GDPR and Your Spanish Tradesperson - What Data They Can and Cannot Hold

Your tradesperson knows more about you than you might realise

When you hire a tradesperson in Spain, you hand over personal information without thinking much about it. Your name and address are on the quote. Your phone number and email are in their contacts. Your WhatsApp conversation contains details about your property, your schedule, when you are away, and sometimes your bank details. Photographs of the inside of your home may be on their phone. In some cases, copies of your NIE or passport were provided as part of the contract process.

All of that is personal data. In Spain, as across the European Union, the collection, storage, and use of personal data is governed by law, specifically by the General Data Protection Regulation (GDPR) and its Spanish implementation, the Ley Orgánica de Protección de Datos y Garantía de los Derechos Digitales (LOPDGDD). Those laws apply to tradespeople and small businesses just as they apply to large corporations. Knowing what your rights are under those laws is not overcomplicated, and it is worth knowing.

Does GDPR apply to Spanish tradespeople?

Yes. GDPR applies to any person or organisation operating within the European Union that processes personal data, regardless of their size, their sector, or whether they are a sole trader or a large company. A self-employed plumber operating as an autónomo in Málaga who keeps a contacts list on their phone containing client names, addresses, and phone numbers is processing personal data within the meaning of GDPR.

The LOPDGDD, Spain's national data protection law, reinforces and in some areas extends GDPR protections for individuals in Spain. The supervisory authority responsible for enforcing both is the Agencia Española de Protección de Datos (AEPD), which is the Spanish equivalent of the UK's Information Commissioner's Office.

What personal data can a tradesperson legitimately hold

A tradesperson can hold personal data that is necessary for the legitimate purpose of carrying out the work you have hired them to do and managing the business relationship that follows. This typically includes:

• Contact details - your name, address, phone number, and email address. These are necessary for communication and for issuing invoices.
• Job records - details of the work carried out, dates, costs, and any relevant notes about your property's installation or systems. A plumber who has serviced your boiler has a legitimate reason to keep a record of the service history.
• Financial records - invoices and payment records must be retained for tax purposes under Spanish law. The Agencia Tributaria requires businesses to retain invoicing records for a minimum of four years. A tradesperson cannot delete financial records relating to your job simply because you ask them to, their tax obligations take precedence.
• Contract documentation - signed contracts and written agreements relating to the work. These can be retained for the duration of any potential dispute period, which for building work can extend to ten years under the Ley de Ordenación de la Edificación.

What personal data a tradesperson cannot hold or use

There are clear limits on what a tradesperson can legitimately do with your personal data:

• They cannot use your data for marketing without your consent - sending you promotional messages, adding you to a mailing list, or contacting you about other services without your explicit consent is a breach of GDPR. If you did not tick a box or sign something that specifically authorised marketing contact, they are not entitled to send it.
• They cannot share your data with third parties without a lawful basis - passing your contact details to another tradesperson, a supplier, or any other party without your knowledge and consent is not permitted under GDPR unless there is a specific legal reason to do so.
• They cannot retain your data indefinitely - personal data should only be held for as long as it is necessary for the purpose for which it was collected. Once a job is complete and the relevant retention periods have passed, personal data should be deleted or anonymised.
• They cannot retain photographs of the interior of your home for purposes beyond the job - if a tradesperson took photographs during the work, those photographs are personal data and should not be used for marketing, shared on social media, or retained beyond what is necessary without your consent.
• They cannot use copies of your NIE or passport beyond the legitimate purpose for which they were provided - identity documents provided as part of a contract process should be retained only for as long as the contract and any dispute period requires.

Your rights as a data subject in Spain

Under GDPR and the LOPDGDD, you have specific rights regarding personal data held about you by any organisation or individual, including tradespeople:

• The right to access - you can request a copy of all personal data a tradesperson holds about you. They must respond within one month.
• The right to rectification - if any data held about you is inaccurate, you can request that it be corrected.
• The right to erasure - also known as the right to be forgotten. You can request that your personal data be deleted where there is no longer a legitimate reason to hold it. Note that this right does not override legal retention obligations, a tradesperson cannot delete invoicing records that they are required to retain for tax purposes.
• The right to restrict processing - you can request that a tradesperson stop using your data in certain ways, for example for marketing purposes, while retaining the data itself for legitimate purposes.
• The right to object - you can object to the processing of your personal data where it is being used for purposes beyond the original legitimate purpose for which it was collected.
• The right to data portability - in certain circumstances, you can request that your data be provided to you in a portable format.

How to make a data request to a tradesperson

Making a data subject access request or a deletion request does not require a lawyer or a formal legal process. A written request, by email or WhatsApp, stating clearly what you are requesting and under what right is sufficient to trigger the tradesperson's obligations under GDPR.

A simple request might read:

Under my rights as a data subject under the General Data Protection Regulation, I am requesting confirmation of what personal data you hold about me and a copy of that data. Please respond within one month as required by law.

If a tradesperson ignores a legitimate data request or refuses to comply without a valid reason, you can make a complaint to the Agencia Española de Protección de Datos (AEPD) at aepd.es. The AEPD takes complaints seriously and has the power to investigate and fine businesses that breach GDPR obligations.

What about WhatsApp conversations and photographs

WhatsApp conversations between you and a tradesperson contain personal data. The messages themselves, the contact information attached to your account, and any photographs shared in the conversation are all within the scope of GDPR.

A tradesperson who uses WhatsApp for business communication, which is the majority of tradespeople on the Costa del Sol, is processing personal data within the meaning of GDPR when they store and use those conversations. In practice, enforcing strict GDPR compliance around WhatsApp is complex, but the principle is clear: photographs of your property shared via WhatsApp during a job should not be used for marketing purposes, shared with third parties, or retained beyond what is necessary without your consent.

SpainTrades and data protection

SpainTrades takes data protection seriously. The platform operates in full compliance with GDPR and the LOPDGDD. Personal data provided by homeowners and tradespeople is collected only for the purposes stated in the privacy policy, is not shared with third parties without consent, and is retained only for as long as necessary.

Every tradesperson listed on SpainTrades operates as a registered business with their own GDPR obligations. When you make contact with a tradesperson through the platform, you are dealing with a vetted professional who is accountable to Spanish data protection law.

Find a tradesperson you can trust with your property and your data at www.spaintrades.es

Important note

The information in this article is intended as a general guide to data protection rights for expats in Spain. It is not legal advice and should not be treated as a complete or definitive account of GDPR or the LOPDGDD. Data protection law is complex and its application to specific situations depends on the facts of each case. If you have concerns about how your personal data is being handled by a tradesperson or any other organisation in Spain, seek independent legal advice or contact the Agencia Española de Protección de Datos directly at aepd.es. SpainTrades accepts no liability for decisions made on the basis of this article.