Privacy policy

Last updated: 1/06/2026

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation — GDPR), Gertek.sa informs users of the ArinPark application (hereinafter, the Application) about the processing of the personal data they have voluntarily provided during registration, access to and use of the service.

IDENTIFICATION OF DATA CONTROLLERS AND DEFINITION OF ROLES

This clause governs the different roles and responsibilities regarding the processing of your personal data according to the features used in the Application:

  • A) Gertek, S.A. as Data Controller: for all operations relating to user account registration, technical support, maintenance, security of the Application’s technological infrastructure and, where applicable, management of your virtual wallet (wallet).

    • Contact details: Gertek, S.A., with tax identification number (CIF) A95158895 and registered address at Alameda Gregorio de la Revilla, 27 - 2º, 48010 Bilbao (Bizkaia).

    • Data Protection Officer (DPO) contact: dpo@postetxea.eus

  • B) Participating Municipal Councils as Data Controllers: each Municipal Council in whose municipality the User parks in a regulated parking area acts as the sole Data Controller for data relating to the vehicle’s registration number, the geolocation of the parking session, collection of the corresponding municipal fee and monitoring of possible administrative traffic or parking offences.

  • C) Gertek, S.A. as Data Processor: For the parking and inspection data referred to in section B), Gertek, S.A. shall act solely as Data Processor on behalf of and under the strict instructions of each participating Municipal Council, in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

PURPOSES OF DATA PROCESSING AND LEGAL BASES

The data provided by the user shall be processed for the following purposes and on their respective legal bases.

Processing for which Gertek, S.A. is responsible

  1. Management of registration, account maintenance and technical support: processing of identification and contact data to enable access to the platform, handle incidents and ensure the Application functions correctly.

    1. Legal basis: performance of the contractual terms of use of the Application accepted by the User (Article 6.1.b GDPR)

  2. Financial management of the wallet (virtual wallet): processing of the financial data of the credit/debit card provided to top up the balance and pay for the corresponding services.

Legal basis: performance of the contract and pre-contractual steps (Article 6.1.b GDPR).

  1. Sending commercial and promotional communications: sending newsletters or advertising about the Application’s services or products.

Legal basis: the User’s express, freely given and unambiguous consent through an affirmative action of ticking a checkbox (Article 6.1.a GDPR and Article 21.1 LSSI). Processing data to send commercial communications to existing customers shall be based on legitimate interest, provided those communications concern identical or similar products or services.

Processing for which participating Municipal Councils are responsible (carried out through Gertek as Processor):

Management, assessment and monitoring of payment of the regulated parking fee: recording the registration number and precise geographical location to issue the parking authorisation (ticket) and verify correct payment of the local public fee.

Legal basis: Processing is necessary to comply with a legal obligation applicable to the Controller (Article 6.1.c GDPR) and to exercise official authority vested in the Data Controller (Article 6.1.e GDPR), arising from the Local Finances Act and the corresponding Municipal Tax Ordinances.

RECIPIENTS AND DISCLOSURES OF DATA

As a general rule, data shall not be disclosed to third parties not involved in providing the service, unless there is a legal obligation to do so. Nevertheless, the User is informed of the following data flows essential to providing the service:

  • Local Public Authorities (Municipal Councils): data relating to the vehicle’s registration number, parking sector, start/end time and ticket payment status shall be fully accessible to municipal inspection services, regulated parking enforcement officers and the Local Police of each participating Municipal Council to verify the lawfulness of parking and, where applicable, process offence reports.

  • Financial Institutions and Payment Gateways: bank and credit/debit card data provided by the User shall be disclosed directly to the banking institutions involved in the payment process to process the corresponding charges.

  • Technology Support Data Processors: certain technology service providers (such as data hosting providers and electronic communications platforms) may access personal data as data processors. Such access shall take place exclusively under the corresponding data processing agreements, concluded in accordance with current legislation, which ensure that data are processed only under the controller’s instructions and expressly prohibit their use for the providers’ own purposes.

Mandatory nature of data and consequences of not providing them: personal data requested in registration forms and while using the Application are generally mandatory and essential for correctly fulfilling the contractual and legal purposes detailed in this Policy. Therefore, if the User does not provide these data, or provides incorrect, inaccurate or incomplete data, it shall not be possible to register for the service, access or use the Application’s features, or lawfully obtain parking authorisations managed by participating Municipal Councils.

DATA PROCESSING AS A DATA PROCESSOR

In municipalities where the Application enables the management and payment of regulated on-street parking (ORA, OTA or equivalent areas), Gertek S.A. does not act as Data Controller, but solely and exclusively as Data Processor (in accordance with Article 28 GDPR) on behalf of the corresponding public entity (Municipal Council, Provincial Council or municipal concessionary company), which acts as Data Controller.

