Privacybeleid — Cars4you

This Privacy Policy explains how Cars4you (“we”, “us”) collects and processes your personal data when you use this website, in line with the EU General Data Protection Regulation (GDPR) and Belgian data-protection law.

1. Who is responsible for your data

The data controller is [Company legal name], [registered address], Belgium, company/VAT number [BE 0XXX.XXX.XXX]. For any privacy question or to exercise your rights, contact us at [privacy@yourdomain].

2. What data we collect

Account data: email address and password (stored hashed by our authentication provider).
Profile data: display name, seller type, phone number and location, when you provide them.
Listing data: the vehicle details and photos you publish, which are shown publicly.
Messages: the content of messages you send to and receive from other users.
Preferences: favorites, saved searches and your language and theme choices.
Technical data: IP address, device/browser information and basic usage statistics needed to operate and secure the service.

3. Why we use your data and our legal basis

To provide the marketplace (create your account, publish listings, enable messaging) — performance of a contract (Art. 6(1)(b) GDPR).
To send saved-search email alerts — your consent (Art. 6(1)(a)); you can withdraw it at any time from your dashboard.
To keep the service secure and prevent abuse/fraud — our legitimate interests (Art. 6(1)(f)).
To comply with legal obligations — where applicable (Art. 6(1)(c)).

4. Cookies

We use only essential cookies: a sign-in session cookie and cookies that remember your selected language and theme. We do not use advertising or third-party tracking cookies.

5. Who we share data with

Your public listing details and seller contact information are visible to other users. We also rely on the following processors, who act on our instructions under data-processing agreements:

Supabase — database, authentication and image storage.
Resend — sending saved-search alert emails.
Vercel — hosting and privacy-friendly usage analytics.

Where a processor transfers data outside the European Economic Area, that transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses. [Confirm the regions and safeguards used by each provider for your project.]

6. How long we keep your data

We keep account, profile and listing data for as long as your account is active. When you delete a listing or your account, the related data is removed or anonymised, except where we must retain it to meet a legal obligation or to resolve disputes. [Set and document concrete retention periods.]

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased (“right to be forgotten”);
restrict or object to certain processing;
receive your data in a portable format;
withdraw consent at any time, without affecting prior processing.

To exercise these rights, email [privacy@yourdomain]. We may ask you to confirm your identity and will respond within one month.

8. Complaints

If you believe we have not handled your data properly, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.

9. Security

We use access controls (including database row-level security) and encryption in transit to protect your data. No system is completely secure, but we work to protect your information against unauthorised access, loss or misuse.

10. Children

The service is not intended for people under 18, and we do not knowingly collect their data.

11. Changes

We may update this policy. Material changes will be indicated by updating the “last updated” date above, and where required we will notify you.

12. Contact

Questions about this policy? Contact us at [privacy@yourdomain].