Your data. Clearly explained.

Controller & contact

1. This website and your enquiry

This notice covers detailing, contact and scheduling, separately from the protected trading area. Submitting the online form stores your enquiry for processing. A preferred date is not yet a confirmed booking.

When enabled, enquiries collect your name, email, optional phone, vehicle and model, service, service address, preferred time and notes, and the resulting offers and confirmations. Please do not include health information, identity documents or other particularly sensitive data. Required contact and scheduling details are needed to process the enquiry.

2. Purposes and legal grounds

Information is used to answer enquiries, agree prices and appointments and organise services: steps before a contract or performance of a contract (GDPR Article 6(1)(b)). Legally required records are retained to meet applicable obligations (c). Security and abuse prevention serve our legitimate interest in operating a secure service (f).

A preferred time is not a reservation. Tiago reviews the price and time. Confirmation is by your acceptance of the quote link, or directly by Tiago when the price, time and location have already been agreed with you. Direct confirmation is recorded as an owner action; you receive confirmation without accepting another link. There are no automatic payment collections, advertising profiles or automated decisions with legal effects. Ordinary email replies are not read automatically or treated as acceptance.

3. Hosting, email and calendar

Railway hosts the website and enquiry records. Cloudflare manages DNS and the www redirect; register.lu/WebCMS provides the business mailbox. Email contact sends your message to that mailbox. Providers also process technical connection and security data, such as IP address, time and requested address.

Following the owner's personal authorisation, Resend sends email as contact@tiago.lu, while Google provides the owner's calendar. Customer emails contain offer and appointment details. Calendar events contain contact details, address, vehicle and appointment status. The owner may synchronise this calendar with Outlook, which manages its own display and synchronisation. Trading administrators cannot access the detailing desk. Keep personal offer links private.

The existing Google authorisation covers verified account identity, sending email and events on owned calendars, not reading the Gmail inbox. The existing email permission is retained but is no longer used for detailing messages. Application code only modifies its associated detailing events. The renewable credential is stored encrypted; the owner can revoke access in Google account permissions. Google user data is not sold, used for advertising or used to train general-purpose AI models. Use complies with the Google API Services User Data Policy, including Limited Use requirements.

Providers may process information outside the EEA. Their notices below explain processing locations and transfer arrangements. This website does not promise Europe-only processing.

4. Cookies, retention and deletion

Security and login cookies protect forms and the owner area. Your language choice may be saved locally in the browser. Detailing code uses no advertising trackers or analytics pixels. Unsubmitted form entries are not persisted in browser storage.

Enquiries, offers, delivery status and audit records are needed for handling, scheduling and documenting services. Legal retention duties or necessary evidence may require longer storage; personal data no longer needed should then be deleted. There is currently no automatic deletion deadline in this system. Tiago handles access and deletion requests at the contact above; mailbox and calendar records must also be considered separately.

5. Your rights

Subject to applicable law, you can request access, correction, erasure, restriction and portability. You can object to legitimate-interest processing on grounds relating to your particular situation. Where processing relies on consent, you can withdraw it for the future. Contact Tiago to exercise your rights. You can also complain to Luxembourg's data protection authority, the CNPD.

Your enquiry on the website

After submission, you receive a personal, non-public link to your enquiry and its status. The link allows reading that enquiry only, not accepting an appointment. Keep it private; it expires no later than 400 days after creation. A protected cookie remembers the latest enquiry on the same device for 30 days and is renewed when viewed. “Hide on this device” removes that browser access but does not delete or cancel the enquiry. The data itself remains subject to the retention rules above.

Email delivery through Resend

We use Resend for automatic enquiry receipts, quotes, appointment confirmations, cancellations, personally confirmed replies and requested login links. The sending service receives the sender, recipient, subject, reply text and technical message identifiers. This does not grant Resend access to our mailbox or Google Calendar. Incoming messages remain in the existing business mailbox; its access credential and the private sending journal on the website server are encrypted. Acceptance by the sending service is not confirmation of delivery. Messages may include contact, vehicle, address, quote and appointment details and personal access links. Calendar updates use Google separately.

Resend · Privacy

Further information

• Railway · Privacy
• Cloudflare · Privacy
• Google · Privacy
• Google API Services User Data Policy
• CNPD · Luxembourg

Optional Detailing customer account

On request, Resend sends a personal one-use sign-in link to your email address; it expires in 15 minutes. The account is created only after you explicitly confirm the link. We store your verified email, language and creation date and link only enquiries made with that email. The secure session cookie lasts up to 30 days. Sign out on shared devices. The account grants no access to Trading, the owner's mailbox or private calendar. Sign-in requests share the limited email budget and are rate-limited. Resend receives the recipient, email content and technical sending identifiers; the sign-in secret is not kept in the owner's send journal. Contact us to request account deletion; applicable enquiry retention remains separate.