← Back to home

Privacy Policy

Last updated on July 21, 2026

Preamble

This policy describes how Carvoh processes your personal data when you use the Carvoh automotive marketplace (the "Site").

It may be updated to reflect legal or operational changes. The last update date appears at the top of this page.

1. Data controller

Data controller: Carvoh.

Registered office: Rue de la Station 8, 6040 Jumet (Belgium).

Crossroads Bank for Enterprises (BCE) number: 1018 823 563.

Privacy contact: contact@carvoh.com.

Applicable framework: Regulation (EU) 2016/679 (GDPR) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

2. What data do we process?

We only process data necessary for the purposes below. Details depend on how you use the Site.

Account and authentication

  • Identity and contact: name, email address, profile photo and cover image where applicable.
  • Account type (individual or professional), preferred language and country.
  • Authentication data: hashed password, email verification, sessions, security tokens; two-factor authentication if enabled.
  • Session metadata: IP address and user agent linked to the session.

Professional accounts and organizations

  • Business details: VAT number, legal address, manager name, phone number, opening hours.
  • PRO account verification status and, where applicable, internal review notes.
  • Organization data: name, slug, members, invitations, logo and verification status.

Listings and media

  • Listing content: title, description, price, vehicle attributes, location (city / country), declared documents and history.
  • Technical identifiers you choose to provide (e.g. VIN).
  • Photos and other uploaded media files, including via temporary upload links.
  • Favorites, saved searches and listing-related events (views, contacts).

Messaging and offers

  • Conversations linked to a listing (buyer / seller).
  • Message content, reactions, reports and moderation decisions.
  • Price offers exchanged in the conversation (amount, currency, status).

Contact, reports and administration

  • Listing contact messages (email and content).
  • Listing or message reports.
  • Admin and security logs for authorized staff.

Preferences and cookies

  • Language (CARVOH_LOCALE cookie) and country (CARVOH_COUNTRY cookie).
  • Search display preference (automarket-search-view cookie).
  • Platform access cookie (carvoh_platform_gate) when the access gate is enabled.
  • Authentication session cookies required for sign-in.
  • Details: see the Cookie Policy.

3. Legal bases

  • Account creation and management, listing publication, messaging, offers and requested features: performance of a contract / pre-contractual steps (GDPR art. 6.1.b).
  • PRO and organization verification, fraud and abuse prevention, Site security: legitimate interest (art. 6.1.f) and, where applicable, legal obligations (art. 6.1.c).
  • Strictly necessary cookies and language / country / display preferences: legitimate interest and necessity of the requested service; consent for any non-essential storage (art. 6.1.f and 6.1.a).
  • Marketing communications: only with your consent (art. 6.1.a), withdrawable at any time.
  • Accounting, tax or dispute retention: legal obligation (art. 6.1.c).

4. Retention periods

  • Account and profile: for the life of the account, then deletion or anonymization after closure, unless a legal obligation or dispute requires otherwise.
  • Listings, media, favorites and saved searches: for the life of the account / listing, then as required operationally and by law.
  • Messages, offers and reports: for the relationship and as needed for moderation, security and disputes.
  • Authentication sessions: until session expiry or revocation.
  • CARVOH_LOCALE / CARVOH_COUNTRY / automarket-search-view cookies: up to 12 months.
  • carvoh_platform_gate cookie: up to 7 days.
  • Accounting / tax records: applicable Belgian statutory periods.

5. Recipients

Your data may be accessed by authorized staff and processors (hosting, transactional email via Resend, technical infrastructure), under appropriate contractual safeguards.

Depending on your actions, some profile or listing information is visible to other users (e.g. published listings, messages with a counterparty).

We disclose data to authorities when required by law or legal process.

List of main processors: available on request at contact@carvoh.com.

6. Transfers outside the EU

Processing is primarily located in the European Union.

If a provider involves a transfer outside the EU, it relies on an adequacy decision or appropriate safeguards (e.g. standard contractual clauses), under GDPR Chapter V.

7. Your rights

You have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is based on consent, under the conditions of the GDPR.

How to exercise your rights

Contact: contact@carvoh.com or post to Rue de la Station 8, 6040 Jumet (Belgium).

Response within one month (extendable by two months if needed, with notice within the first month).

Manifestly unfounded or excessive requests may be refused.

8. Complaints

Belgian Data Protection Authority: https://www.autoriteprotectiondonnees.be — Rue de la Presse 35, 1000 Brussels — +32 (0)2 274 48 00 — contact@apd-gba.be.

You may also bring proceedings before the competent court of your place of residence.

9. Security

Appropriate technical and organisational measures: HTTPS, password hashing, access controls, moderation and security logging.

Further details on request: contact@carvoh.com.

10. Cookies

See the Cookie Policy for the list, purposes and durations.

11. Governing law

Belgian law. Disputes: courts of the judicial district of Charleroi, without prejudice to mandatory consumer protection rules.