HiperService de Arcos, S.L. ("HiperService") is committed to protecting the personal data of the customers, candidates, end-users, technicians, partners and website visitors with whom we interact. This Privacy Policy explains how we collect, use, share and safeguard personal data, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and, where applicable, Portuguese Law 58/2019.
1. Data controller
2. Scope
This policy applies to all personal data processed by HiperService in the context of our commercial relationships, service operations, customer support, recruitment activities, marketing communications, and use of our website and digital channels. Where HiperService acts as a processor on behalf of a manufacturer, retailer or brand (for example, when handling after-sales tickets, scheduling installations or issuing service notifications), the privacy notice of that controller shall prevail and we will process the data strictly under their documented instructions and a Data Processing Agreement (DPA).
3. Categories of data we process
- Identification and contact data: name, surname, NIF/NIE, postal address, email, phone number.
- Service data: product, serial number, warranty status, incident description, photos, technician notes, signatures, time stamps and geolocation of the service intervention.
- Communications data: SMS, RCS, WhatsApp and email exchanges, call recordings (where lawful and notified), chat transcripts.
- Commercial data: orders, invoices, payment status (we do not store full card numbers).
- Technical data: IP address, device, browser, log files, cookies and similar identifiers.
- HR data: CV, references and qualifications (recruitment only).
4. Purposes and legal bases
5. SMS, RCS and messaging program
Where HiperService (or its messaging partners acting as processors) sends transactional or operational messages over SMS, RCS, WhatsApp Business or email — such as appointment confirmations, technician en-route notifications, repair status updates and satisfaction surveys — the legal basis is the performance of the underlying service contract or the legitimate interest in delivering high-quality after-sales operations.
Promotional or marketing messages are only sent where the recipient has provided prior, free, specific, informed and unambiguous consent, in accordance with Art. 21 of the Spanish LSSI-CE and Art. 13-A of Portuguese Law 41/2004. Each message includes a free opt-out mechanism (typically reply STOP or BAJA). Opt-out requests are honoured within 24 hours.
6. Retention periods
- Service and warranty records: duration of the contract plus 6 years (Spanish Commercial Code) / 10 years (Portuguese Commercial Code).
- Invoicing and tax records: 4–10 years depending on jurisdiction.
- Marketing data: until the user withdraws consent, plus a blocking period for legal defence.
- Call recordings: 1 year, unless required for evidentiary purposes.
- Recruitment data: 1 year from receipt of the application, unless consent is renewed.
- Website analytics: as defined in our Cookies Policy.
7. Recipients and international transfers
Personal data may be shared with: (i) entities of Warranty Global Group strictly to the extent necessary; (ii) brands, manufacturers and retailers on whose behalf the service is delivered; (iii) authorised technical service networks; (iv) logistics, payment, cloud, CRM, telecommunications and messaging providers acting as processors under Art. 28 GDPR; (v) public authorities when legally required.
Some of our processors may be located outside the European Economic Area. In such cases, HiperService ensures an adequate level of protection through European Commission adequacy decisions, the latest Standard Contractual Clauses (Decision 2021/914), and supplementary measures where required, in line with the Schrems II ruling and EDPB Recommendations 01/2020.
8. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, as well as the right not to be subject to automated decisions producing legal effects. You may also withdraw any consent previously granted without affecting the lawfulness of prior processing.
Rights may be exercised free of charge by writing to dpo@hiperservice.com, attaching a copy of an identity document. You also have the right to lodge a complaint with the Spanish AEPD (aepd.es) or the Portuguese CNPD (cnpd.pt).
9. Security
HiperService implements technical and organisational measures aligned with ISO/IEC 27001 principles, including role-based access control, encryption in transit and at rest, network segmentation, vulnerability management, secure software development, supplier due diligence and a documented incident-response procedure compliant with Art. 33–34 GDPR.
10. Minors
Our services and digital channels are not directed to minors under 14 (Spain) or 13 (Portugal). We do not knowingly collect personal data from minors without verifiable parental consent.
11. Changes to this policy
This Privacy Policy may be updated to reflect operational, legal or regulatory changes. The effective date is shown at the top of this page. Material changes will be communicated through appropriate channels.