Privacy Policy

Last updated:

Draft — to be reviewed by a lawyer. This policy is a starting template and is not legal advice. Please have it checked by a qualified lawyer (in Spain, for compliance with the GDPR and the LOPDGDD) before relying on it.

1. Who we are

This website is operated by (tax ID ), trading as Online IDP Express, based in Spain. We are the data controller for the personal data described in this policy. Contact: .

Online IDP Express is an independent authorized agent of , which issues and ships International Driving Permits.

2. What data we collect

  • Identity and contact data: first and last name, email, phone number, date of birth, gender, eye color, height, country of birth and delivery address.
  • Documents and images: a photo of you, both sides of your driver's license, your passport or national ID and its number, and your signature.
  • Order and payment data: chosen plan and shipping, amount, order status, and payment references. We never see or store your card number or bank login.
  • Messages: what you send us via the contact form, email or WhatsApp.
  • Technical data: basic logs kept by our hosting providers for security (such as IP address and time of request), and your chosen language.

3. Why we use it and our legal basis

  • To prepare and submit your permit application, ship it, send you its digital copy and keep you informed — necessary to perform our contract with you (GDPR art. 6(1)(b)).
  • To process documents that identify you — with the consent you give on the application form (art. 6(1)(a)), and because it is necessary for the service. You can withdraw consent at any time, but we will then be unable to complete an order that has not yet been submitted.
  • To keep invoices and accounting records — to comply with legal obligations (art. 6(1)(c)).
  • To prevent fraud, keep our systems secure and answer your messages — our legitimate interests (art. 6(1)(f)).

We do not sell your data, and we do not use it for advertising or automated decision-making.

4. Who we share it with

  • — the issuer, to produce and ship your permit.
  • Supabase — secure database and file storage (hosted in the European Union).
  • Netlify — hosting of this website.
  • PayPal and Wise — to process your payment, if you use them.
  • Resend — to send order emails.
  • WhatsApp (Meta) — only if you choose to contact us there.
  • Postal and courier companies — to deliver your permit.
  • Public authorities, only when the law requires it.

Some of these providers may process data outside the European Economic Area (for example, in the United States). When this happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

5. How long we keep it

  • Your documents and images (photo, license, passport/ID, signature) and identity details such as your document number, date of birth, height and eye color are deleted days after your order is fulfilled (shipped).
  • Orders that are never paid are deleted, with their files, days after they were created.
  • Basic order and billing records (name, contact details, address, what you bought, amount and date) are kept for as long as Spanish tax and commercial law requires (generally up to 6 years).
  • Contact messages are kept for up to 12 months.

6. How we protect it

All data is sent over encrypted connections (HTTPS). Documents are kept in a private storage area that cannot be accessed publicly; only the owner of Online IDP Express can open them, after signing in. Links to documents sent by email are temporary and expire automatically. The order tracking page only shows the status of an order to someone who knows both its order number and email address.

7. Your rights

You have the right to access, correct or delete your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. To exercise these rights, write to . We will reply within one month.

If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority in your country.

8. Cookies and local storage

We do not use advertising or tracking cookies. Your browser remembers the language you choose on this website. If you pay with PayPal, PayPal may set its own cookies needed for the payment. The admin area stores a sign-in session in the browser only for the site owner.

9. Minors

Our service is only for people aged 18 or over. We do not knowingly collect data from minors.

10. Changes

We may update this policy. The date at the top shows the latest version.