Privacy policy

4.1. Technical data, cookies, similar technologies, and server-side technical processing

When accessing the website, we may process technical data such as IP address, online identifiers, browser information, device used, operating system, date and time of access, pages accessed, traffic source, and other similar technical information, depending on the cookies and similar technologies used on the site.

For detailed information about cookies, similar technologies, cookie categories, involved providers, storage duration, and the method of expressing/withdrawing consent, please consult the Cookie Policy.

Separately from cookies and similar technologies that involve storing or accessing information on the user's device, CERTCAR SRL may carry out certain technical server-side processing, necessary for the operation, security, and protection of the platform against unauthorized access, fraud, spam, automated traffic, or other forms of abuse.

This processing may include the IP address transmitted through Cloudflare infrastructure, used for security purposes, technical diagnostics, traffic management, and protection against unauthorized or abusive access.

In development or testing environments, the IP address may be transformed through SHA-256 algorithm for managing access lists, without storing the IP address in plain text.

The platform may also use country-level geolocation information provided through Cloudflare infrastructure, for the purpose of applying contractual requirements regarding the display of certain categories of data in reports. In this context, only the country code is used, without storing the IP address for precise geolocation purposes.

When using Google reCAPTCHA v3, Google may process certain technical and behavioral signals from the device or browser to determine a risk score. CERTCAR SRL stores only the score returned by the reCAPTCHA service, for the purpose of protecting forms, preventing abuse, and ensuring platform security.

Purpose of processing: technical operation of the website, ensuring security, traffic management, fraud and abuse prevention, form protection against spam and automated access, remembering cookie preferences, generating traffic and platform performance statistics, service improvement, conversion measurement and attribution, evaluation and optimization of advertising campaigns, and, in the case of the TikTok Pixel and the Meta Pixel, the creation of remarketing audiences, under the conditions described in the Cookie Policy.

Legal basis: legitimate interest of the Controller for the operation, security, management, and protection of the website, fraud and abuse prevention, and security incident prevention; performance of a contract or taking pre-contractual steps when technical data is necessary for providing user-requested services; consent of the data subject for non-essential cookies and similar technologies used for statistical analysis, conversion measurement and attribution, advertising campaign optimization, and remarketing; legal obligation, if processing is necessary to comply with legal requirements applicable to the Controller. Regarding cookieless technical signals transmitted through Google Consent Mode v2 in the absence of consent for the marketing category, to the extent they constitute personal data, processing is based on CERTCAR SRL's legitimate interest in obtaining aggregated measurements of advertising campaign effectiveness, without using these signals to create remarketing audiences or to individually track users by CERTCAR SRL.

Retention period: technical data is retained for the duration necessary to fulfill the purposes for which it is processed, according to the terms indicated in the Cookie Policy, technical provider settings, cookie or similar technology lifespans, and the Controller's internal logging, security, and fraud prevention policies. The reCAPTCHA score, technical logs, and security information are retained only for as long as necessary to protect the platform, investigate incidents, prevent abuse, or defend CERTCAR SRL's rights.

4.2. Communications and social media

If you contact us by email, phone, contact form, chat, or other remote communication means, we may process data such as name, surname, email address, phone number, message content, the capacity in which you contact us, data regarding the request submitted, and any other information you voluntarily communicate to us.

If you interact with our social media pages, we may process data such as profile name or designation, profile picture, messages, comments, reactions, content sharing, public profile data, and other information you transmit to us or that is made available through the respective platform's functionalities. Information from social media accounts is stored in accordance with the terms and conditions established by the social network owners. Only the data explicitly identified above will be stored in our databases, and these are covered by this Policy.

Purpose of processing: contacting the data subject to provide a response to their request, managing communications, resolving requests, support, and defending CERTCAR SRL's rights.

Legal basis: performance of a contract or taking steps at the request of the data subject before concluding a contract, when the request concerns Certcar services; the legitimate interest of the Controller in responding to requests received, managing communications, resolving requests/complaints, and defending its rights; consent of the data subject only when separately requested for marketing communications or for other processing for which the law requires the data subject's agreement. (Art. 6(1)(a), (b), and (f) GDPR).

Retention period: data related to requests submitted by email, phone, contact form, chat, or other communication means is retained for the duration necessary to resolve the request and subsequently for a period of up to 3 years, to the extent necessary for proving communications, resolving complaints, or defending CERTCAR SRL's rights, unless the law requires or permits a longer period.

