Privacy policy
Last updated: 14 August 2026
The short version
If you join the waiting list we keep your email address and, if you tell us, your car, your gearbox, your country and how interested you are in the first batch. Only to send you development updates and the heads-up when that batch opens. You have to confirm the address by clicking a link in an email — nothing is stored as a subscription until you do. Your data is never sold or shared for advertising, and you can delete yourself any time with one click or one email.
1. Data controller
- Controller: Kronoset SL
- Spanish tax ID (NIF): B24749251 (EU VAT: ESB24749251)
- Address: Carrer Pep Ventura 67, Local 2 · 08810 Sant Pere de Ribes · Barcelona · Spain
- Privacy contact: hello@cockpitdial.com
A Data Protection Officer is not mandatory in this case, so none has been appointed: write to the address above for any privacy matter.
2. What data we process
| Data | Required? | Why we ask |
|---|---|---|
| Email address | Yes | It's the only way to reach you. No email, no waiting list. |
| Car model | No | To see which versions real demand prioritises, and to contact you only if your car ends up supported. |
| Gearbox (manual / PDK / Tiptronic) | No | It decides which data we can read from your car, so it decides what we can promise you. |
| Country | No | To work out shipping, VAT and customs, and to decide which markets the first batch goes to. The country only, never your address. |
| How interested you are in the first batch | No | To size the batch. It commits you to nothing. |
| Language of the page you signed up on | Automatic | So we write to you in your language and not in a random one. |
| Proof of your consent: date and time, IP address, version of the text you accepted, and date and time of your confirmation click | Automatic | The law requires us to be able to prove that you consented (art. 7(1) GDPR). Without this record we couldn't. |
| The content of emails you send us | No | So we can reply. |
We do not ask for your name, phone number, postal address or payment details. We do not process special categories of data (health, beliefs, biometrics…) and we do not process data of children under 14: this site is not aimed at minors.
The list works with double opt-in. After the form you get an email with a confirmation link, and only if you click it do we store you as a subscriber. If you never click, the pending record is deleted within 30 days.
We use no web analytics and no tracking cookies (see the cookie policy). Our hosting provider does record, as any server does, technical connection data (IP address, date, browser) in its logs, for security and abuse prevention.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Running the waiting list and sending you development updates and the first-batch announcement | Your consent (art. 6(1)(a)), given by ticking the box on the form. For commercial email, also art. 21 of the Spanish LSSI. | Until you withdraw consent or unsubscribe. At most 24 months without any interaction from you. |
| Replying to enquiries you send us by email | Your consent and our legitimate interest (art. 6(1)(f)) in answering people who write to us. | For the duration of the exchange and up to 1 year after. |
| Site security (server logs) | Legitimate interest (art. 6(1)(f)) in keeping the service available and free of abuse. | The hosting provider's retention period (usually days or a few weeks). |
| Complying with legal obligations and handling claims | Legal obligation (art. 6(1)(c)) and legitimate interest in defending against claims. | Blocked for the statutory limitation periods, then deleted. |
We do no profiling and no automated decision-making with legal effects on you. We do not use your data for third-party advertising, and we do not sell, rent or share it commercially.
4. What happens if you don't give us the data
Simply that we can't add you to the waiting list. Nothing else: the whole site can be browsed without giving any data.
5. Who else handles your data (processors)
To operate we rely on providers that process data on our behalf, under a data processing agreement (art. 28 GDPR) and without using it for their own purposes:
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. / Cloudflare Ltd (Ireland) | Website hosting, connection logs, and the database that holds the waiting list | The waiting-list database is created with EU jurisdiction, so its data is stored and processed inside the EU. Cloudflare is a US company: its data processing agreement and the Commission's Standard Contractual Clauses apply. |
| Brevo (Sendinblue SAS) | Sending the confirmation email and the waiting-list emails | France (EU) |
| Titan (titan.email) | Mailbox where the emails you write to us are received and stored | Outside the EEA where applicable. Their data processing addendum incorporates the European Commission's Standard Contractual Clauses (art. 46.2.c GDPR). |
There is no form provider. The waiting-list form posts to this same domain and is handled by our own code: no third-party form service ever sees what you type. Nothing is loaded from anyone else's server, so filling the form doesn't hand your data to a middleman.
Public authorities and courts may also access your data where a law requires it.
International transfers
If any provider is outside the European Economic Area (for example, in the US), the transfer relies on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on the Standard Contractual Clauses approved by the Commission, with supplementary measures where appropriate. You can ask us for a copy of those safeguards at hello@cockpitdial.com.
6. Your rights
You have the right to:
- Access: know what data of yours we hold and get a copy.
- Rectification: correct anything inaccurate.
- Erasure ("right to be forgotten"): have it deleted.
- Object to processing based on legitimate interest.
- Restriction: have us keep the data without using it while a claim is resolved.
- Portability: receive it in a structured, commonly used format, or have us send it to another controller.
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
How to exercise them
The quick way: the unsubscribe link in every email we send, which removes you from the list immediately. For any right, email hello@cockpitdial.com saying which one you want to exercise. We reply within one month (extendable to two for complex requests, and we'll tell you if that happens). Exercising these rights is free. We will only ask for an identity document if there is reasonable doubt about who is writing, and we will never keep it longer than needed to handle the request.
Complaints to the supervisory authority
If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), the competent authority as we are established in Spain, or to your own national authority. We'd appreciate it if you wrote to us first: almost everything gets sorted with one email.
7. Security
We apply technical and organisational measures proportionate to the size of this project: encrypted connection (HTTPS) across the site, access to the data limited to the owner, two-factor authentication on provider accounts, and minimisation — we don't collect data we don't need. If a breach occurred with a risk to your rights, we would tell you and notify the AEPD within the legal deadlines.
8. Changes to this policy
If providers, purposes or the law change, we will update this page and its "last updated" date. If a change affects you materially (a new purpose, say), we'll tell you by email and, where the law requires it, ask for your consent again.
9. Language
This is an English translation provided for convenience. The Spanish version is the legally binding one; in case of any discrepancy, the Spanish text prevails. A German version is also available.