legal Notice and the Cookies Policy.

At JOINUP, we provide information so that, before entering your personal data, you can access the Privacy Policy and any other relevant information on Data Protection.

WHAT WE USE YOUR DATA FOR

JOINUP processes your personal data (first name, surname, email address, telephone number, identification and banking details, and any other information necessary for the management and provision of the services) through any available contact channel (including the website, the APP, the telephone switchboard and any other means enabled by JOINUP) for the following purposes:

CONTRACTUAL: (i) Managing the contracting of services, the corresponding billing and delivery; (ii) Managing your registration as a user; (iii) Coordinating journeys, transfers and events (including driver bookings, vehicle registration numbers, car parks and associated logistics); and (iv) Managing employment and professional relationships: recruitment, payroll preparation, employee benefits, internal training and communication with employees.
CONSENT: (i) Carrying out marketing activities and sending commercial communications by any means, including electronic means; (ii) Responding to enquiries, comments, incidents or suggestions through the available channels; (iii) Receiving automatic notifications about new recruitment processes opened by JOINUP, subject to the user’s prior acceptance; and (v) Using the geolocation data (GPS) from the User’s device, subject to prior authorisation, to enable the provision of the services requested through the mobile application or the website, including the allocation of vehicles, the location of car parks or charging points, the vehicle registration number for managing access to car parks, and the transmission of that information to the Providers involved solely for the proper performance of the service.
LEGITIMATE INTEREST: (i) Sending service recommendations based on previous purchases; (ii) Responding to enquiries and managing incidents through the various channels (including the switchboard); (iii) Recording calls to the switchboard to ensure service quality and security; (iv) Preventing, investigating and detecting possible fraud or misuse of our services; (v) Ensuring the proper use of the website, the APP and the other channels, preventing unlawful use or use contrary to the regulations in force; and (vi) Managing suggestions, complaints and enquiries concerning the products and/or services purchased.
LEGAL OBLIGATION: (i) Complying with statutory obligations and verifying compliance with contractual obligations, including the prevention of fraud and money laundering; and (ii) Responding to requests from competent authorities and public bodies.

HOW LONG WE PROCESS YOUR DATA

The retention period for personal data will vary depending on the service contracted and the legal obligations applicable in each case.

In general, we will retain your data for the duration of the contractual or commercial relationship with JOINUP. Once that relationship has ended, the data will remain blocked for the limitation periods applicable to any potential liabilities arising from the processing and/or for the legally required periods, and will be made available only to the competent authorities.

By way of example and without limitation, the main retention periods are as follows:

Contact details and commercial communications (Newsletter): until consent is withdrawn.
Job applicants: 1 year from receipt of the CV or completion of the recruitment process.
Personal obligations without a specific limitation period: 5 years (Article 1964.2 of the Civil Code).
Books, correspondence, documentation and accounting/commercial supporting documents: 6 years (Article 30 of the Commercial Code).
Tax obligations: 4 years (Articles 66 to 70 of Law 58/2003, the General Tax Law).
Social security obligations: 4 years.
Employment documentation (actions arising from the employment contract): 1 year (Article 59 of Royal Legislative Decree 2/2015, the Workers’ Statute).
Health data relating to Occupational Risk Prevention: 4 years (Article 22 of Law 31/1995 on Occupational Risk Prevention).
Data protection obligations: 3 years (Article 78 LOPDGDD).
Video surveillance: 30 days.
Prevention of money laundering: 10 years.
Health documentation relating to persons with reduced mobility (adaptation of services): 5 years.

HOW YOU CAN EXERCISE YOUR RIGHTS

As the holder of the rights relating to your personal information, you have control over that data. In this way, we also ensure that the information we process is accurate and truthful.

