Spot4Dis PRM Card Legal Declaration and Verification Privacy Policy
This page sets out the declaration you accept when you tick the box on the PRM card registration screen and explains
how we process the photographs and data you provide to verify your card, both in the manual review and in the optional
instant verification. It also applies to accounts validated before this system was introduced, which the App asks for
the same declaration and a selfie before parking in a PRM space.
LEGAL DECLARATION
By ticking the box, you declare under your own responsibility, on your own behalf or as the legal representative of
the holder of the European Parking Card for Persons with Disabilities (hereinafter "PRM Card"), that:
- The PRM Card is genuine, currently valid and has been issued by the competent authority.
- You are the holder of the PRM Card or are acting as their legal representative with sufficient authority to do so.
-
The documents shown in the photographs are the originals and the people shown in them are who they claim to be.
The photographs were taken at that moment with the device's camera and are not photocopies, pictures of a screen or altered images.
- The information you provide is true and, if the PRM Card expires, is withdrawn or otherwise ceases to be valid, you will stop using it in Spot4Dis.
-
You will only use parking spaces reserved for persons with disabilities when the PRM Card holder is driving the
vehicle or travelling in it, in accordance with the applicable regulations.
Providing false or altered documents, or using another person's card, may constitute an administrative or criminal
offence. In that case, AsoPMR may cancel the card validation, suspend or close the account, and report it to the
competent authorities. AsoPMR keeps a record that you accepted this declaration and of the date and time you did so.
DATA CONTROLLER
- Association of People with Reduced Mobility (hereinafter "AsoPMR").
- CIF: G67551416.
- Registered office: Gran Via de les Corts Catalanes 630, 4th Floor, Barcelona 08007, Spain.
-
Email:
asopmr@asopmr.org
PHOTOGRAPHS REQUESTED
All photographs must be taken at that moment with the device's camera. The App does not allow images to be chosen from the gallery.
Manual review (required): three photographs
- Front of the PRM Card.
- Back of the PRM Card.
- A selfie holding the PRM Card next to your face.
If you only provide these three photographs, a member of the AsoPMR team reviews the application, usually within
24 to 48 hours. In this case no image is sent to any artificial intelligence service.
Instant verification (optional): two additional photographs
- The front of your identity document (DNI, NIE or passport) next to your face.
- The back of the PRM Card (the side with your photo) next to your face.
If you provide both, an artificial intelligence system (Google's Gemini) automatically analyses those two photographs
and the photographs of the front and back of the PRM Card (the selfie is not sent to it) in order to:
- Check that the face in the two optional photographs matches the photograph on the identity document and the one on the PRM Card.
- Read the data printed on the documents: name, number and expiry date of the PRM Card, and name and number of the identity document.
- Check that the documents are originals and not a photocopy, a screen or a digital image.
-
Check that the name on the identity document matches the one on the PRM Card and the one you entered when creating
your account, and that the identity document number is not already registered to another account.
If all checks are passed, the card is validated instantly. If any check is not passed or the system cannot give an
answer, the application goes to manual review. If you only provide one of the two optional photographs, the application
is handled by manual review only and that photograph is not kept.
AUTOMATED DECISION-MAKING
Instant verification is an automated decision that can only validate your card: the system never rejects an
application on its own and, when it cannot confirm it, passes it to a member of the AsoPMR team. The only exception is
a PRM Card whose printed expiry date has already passed: in that case the application is not processed and no
photograph is kept. In any case, you can request human intervention, express your point of view and contest the
decision by writing to asopmr@asopmr.org.
PURPOSES AND LEGAL BASIS FOR PROCESSING
Personal data will be processed for the following purposes and on the following legal bases:
| Purpose of Processing |
Data Processed |
Legal Basis (GDPR) |
|
Legal declaration:
To record that the PRM Card is legitimate and the conditions for using reserved spaces, and to be able to prove it in the event of fraudulent use.
|
Acceptance of the declaration and the date and time of acceptance.
|
Performance of the terms of use accepted by the user (Art. 6.1.b) and legitimate interest in preventing fraud (Art. 6.1.f).
|
|
PRM Card validation (manual review):
To confirm ownership of a valid PRM Card in order to prevent fraud.
|
Photographs of the front and back of the PRM Card and selfie, and the data shown on the card (name, number and expiry date).
|
Explicit consent of the data subject (Art. 6.1.a and Art. 9.2.a, as this is health-related data).
|
|
Instant verification (optional):
To validate the PRM Card instantly through the automated analysis described on this page.
