Privacy policy

1. Data controller

The data controller is Carvia operator (name to be specified) (registration code to be specified, address to be specified). For data-protection questions, contact privaatsus@carvia.ee.

2. Data we process

• Account data: name, email address and password hash (not the password itself).
• Contact data: phone number if you choose to add it.
• Listing data: vehicle registration number, VIN, technical data, price, photos and documents.
• Usage data: IP address, session cookie and activity logs required for security.
• With your consent: analytics data about use of the platform.

3. Purposes and legal bases

• Creating an account and providing the platform — performance of a contract (GDPR Art. 6(1)(b)).
• Preparing, checking and publishing listings — contract and legitimate interests.
• AI analysis of photos and documents to improve listing quality — legitimate interests.
• Security, fraud prevention and logging — legitimate interests.
• Analytics and service improvement — your consent (GDPR Art. 6(1)(a)).
• Compliance with legal obligations — legal obligation.

4. Automated processing and artificial intelligence

Carvia uses artificial intelligence to analyse listing photos and data, for example to detect equipment, compare prices and flag conflicts. It assists with preparing a listing and does not make automated decisions that produce legal effects for you. AI results are indicative and reviewable by a person.

5. Processors and international transfers

We use trusted providers that process data on our behalf, including cloud hosting and databases, an AI-analysis provider and, with your consent, analytics services. Some providers may be outside the European Economic Area; in that case we use appropriate safeguards such as European Commission standard contractual clauses.

We do not sell your personal data.

6. Retention periods

• We retain account data while the account exists and for a reasonable period after deletion to meet legal requirements.
• We retain listing data for the life of the listing and archive it after removal.
• Security logs are retained for a limited period for security purposes.

7. Your rights

• The right to access your data and receive a copy.
• The right to correct and erase data.
• The right to restrict processing and object to processing.
• The right to data portability.
• The right to withdraw consent at any time without affecting earlier lawful processing.
• The right to complain to the Estonian Data Protection Inspectorate (aki.ee).

8. Account deletion and data export

You can request account deletion or a data export by writing to privaatsus@carvia.ee. We will respond within the time limit provided by the GDPR.

9. Cookies

Our separate cookie policy describes how cookies are used. Necessary cookies are essential to operate the platform; analytics and marketing cookies are used only with your consent.

10. Changes and contact

We may update this policy from time to time and will announce material changes on the platform. Contact us at privaatsus@carvia.ee.