Privacy policy

1. Data controller

• Controller: BestFixing S.L. — VAT number B67958017
• Address: Carrer de Fontanella, 14, ground floor, 08010 Barcelona (Spain)
• Contact: info@bestfixing.com · +34 624 079 085 · +34 936 121 063

2. What data we handle and where it comes from

We only handle what you give us. We don’t buy lists, we don’t merge third-party databases and we don’t profile you.

• Quote form and contact form: your name, your phone number or email address, whether we can reply on WhatsApp, which device it is and what’s wrong with it, and whatever you tell us about the fault.
• How you got here: the form is sent along with where your visit came from — the utm_source, utm_medium and utm_campaign parameters in the address, the gclid identifier if you arrived from a Google ad, and the address you followed a link from. It tells us which channel brings customers to the workshop, not who you are.
• WhatsApp or phone: whatever you share in the conversation, including your number.
• Repairs at the workshop: on top of the above, what’s needed for the repair order and the invoice.
• Site usage: our own measurement, which doesn’t identify you and is explained in full in section 7.

3. Where your form goes

When you send the form, the data goes to FlightDeck (flightdeck.bestfixing.cloud), the workshop’s own management system. It isn’t Google, a rented CRM or a marketing tool: it’s ours, we run it, and that’s where your request is opened and followed up until we get back to you. Being on a different domain doesn’t make it a third party — the controller is still the same one, BestFixing S.L.

Where the data sits: it is stored in the European Union. FlightDeck runs on a server of our own in Madrid (España), and the website is served by our hosting provider (Namecheap), with servers in Ámsterdam (Países Bajos). Your request is not stored outside the Union.

And we say it precisely, because there is a nuance. That server is published to the internet through Cloudflare, a US company with nodes in the European Union. Traffic between your browser and us crosses their network, which makes Cloudflare another processor: it carries the request and does not access the content beyond that. Where the data is stored is what we said above; the transit we declare separately rather than hiding it behind a rounder sentence.

If you have JavaScript disabled, the form sends nothing on its own: it opens WhatsApp with the message written out so you can send it yourself. In that case your details reach us through WhatsApp rather than the form.

4. What we use it for, and on what legal basis

• Answering your enquiry and quoting for the job. Basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
• Replying on WhatsApp to the number you give us. The quote form says so right under the phone field; if you’d rather have a call or an email, say so in your message and that’s how we’ll answer. Basis: dealing with the request you started (Art. 6(1)(b)).
• Carrying out and invoicing the repair. Basis: performance of the contract (Art. 6(1)(b)) and compliance with tax and accounting obligations (Art. 6(1)(c)).
• Handling the warranty and any follow-up. Basis: performance of the contract, and our legitimate interest in being able to evidence the work done (Art. 6(1)(f)).
• Knowing which channel brings customers (the attribution sent with the form) and measuring how the site performs. Basis: our legitimate interest in running and improving the business (Art. 6(1)(f)). It isn’t used to profile you or to show you ads, and you can object.
• Finding out where people give up on the quote form. Until now we could see how many people started it and how many finished, but not where the ones who didn’t finish dropped out. Noting which step they reached, and with which device, is what tells us what needs fixing: a step that drags, a list their fault isn’t on, a field that misbehaves on their phone. Basis: our legitimate interest in having a form that works (Art. 6(1)(f)). These are counts with no name attached, not a profile of you, and you can object.

5. How long we keep it

Enquiries that don’t lead to a repair are kept for as long as it takes to deal with them, and for a year at most.

Data tied to a repair is kept for as long as the relationship lasts and then blocked for the statutory limitation periods — in particular the six years the Spanish Commercial Code requires for business records, plus the periods set by tax law.

Site measurement data isn’t linked to any person, so there is no retention period that depends on you: the identifier that stitches it together is erased when you close the tab, and what’s left is counts.