|
The two optional photographs, photographs of the front and back of the PRM Card, name and number of the identity document,
name, number and expiry date of the PRM Card, and the results of the checks.
|
Explicit consent (Art. 6.1.a and Art. 9.2.a, for biometric and health-related data), which you give by voluntarily providing the two optional photographs.
|
|
Biometric identification when parking:
To check that the person parking in a space reserved for persons with disabilities is the validated holder.
|
Biometric template generated from the selfie, and selfies taken when parking.
|
Explicit consent (Art. 9.2.a for special category data).
|
|
Fraud prevention:
To detect the same identity document being used in more than one account.
|
Identity document number, only if it was read clearly during instant verification.
|
Legitimate interest (Art. 6.1.f).
|
BIOMETRIC TEMPLATE AND VERIFICATION WHEN PARKING
-
What it is: a biometric template is generated from the selfie: a numerical representation
of facial features, which is not a photograph. It is computed by a face verification service operated by AsoPMR itself,
hosted on its Google Cloud infrastructure, without any external biometrics provider.
-
When it is created: only once the card is validated, either instantly or after manual review.
If the application is rejected, no template is generated.
-
Use when parking: when you park in a reserved space, the App may ask you for a selfie to compare with your
template. That selfie is not kept. If it does not match, the parking in the PRM space is not registered and you can try again.
If the check fails because of the photo itself (for example, poor lighting or no visible face), the selfie may be sent to
Gemini to obtain a short text description of the problem, which is kept in the technical logs to diagnose the failure.
The image is not kept.
-
Accounts without a template: if your card was validated before this system was introduced or the template
could not be generated, the first time you try to park in a PRM space the App will ask you to accept this declaration and
take a selfie to create it. That photo is not kept either.
RETENTION PERIOD
-
Successful instant verification: no photograph is kept. They are analysed in memory and discarded once the verification ends.
-
Manual review: the photographs of the front and back of the PRM Card and the selfie are kept in private
storage that only authorised AsoPMR staff can access, through temporary links. The optional photographs are only kept when
the reviewer needs to see them to check why instant verification was not completed. All of them, together with the review
notes, are permanently deleted as soon as the application is approved or rejected.
-
Biometric template: it will be retained while the account remains active to allow parking checks,
and will be deleted when the account is deleted or consent is withdrawn.
-
Card data, identity document number and record of the declaration: they will be retained while the account remains active.
-
Legal Retention: In all cases, data may be retained in a blocked state for the legally established periods in order to deal with judicial or tax-related claims.
DATA RECIPIENTS
Your data will not be transferred to third parties except in the following cases:
-
Google (Gemini API):
As Data Processor, solely for instant verification, if you provide the optional photographs, and for the selfie
diagnosis described on this page. Under its terms of service, Google does not use this data to train or improve its
models and only keeps it for a limited period to detect abuse. Google may process this data outside the European
Economic Area; in that case, the transfer is covered by the European Commission's Standard Contractual Clauses included
in its data processing terms and, where applicable, by the EU-U.S. Data Privacy Framework.
-
Google Cloud:
As Data Processor providing the infrastructure that hosts Spot4Dis's servers, database and storage.
-
Competent Authorities:
Where there is a legal obligation or there are signs of fraudulent use of a PRM Card or of reserved spaces.
EXERCISE OF THE DATA SUBJECT'S RIGHTS
Once you, as a user of the App, have provided us with your personal data,
the applicable legislation grants you the following rights as a data subject:
- Request access to your personal data.
- Request the rectification or erasure of your personal data.
- Request the restriction of the processing of your personal data.
- Object to the processing of your personal data.
- Request the portability of your personal data.
- Not be subject to decisions based solely on automated processing, obtain human intervention, express your point of view and contest the decision.
-
Withdraw the consent given at any time, without affecting the lawfulness of processing based on consent
before its withdrawal. If you withdraw consent for the biometric template, it will be deleted and we will not be able to
verify your identity when you park in PRM spaces.
To exercise any of the rights described above, the data subject must provide sufficient identification or, where applicable,
that of their legal representative before AsoPMR. Requests should be sent to: asopmr@asopmr.org.
Data subjects may also lodge a complaint with the Spanish Data Protection Agency.
CHANGES TO THE PRIVACY POLICY
The platform reserves the right to modify this Privacy Policy in order to adapt it to legislative or case law developments.
In such cases, the Provider will announce the changes introduced on this page with reasonable notice before they come into effect.
Last updated: October 2026.