Privacy Policy
This policy explains which personal data we process when you use voziti.eu, for what purposes, on which legal basis, for how long, and what rights you have.
1. Controller
SaltySoulCreatives · further details in the legal notice. A data protection officer is not required by law; please send any privacy questions via the contact page.
2. Hosting and server log files
The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Friedersdorf, Germany (processor under Art. 28 GDPR). Whenever a page is accessed, the server processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. This serves delivery, stability and security (Art. 6(1)(f) GDPR). Log files are deleted or anonymised by the host after a short time. To protect against misuse (e.g. too many login attempts) we additionally store a non-reversible hash of the IP address for a short time.
3. User account
On registration we process your email address, password (stored only as an encrypted hash), name or display name, account type (private/dealer) and optional profile details such as phone number, town/postcode, company name, address, tax number (OIB/VAT ID), website, opening hours and logo. The purpose is to provide the account and the platform (Art. 6(1)(b) GDPR). The data is kept as long as the account exists and removed after the account is deleted, unless retention obligations apply.
4. Listings and publicly visible data
The content of listings (texts, photos, vehicle data, price, location) as well as your display name, company details for dealers and – if you wish – your phone number are publicly visible, are shown in all language versions and may be indexed by search engines. The vehicle identification number (VIN) is never shown publicly. The legal basis is Art. 6(1)(b) GDPR. Listings run for 90 days; expired listings that are not reactivated are deleted together with their photos six months later. If you do not want them shown, please do not publish number plates or people in photos.
Dealers can transfer listings by spreadsheet upload or via connected dealer software (e.g. SALTYDATA); the transferred listing data and photos are processed in the process. You can also upload photos with your smartphone via QR code; a short-lived upload session is created for this.
5. Messages, watch list and contact
We store messages between users in order to deliver and display them (Art. 6(1)(b) GDPR); you are notified of new messages by email. Messages are deleted automatically after 90 days. We do not read messages except in the case of a report or a specific suspicion of misuse. Your watch list is linked to your account. We process enquiries via the contact page or by email to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them once they have been dealt with and no retention obligation applies. When you make contact via WhatsApp links, WhatsApp’s privacy policy applies; voziti.eu does not transfer any data to WhatsApp unless you click the link.
6. Payments (Stripe)
Paid services are processed via Stripe Payments Europe Ltd., Dublin, Ireland. Payment details are entered directly with Stripe; we do not receive full card or account details, only the payment status, amount, service and email address. The legal basis is Art. 6(1)(b) and (c) GDPR. Stripe may also transfer data to the USA (EU-US Data Privacy Framework or standard contractual clauses). We keep invoice and booking data for up to ten years in accordance with tax and commercial law obligations. Stripe’s privacy policy: https://stripe.com/privacy
7. Emails
We only send system and contract-related emails (e.g. registration confirmation, password reset, new message, listing expiry, payment confirmation) via our host’s mail server. We do not send advertising newsletters.
8. Translation, description assistant and smart search (AI)
For the automatic translation of listing texts, assistance with writing descriptions and natural-language search we use the interface of xAI (X.AI LLC, USA). Only the relevant texts or vehicle data and search queries are transferred – no names, email addresses or IP addresses of users. Please do not include personal data in descriptions and search queries. Translations are cached on our side so that they do not have to be requested again. The legal basis is Art. 6(1)(b) and (f) GDPR (multilingual marketplace, convenient search). The transfer to the USA is based on standard contractual clauses (Art. 46 GDPR) or – where the provider is certified – the EU-US Data Privacy Framework.
9. Maps and location search
On listing and dealer pages we display maps from OpenStreetMap (OpenStreetMap Foundation, United Kingdom); the location is converted into coordinates using the Nominatim service. In the process your IP address and the location searched for are transferred to OpenStreetMap’s servers. The legal basis is Art. 6(1)(f) GDPR (showing the location). There is an EU adequacy decision for the United Kingdom. Privacy policy: https://osmfoundation.org/wiki/Privacy_Policy
10. External content (CDN)
We load some software libraries and icons from content delivery networks: cdnjs (Cloudflare, Inc., USA) for the map library, unpkg (Cloudflare, Inc., USA) for icons and flagcdn.com for country flags. In the process your IP address is transferred to the respective provider. The legal basis is Art. 6(1)(f) GDPR (fast, reliable display). Cloudflare is certified under the EU-US Data Privacy Framework. Fonts are loaded from our own server; there is no connection to Google Fonts.
11. Advertising and partner links
We count clicks on our own advertising banners anonymously (number of clicks, no personal data). On some pages we show marked partner links to online shops (e.g. tyre retailers) via the affiliate network Awin (AWIN AG, Berlin, Germany). No data is transferred to Awin when the page loads. Only when you click a partner link are you redirected to the shop via Awin; Awin and the shop may then set cookies to attribute a purchase to the link. Awin and the respective shop are responsible for this; we only receive anonymous commission data. Awin’s privacy policy: https://www.awin.com/gb/privacy
12. Cookies and local storage
We only use technically necessary cookies and browser storage: a session cookie for logging in (deleted when you log out or the session ends), a cookie and a local entry for the selected language (one year), and local entries for settings and drafts. These are strictly necessary for the features you request (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR); no consent is required for them. We do not use analytics or advertising tracking cookies. You can delete cookies in your browser at any time.
13. Recipients and third countries
Depending on the feature, recipients of your data are other users (public listings, messages), our host, Stripe, xAI, OpenStreetMap, the CDN providers mentioned and, if you click partner links, Awin. Authorities receive data only if we are legally obliged to provide it. Data is transferred to countries outside the EU/EEA only as described in the individual sections. We do not sell data.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21). You can change many details yourself in your profile and delete listings yourself. To delete your account or for any other request, a message via the contact page is sufficient.
You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. In Croatia: Agencija za zaštitu osobnih podataka (AZOP), www.azop.hr.
15. Security, no automated decision-making, changes
Data is transmitted in encrypted form (HTTPS); passwords are stored only as hashes. There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Providing data is neither a statutory nor a contractual requirement; however, without the details needed for an account you cannot publish listings. We update this policy when features or the legal situation change; the version published here applies.