Privacy policy

Controller

The controller responsible for data processing is CarSalePro [placeholder: full company name], [placeholder: address]. Contact: [placeholder: data protection email].

Data processed

We process the following categories of personal data:

• Account data (name, email, phone number, language)
• Order data (vehicle, address, status)
• KYC records from inspectors (identity, qualification)
• Payment data (processed via Stripe)
• Photos and report data from the inspection

Legal bases

Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR), for compliance with legal obligations (lit. c), and on the basis of legitimate interests (lit. f). Analytics cookies are only set with consent (lit. a).

Retention period

Report photos are retained in line with our retention policy for traceability. KYC documents are purged 90 days after the check is completed. Account data is stored until the account is deleted. You may request erasure at any time, unless a statutory retention obligation applies.

Your rights

You have the right to:

• Access to the data stored about you
• Rectification of inaccurate data
• Erasure (unless a retention obligation applies)
• Restriction of processing
• Data portability
• Object and lodge a complaint with a supervisory authority

Sub-processors

We engage the following service providers as sub-processors under a data processing agreement (DPA):

• Render — application hosting and database (EU, Frankfurt)
• Cloudflare R2 — storage of photos and files
• Stripe — payments, payouts, and Stripe Connect
• Mapbox — geocoding and maps
• Vercel — frontend hosting
• Google — sign-in and infrastructure
• Email, SMS, and push providers (SendGrid, Twilio, Firebase) once enabled

Cookies

Functional cookies are required for operation and are set without consent. Analytics cookies are only used after your explicit consent and can be withdrawn at any time.