PRIVACY POLICY

1. Data Controller

The controller that determines the purposes and means of processing is:

We have not appointed a statutory Data Protection Officer, as we are not legally required to. Privacy requests are handled directly via the contact above.

2. Personal Data We Collect

• Identity & contact data: name, email, phone, and (for invoicing/B2B) company name, address and VAT/NIP number.
• Order & vehicle data: vehicle details, VIN, listing links, the inspection location and the seller's contact details that you provide to us.
• Car Finder brief: if you order our car-sourcing service — your budget, preferred makes/models, body type, fuel, gearbox, mileage and year limits, the destination country and any notes you add. This data is used solely to perform the search and prepare your shortlist.
• Digital purchases: for the downloadable guide — your e-mail address and payment confirmation, used to deliver the download link.
• Inspection content: the technical report, measurements, notes and the photo/video documentation of the vehicle (see §4).
• Payment data: processed by Stripe. We receive confirmation of payment and limited transaction metadata; we do not receive or store full card numbers or banking credentials.
• Correspondence: messages you send us by email, contact form, WhatsApp or phone.
• Technical & usage data: IP address, device/browser type, pages viewed and similar data collected via cookies and server logs.

3. Purposes & Legal Bases

A. Performing the contract — Art. 6(1)(b)

To take your order, schedule and carry out the inspection, produce and deliver the Report, and provide support.

B. Payment & legal obligations — Art. 6(1)(b) & (c)

To process payment via Stripe and to comply with accounting, invoicing and tax obligations under Belgian law.

C. Legitimate interests — Art. 6(1)(f)

To secure and improve our website and services, prevent fraud and abuse, keep records of inspections, and defend or pursue legal claims. You may object to processing based on legitimate interests (see §8).

D. Consent — Art. 6(1)(a)

For non-essential cookies/analytics and for any direct marketing where consent is required. Consent can be withdrawn at any time.

4. Photographs, Video & Third-Party Data

Our inspections produce photos and video of the vehicle. These may incidentally capture personal data such as licence plates, VINs, or the reflection/appearance of bystanders. We process this documentation on the basis of our legitimate interest in evidencing the vehicle's condition and providing you with the Report (Art. 6(1)(f)). We use it only for the inspection, store it securely, and do not publish it without a lawful basis. Where we obtain vehicle-history or VIN-check data from third-party databases, that data may include prior-keeper information; we use it solely to inform your purchasing decision.

5. Recipients & Processors

We share personal data only with trusted providers acting as processors on our instructions, or where required by law:

• Stripe Payments Europe, Ltd. (Ireland / USA): secure payment processing. Card data is handled directly by Stripe under PCI-DSS.
• Hosting provider (SEOHOST sp. z o.o., Poland/EU): website and email hosting and server logs.
• Anthropic (AI model provider, USA): our staff may use Anthropic's Claude model to prepare a draft reply to your enquiry or message, to sort incoming e-mails and to translate inspection reports. We send only the text needed for that task. Before sending, we automatically remove e-mail addresses, telephone numbers and bank account numbers and, for enquiries submitted through our forms, also your surname, company name and VAT number; other details written in the message itself may remain. Anthropic acts as our processor under its data processing terms and does not use this data to train its models. A person reads and approves every draft before anything is sent to you; no decision about you is taken automatically. Legal basis: our legitimate interest in answering enquiries efficiently (Art. 6(1)(f) GDPR).
• Email delivery: our own authenticated mailboxes are used to correspond with you and send service or marketing emails.
• Trustpilot A/S (Denmark/EU): after a completed order we may pass your e-mail address and order reference to Trustpilot solely so that it can send you a single, optional invitation to review our service. Trustpilot acts under its own review-platform terms; you are never obliged to respond.
• Google Ireland Ltd.: we display publicly available Google reviews of our business on our website. These reviews are retrieved by our server — no data about you as a visitor is sent to Google for this purpose. If you choose to leave us a Google review, Google's own privacy policy applies.
• Content delivery networks: some fonts, icons and scripts are loaded from CDNs (Google Fonts, Cloudflare cdnjs, jsDelivr, Tailwind CDN). When your browser fetches these files, the CDN technically receives your IP address and browser data as with any web request. We use these providers for site performance and security.
• Messaging (e.g. WhatsApp / Meta): where you choose to contact us through it.
• Accountant & advisors: for bookkeeping and legal compliance.
• Authorities: where we are legally obliged to disclose.

6. International Transfers

Some providers (e.g. Stripe, Google, Anthropic) may process data outside the European Economic Area. Where this happens, transfers are protected by appropriate safeguards under the GDPR, in particular the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. A copy of the relevant safeguards is available on request.

