Privacy Policy

Controller

[Company or full name], [address]. Email: [privacy@example.com]. See the Imprint for full details.

What we process and why

Visiting the site. Our server processes your IP address, the requested page, date and time, and your browser's user agent to deliver the site, keep it secure and limit abuse (for example rate limits on login, bidding, search and forms). Legal basis: our legitimate interest in a secure, working service.

Your account. When you register we store your email address, username, first and last name, account type and, for companies, the company name. We use them to run your account, show your username on bids and listings and send account emails (verification, password reset). Legal basis: performance of a contract.

Listings, bids and garage. We store the vehicles you add, the photos you upload, your listings, your bids and notifications about them. Your username is shown publicly next to your listings and bids. Legal basis: performance of a contract.

Payments and payouts. Payments, payouts and identity verification are handled by Stripe. Card and bank details are entered directly with Stripe; we only store references Stripe gives us (customer and account IDs, card brand, last 4 digits and expiry, bank name and last 4 digits, verification status and document type). Legal basis: performance of a contract and legal obligations (e.g. anti-money-laundering checks).

Account standing. We record missed payments ("strikes") and may block bidding after repeated non-payment. Legal basis: our legitimate interest in a fair marketplace.

Contact form. When you send us a message we store the data you enter and use it to answer you. Legal basis: our legitimate interest in answering enquiries, or steps prior to a contract.

Cookies and local storage

We use one technically necessary cookie, payload-token, to keep you logged in. We store your light/dark theme choice in your browser's local storage. On payment pages Stripe sets its own cookies for fraud prevention. We use no analytics or advertising trackers.

Recipients

• Hosting: [hosting provider, country], which runs our servers, database and file storage.
• Stripe: Stripe Payments Europe Ltd. (Ireland) and Stripe, Inc. (USA) for payments, payouts and identity verification. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses. See stripe.com/privacy.
• Email: [email provider], which delivers our emails.

How long we keep data

Account data is kept while your account exists. When you delete your account we remove it, except where we must keep records of completed sales and payments for statutory retention periods (up to [10] years). Server logs are kept for [14] days.

Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw consent at any time. Contact us at [privacy@example.com]. You can also lodge a complaint with a data protection supervisory authority.

Last updated: [date]