Privacy Policy

The data controller for the personal data collected through the Platform www.caroga.be is Caroga, represented by its managing director. For any questions regarding the protection of your data, you may contact us at info@caroga.be.

In the course of using the Platform, Caroga collects the following categories of data: • Identification data: surname, first name, email address, phone number, VAT number (professionals). • Advertisement data: vehicle information (make, model, price, mileage, photos), advertisement status. • Browsing data: IP address, browser type, pages visited, visit duration, via Google Analytics 4 and Vercel Analytics. • Payment data: banking information is processed exclusively by Stripe and is never stored on Caroga's servers.

Your data is processed for the following purposes: • Creation and management of your user account. • Publication, display and management of vehicle advertisements. • Connecting Sellers and Buyers (contact form, phone number display). • Subscription management and invoicing. • Sending transactional emails (registration confirmation, contact notifications, subscription reminders). • Improving the Platform through statistical traffic analysis. • Fraud prevention and Platform security.

Data processing is based on: • Performance of the contract: processing necessary for the provision of the service (account management, advertisement publication, payment). • Consent: the use of analytical cookies (Google Analytics 4) is subject to your consent via the cookie banner. • Legitimate interest: fraud prevention and Platform security.

Your data may be shared with the following technical providers, strictly for the purpose of service delivery: • Supabase Inc.: database hosting (EU West region — Frankfurt, Germany). • Cloudinary Ltd.: image hosting and optimisation. • Stripe Payments Europe, Ltd.: secure payment processing. • Resend Inc.: transactional email delivery. • Vercel Inc.: website hosting and analytics. • Google LLC: analytics (Google Analytics 4) and indexing (Google Search Console). Caroga does not sell, rent or transfer your personal data to third parties for commercial purposes under any circumstances.

Certain providers (Vercel, Cloudinary, Google, Resend) may process data in the United States. These transfers are governed by the EU-U.S. Data Privacy Framework or by standard contractual clauses approved by the European Commission, in accordance with the General Data Protection Regulation (GDPR).

• Active account data: retained for the entire duration of registration on the Platform. • Data after account deletion: deleted within 30 days, except for data required to comply with legal obligations (invoicing: 7 years). • Analytical cookies: maximum duration of 13 months in accordance with the recommendations of the Belgian Data Protection Authority.

The Platform uses strictly necessary cookies for website operation (authentication, language preferences) that do not require consent, as well as analytical cookies (Google Analytics 4, Vercel Analytics) subject to your consent via the cookie banner displayed on your first visit. You may modify your preferences at any time from the cookie settings accessible at the bottom of the page.

In accordance with the GDPR (EU Regulation 2016/679), you have the following rights: • Right of access: obtain confirmation that your data is being processed and receive a copy. • Right to rectification: have your inaccurate or incomplete data corrected. • Right to erasure: request the deletion of your data, subject to legal retention obligations. • Right to restriction: request the restriction of the processing of your data in certain cases. • Right to portability: receive your data in a structured and commonly used format. • Right to object: object to the processing of your data on legitimate grounds. To exercise these rights, send your request to info@caroga.be. Caroga undertakes to respond within 30 days. In the event of a disagreement, you have the right to lodge a complaint with the Data Protection Authority (DPA) — www.dataprotectionauthority.be.

Caroga implements appropriate technical and organisational measures to protect your data against unauthorised access, modification, disclosure or destruction. These measures include connection encryption (HTTPS/TLS), secure authentication, database-level security policies (Row Level Security), and outsourced payment processing through a PCI-DSS certified provider.

This policy may be amended to reflect legal or technical developments. Any substantial amendment will be communicated to registered users by email. The date of the last update is indicated at the bottom of this page.