6. Who we share it with

We don’t sell or hand over your data. The only people who see it are the suppliers we need in order to provide the service, acting as processors:

• Our web hosting provider (Namecheap), which serves the page and keeps the server’s technical logs.
• The server FlightDeck runs on (Madrid (España)), which is ours, and where requests submitted through the form are stored.
• Cloudflare, which publishes that server to the internet and carries the traffic between your browser and us.
• WhatsApp (Meta Platforms Ireland Ltd.), if you choose that channel. In that case the message is also governed by WhatsApp’s own terms, including its international transfers under the EU–US Data Privacy Framework and standard contractual clauses.
• The tax authorities and banks, where the law requires it.
• Our accountants, for invoicing.

7. How we measure use of this site

This site carries our own measurement. The data goes to FlightDeck (flightdeck.bestfixing.cloud), the same system we run the workshop on: there is no Google Analytics, no advertising pixels and no third-party tool. It used to be stored on the website’s own hosting; from now on it goes to FlightDeck, which belongs to the same company and is used for the same thing.

We also measure how far people get inside the quote form, and here is what for: some people start it and leave without finishing, and until now we had no way of knowing where they went. Knowing which step they reached, and with which device, is what lets us fix whatever is going wrong there. It isn’t profiling anyone: they are counts with no name attached.

For each visit we record:

• The path of the page you’re on, without the parameters in the address.
• The domain you came from — only the domain, never the full address — and only on the first page of the visit.
• The campaign parameters in the address (utm_source, utm_medium, utm_campaign and gclid), if there were any.
• Whether you’re on a phone, tablet or desktop, and the language of the page.
• Performance metrics for the page: LCP, CLS, INP, TTFB and FCP. They measure whether the site is fast, not what you do on it.
• The name of the button you press when it’s a contact button (call, WhatsApp, submit the form), and the fact that someone started filling in a form — never anything they typed.
• Which of the three steps of the quote form you reached: choosing a device, choosing a fault, or filling in your details.
• Which device you picked on the first step: iPhone, Mac, iPad, Apple Watch or “other”.
• Which fault you picked on the second: screen, battery, won’t turn on, liquid damage, logic board, data recovery or “other”.
• How the submission ended: whether it went through first time; whether it failed and we showed you the phone number and the WhatsApp button so you could call us; and whether the automatic retry got through afterwards. It means we find out that someone’s submission failed without waiting for them to tell us.
• Each of those four notes is recorded once per visit: they say which points you passed, not how many times you pressed each button.
• Of what you choose, only the list option. The device and the fault we note are the option you tick from a fixed list — the same ones you see on the form — never the text where you tell us what’s wrong with your device. It is exactly the same category that already travels with your request when you send it.
• A random session identifier, so we can tell those lines belong to the same visit. It lives in the tab’s memory and disappears when you close it.

8. What the measurement doesn’t do

• It uses no cookies. None at all, ours or anyone else’s.
• It doesn’t store your IP address.
• It stores no identifier that outlives the tab, so it can’t recognise you tomorrow or join two of your visits together.
• It can’t follow you around other websites: the data never leaves our systems.
• It collects nothing you type into the forms. Not your name, not your phone number, not your email, not one word of the text where you describe the fault — none of it goes into the measurement, not even how long it is. What you type leaves your browser when you press send, and then it goes into your request, not into the counts.
• It doesn’t know which device is yours, only which box you ticked. “iPhone” and “screen” are options from a list of five and a list of seven; they aren’t your serial number, your model, or anything you told us.
• It honours your browser’s “Do Not Track” setting: with it on, we record only the page view and its performance — no source, no campaigns, no buttons, and nothing about your progress through the form.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent where the processing relies on it, by writing to info@bestfixing.com or to the workshop’s address, saying which right you’re exercising and enclosing proof of identity.

If you think we haven’t handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the Catalan Data Protection Authority.

10. The data inside your device

Repairing a device can mean incidental access to what’s on it. We only go as far as we need to in order to diagnose the fault and check the repair, we don’t extract or copy anything unless you specifically ask us to (in a data recovery job, for example), and we keep no copy once the device goes back to you.

We recommend backing your device up before you leave it with us. Backups are the customer’s responsibility.

11. Security and changes

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.

This policy may be updated if our services or the law change. The version in force is always the one published on this page.

Last updated: 9 September 2026.