4.3. Account creation and service usage

If you create an account on the website and use Certcar services, we may process the following categories of data:

• a) account data: name, surname, email address, phone number, encrypted/hashed password, account identifier, account creation date, authentication history;
• b) billing data: name and surname or company name, address, tax ID for legal entities, Trade Register number where applicable, representative/contact data, information necessary for invoice issuance;
• c) payment data: payment status, amount, currency, transaction identifier, payment method, payment processor; CERTCAR SRL does not store complete bank card data on its own servers;
• d) order data: order number, VIN/chassis number entered, type of report requested, order status, generated report, order history, credits purchased/used, discount code, order-related communications;
• e) technical and security data: IP address, online identifiers, access logs, browser, device, operating system, date and time of access, data regarding consent expressed for cookies or contractual clauses, to the extent necessary;
• f) communications: messages sent to us, support requests, complaints, reports, responses, and documents provided by the user.

Processing purposes are:

• a) creation and management of the user account;
• b) receiving, processing, and delivering orders;
• c) generating and providing the requested report;
• d) managing credits, payments, refunds, and invoices;
• e) transactional communications regarding the account, order, payment, report, or requested support;
• f) compliance with tax, accounting, and legal obligations;
• g) fraud prevention, website security, logging relevant activities, and protecting Certcar's rights;
• h) resolving requests, complaints, and disputes;
• i) service improvement and internal analysis;
• j) direct marketing, conversion measurement and attribution, evaluation and optimization of advertising campaigns and, where applicable, the creation of remarketing audiences, only in compliance with the law and based on the legal basis applicable to each operation.

Legal bases are:

• a) performance of a contract or taking pre-contractual steps — for account creation, placing orders, generating and delivering the report, credit management, and transactional communications;
• b) legal obligation — for issuing and retaining invoices, accounting records, tax reporting, and responses to authorities;
• c) legitimate interest — for website security, fraud prevention, protecting Certcar's rights, maintaining records of terms acceptance, resolving complaints, defending rights in court, service improvement, and managing the relationship with users;
• d) consent — for non-essential cookies and similar technologies, direct marketing communications, newsletters, conversion measurement and attribution, advertising campaign optimization, the creation of remarketing audiences, and other processing for which the law requires the data subject's agreement.

Retention periods are established based on the processing purpose:

• a) account data — for the duration of the account's existence and subsequently for a period of 5 years from account closure or last activity, to the extent necessary for defending Certcar's rights;
• b) order and report data — for the duration of report availability in the account and subsequently for a period of 2 years, to the extent necessary for support, complaints, fraud prevention, and defending rights;
• c) invoices and financial-accounting documents — for the duration provided by applicable tax-accounting legislation;
• d) technical data and security logs — for a period of 1 year, except where longer retention is necessary for investigating fraud, security incidents, or defending rights;
• e) data processed based on consent — until consent is withdrawn or until the expiration of the duration indicated at the time of collection;
• f) data related to requests/complaints — for the duration necessary for resolution and subsequently for the period necessary to prove the method of resolution.

4.4. Certcar affiliates

If you become a Certcar affiliate, we may process data such as name, surname, email address, phone number, identification data necessary for concluding and executing the affiliate relationship, payment/bank account data, tax data, generated commissions, unique discount code, dashboard, invoices, communications, and data regarding affiliate activity.

Purpose of processing: analyzing the affiliate application, managing the contractual relationship, assigning the unique discount code, calculating and paying commissions, issuing/managing tax documents, fraud prevention, and protecting Certcar's rights.

Legal basis: performance of a contract, legal obligation, legitimate interest of Certcar, and, where applicable, consent for marketing communications.

Retention period: data related to the affiliate relationship is retained for the duration of the affiliate application analysis and, if the contractual relationship is concluded, for the duration of its execution and subsequently for the period necessary to fulfill tax, accounting, and contractual obligations and to defend CERTCAR SRL's rights. Financial-accounting data is retained according to the terms provided by applicable tax-accounting legislation.

4.5. Partner representatives

If you represent or act on behalf of a Partner legal entity, we may process data such as name, surname, position/capacity, professional email address, phone number, signature, professional identification data, communications, data necessary for concluding and executing the addendum, data regarding the unique discount code, dashboard, commissions, and invoices.

Purpose of processing: negotiating, concluding, and executing the partnership relationship, managing communications, assigning the unique code, calculating commissions, verifying partner conduct, fraud prevention, and defending Certcar's rights.

Legal basis: performance of a contract or taking pre-contractual steps, legal obligation, and the legitimate interest of Certcar in managing the relationship with partners and their representatives.

Retention period: data of representatives or contact persons of Partners is retained for the duration of negotiation, conclusion, and execution of the contractual relationship with the Partner and subsequently for the period necessary to fulfill legal obligations, resolve possible complaints or disputes, and defend CERTCAR SRL's rights.

4.6. Consent-based processing

Where the processing of personal data is based on consent, it will be requested separately, in a clear, specific form, distinct from other processing, through an affirmative action of the data subject.