The rights you may exercise are those recognised under the legislation in force, including:

Right of Access: you may enquire whether we are processing personal data concerning JOINUP.
Right to Rectification and Erasure: you may access your personal information and request that your data be rectified or erased where it is inaccurate or you consider that it is no longer necessary for the purposes for which it was collected.
Right to Object: you may object to the processing of your data, unless, for compelling legitimate grounds or for the establishment, exercise or defence of potential legal claims, we keep it duly blocked for the relevant periods for as long as the legal obligations remain in force.
Right to Restriction of Processing: you may request that the processing of your personal information be restricted while a challenge to the accuracy or lawfulness of your data is being verified and during the establishment, exercise or defence of potential legal claims or disputes.
Right to Data Portability: you may request the portability of the data you have provided to us to another data controller in certain circumstances.

You may exercise your rights free of charge.

Those rights may be exercised in several ways:

By sending a written communication to the postal address of the Data Controller.
By sending an email to privacy@joinup.es.

HOW CAN I LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY?

If you consider that there is a problem with the way in which JOINUP is handling your data, you may submit your complaints either to the address Paseo de la Castellana 194, 28046 Madrid, as stated in the heading, or to the relevant data protection supervisory authority. In Spain, the competent authority is the Spanish Data Protection Agency, through its website: www.aepd.es.

WILL MY DATA BE DISCLOSED TO OTHER RECIPIENTS?

We guarantee that your data will only be transferred to:

Competent public bodies, the Spanish Tax Agency, State Law Enforcement Agencies, Judges and Courts, where JOINUP is legally obliged to provide it.
Financial institutions in the event that the services provided are financed.
Third parties necessary for the provision of the contracted service: service providers, call centre, subcontracted professionals, etc.
For the proper provision of the services, JOINUP will transmit the strictly necessary personal data to the Providers involved (taxi drivers, car park operators and electric vehicle charging operators). Those Providers act as independent controllers or joint controllers in relation to the service provided.

Under no circumstances will your personal data be shared with third-party companies without complying with the statutory requirements.

We engage providers that may have access to your data and that will process such data in the name and on behalf of JOINUP GREEN INTELLIGENCE S.L. The selection of providers will follow an exhaustive compliance verification process in order to ensure appropriate control in matters of data protection. In addition, a contract will be entered into in accordance with Article 28 of the General Data Protection Regulation, under which those providers undertake to implement appropriate technical and organisational measures and to process personal data solely in accordance with the documented instructions of the joint controllers.

If any of the processors is located outside the European Economic Area, the joint controllers will enter into the Standard Contractual Clauses with them, which will provide appropriate safeguards and protect at all times any access that those third parties may have to your data.

SECURITY

At JOINUP, we maintain the highest levels of security required by law to protect your personal data against accidental loss and unauthorised access, processing or disclosure, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed. When we receive your data, we use stringent procedures and security features to prevent any unauthorised access.

The actions described in this section and intended to ensure a level of security appropriate to the risk identified will include, where necessary, the following measures:

Pseudonymisation and encryption of personal data.
Measures capable of ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services.
Measures capable of restoring the availability of and access to personal data promptly in the event of a physical or technical incident.
A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.
Regular assessment of the risk of accidental or unlawful destruction, loss or alteration of personal data transmitted, stored or otherwise processed, or unauthorised disclosure of or access to such data.
Measures to ensure that any person acting under the authority of JOINUP who has access to personal data may process such data only on instructions from JOINUP.

CONFIDENTIALITY

Any personal data that may be collected will be treated as strictly confidential. We undertake to maintain secrecy in respect of it and guarantee the duty to safeguard it by adopting all necessary measures to prevent its alteration, loss, unauthorised processing or access, in accordance with the applicable legislation.

ACCEPTANCE AND CONSENT

The user declares that they have been informed of the conditions regarding the protection of personal data and accepts and consents to the processing thereof by JOINUP in the manner and for the purposes indicated in this Privacy Policy.

CHANGES TO THE PRIVACY POLICY

JOINUP reserves the right to amend this policy in order to adapt it to legislative or case-law developments, as well as to other industry practices. In such cases, JOINUP will announce the changes made on this page reasonably in advance of their implementation.

This version of the Privacy Policy corresponds to an update that was published and entered into force in September 2025. You may contact JOINUP through the established contact channels with any related enquiries.

Last reviewed in September 2025