7. Retention Periods

• Invoicing & accounting records: retained for 7 years as required by Belgian law.
• Inspection reports & documentation: retained for the period needed to handle warranty, complaint and liability matters, and in any event no longer than necessary for that purpose.
• Inquiries that do not lead to an order: retained for a limited period and then deleted.
• Marketing data: until you unsubscribe or withdraw consent.

8. Your GDPR Rights

Subject to the conditions of the GDPR, you have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests or to direct marketing; and withdraw consent at any time.

To exercise any of these rights, e-mail contact@daexport.com; we respond within one month. You also have the right to lodge a complaint with the Belgian supervisory authority: Gegevensbeschermingsautoriteit / Autorité de protection des données (GBA/APD), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, contact@apd-gba.be — or with the authority of your own EU member state.

You also have the right to lodge a complaint with the Belgian supervisory authority: the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be.

9. Marketing Communications

We send commercial emails only where the law allows — that is, to existing clients about our own similar services, or to others who have given consent. Every marketing email contains a one-click unsubscribe link, and you can opt out at any time by writing to contact@daexport.com. Unsubscribing does not affect service emails that are necessary to perform an order.

10. Cookies & Local Storage

We keep this simple and minimal. What our website actually stores on your device:

• Functional local storage (no consent required): cookiesAccepted — remembers that you dismissed the cookie notice; preferredLang — remembers your chosen language version. Neither identifies you or tracks you across sites.
• Session cookie (staff only): a login session cookie is set only when our own staff sign in to the administration panel. Regular visitors never receive it.
• Payment cookies (Stripe): during checkout, Stripe sets strictly necessary cookies on its payment pages for security and fraud prevention (PCI-DSS). These are governed by Stripe's privacy policy.

We currently use no analytics and no marketing/advertising cookies. If we introduce analytics in the future, non-essential cookies will be set only after your explicit consent via an updated consent banner, and this Policy will be revised accordingly. You can always clear or block storage through your browser settings.

11. Security

• Encryption of data in transit (HTTPS/TLS) and authenticated, access-controlled administrative panels.
• Access restricted to authorised persons on a need-to-know basis.
• Reputable, GDPR-compliant processors and reasonable technical and organisational measures appropriate to the risk.

No method of transmission or storage is completely secure; we cannot guarantee absolute security but work to protect your data and to notify you and the authority of any breach where legally required.

12. Children

Our services are intended for adults (18+). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Third-Party Links & Changes

Our website may link to third-party sites (e.g. vehicle listings); we are not responsible for their privacy practices. We may update this Policy to reflect changes in our practices or the law; the "Last Updated" date shows the latest revision. For matters not covered here, Belgian law and the GDPR apply, and the competent court is that of the controller's registered office in Antwerp, Belgium.

14. Mobile & Web Application (DAExport app)

This section applies when you use the DAExport app — our mobile application for Android and iOS and its web version at daexport.com/marketplace. The controller is the same as in §1, and the legal bases, transfer safeguards and your rights described in §§3, 6 and 8 apply equally to the app.

A. Data the app collects

• Account data: your e-mail address and password (transmitted over TLS; stored on our server only as a cryptographic hash), optionally your name and phone number, and your country and preferred language (used for tax settings in the calculator and for the language of e-mails and reports).
• Push notification token & platform: if you enable notifications, a device push token issued by the Expo push service and delivered via Google FCM (Android) or Apple APNs (iOS), used solely to send you Radar alerts. Logging out de-registers the device; deleting your account deletes the token.
• Anonymous installation identifier: a random string generated by us on first launch, used only to link a survey completed before registration to your later account. It is not a hardware identifier and not an advertising ID.
• Saved Radar filters: the make, model, fuel, gearbox, country, year, price, mileage, power and distance criteria you save in order to receive alerts about matching vehicles.
• Inspection order data: the vehicle description, the address / location of the vehicle you are considering (not your own location), notes, preferred date, listing reference, the signed quote, chosen package and language — plus the payment status and amount of your orders.
• Onboarding survey answers: purpose, frequency, horizon and budget range, used to recommend a suitable plan; linked to your identity only if you later claim them to your account.
• Support messages: the message you write plus basic diagnostics (app version, platform, language, plan, user id, current screen), sent only when you explicitly tap send.

B. Payments

Payments are processed by Stripe in your system browser on Stripe's own pages. The app contains no payment SDK and never sees or stores your card details — these are handled exclusively by Stripe (see §5).

C. VIN look-ups

If you use the vehicle-history features: the free decoder sends the VIN you type to the public NHTSA vPIC API (a US government database), and the full history report opens a carVertical link that includes that VIN — in each case only after you tap the respective button.

D. What the app does NOT collect

E. Retention & your controls

Your account exists until you delete it — the app has built-in Delete account and Export my data functions on the Account screen. Orders and invoices are retained after account deletion as required by tax law (see §7), but are unlinked from your person.