Privacy Policy

What we process

• Staff accounts: name, e-mail address, sign-in data, and a record of who changed what in the CRM.
• Clients and car owners: name and phone number, the details and photos of the car, the desired price. If a client asks for an acceptance protocol, also the address, date of birth or company ID, and e-mail address.
• Public form: a hashed IP address, used only to limit abuse.
• The connected Instagram account and Telegram channel: their ID and name, access tokens, and the photos, texts and status of the posts published from the CRM.
• Public website: it shows the cars on sale and sets no cookies. To count how many different visitors viewed the website and each car, we store a keyed hash of the IP address, never the address itself. The hosting provider keeps technical logs, such as IP addresses, to run and secure the service.

What we do not collect from Instagram and Telegram

We use these platforms only to publish the company's posts and to show their status. We do not read messages, followers, or data of other users of the platforms.

Why we process it

• To handle the sale of a car on commission and to take the steps a client asks for before a contract.
• To publish the company's car listings, which is our legitimate interest.
• To see how many people view the website and each car, which is also our legitimate interest.
• To meet our legal obligations and to keep the system secure.

Who receives it

We do not sell personal data.

• Amazon Web Services: storage of the data and photos, in the Frankfurt region.
• Vercel: hosting of the application, with its functions running in the Frankfurt region.
• Meta (Instagram) and Telegram: only the photos and texts of the posts about cars, which then become public under those platforms’ own terms.

How long we keep it, and how we protect it

We keep data as long as needed for the purposes above or as required by law. Access tokens are encrypted and kept until the account is disconnected. The hashed IP addresses used to count views are deleted about 12 months after the visit, or earlier together with the car. Only signed-in staff can access the CRM.

Your rights

You may ask for access to your data, its correction or erasure, restriction of processing and data portability, and you may object to processing or withdraw a consent you gave. You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky).

How to request data deletion

• Write to brocar.s.r.o@gmail.com and say which data the request is about. We answer without undue delay, at the latest within one month.
• Connected accounts: use “Disconnect” in the CRM settings, which deletes the stored tokens. Access can also be removed in the Instagram app, in the settings for apps connected to the account.
• Posts that were already published are deleted in the Instagram or Telegram app.

Contact

Bro-Car, s.r.o., Okružná cesta 2585/1, 945 01 Komárno. E-mail: brocar.s.r.o@gmail.com