Privacy policy

1. Who is responsible for your data

The controller for the processing of your personal data is [company name], established at [address], registered with the Dutch Chamber of Commerce under number [Chamber of Commerce number]. You can reach us about privacy matters at [e-mail address].

2. What this policy covers

This policy applies to the portal at portal.automotive-auctions.nl and to the e-mails and text messages we send from it. The portal is used by customers who offer vehicles for auction and by our employees who guide that process. Auctions themselves take place on external auction platforms, which have their own privacy policies.

3. Which data we process

Depending on how you use the portal, we process the following categories of personal data.

• Account details: your name, e-mail address, telephone number, preferred language, a hashed password and, if you sign in with Google, the identifier Google assigns to your account.
• Vehicle details: licence plate, chassis number, mileage, options, condition, damage, photos and documents of the vehicles you submit, and the vehicle data we retrieve from public registers on the basis of the licence plate or chassis number.
• Auction and financial details: the auctions your vehicles take part in, bids and results, award decisions, payment requests, payment status and invoices. Payments are handled by a payment provider; we never see or store your full card or bank details.
• Communication: messages in your portal inbox, notes made about your assignment, appointments you schedule with us and the notifications we send you by e-mail or text message.
• Signed documents: the agreements and forms you sign electronically through the portal, including your name, e-mail address and the time of signing.
• Technical data: your IP address, browser information, log entries of actions in the portal and error reports. We use these to keep the portal secure and working properly.

4. Why we process your data

We use your personal data to create and manage your account, to prepare, run and settle the auction of your vehicles, to communicate with you about your assignment, to handle payments and to keep the portal secure. We rely on the following legal bases.

• Performance of the agreement: without your account, vehicle and payment details we cannot auction your vehicle or settle the result.
• Legal obligation: we are required to keep financial records, such as invoices and payment records, for the statutory retention period.
• Legitimate interest: we log actions and technical data to protect the portal against misuse, to investigate incidents and to improve our service.
• Consent: for signing in with Google and for optional notifications, such as text messages, we ask for your consent. You can withdraw it at any time.

5. Signing in with Google

You can sign in to the portal with your Google account. When you do, Google shares your name, e-mail address and Google account identifier with us. We only use these details to create your portal account or to link it to your existing account. We do not get access to your Google account, your e-mail or any other Google data.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this information or use it for advertising. Google's own privacy policy applies to the way Google processes your data.

6. Who we share your data with

We share personal data only where this is necessary for the auction process or the operation of the portal, and only with the following categories of parties. Where a party processes data on our behalf, we have concluded a data processing agreement.

• Auction platforms on which your vehicle is offered, such as Troostwijk Auctions and Auction Experts. They receive the vehicle details, photos and documents needed to publish the lot and to settle the auction.
• Providers of vehicle data, which we use to retrieve registration details on the basis of a licence plate or chassis number.
• Our payment provider (Stripe), which processes payments and payment requests on our behalf.
• Our electronic signing provider (DocuSign) and our appointment scheduling provider (Calendly).
• Our e-mail and text message provider (Brevo), which delivers the notifications we send you.
• Our hosting and storage providers, on whose servers the portal and the uploaded photos and documents are stored.
• Google, if you choose to sign in with your Google account.

We only provide personal data to other parties, such as public authorities, when we are legally required to do so.

7. Processing outside the European Economic Area

Some of the providers mentioned above, such as Google, Stripe, DocuSign and Calendly, may process data outside the European Economic Area. In those cases we rely on the safeguards recognised under the GDPR, such as the EU-US Data Privacy Framework or the standard contractual clauses adopted by the European Commission.

8. How long we keep your data

We do not keep personal data longer than necessary for the purpose for which we collected it, unless a longer retention period is required by law.

• Account and assignment details are kept for as long as your account is active. When your account is closed, we anonymise your personal data so that it can no longer be traced back to you.
• Invoices, payment records and signed agreements are kept for seven years after the end of the financial year, in line with the statutory retention obligation.
• Log entries of actions in the portal are deleted automatically after twelve months. Technical error reports are deleted after a shorter period, depending on their severity.

9. How we protect your data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Among other things, all traffic to the portal is encrypted, passwords are stored in hashed form only, access to data is restricted on the basis of roles and permissions, and actions in the portal are logged.

10. Your rights

Under the GDPR you have the following rights with regard to your personal data.

• The right to access the personal data we hold about you.
• The right to have incorrect or incomplete data corrected. Most account details can be changed directly in your profile.
• The right to have your data erased, unless we are required to keep it.
• The right to restrict processing and the right to object to processing based on our legitimate interest.
• The right to receive the data you provided to us in a structured, commonly used and machine-readable format.
• The right to withdraw consent you have given, without affecting the lawfulness of processing before the withdrawal.
• The right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.

To exercise these rights, contact us at [e-mail address]. We may ask you to verify your identity before we act on your request. We will respond within one month.

11. Cookies

The portal only uses cookies that are strictly necessary for it to work. We do not use tracking, advertising or analytics cookies, and no consent is required for the cookies below.

• A session cookie that keeps you signed in while you use the portal.
• A security cookie that protects forms against forged requests.
• An optional cookie that remembers your login if you tick the remember-me box.
• A cookie that remembers your language preference.

12. Changes to this policy

We may update this privacy policy, for example when the portal or the law changes. The date at the top of this page shows when it was last changed. For significant changes we will inform you through the portal.

13. Contact

If you have questions about this privacy policy or about the way we handle your personal data, contact [company name] at [e-mail address] or by post at [address].