Legal information
Privacy policy
Last updated: 15 June 2026
1. Data controller
The controller of the personal data collected through Central de Trámites (https://centraldetramites.es) is:
Central de Trámites (trading name Central de Trámites).
The controller’s full identification details (tax ID and registered address) are available in the Legal notice .
To exercise your rights or submit privacy queries, you may contact us at hola@centraldetramites.es .
2. Data we process
Through procedure request forms we collect, depending on the service contracted, identification and contact data such as name, identity document, address, vehicle registration plate or VIN, land registry details, email and other fields required for the management requested.
In the payment process, Stripe may process billing and transaction data. We do not store full card numbers in our systems.
3. Purpose and legal basis
- Request management: to process the contracted service, communicate with you and deliver the requested documentation. Basis: performance of a contract (Art. 6(1)(b) GDPR).
- Legal compliance: retention of billing records and tax obligations. Basis: legal obligation (Art. 6(1)(c) GDPR).
- Web analytics: audience measurement via Google Analytics, only if you accept measurement cookies. Basis: consent (Art. 6(1)(a) GDPR).
4. Storage in Firebase / Firestore
Your request data is recorded in the «solicitudes» collection in Cloud Firestore (Google Cloud infrastructure), associated with the service’s Firebase project. That collection stores the procedure identifier, form data, management status (for example, pending payment or paid), contact email and technical transaction metadata.
Access to this collection is restricted by security rules: end users cannot read or modify the documents directly. Only authorised serverless backend processes manage those records.
5. Security and SSL encryption
All browsing on https://centraldetramites.es is carried out over the HTTPS protocol with TLS/SSL encryption, which protects data transmission between your device and our servers.
Payments are processed through Stripe, a PCI-DSS certified provider, and we do not store full banking credentials in our systems.
6. Recipients and transfers
We may disclose data to:
- Google Cloud / Firebase (hosting, database and serverless functions), with servers in the European Union or with adequate safeguards according to the provider.
- Stripe Payments Europe Ltd. for payment processing.
- Competent public bodies, where necessary for the filing requested by you.
- Google Analytics, if you consent to measurement cookies, under the terms of Google Ireland Limited.
We do not sell or transfer your data to third parties for commercial purposes.
7. Retention period
We will retain request data for the duration of the contractual relationship and thereafter for the periods necessary to address legal liabilities, claims or administrative requirements (typically between 3 and 6 years depending on applicable law).
8. ARCO rights and other GDPR rights
Under Regulation (EU) 2016/679 and the Spanish LOPDGDD, you may exercise the following rights:
- Access (ARCO): to know what data we process about you.
- Rectification: to correct inaccurate or incomplete data.
- Erasure («Cancellation»): to request deletion where applicable.
- Objection: to object to certain processing.
- Restriction of processing and portability, where applicable.
To exercise them, send an identified request together with a copy of your DNI/NIE to hola@centraldetramites.es . We will respond within a maximum of one month.
If you consider that we have not properly addressed your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
10. Changes
We may update this policy to adapt it to regulatory or technical changes. The current version will always be published at this URL with the corresponding revision date.