Regulation of the relationship and safeguards (Article 28 GDPR)

The provision of this technical intermediary service is governed by the administrative terms of technical integration and the corresponding data processing clauses or agreements concluded (or being concluded) with each Municipal Council, which ensure that:

Instructions: ArinPark shall process parking data (registration number, zone, amount, date/time and vehicle geolocation) solely according to the municipality’s technical instructions to validate the ticket’s validity for local parking enforcement officers.

Security: the necessary technical and organisational measures are applied to ensure the confidentiality and integrity of traffic and parking enforcement data, aligned, where applicable, with the National Security Framework (ENS).

Subcontracting: subprocessors necessary for the technological infrastructure operate under agreements that reproduce these same data protection safeguards.

Destination of data: parking ticket data are integrated into municipal systems and shall be retained or erased according to the statutory limitation periods for local public fees/prices.

Exercise of rights

As the Municipal Council is responsible for processing the data relating to the parking fee, if you wish to exercise your rights of access, rectification, erasure or objection regarding issued parking tickets or resulting penalties, we recommend contacting the relevant Municipal Council directly. However, if you submit your request to us, we shall immediately forward it to the Data Controller for resolution.

RETENTION OF PERSONAL DATA

Personal data shall be retained while the User keeps their account active in the Application and does not request their erasure.

Once the User requests cancellation of the service or erasure of their data, Gertek, S.A. and the corresponding Municipal Councils shall strictly block the information in accordance with Article 32 of Organic Law 3/2018 (LOPDGDD). Blocked data shall be restricted and accessible exclusively to Judges and Courts, the Public Prosecutor’s Office or competent Public Authorities (including the Spanish Data Protection Agency and Local Tax Authorities) to address any civil, administrative, tax or criminal liabilities arising from processing, during the following statutory limitation periods:

  • Transaction and municipal fee collection data: shall remain blocked for 4 years, in accordance with the limitation periods established in the General Tax Act or applicable foral tax legislation, depending on where the service was provided.

  • User account contractual data: shall remain blocked for 5 years, in accordance with the general limitation period for personal actions under Article 1964 of the Civil Code.

SECURITY MEASURES AND INFORMATION PROTECTION

Gertek, S.A. shall adopt the technical and organisational security measures necessary to ensure the confidentiality, integrity, availability and resilience of personal data, in accordance with Article 32 of Regulation (EU) 2016/679 (GDPR). Furthermore, insofar as the Application supports the management of local authority fees, the implemented security measures shall align with the standards required by Royal Decree 311/2022 of 3 May, regulating the National Security Framework (ENS).

Gertek, S.A. regularly backs up data integrated into the platform to ensure service continuity in the event of technical incidents. The terms relating to restoration of data following accidental deletion attributable exclusively to the User’s actions shall be governed by the Application’s Terms of Use.

EXERCISE OF RIGHTS

The User may withdraw their consent at any time and exercise, entirely free of charge, their rights of access, rectification, erasure (right to be forgotten), objection, restriction of processing, data portability and not to be subject to automated individual decision-making (including profiling), through the following available channels:

    Email: By sending a written communication to: dpo@postetxea.eus, with “Exercise of Rights” in the subject line.
  • Postal address: Alameda Gregorio de la Revilla, 27 - 2º, 48010, Bilbao (Bizkaia).

If Gertek, S.A. has reasonable doubts about the identity of the natural person making the request, it may require additional necessary information (such as a copy of an official identity document) to confirm their identity.

If the User considers that their rights have not been duly addressed, they may contact our Data Protection Officer at dpo@postetxea.eus This is without prejudice to their right to lodge a complaint with the Spanish Data Protection Agency (AEPD) through its electronic office (www.aepd.es).

ELECTRONIC COMMERCIAL COMMUNICATIONS

In accordance with Article 21 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE), Gertek, S.A. shall not send advertising or promotional communications by email or an equivalent medium that have not previously been requested or expressly authorised by the User through the checkboxes provided during registration.

Notwithstanding the above, if a prior contractual relationship exists, Gertek, S.A. shall be entitled to send commercial communications about the Application’s own products or services similar to those initially contracted by the customer, based on legitimate interest and the exception provided in Article 21.2 of the aforementioned LSSI-CE.

The User may object at any time to the processing of their data for

advertising purposes:

  • By using the automated unsubscribe link (“Unsubscribe”) included at the bottom of each commercial email sent.