Privacy Policy
PRIVACY POLICY
Last updated: September 8, 2026
At AFR Engine, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect through our file service platform (the "Service"), for what purpose, for how long, and what rights you have under the General Data Protection Regulation (GDPR) and applicable Spanish data protection law.
1. DATA CONTROLLER
Controller: AFR Engine
Registered address: Calle Ajedrea, 13, Naves 18-19, Polígono Industrial Empresarium, 50720 Cartuja Baja, Zaragoza, Spain
Phone: +34 644 09 12 47
Contact email: contacto@afrengine.es
2. DATA WE COLLECT
- Registration data: name, email, password (encrypted), and billing details where applicable.
- Vehicle and file data: make, model, engine, ECU type, and the remapping files (original and modified) you upload or download through the Service.
- Balance and payment data: top-up history, amounts, and the payment method used (PayPal, Revolut, or bank transfer). We do not store your full card or bank account details; these are handled directly by PayPal, Revolut, or your bank.
- Usage data: activity logs, IP address, date and time of access, browser type, and device.
- Cookies and similar technologies: as detailed in section 9.
- Communications: messages you send us through contact forms, email, WhatsApp, or support tickets.
3. PURPOSES OF PROCESSING
- Creating and managing your user account and providing the Service.
- Processing requested remapping files and managing your account balance (top-ups and per-service deductions).
- Managing payments and billing.
- Sending you communications related to the Service (security notices, changes to the Terms, technical support, request status).
- Sending you marketing communications, only if you have given express consent.
- Detecting and preventing fraud, abuse, or misuse of the Service.
- Complying with applicable legal obligations (tax, accounting).
- Producing aggregated, anonymous statistics to improve the Service.
4. LEGAL BASIS FOR PROCESSING
- Performance of a contract: to provide the Service (registration, balance management, file processing, support).
- Consent: for marketing communications and non-essential cookies, revocable at any time.
- Legitimate interest: for Service security, fraud prevention, and product improvement.
- Legal obligation: to comply with tax, accounting, or regulatory requirements.
5. RETENTION PERIOD
We retain your personal data for as long as your account remains active. After account closure or cancellation, your files and associated data will be deleted within [X days/months], unless we must retain them for a longer period to comply with legal obligations (for example, tax obligations) or to exercise or defend against claims.
6. RECIPIENTS OF THE DATA
We do not sell your personal data. We may share data with:
- Infrastructure and platform hosting providers, acting as data processors under a contract in accordance with Art. 28 GDPR.
- Payment providers: PayPal and Revolut, to manage balance top-ups, and our bank, for transfers.
- Analytics and support tools (for example, [tool names]).
- Competent authorities, where there is a legal obligation to disclose information.
7. INTERNATIONAL TRANSFERS
Some of our providers (for example, PayPal) may be located, or transfer data, outside the European Economic Area. In such cases, we ensure that the transfer takes place with appropriate safeguards (standard contractual clauses approved by the European Commission, an adequacy decision, or another valid mechanism under the GDPR).
8. YOUR RIGHTS
As a data subject, you have the right to:
- Access: know what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your data ("right to be forgotten").
- Objection: object to certain types of processing.
- Restriction: request that processing be restricted in certain cases.
- Portability: receive your data in a structured, commonly used format.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing.
You can exercise these rights by writing to contacto@afrengine.es, indicating which right you wish to exercise and attaching a document proving your identity.
If you believe we have not properly addressed your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the supervisory authority of your country of residence.
9. COOKIES
We use our own cookies and, where applicable, third-party cookies for the essential operation of the Service and usage analysis. You can manage your cookie preferences from the cookie settings panel or your own browser settings.
10. SECURITY
We implement appropriate technical and organizational measures to protect your data and files against unauthorized access, loss, or alteration, including encryption in transit (HTTPS/TLS), access controls, and backups. No system is 100% foolproof, so we recommend using strong passwords.
11. MINORS
The Service is not intended for individuals under 18 years of age. If we become aware that we have collected data from a minor without the consent of their legal guardian, we will delete it.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy to reflect legal, technical, or organizational changes. We will publish the updated version on this same page, indicating the date of the last revision.
13. CONTACT
For any questions about this Privacy Policy, you can write to us at contacto@afrengine.es.
