Privacy policy
Last updated: October 2026
We handle your personal data with care and only process what is necessary. This policy explains which data we process, why, for how long, and what your rights are (Art. 13 GDPR).
1. Controller
SMART BOUW BV (CarCentrale), Statiestraat 31, 2070 Zwijndrecht, Belgium, company number BE0800.306.022. Privacy contact: smartbouwbv@gmail.com.
2. What data, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, e-mail, password (encrypted), phone, language | Creating and managing your account, login, account communications | Performance of contract (Art. 6.1.b) |
| Company name, company number, address (dealers) | Trader traceability and display with listings | Legal obligation (Art. 6.1.c — Art. 30 DSA) |
| Listing content: vehicle details, photos, price, description, postcode and town | Publishing your listing | Performance of contract |
| Messages between buyers and sellers (name, e-mail, optional phone, message) | Forwarding to the seller; evidence in case of abuse | Performance of contract; legitimate interest (fraud prevention) |
| Favourites and search alerts | Storing your preferences and e-mailing new results | Performance of contract |
| Reports and moderation decisions | Handling reports, giving reasons for decisions, complaints | Legal obligation (DSA) |
| Pseudonymised IP address (irreversible hash), timestamps of actions, login attempts | Security, preventing spam, fraud and abuse | Legitimate interest (Art. 6.1.f) |
| E-mail for newsletter (only if ticked) | News and tips from CarCentrale | Consent (Art. 6.1.a), withdrawable at any time |
Photos are re-saved on upload, which removes hidden metadata such as GPS location. We never store your full IP address. Your password is only stored in encrypted (hashed) form.
3. What is public?
A listing shows its content, your name, your town and postcode and — only if you enable it — your phone number. For dealers, also the legally required company details. Your e-mail address is never public.
4. Recipients
- Sellers receive the data a buyer enters in a message.
- Hosting provider: our website, database and e-mail are hosted by hosting.com (A2 Hosting) in a data centre in the European Union (the Netherlands), as processor.
- AI selling assistant (only if you use it): the photos and text you provide are processed by Anthropic PBC (Claude API, USA) as processor to propose your listing. Transfers rely on the EU Standard Contractual Clauses. Anthropic does not use this data to train AI models. You can always fill in the listing yourself without AI.
- Authorities, only where required by law.
We never sell your data and use no advertising networks or tracking services.
5. Retention periods
- Account data: as long as your account exists; erased or anonymised immediately after deletion.
- Listings and photos: until you delete them; expired or sold listings are deleted automatically 12 months later.
- Messages: 24 months, then deleted automatically.
- Sent e-mail log: 180 days. Security log: 2 years.
- Moderation decisions and reports: 5 years (evidence and legal obligations).
- Unused empty drafts: 30 days.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time. In "Settings" you can download all your data (JSON) and delete your account. For other requests e-mail smartbouwbv@gmail.com; we reply within one month.
You can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).
7. Security
Encrypted connections (HTTPS), encrypted passwords, protection against automated attacks, restricted staff access and logging of sensitive actions.
8. Automated decision-making
Listings are automatically checked for fraud indicators. At most this leads to a manual review by a staff member; a listing is never permanently refused solely by automated means.
9. Cookies
See our cookie policy. We only use strictly necessary cookies.