Voluntary provision of additional information in free fields, forms, or communications sent to CERTCAR SRL does not automatically equate to expressing consent for any processing purpose. This information will be processed only to the extent necessary for analyzing and resolving the submitted request, for performing a contract, for taking pre-contractual steps, for complying with a legal obligation, or for protecting the legitimate interests of CERTCAR SRL, as applicable.

When a particular processing is based exclusively on consent, you have the right to withdraw your consent at any time, without the withdrawal affecting the legality of processing carried out prior to the withdrawal.

Consent withdrawal can be accomplished by modifying settings available in your account, by using the unsubscribe or withdrawal mechanisms provided, or by submitting a request to the email address indicated in this Policy.

We may maintain records regarding the granting, modification, or withdrawal of consent, for the purpose of demonstrating compliance with applicable legislation.

4.7. Direct marketing and advertising campaign measurement technologies

Processing data for sending direct marketing communications, newsletters, commercial offers, or promotional communications is carried out only based on the data subject's consent, with the possibility of withdrawing it at any time. Withdrawal of consent does not affect the legality of processing carried out prior to withdrawal.

Separately from direct marketing communications, CERTCAR SRL uses the TikTok Pixel, the Meta Pixel, and the Google Ads tag for conversion measurement and attribution, evaluation and optimization of advertising campaigns and, in the case of the TikTok Pixel and the Meta Pixel, the creation of remarketing audiences.

The TikTok Pixel and the Meta Pixel do not set cookies and do not transmit data to TikTok or Meta, respectively, before the user expresses consent for the marketing category through the cookie management mechanism. Refusing consent keeps these technologies disabled, and subsequent withdrawal of consent stops any further transmission of data through them.

The Google Ads tag is implemented through Google Consent Mode v2. In the absence of consent for the marketing category, no Google Ads advertising cookies are set, but cookieless technical signals may be transmitted to Google, used for aggregate conversion modeling and estimation. After consent is expressed, the Google Ads tag may set and use the advertising cookies described in the Cookie Policy.

Through these technologies, depending on the tool used and the event tracked, data may be processed such as IP address, online identifiers, cookie or device identifiers, browser and operating system information, pages viewed, traffic source, the URL of the previously visited page, advertising click identifiers, and information about the user's interactions with the site, including viewing a page, initiating the checkout process, or completing a payment.

Detailed information about cookie names, providers, purposes, storage durations, and the method of expressing or withdrawing consent is available in the Cookie Policy.

4.8. Data from third-party sources for reports

Regarding data processed for generating and providing reports, Certcar may receive, access, query, structure, or display data from contractual suppliers, authorities, registries, database operators, technical platforms, or other third-party sources, under the terms of the contracts concluded with them and applicable legislation.

Certcar does not fully determine how third-party sources collect, update, correct, or supplement the data in their own systems. The user is obligated to use the data received through the Report in compliance with the law, the Terms and Conditions, and the rights of data subjects.

4.9. Automated decisions and profiling

CERTCAR SRL does not use decision-making processes based solely on automated processing that produce legal effects on the data subject or similarly significantly affect them, within the meaning of Article 22 of Regulation (EU) 2016/679.

Generating reports regarding vehicle history, technical verifications, anti-abuse scores, or anti-fraud mechanisms may involve automated processes or technical queries of databases, but these are not intended to adopt an automated legal decision regarding the data subject.

The use of the TikTok Pixel and the Meta Pixel and the creation of remarketing audiences may involve the automated analysis of users' events and interactions with the site and their inclusion in certain advertising categories or audiences. These operations may constitute profiling activities for advertising purposes but do not, from CERTCAR SRL's perspective, produce legal effects on the data subject and do not similarly significantly affect them within the meaning of Article 22 of Regulation (EU) 2016/679.

Advertising platform providers may carry out subsequent processing according to their own privacy policies, applicable terms, and their own legal bases.

4.10. Data minimization principle

The principle of personal data collection that guides us consists in respecting confidentiality, so that we collect and process, under security conditions, exclusively the data necessary for providing services, according to the purpose of their collection, for the period they are necessary, and they are not disclosed to third parties except in situations where they are necessary for performing services or fulfilling legal obligations.

4.11. Minimum age

Our services are intended for persons interested in verifying a vehicle, i.e., professionals, public authorities, potential buyers, etc., implicitly users over 18 years of age, so we do not intend to collect and process through our website data of persons under the age of 18.

4.12. Data deletion

When the data processing period expires (processing is no longer necessary/consent withdrawal), measures will be applied regarding deletion, anonymization, archiving, destruction in accordance with applicable legal procedures and the requirements for protecting the interests of data subjects. If personal data is deleted at your request, CERTCAR SRL may retain copies of the information to the extent necessary to protect its legitimate interests and those of third parties, to comply with legal obligations, to establish, exercise, or defend a right in court, and to resolve disputes.