Privacy Policy

1. Who is responsible for your data

This Privacy Policy explains how Private Car Trade (PCT) processes personal data when you visit privatecartrade.com, apply to join, use the Platform as a member, or contact us.

The controller of your personal data is:

Legal entity

CIUK VERKAUF SRL

Platform

Private Car Trade (PCT)

Website

privatecartrade.com

VAT number

RO47527652

Trade register

J2023000541236

EUID

ROONRC.J2023000541236

Registered address

67-77 Biharia St., Bldg. G, Floor 2, Office 4, Sector 1, Bucharest, Romania

Email

office@privatecartrade.com

For any question about your data, or to use your rights, write to us through the contact page, with Account & verification as the topic, or by post to the registered address above.

PCT is a business-to-business service. The personal data it processes is mainly that of the people who act for member businesses: owners, managers and employees.

2. Personal data we collect

Account information

• your first and last name;
• your email address;
• your phone number;
• your password, stored only as a secure hash that nobody can read back.

Company information

• the company's name, country and city;
• its VAT or company registration number, and the name and address the EU VAT register (VIES) holds for it;
• its business types, how it trades and what it specialises in, website, the languages it trades in, its description, its logo and its social media pages;
• the business contact details you put on your profile, such as WhatsApp.

Platform activity

• your vehicle listings, with their photos, VIN, price and details, and your buying and transport requests and the answers to them;
• the cars and searches you save, and the alerts for them;
• deals marked as completed, and the reviews you write and receive;
• the reports you send, and reports about your listings or your company;
• your notifications, and the emails the Platform sends you;
• how you use the Platform, such as the listings and requests you open, the sellers you contact and when you last used it;
• the messages you send the PCT team through the contact form.

Billing information

• the membership you choose, its status and its dates;
• your payments: amounts, dates and status;
• the details on your invoices: company name, VAT number and address;
• the invitations and referral rewards linked to your account.

Technical information

• the IP address and browser you use when you sign in, accept the Terms or send the contact form;
• your sessions: when you signed in, from which IP address and which browser;
• security records, such as repeated sign-in attempts;
• the cookies the Platform needs to keep you signed in, described in the Cookie Policy.

The PCT team also keeps internal notes about applications and members, and a log of the actions the team takes, such as approving an application or suspending an account.

3. Purposes and legal bases

PCT uses personal data only for the purposes below, each with its legal basis under the GDPR (Regulation (EU) 2016/679).

PCT does not send marketing emails and does not use your data for advertising. If that changes, PCT will ask for your consent first where the law requires it, and you can withdraw it at any time.

Where PCT relies on its legitimate interest, you can object, as explained in section 7.

4. Service providers we use

PCT shares personal data only with the providers that help it run the Platform, and only what each needs:

When you contact a member on WhatsApp, the message goes through WhatsApp, under WhatsApp's own terms. PCT only opens WhatsApp with the message ready to send.

PCT does not sell personal data and does not share it with advertisers. It may disclose data where the law requires it, for example to tax authorities, a court or another public authority, or to establish or defend legal claims.

5. What other members can see

PCT is a private network. What members publish is visible only to other approved members with an active membership. It is never public and search engines do not see it.

Other members can see:

• your company profile: name, logo, business types, how you trade and what you specialise in, country, city, languages, description, website and social media pages;
• the business contact details on your profile, such as WhatsApp and email;
• your vehicle listings and your open requests;
• the reviews you received and wrote, each with the name of the company that wrote it;
• that your company is verified, and whether you are on PCT now or roughly when you last were: today, yesterday or how many days ago, up to a week back.

Other members cannot see your password, your billing details, your payments, the reports you send, or the PCT team's notes. A member who is reported is never told who reported them.

PCT has no private messaging between members: you contact a member on WhatsApp or by email, outside the Platform. Messages you send the PCT team through the contact form are seen only by the team.

6. How long we keep data

PCT keeps personal data only as long as it needs it for the purposes above:

7. Your rights under the GDPR

You have the right to:

• access: get a copy of the personal data PCT holds about you;
• rectification: have wrong or incomplete data corrected;
• erasure: have your data deleted, unless PCT must keep it, for example invoices;
• restriction: have the use of your data limited while a question about it is settled;
• portability: get the data you gave PCT in a common machine-readable format, or have it sent to another provider;
• objection: object to processing based on PCT's legitimate interest;
• withdrawal of consent: where processing is based on your consent, withdraw it at any time, without affecting what was done before.

You can correct your profile yourself in Settings, and delete your account at any time: in Settings, or on your account's status page while you are not a member. For anything else, write to us as described in section 1. PCT answers within one month. For complex requests this can be extended by two more months, and you are told why. PCT may ask you to confirm who you are.

You also have the right to complain to a data protection authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at dataprotection.ro. You can also complain in the EU country where you live or work.

8. International data transfers

Some providers are based outside the European Economic Area (EEA), or may process data there: Cloudflare and Google, in the USA, and companies of the Stripe group in the USA.

Where personal data is transferred outside the EEA, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for providers certified under it, or on the European Commission's standard contractual clauses, with additional measures where needed.

9. Security

PCT protects personal data with technical and organisational measures that fit the risk, including:

• encrypted connections (HTTPS) for every page;
• passwords stored only as secure hashes;
• a confirmed email address before an account can be used;
• limits on repeated sign-in attempts;
• access to member data in the admin area only for the PCT team, by role, with a log of their actions;
• card payments handled entirely by Stripe.

No system is completely secure. If a breach of personal data is likely to put your rights at risk, PCT tells you and the supervisory authority, as the GDPR requires.

10. Contact and updates

Questions about this policy or your data: write to us through the contact page, or by post to the registered address in section 1.

PCT may update this Privacy Policy when the way it processes data changes. The date of the last update is at the top of this page, earlier versions are listed under Version history, and members are told of important changes by email.