Last updated: September 8, 2026
At AFR Engine, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect through our file service platform (the "Service"), for what purpose, for how long, and what rights you have under the General Data Protection Regulation (GDPR) and applicable Spanish data protection law.
1. DATA CONTROLLER
Controller: AFR Engine
Registered address: Calle Ajedrea, 13, Naves 18-19, Polígono Industrial Empresarium, 50720 Cartuja Baja, Zaragoza, Spain
Phone: +34 644 09 12 47
Contact email: contacto@afrengine.es
2. DATA WE COLLECT
- Registration data: name, email, password (encrypted), and billing details where applicable.
- Vehicle and file data: make, model, engine, ECU type, and the remapping files (original and modified) you upload or download through the Service.
- Balance and payment data: top-up history, amounts, and the payment method used (PayPal, Revolut, or bank transfer). We do not store your full card or bank account details; these are handled directly by PayPal, Revolut, or your bank.
- Usage data: activity logs, IP address, date and time of access, browser type, and device.
- Cookies and similar technologies: as detailed in section 9.
- Communications: messages you send us through contact forms, email, WhatsApp, or support tickets.
3. PURPOSES OF PROCESSING
- Creating and managing your user account and providing the Service.
- Processing requested remapping files and managing your account balance (top-ups and per-service deductions).
- Managing payments and billing.
- Sending you communications related to the Service (security notices, changes to the Terms, technical support, request status).
- Sending you marketing communications, only if you have given express consent.
- Detecting and preventing fraud, abuse, or misuse of the Service.
- Complying with applicable legal obligations (tax, accounting).
- Producing aggregated, anonymous statistics to improve the Service.
4. LEGAL BASIS FOR PROCESSING
- Performance of a contract: to provide the Service (registration, balance management, file processing, support).
- Consent: for marketing communications and non-essential cookies, revocable at any time.
- Legitimate interest: for Service security, fraud prevention, and product improvement.
- Legal obligation: to comply with tax, accounting, or regulatory requirements.
5. RETENTION PERIOD
We retain your personal data for as long as your account remains active. After account closure or cancellation, your files and associated data will be deleted within [X days/months], unless we must retain them for a longer period to comply with legal obligations (for example, tax obligations) or to exercise or defend against claims.
6. RECIPIENTS OF THE DATA
We do not sell your personal data. We may share data with:
- Infrastructure and platform hosting providers, acting as data processors under a contract in accordance with Art. 28 GDPR.
- Payment providers: PayPal and Revolut, to manage balance top-ups, and our bank, for transfers.
- Analytics and support tools (for example, [tool names]).
- Competent authorities, where there is a legal obligation to disclose information.
7. INTERNATIONAL TRANSFERS
Some of our providers (for example, PayPal) may be located, or transfer data, outside the European Economic Area. In such cases, we ensure that the transfer takes place with appropriate safeguards (standard contractual clauses approved by the European Commission, an adequacy decision, or another valid mechanism under the GDPR).
8. YOUR RIGHTS
As a data subject, you have the right to:
- Access: know what data we hold about you.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your data ("right to be forgotten").
- Objection: object to certain types of processing.
- Restriction: request that processing be restricted in certain cases.
- Portability: receive your data in a structured, commonly used format.
- Withdraw your consent at any time, without affecting the lawfulness of prior processing.
You can exercise these rights by writing to contacto@afrengine.es, indicating which right you wish to exercise and attaching a document proving your identity.
If you believe we have not properly addressed your request, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with the supervisory authority of your country of residence.
9. COOKIES
We use our own cookies and, where applicable, third-party cookies for the essential operation of the Service and usage analysis. You can manage your cookie preferences from the cookie settings panel or your own browser settings.
10. SECURITY
We implement appropriate technical and organizational measures to protect your data and files against unauthorized access, loss, or alteration, including encryption in transit (HTTPS/TLS), access controls, and backups. No system is 100% foolproof, so we recommend using strong passwords.
11. MINORS
The Service is not intended for individuals under 18 years of age. If we become aware that we have collected data from a minor without the consent of their legal guardian, we will delete it.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy to reflect legal, technical, or organizational changes. We will publish the updated version on this same page, indicating the date of the last revision.
13. CONTACT
For any questions about this Privacy Policy, you can write to us at contacto@afrengine.es.