Privacy Notice

1. Who we are

The controller is the natural or legal person that publishes CarLazer at https://carlazer.com (the “Operator”, “we”). Write to [email protected] for all privacy requests. If a company name, company number, VAT number or registered office is later published on the Platform, that identification supplements this notice without reducing your rights.

2. What this notice covers

This notice covers personal data we process as controller. It does not cover a seller who receives your message or phone call: that seller is an independent controller of the data you choose to send them. Third-party sites linked from a listing (Car-Pass, maps, a dealer website) have their own notices.

3. Data we collect

• Account data: email, password hash, name where provided, language, and organisation memberships.
• Profile and dealer data: phone, city, country, postal address, VAT number, opening hours, storefront text, logo and cover images.
• Listing data: vehicle attributes, price, description, images, optional history and document files, and an optional VIN or chassis number stored only for verification.
• Usage data: favourites, search criteria in the URL, calculator inputs you put in the URL, and listing view counts.
• Communications: messages you send through the Platform, invitation emails, and support emails you send us.
• Technical data: IP address, user-agent, security logs, and cookies described below.

4. Why we process data and on which legal bases

• Contract (art. 6(1)(b) GDPR): creating and securing your account, publishing and hosting listings, showing storefronts, sending verification and reset emails, and providing tools you request.
• Legitimate interests (art. 6(1)(f)): preventing fraud and abuse, keeping VIN off public pages, measuring listing views, improving relevance and security, defending legal claims, and operating a multilingual marketplace.
• Legal obligation (art. 6(1)(c)): responding to lawful authority requests, keeping invoices and identity data where tax or accounting law requires it, and DSA notice records.
• Consent (art. 6(1)(a)), where required: optional communications or non-essential cookies, if we introduce them. You may withdraw consent without affecting prior lawful processing.

5. VIN and vehicle identifiers

A VIN or chassis number is collected only when a seller provides it, for verification, fraud prevention and support. It is never shown on public listing pages. We treat it as a high-risk identifier: access is restricted, and we may refuse or strip it from public fields. Do not put a VIN in a public description or image.

6. Messages and seller contact

If you call a seller, the call takes place on the telephone network, not on our servers. If you send a Platform message, we process the content to deliver it and to detect abuse. Do not include payment-card numbers or unnecessary special-category data. The seller becomes an independent controller of what you send them.

7. Cookies and similar technologies

We use cookies that are strictly necessary to operate the Platform:

• Authentication and session cookies issued by our sign-in system, so you stay signed in and we can enforce access control.
• A language cookie named CARLAZER_LOCALE, so the Platform can remember English, French or Dutch.
• Cloudflare Turnstile on the password-reset form only, to distinguish humans from bots. Sign-up and sign-in are not currently gated by Turnstile.

We do not currently use advertising cookies. If we later add non-essential analytics or marketing cookies, we will ask for consent where the law requires it. You can delete cookies in your browser; essential cookies may then need to be set again for the Platform to work.

8. Recipients and processors

We share data only as needed:

• Other users, when you publish a listing or a dealer storefront (never the VIN).
• Infrastructure processors: our database host, Cloudflare (CDN, security and object storage via R2), and Amazon Web Services for transactional email (SES, currently in the EU West region).
• An AI language-model provider, solely to generate listing-description translations. We send the description text and source language, not your password and not a VIN unless you embedded one in the description against these rules.
• A payment processor (Stripe), if and when billing is activated for a paid feature you accept.
• Professional advisers, authorities and courts where the law requires or allows disclosure.

9. International transfers

Some processors (in particular Cloudflare and the AI provider) may process data in the United States or other countries outside the EEA. Where that occurs we rely on an adequacy decision if one exists, or on standard contractual clauses and supplementary measures. You may ask us for more detail at the contact email.

10. Retention

• Account and profile data: for the life of the account, then a short winding-up period unless a longer legal hold applies.
• Published listings and public storefronts: while published, then as needed for caches, disputes and fraud prevention.
• VIN: no longer than needed for the verification or fraud purpose, and not after the listing and related disputes are closed unless the law requires otherwise.
• Invoices and billing identity snapshots: typically seven to ten years where accounting or tax law applies.
• Security logs: a limited period measured in weeks or months, unless needed for an incident.

11. Your rights

You may request access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Send a request to [email protected] from the email of your account where possible. We may need to verify your identity. We will respond within one month, extendable as the GDPR allows.

Erasure is not absolute. We may keep data needed for legal claims, invoices, fraud prevention, DSA records, or another exemption in article 17 GDPR. Until a full self-service deletion flow exists, account-closure requests are handled through the contact email.

12. Automated decisions

We do not make solely automated decisions that produce legal effects concerning you, other than security and abuse filters (for example blocking a password-reset request that fails a bot check, or refusing a listing that violates published rules). Those filters are necessary for the service and for our legitimate interest in Platform integrity.

13. Children

The Platform is for persons aged 18 or over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

14. Security

We use technical and organisational measures appropriate to the risk, including hashed passwords, access control, HTTPS, and separation of public listing fields from VIN. No method of transmission or storage is perfectly secure. You must also keep your password and devices safe.

15. Complaints and the Belgian DPA

You may complain to us first at [email protected]. You also have the right to lodge a complaint with the Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels, Belgium (https://www.autoriteprotectiondonnees.be / https://www.gegevensbeschermingsautoriteit.be). If you live in another EEA country you may instead contact your local supervisory authority.

16. Changes and contact

We may update this notice. The new version applies when published on the Platform. For a material change we will use reasonable efforts to notify account holders. Contact: [email protected].