This policy explains what personal data Torqua processes as controller, for what purpose, on what basis and for how long. The data that a workshop keeps about ITS customers (records, vehicles, appointments, invoices…) is processed by Torqua on behalf of that workshop: the controller is the workshop, and that data is governed by the Data Processing Agreement. If you are a workshop's customer and want to exercise your rights over that data, contact the workshop; if you write to us, we will pass it on.
1. Controller
- Owner: Roberto Joao Tiron Tiron — Tax ID (NIF) 43945647F
- Registered address: Calle Luis Alberdi 11 8E, 09007, Burgos, Espana
- Privacy email: info@torqua.app
- Data protection officer: there is none. It is not mandatory for Torqua: it is not one of the entities listed in article 34 of Spanish Organic Law 3/2018, nor does it process special categories of data on a large scale (art. 37 GDPR). Any question goes to the privacy email.
2. What data we process, for what purpose and on what basis
| Who | What data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| People who work at a workshop (owner, front desk, mechanics) | Name, email, password (encrypted, never in plain text), photo if uploaded, language, role, second factor if enabled | Giving them access to the panel and to the functions of their role | Performance of the contract with the workshop (6.1.b) and its legitimate interest in its team being able to work (6.1.f) |
| The workshop as Torqua's customer | Company name, tax ID, address, email and plan details | Charging the subscription and issuing invoices | Contract (6.1.b) and legal obligation (6.1.c) |
| The workshop as Torqua's customer | Card or other payment method | Charging | Contract (6.1.b). Card details are received directly by Stripe; Torqua neither sees nor stores them, only the brand, the last four digits and the expiry date |
| People with a portal account (My Torqua) | Email, name, password (encrypted) or Google/Microsoft account, profile photo if uploaded, language | Letting them sign in and see their history with each workshop where they are a customer | Contract (6.1.b): the terms accepted when creating the account |
| Anyone who uses the service | IP address, browser, date and time of sign-ins and of deletion and support actions | Security: detecting unauthorised access, warning of new sign-ins, stopping abuse and reconstructing what happened in an incident | Legitimate interest in the security of the service (6.1.f; recital 49) |
| People who write to Torqua | What they tell us and their email | Replying | Legitimate interest (6.1.f) or, if already a customer, the contract |
| People who use the AI Assistant in the panel | What they ask it and what it answers | So the person can look it up again and the workshop administrator can see what was done with it | Contract with the workshop (6.1.b) and legitimate interest in being able to review what an automated tool did (6.1.f) |
| People who reply STOP to a Torqua WhatsApp message | Their mobile number and when they asked | Not sending them notifications from any workshop again, because the sending number is the same for all | Obligation to respect their objection (6.1.c, art. 21) |
| People who accept these terms or the portal terms | Which version they accepted, when and from which IP address | Being able to prove what was accepted if there is a disagreement | Obligation to demonstrate it (6.1.c, art. 7.1) and legitimate interest in defending ourselves (6.1.f) |
We do not build commercial profiles, we do not sell data and there is no advertising in the product. There are no third-party analytics on the website or in the panel.
No decision with legal effects is taken by automated means (art. 22 GDPR). The panel's AI Assistant only makes proposals, and a person at the workshop confirms them. If a workshop switches on WhatsApp automatic replies, those replies are identified as written by an AI (art. 50 of the European Artificial Intelligence Regulation) and decide nothing about you: for anything that matters, the workshop answers you in person.
3. The portal account and the workshops
The portal account is a single one for all workshops, but each workshop only sees what its customer has with it. Creating the account does not give any workshop access to your data: the link with a workshop is created only when there is a real relationship (you request an appointment, or the workshop already had you as a customer with that same email). The history with one workshop is never mixed with that of another.
Your notifications, workshop by workshop. From each workshop's page in your portal you can give or withdraw permission for it to notify you by WhatsApp and stop receiving the MOT (ITV) and service reminders. Each reminder also includes a link to unsubscribe without signing in. Notifications about your appointments, quotes and invoices cannot be turned off while you have something in progress with that workshop: they are part of the service you have asked it for.
If you reply STOP to a Torqua WhatsApp message, you will stop receiving them from all workshops, because the number is the same. To receive them again, reply in that same chat.
