PRIVACY POLICY (GDPR)

Preamble
The protection of your personal data is a top priority for CARTOBIKE. The purpose of this Privacy Policy is to provide you with transparent information about how we collect, use and protect your data, as well as your rights.

1. Data Controllers
The data collected on the CARTOBIKE platform is processed jointly by:
• CARTOBIKE SRL (Belgium), Place du Champ de Mars, 5 - 1050 Brussels •contact@cartobike.com
• CARTOBIKE SASU (France), 60 rue François 1er - 75008 Paris • contact@cartobike.com
(hereinafter referred to collectively as "CARTOBIKE" or "We").

2. Data Protection Officer (DPO)
We have appointed a Data Protection Officer to ensure compliance with our processing activities.
Name: Mr Moussa JADIR
Contact: contact@cartobike.com
Postal address: DPO CARTOBIKE, Place du Champs de Mars, 5 - 1050 Brussels, Belgium

3. Data Collected
We collect the following data based on your use of our services:

3.1. When you register and manage your account
• Identity: Surname, first name, title
• Contact details: Email address, telephone number, postal address
• Identifiers: Password (encrypted)
• Professional data (if applicable): Company name, VAT number, Kbis

3.2. When verifying your identity (KYC)
• Copy of identity document (ID card, passport)
• Photo of your face (verification selfie)

3.3. During your transactions and browsing
• Transaction data: History of purchases, sales, auctions, payments
• Technical data: IP address, browser type, device used, connection logs
• Browsing data: Pages viewed, adverts viewed, searches performed (via cookies)

3.4. When using the Support Service
• Nature of the project (purchase, sale, financing, etc.)
• Preferences and needs expressed
• Context of the request (vehicle viewed, budget)

4. Purposes and Legal Bases for Processing

Purpose of processing: User account management and access to the platform
Legal basis (GDPR): Performance of the contract (Art. 6.1.b)

Purpose of processing: Management of transactions (auctions, sales, payments)
Legal basis (GDPR): Performance of the contract (Art. 6.1.b)

Purpose of processing: Identity verification and fraud prevention
Legal basis (GDPR): Legal obligation (Art. 6.1.c) and Legitimate interest (Art. 6.1.f)

Purpose of processing: Support service and partner networking
Legal basis (GDPR): Consent (Art. 6.1.a)

Purpose of processing: Transmission of buyer's contact details to professional seller (B2C)
Legal basis (GDPR): Legitimate interest (Art. 6.1.f) - Facilitating the transaction

Purpose of processing: Sending newsletters and commercial offers
Legal basis (GDPR): Consent (Art. 6.1.a)

Purpose of processing: Improvement of services and statistics
Legal basis (GDPR): Legitimate interest (Art. 6.1.f)

Purpose of processing: Management of disputes and litigation
Legal basis (GDPR): Legitimate interest (Art. 6.1.f)

5. Recipients of the Data
Your data may be transmitted to the following recipients, within the limits of their respective responsibilities: our partners

5.1. Inter nal recipients and service providers
• Authorised CARTOBIKE personnel
• Technical service providers (hosting, maintenance)
• Payment service providers (Stripe, banks)
• Identity verification service providers

5.2. Support service partners
Only with your explicit consent will your data be shared with our partners in order to respond to your specific requests:
• Car dealerships and distributors
• Banks and credit institutions
• Insurance companies
• Specialised platforms
These partners act as independent data controllers.

5.3. Authorities
To the competent administrative or judicial authorities, upon legal request.

6. Data transfers outside the EU
Some of our service providers (e.g. Google, Stripe) may be located outside the European Union.
These transfers are governed by appropriate safeguards, including:
• The EU-US Data Privacy Framework for certified service providers (replaces the Privacy Shield)
• The European Commission's Standard Contractual Clauses (SCCs)

7. Retention Period
• Active account: As long as the account is not deleted
• After account deletion: 14 days (backups) then permanent deletion (unless legally required)
• Transaction data: 10 years (accounting and tax obligations)
• Data (Support Service): 180 days after transmission to the partner
• Identity data (KYC): Duration of the contractual relationship + 5 years (anti-money laundering)
• Cookies: Maximum 13 months

8. Your rights
In accordance with the GDPR, you have the following rights:
• Right of access: Obtain a copy of your data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request the deletion of your data ("right to be forgotten")
• Right to restriction: Temporarily suspend the use of your data
• Right to portability: Retrieve your data in a structured format
• Right to object: Refuse processing based on legitimate interest (e.g. commercial prospecting)
• Right to withdraw consent: At any time, for processing based on consent (e.g. newsletter)
Exercising your rights:
By email tocontact@cartobike.com or from your personal account.

9. Cookies
We use cookies to ensure the proper functioning of the site, measure audience and personalise content.
You can manage your cookie preferences at any time via the "Cookie management" link at the bottom of the page.

10. Security
We implement technical (encryption, firewalls) and organisational (access control) security measures to protect your data.

11. Changes to the Policy
We may amend this policy at any time. The current version is the one published on our website.