Privacy Policy

1. Who is the controller responsible for processing your personal data?

INDUSTRIAL CARROCERA ARBUCIENSE, S.A. (hereinafter, “INDCAR”), Tax ID A17227935, with registered office at Polígono Industrial Torres Pujals, 4 – 17401 Arbúcies (Girona – Spain), is the controller responsible for processing the personal data you provide to us through the website https://indcar.es and through your relationship with us as a customer, supplier, job applicant or visitor to our premises.

INDCAR carries out its activity in Spain, France, Italy and Romania through the following group offices and companies:

Unless otherwise indicated for a specific processing activity, INDUSTRIAL CARROCERA ARBUCIENSE, S.A. is the sole controller for data collected through the corporate website indcar.es, regardless of the country from which access is made or the entity the user has contacted. Where a processing activity is managed independently by a subsidiary (for example, local recruitment processes in France, Italy or Romania), specific information will be provided at the time the data is collected.

2. Data Protection Officer (DPO)

INDCAR has appointed an external Data Protection Officer (DPO), in accordance with Article 37 of the GDPR, whose contact details are as follows:

• Entity: FORRELLAT CONSULTORS, S.L.
• Contact address: Carrer González de Soto, 46 – 3rd-1st – 17600 Figueres (Girona)
• Contact email: indcar@forrellatconsultors.cat

You may contact the DPO for any matter relating to the processing of your personal data or to exercise your rights.

The Data Protection Officer (DPO) has been appointed for the entire Group, in accordance with Article 37.2 of Regulation (EU) 2016/679 (GDPR), and performs his/her duties for all companies within the Group. Decisions relating to the purposes and means of the processing of personal data within the Group are made centrally from Spain. The DPO is easily accessible from each of the Group’s establishments. The DPO’s contact details are published in the Legal Notice.

3. For what purposes do we process your personal data?

We process the data you provide to us for the following purposes:

• To deal with your requests for information, quotes or commercial contact.
• To manage contractual relationships with customers, suppliers and collaborators.
• To manage recruitment processes when you submit your application to us.
• To send you commercial communications about our products and services, where you have given your consent or where a prior relationship allows it.
• To manage browsing and the operation of the website (see our Cookies Policy).

The legal basis for this processing is, depending on the case: the performance of a contract or pre-contractual measures (Art. 6.1.b GDPR), the consent of the data subject (Art. 6.1.a GDPR), INDCAR’s legitimate interest (Art. 6.1.f GDPR), or compliance with a legal obligation (Art. 6.1.c GDPR).

4. How long do we keep your data?

Your data will be kept for as long as the relationship or purpose for which it was collected remains in place, and subsequently for the applicable legal limitation periods (generally, up to 6 years for commercial and tax purposes in Spain, without prejudice to the specific periods applicable in France, Italy or Romania where the processing is managed locally). Once these periods have elapsed, the data will be deleted or anonymised.

5. Who will your data be shared with?

Your data may be shared with:

• INDCAR group companies identified in section 1, where necessary for the purpose of the processing (for example, order management, after-sales service or technical support in the relevant country).
• Service providers acting as data processors (for example, web hosting, analytics tools or messaging), with whom INDCAR has entered into the corresponding processing agreement pursuant to Art. 28 GDPR.
• Public authorities or bodies, where there is a legal obligation to do so.

This list should be replaced or supplemented with the actual data processors used (hosting provider, CRM, communications platform, etc.) before publication, indicating whether any of them is established outside the EU.

6. International data transfers

INDCAR’s offices in Spain, France, Italy and Romania are all located within the European Economic Area. The transfer of data between these offices therefore does not constitute an “international transfer” for the purposes of Chapter V of the GDPR and does not require additional safeguards.

Where, for the provision of certain services (for example, technology or web analytics tools), it is necessary to transfer data to a provider located outside the EEA, INDCAR will ensure that such transfer is subject to an appropriate safeguard under the GDPR, such as a European Commission adequacy decision, standard contractual clauses (SCCs) or, in the case of providers established in the United States, their adherence to the EU-U.S. Data Privacy Framework.

7. What are your rights?

Any individual has the right to obtain confirmation as to whether INDCAR is processing personal data concerning them. Data subjects have the right to:

• Access their personal data.
• Request rectification of inaccurate data.
• Request erasure of their data where, among other reasons, it is no longer necessary for the purposes for which it was collected.
• Request restriction of the processing of their data.
• Object to the processing of their data.
• Request the portability of their data.
• Withdraw consent given at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

You may exercise these rights by contacting the Data Protection Officer at dpo.indcar@forrellatconsultors.cat, indicating the right you wish to exercise and attaching a copy of a document proving your identity.

You also have the right to lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place where the alleged infringement occurred: in Spain, the Spanish Data Protection Agency (AEPD); in France, the Commission Nationale de l’Informatique et des Libertés (CNIL); in Italy, the Garante per la protezione dei dati personali; and in Romania, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

8. Links to third parties

The indcar.es website may contain links to other websites. Access to an external site through these links will be subject to that site’s privacy policy, and INDCAR shall bear no responsibility in this regard.

9. Cookies

INDCAR’s website and social media use cookies to optimise and personalise browsing. You can consult details of the cookies used, their purpose and how to manage them in our Cookies Policy (https://indcar.es/en/cookies-policy/).

10. Language

This text has been translated into English from its original Spanish version. In the event of any discrepancy, contradiction or erroneous interpretation between the two versions, the Spanish-language text shall prevail in all cases and constitutes the legally valid version.

11. Amendments to this policy

INDCAR may amend this Privacy Policy to adapt it to legislative or case-law developments, as well as to industry practices. The version in force will always be the one published at indcar.es. Last updated: 13/08/2026.