Privacy notice

The controller is the operator of autotrade360 named in the Imprint. Write to the address below on privacy matters. We have no separate data protection officer.

• We handle as much data as the service, security and the law require — no more.
• We do not sell your data, nor pass it on for advertising.
• We have no tracking, analytics or advertising cookies.
• A listing is visible to everyone; but if you advertise as a private person, your name appears only if you switch on your public seller page.

The table below shows the processing activity by activity. The legal basis refers to Article 6(1) GDPR: “contract” to point (b) (providing the service), “legitimate interest” to point (f) (protecting the service and its users).

• Account

  Data

  name, email address, password (only as an irreversible one-way hash), language, account type; for a dealer its name, company name, tax number, phone, website, logo, location

  Purpose and legal basis

  the account and the service — contract

  How long

  until the account is deleted

• Signing in with another account

  Data

  the identifier, email address and name of the Google, Facebook, Microsoft or Apple account (we never receive the password)

  Purpose and legal basis

  sign-in and registration — contract; the provider’s own rules apply too

  How long

  until the account is deleted

• Listing

  Data

  vehicle details, equipment, pictures (watermarked), price, description, town and postcode, the seller’s chosen contact details; the VIN is never published, an unfinished listing is a private draft

  Purpose and legal basis

  showing the listing — contract

  How long

  until the listing or the account is deleted

• Message to a seller

  Data

  the sender’s name, email address, any phone number given, the message and the listing; the message goes to the seller, who from then on is a controller in their own right

  Purpose and legal basis

  getting in touch — contract

  How long

  until the account is deleted

• Saved items and alerts

  Data

  parked listings and saved searches, alert frequency, followed dealers, recently viewed listings; kept only in the browser while signed out, moved to the account on signing in

  Purpose and legal basis

  saved items and email alerts (switch off any time) — contract

  How long

  until you delete them, at the latest until the account is deleted

• Sessions

  Data

  IP address, browser identifier, time of last use

  Purpose and legal basis

  keeping you signed in, detecting abuse — legitimate interest

  How long

  30 days after expiry or signing out

• Email links

  Data

  the confirmation link (valid for 48 hours) and the password reset link (valid for 60 minutes), only as hashes

  Purpose and legal basis

  confirming the address, changing the password — contract

  How long

  30 days after expiry

• Preventing abuse

  Data

  blocked email domains and IP addresses, the number of sign-in attempts

  Purpose and legal basis

  filtering out unwanted and fraudulent registrations — legitimate interest

  How long

  while the rule stands

• Administrator log

  Data

  who did what, when and from where (IP address, browser)

  Purpose and legal basis

  accountability for privileged access — legitimate interest

  How long

  as long as the log’s purpose requires

• System emails

  Data

  email address and the subject of the email: confirmation, password change, the state of your listings, a new enquiry, saved search alerts; no newsletter or advertising without your consent

  Purpose and legal basis

  information tied to the service — contract

  How long

  until delivery

• Views

  Data

  one aggregate count per listing; no cookie and no visitor profile

  Purpose and legal basis

  so the seller can see how popular the listing is — legitimate interest

  How long

  until the listing is deleted

• Billing

  Data

  none at present — every package is free; for a paid service the data invoicing requires, with the payment provider named in advance

  Purpose and legal basis

  legal obligation (Accounting Act)

  How long

  8 years

• Our providers: the hosting provider, the image store and the email provider, each under a data processing agreement. Where one of them works outside the European Economic Area, the transfer is made with the safeguards of the GDPR (for example the EU–US Data Privacy Framework or standard contractual clauses).
• The providers of external sign-in (Google, Facebook, Microsoft, Apple) — if you choose it — in their own right, as independent controllers. YouTube (Google) likewise, if you play a YouTube video on a listing.
• The seller — the details of the message you send them.
• Authorities — where the law obliges us.

Our providers’ details:

The pages are served only over an encrypted (HTTPS) connection. Passwords are stored as one-way hashes, and session identifiers and email links are hashed too. Only those whose work needs it can reach the data; roles set the permissions. If a personal data breach occurs, we act under Articles 33–34 GDPR.

• Ask what data we hold about you, and request a copy.
• Ask for incorrect data to be corrected — you can change most of it in your account yourself.
• Ask for your data to be deleted; you can delete your account yourself on the Settings page in Studio. Issued invoices are still kept, as the accounting act requires.
• Ask for processing to be restricted, and object to processing based on legitimate interest.
• Ask for your data in a machine-readable format.

We answer within a month; a complex request may extend this by two months. We may first make sure that the request really comes from you.

If you are not satisfied, write to us first. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, naih.hu), and go to court — including the regional court of your place of residence or stay.

• People under 18 may not use the service; if we find that a minor has registered, we delete the account.
• We update this notice when the service or the law changes. We announce significant changes on the Website and by email.