Privacy Policy

1. Controller and Scope

For the activities described in this Policy, the operator of AlphaAuto acts as the data controller for the platform's own processing operations.

When sellers, buyers, dealerships or other users process personal data independently outside the platform, they act as separate controllers for their own activities and responsibilities.

• Controller: AlphaAuto
• Registered office: Bucharest, Romania
• Location: Bucharest, Romania
• Email: contact@alphaauto.ro
• Phone: +40 733 626 626

• For privacy requests or complaints, you can contact us using the email address and phone number shown at the end of this page.

2. Categories of Personal Data We Process

Depending on how you use AlphaAuto, we may process the following categories of data:

• Account and profile data, such as name, email address, phone number, avatar, seller type, dealership information and profile preferences.
• Authentication and security data, such as sign-in events, magic-link delivery metadata, WebAuthn or passkey credentials, session records and abuse-prevention records.
• Listing content, such as vehicle details, descriptions, prices, images, publication status, promotion settings and availability information.
• User interaction data, such as favorites, comparisons, recently viewed listings, offers, contact requests, illegal-content notices and support messages you send through the platform.
• Technical and usage data, such as IP-based security signals, device and browser information, cookie preferences, local-storage preferences, approximate timestamps, pages viewed and operational logs.
• Information needed to handle legal notices, DSA reports, authority requests, complaints and disputes, including the content URL, reasons for the report and contact details of the submitter.

3. Sources of Data

Most data is provided directly by you or generated when you use the platform.

• You provide data when you create an account, list a vehicle, edit your profile, send an offer, contact us or submit a report.
• Some data is generated automatically by the service, such as authentication logs, cookie preferences, listing view events and security signals.
• Other users may provide data about you when they send an offer, report content, reply to a transaction discussion or contact support.
• Authorities, professional advisers or dispute parties may provide data when they send lawful requests or notices.

4. Purposes and Legal Bases

We process personal data only when we have a legal basis under the GDPR. The main purposes are:

• Providing your account, authenticating sign-in, publishing listings, showing saved items and operating the features you request. Legal basis: performance of a contract or steps taken at your request before entering into a contract.
• Responding to contact requests, support issues, reports and operational messages related to your account or listings. Legal basis: contract, pre-contractual steps or legitimate interests in running the service.
• Preventing fraud, spam, account takeover, abuse and technical misuse, and protecting users and the platform. Legal basis: legitimate interests and, where applicable, compliance with legal obligations.
• Complying with accounting, tax, legal-retention, DSA, court-order, authority-request or dispute-handling obligations. Legal basis: compliance with legal obligations and legitimate interests in defending legal claims.
• Using optional analytics, functional local storage, marketing pixels or similar non-essential technologies only where consent is required. Legal basis: your consent, which you can withdraw at any time.
• If we later introduce direct marketing or advertising tools, we will use consent where required by ePrivacy/GDPR and will provide opt-out or withdrawal controls.

5. Who We Share Data With

We do not sell personal data. We may share data only with recipients who need it for the purposes described above, including:

• Hosting, database, cloud-storage, email-delivery, authentication, security, analytics, legal-compliance and technical-service providers acting on our instructions.
• Other users, but only to the extent necessary for the platform flow you choose, for example the listing information you publish and the contact details needed to handle an offer or sale discussion.
• Professional advisers such as lawyers, accountants and auditors when access is necessary and legally justified.
• Courts, regulators, consumer-protection bodies, law-enforcement bodies or other authorities where disclosure is required by law or needed to defend legal claims.
• Potential successors or transaction parties if we reorganize, sell or transfer the business, subject to appropriate confidentiality and data-protection safeguards.

6. International Transfers

Some service providers may process data outside the European Economic Area. Where that happens, we rely on safeguards recognized by the GDPR.

• Safeguards may include European Commission adequacy decisions, Standard Contractual Clauses, supplementary technical and organizational measures, or another lawful transfer mechanism.
• You may contact us for more information about the transfer mechanism relevant to a particular provider, where disclosure is possible without compromising security or confidential arrangements.

7. Retention

We keep personal data only for as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.

• Account, profile and listing records are generally kept while the account or listing remains active and for a reasonable period afterward for security, audit, dispute handling and restoration from backups.
• Support messages, contact requests, illegal-content notices and offer records may be retained for the period needed to resolve issues, prevent abuse and maintain evidence of platform actions.
• Security logs, session records and abuse-prevention signals may be retained for a limited period proportionate to fraud prevention, account protection and incident investigation.
• Where the law requires longer retention, for example for accounting, tax, litigation, authority requests or legal claims, we keep the relevant data for that mandatory or defensible period.
• Deleted data may persist in encrypted or access-restricted backups until the normal backup rotation expires, unless restoration is required for legal or security reasons.

8. Your GDPR Rights

Subject to the conditions and limits in the GDPR, you may request:

• Access to the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Deletion of data when there is no valid legal ground to keep it.
• Restriction of processing in the cases provided by law.
• Objection to processing based on our legitimate interests, including related profiling where applicable.
• Data portability for data processed by automated means on the basis of contract or consent.
• Withdrawal of consent at any time for processing based on consent, without affecting processing that took place before withdrawal.
• Not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects, unless the law allows it with safeguards.
• The right to lodge a complaint with the Romanian supervisory authority for personal-data protection (ANSPDCP) or with another competent authority or court.

9. Cookies, Local Storage and Security

We use essential technologies needed for authentication, security and core platform functions. Optional analytics, marketing pixels or convenience storage runs only where you allow it or where applicable law permits.

For details about the categories of cookies and similar technologies we use, the legal basis for optional tools and how to change your preferences, see our Cookie Policy.

10. Marketing Tools and Future Pixels

AlphaAuto does not currently enable third-party advertising pixels by default. If we later implement tools such as Meta/Facebook Pixel, they will be treated as optional marketing or third-party technologies.

Before enabling such tools, we will update the Cookie Policy and, where required, this Privacy Policy with provider details, purposes, data categories, transfer information and retention information.

• No Meta/Facebook Pixel is active in production at the date of this Policy.
• Marketing pixels, remarketing tags and similar tracking technologies must remain disabled unless you give explicit consent through the cookie controls.
• You can withdraw marketing consent at any time, and withdrawal must be as easy as giving consent.

11. Security and Breach Handling

We use technical and organizational measures designed to reduce unauthorized access, loss, misuse or disclosure of data. No online system is completely risk-free, so you should also protect your own login methods and devices.

If a personal-data breach occurs and the GDPR requires notification, we will notify the competent authority and affected individuals as required by law.

12. Children

AlphaAuto is not intended for children and should not be used by persons who do not have legal capacity to use marketplace services. If you believe a child has provided personal data to us, contact us so we can assess and delete the data where appropriate.

Competent supervisory authority

If you believe our processing infringes the GDPR, you may lodge a complaint with ANSPDCP or another competent EU supervisory authority.

• National Supervisory Authority for Personal Data Processing
• 28-30 G-ral Gheorghe Magheru Boulevard, District 1, Bucharest 010336, Romania
• anspdcp@dataprotection.ro
• +40 31 805 92 11
• ANSPDCP

Contact Details

Privacy requests, legal notices and complaints can be sent to:

• contact@alphaauto.ro
• +40 733 626 626