4. How long
| What | How long |
|---|---|
| Panel and portal accounts | While they are active. When deleted, they are erased |
| Data of a workshop that cancels or is deleted | 30-day grace period in case it changes its mind; then it is erased |
| Backups | 30 days; they are encrypted |
| Sign-in, support access and audit logs | 24 months |
| Technical logs | 12 months |
| Notifications already sent | 90 days |
| Conversations with the AI Assistant | 90 days |
| Numbers that asked for STOP on WhatsApp | Until they ask to receive them again |
| Expired single-use links (password recovery, invitations, approvals) | 30 days after expiry |
| Invoices that Torqua issues to the workshop | 6 years (Spanish Commercial Code, art. 30), blocked: only used if requested by the workshop or an authority |
| Record of which terms were accepted | For the duration of the relationship and 6 more years, which is how long a claim can take |
5. Who it is shared with
Only with the providers needed to deliver the service. Almost all of them process data on Torqua's behalf, under a data processing agreement. Stripe, Google and Microsoft are controllers in their own right for their part: Stripe for payment and fraud prevention; Google and Microsoft for signing in with their account, if you choose it.
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database, sign-in and photo storage | EU (Germany) |
| Render | Application server | EU (Frankfurt) |
| Cloudflare | Hosting of the websites, delivery network, bot verification (Turnstile) and encrypted backups | Global network; backups in the EU |
| Stripe | Charging the subscription and balance top-ups | EU (Ireland) / USA |
| Resend | Sending emails | USA |
| GitHub | Encrypted backups | USA |
| Sentry (Functional Software) | Logging application errors so they can be fixed. It receives the error without the person’s data: emails, number plates, phone numbers, ID numbers and IP addresses are struck out before it leaves | EU (Germany) |
| Anthropic | The panel's AI Assistant, draft replies to customers' WhatsApp messages and translation of the workshop's website, only if the workshop has them switched on. It does not train on this data and deletes it within 30 days | USA |
| Meta Platforms (WhatsApp) | WhatsApp notifications to people who have given their permission, and the messages that person writes to that number. It acts as processor, keeps messages for 30 days at most and does not use them for advertising | EU / USA |
| APIVehículo | Vehicle technical data from the number plate; it receives only the number plate, with no name or any other personal data | Spain |
| NHTSA (vPIC, US government) | Decoding a chassis number (VIN) from outside Spain and Portugal; it is a free public service that receives only the VIN, with no other data | USA |
| Google, Microsoft | Signing in with their account, only if the person chooses it | USA |
When a provider processes data outside the European Economic Area, the transfer has its safeguard:
- EU-US Data Privacy Framework (Decision (EU) 2023/1795): Cloudflare, Resend, GitHub, Stripe, Google and Microsoft.
- Standard contractual clauses of the Commission (Decision (EU) 2021/914): Supabase, Render, Anthropic and Sentry.
- Meta's European Region transfer addendum, for WhatsApp.
The database and the application server are in the European Union.
In addition, where the law requires it: to the Spanish Tax Agency (the workshop's invoices are sent to it through VERI*FACTU because it is an obligation of the workshop, not of Torqua), to judges and to authorities.
6. Your rights
You can request access, rectification, erasure, objection, restriction of processing and portability by writing to info@torqua.app. We will reply within the one-month period set by the GDPR, which can be extended by two more months if the request is complex, letting you know. If you are not satisfied, you can lodge a complaint with the authority of your country: in Spain, the Agencia Española de Protección de Datos (www.aepd.es); in Portugal, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
Part of this can be done from the product itself: changing your details and your photo, deleting your portal account from the portal itself, or downloading the workshop's customers and inventory. If you work at a workshop and want to delete your panel account, ask its administrator or write to us.
What can be deleted and what cannot
Almost everything is truly deleted. What is not, and why:
- Invoices and their tax records: the law requires them to be kept (six years in Spain, ten in Portugal). They remain blocked and the right to erasure does not apply to them (art. 17.3.b GDPR).
- What has already left Torqua: an email or a WhatsApp message you have already received, or a record that is already at the Spanish Tax Agency.
- What Stripe keeps about a payment: it is a controller in its own right and has its own obligations.
- Your number, if you asked to unsubscribe (BAJA) from WhatsApp: it is the only thing that prevents us from writing to you again. It is deleted if you ask to subscribe again (ALTA).
- Backups: they are not edited one by one; what has been deleted disappears from them when they expire, within 30 days.
7. Security
Data travels encrypted (TLS) and is stored encrypted at rest. Each workshop is isolated from the others in the database itself, not only in the application. Passwords are not stored in plain text, administration access supports a second factor, and access by the support team to a workshop is logged.
8. Changes
If this policy changes in a way that affects you, we will tell you beforehand by email or in the product.