Privacy notice

Template. Complete it with your legitimate-interest assessment (LIA) and DPIA, and have it reviewed before launch.

Controller

SMART AUTOCONSTRUCT SRL, Str. Parcului nr. 1, sc. 1, ap. 12, Beclean, jud. Bistrița-Năsăud, România, CUI 43746129 · J2021000207064. Contact: [contact@example.com].

What we process

• Search data: country, registration plate, the purpose you selected, date and time, and a one-way hash of your IP address.
• Vehicle data returned: VIN and technical data (make, model, version, year, fuel, engine, power, body, transmission, doors, colour). We never request or store data about the owner or keeper.
• Payment data: handled by our payment processor. We receive only the payment status and, for business packs, the email for the invoice.
• Business accounts: a hash of your access key and your credit balance.
• Customer accounts (optional): your email address, a one-way hash of your password (or, if you sign in with Google, your Google account ID and email), and the list of reports you bought, so you never pay twice for the same plate. You can delete your account at any time from "My account"; this removes the login and the link to your reports.

Why, and on what legal basis

A registration plate and a VIN linked to it can, in some cases, relate to an identifiable person (CJEU, C-319/22). We process them to provide the report you request (Art. 6(1)(b) GDPR, performance of a contract) and, towards the vehicle keeper, on the basis of legitimate interest (Art. 6(1)(f) GDPR): helping buyers, garages and insurers identify a vehicle correctly and prevent fraud. To keep this balanced, we return technical data only, require a declared purpose for every search, limit the number of searches per connection and keep a log to detect misuse.

Recipients

To answer a search we send the country and plate to licensed vehicle-data providers acting on our behalf. Payments are handled by a payment processor, and the service runs on a hosting provider. Some of these recipients are outside the EU; transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask us for the list of recipients at [contact@example.com].

How long we keep it

The plate and the IP hash are erased from our search log after 365 days. The report (VIN and technical data) stays available through its link for that period. Payment records are kept as long as tax law requires.

Your rights

You can ask for access, correction, erasure, restriction, portability, or object to processing, by writing to [contact@example.com]. If you are the keeper of a vehicle and want to object to searches on your plate, write to us with the plate and country. You can also complain to your national data protection authority.

Cookies

We do not use tracking or advertising cookies. If you log in, we set one strictly necessary cookie (cp_session) that keeps you logged in for up to 90 days. Your browser stores your language, last country and business access key locally, on your device only. If you choose Google sign-in, Google's sign-in button loads from Google and is subject to Google's privacy policy.