Draft: have this reviewed by a lawyer before the site goes live
This is a template text. Details in [square brackets] still need to be filled in. No rights can be derived from this text yet.
We handle your data with care and process no more than we need. Below you can read exactly what we do.
1. Who are we?
Sell Your Car ([registered name and legal form], Chamber of Commerce (KvK) number [number], at [address]) is the controller for personal data processed on sellyourcar.nl. You can reach us at [email protected]. [Name of the data protection officer, if appointed.]
This privacy statement explains which data we process, why, for how long and which rights you have under the General Data Protection Regulation (GDPR, in Dutch: AVG).
2. Which data do we process?
- Contact details: name, email address and phone number.
- Account data: login details and your preferences.
- Vehicle data: licence plate, mileage, condition, photos and data from RDW open data.
- Listing and auction data: asking price, reserve price, bids and messages between buyers and sellers.
- Verification data: for private bidders an identity check through [verification partner]; for dealers the KvK number and RDW recognition.
- Payment data: IBAN and the payments of deposits and purchase prices through the escrow account of [escrow partner].
- Technical data: IP address, browser and device data, and cookies (see section 8).
We do not ask for special categories of personal data or your citizen service number (BSN).
3. Why do we use your data and on what legal basis?
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Valuation and free tools | licence plate, vehicle data | legitimate interest; performance of a contract if you have an account |
| Quote and invoice check | the file or text you send (it may contain names and addresses) | [legal basis to be decided: performing your request or consent] |
| Owner reviews (new cars) | name (shown), email address (not shown), hashed IP address, scores and text | [legal basis to be confirmed by a lawyer: consent or legitimate interest] |
| Listing a car and auctions | contact, vehicle and auction data | performance of the contract |
| Verifying bidders and preventing fraud | verification data | legitimate interest; legal obligation where it applies |
| Payment through escrow | payment data | performance of the contract |
| Answering questions | contact details, your message | performance of the contract or legitimate interest |
| Requesting a quote for a new car: forwarding your request to up to 3 dealers of the brand | name, email address, postcode, phone number (if you give it), the car, your answers, the plate of your trade-in car (if you give it) and your message | consent, which you give separately in the form [legal basis to be confirmed] |
| Reminders and newsletter, such as an APK reminder | email address, licence plate | consent |
| Statistics and improving the site | technical data | consent or legitimate interest [depending on the analytics tool chosen] |
| Accounting | invoice and payment data | legal obligation |
4. How do we use RDW data?
When you enter a licence plate, we retrieve data from RDW open data, such as make, model, fuel, APK expiry date, odometer verdict and recalls. That open data does not contain the owner's name or address. Because a licence plate combined with other data can identify you, we treat licence plates entered on our site as personal data.
5. How long do we keep your data?
| Data | Retention period |
|---|---|
| Account | as long as your account exists, then [period] |
| Listings and auctions | [period] after they end |
| Verification data | [period] |
| Contact form messages | [period] after handling |
| Quote and invoice check: file, text and result | not kept: only in memory while the check runs |
| Quote requests for a new car | [period] after handling |
| Owner reviews | see section 7 |
| Accounting (invoices, payments) | the statutory tax retention period [check: 7 years] |
| Cookies | see the cookie overview [link] |
6. Who do we share your data with?
- The other party in a sale: after a successful sale we share the data needed for the handover and the ownership transfer.
- Service providers (processors): hosting, email, identity verification and the escrow partner. We sign a data processing agreement with each of them.
- Dealers of the brand, only for a quote request for a new car: with your consent we forward your request and contact details to up to 3 dealers of that brand near you, so they can make you an offer. Without that consent nothing goes to a dealer, and we never email dealer addresses found on other websites. [Role of the dealer to be decided: independent controller for the quote or not.]
- Anthropic, only for the quote and invoice check: the file you upload or the text you paste is sent to Anthropic, the maker of the AI model Claude, which reads the amounts for us. Anthropic acts as our processor for this. We do not keep the file, the text or the result. Anthropic states that it deletes API inputs and outputs within 30 days, that it may keep them for up to 2 years if Anthropic's automated trust and safety systems flag them, and that retained data is not used to train models without permission (consulted on 27 October 2026: how long Anthropic stores organisations' data and API and data retention). [Check the country of processing and the safeguard for transfers outside the EEA.] If you do not want to send names or addresses, make them unreadable first.
- Authorities: only when the law requires it.
We do not sell your data. Data only leaves the European Economic Area with appropriate safeguards, such as an adequacy decision or standard contractual clauses. [List of processors and countries.]
7. Owner reviews (new cars)
If you share your review of a new car, we process:
- your name or first name: shown with your review on the site;
- your email address: never shown;
- a hashed IP address: to limit abuse;
- your review: scores, text, pros and cons, version, model year, kilometres and since when you drive the car.
Why: to have you confirm your review by email, to moderate it (a member of our team reads every review before it appears), to email you the outcome and, if someone reports your review under the Digital Services Act, to send you our decision with the reasons. Legal basis: [legal basis to be confirmed by a lawyer: consent or legitimate interest].
How long:
- a review you do not confirm within 7 days is deleted;
- a published review stays online until you ask us to remove it or we remove it;
- we keep your email address while your review is online and up to 6 months after it is removed or rejected; after that we anonymise the review (name, email address and text go, the scores stay without a name);
- the hashed IP address and the address our emails about your review went to: 30 days;
- if your review is reported, your email address stays in the file of that report until 12 months after the decision.
Your rights: if you ask us to erase your data, we take your reviews off the site and anonymise them. You can also ask for access to or a copy of your reviews (section 9).
Processors: the emails about your review are sent by our email service [name of email service]; the data is stored with our hosting provider [name of hosting provider]. We sign a data processing agreement with each of them.
8. Cookies and local storage
- Functional: needed for the site to work, for example your chosen city and language. We don't ask consent for these.
- Analytics: [configured privacy-friendly without consent / only with consent].
- Marketing: only with your consent. [Not in use at the moment.]
You can always refuse or delete cookies in your browser.
9. What are your rights?
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. If you gave consent, you can withdraw it at any time. Send your request to [email protected]. We respond within one month.
If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
10. How do we protect your data?
We take appropriate technical and organisational measures, such as encrypted connections (https), access control and [additional measures]. If you notice something wrong, please report it straight away.
11. Changes
We may update this privacy statement. The date at the top shows when it last changed. We will tell you in advance about significant changes.
See also: Terms of use · Our fairness rules · [email protected]