Privacy policy (GDPR)

This page explains what personal data we process, why, who we pass it to and what your rights are. It is the information referred to by the "I agree to the processing of personal data" box on our forms.

1. The controller

The auto-garaj platform is operated through the carbase.ro website. The controller's full legal details (name, tax number, registered office) will be published here once the company is formally established. For anything to do with your data, write to info@carbase.ro.

2. What we process

• Account: name, e-mail, phone, password (stored only as a hash).
• Garage: VIN, number plate, make, model, year, mileage, RCA expiry date, service history.
• Listings: the text, photos and locality you publish.
• Bookings and orders: the workshop chosen, the work requested, the parts ordered, the delivery address.
• RCA: the details needed to quote and issue a policy, including the personal numeric code where the insurer requires it.
• Payments: the amount, the payment status and the transaction reference from the processor. Card details never reach us.
• Technical: IP address, device type and pages visited, for security and statistics.

3. Why, and on what legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): account, garage, listings, bookings, orders, policies.
• Legal obligation (point c): invoicing, accounting, answering requests from authorities.
• Legitimate interest (point f): fraud prevention, platform security, improving the service.
• Consent (point a): marketing messages and push notifications. You can withdraw it at any time without losing access to the service.

4. Who we share it with

Only those who need it so that you get the service you asked for: the workshop you book, the supplier of the part you order, the insurer you choose, the payment processor, and our hosting and e-mail/SMS providers. We do not sell personal data to anyone.

5. How long we keep it

Account data for as long as the account exists, plus the period the law requires us to keep documents (usually 5–10 years for invoices and policies). Deleted listings disappear from the platform; technical logs are kept for at most 12 months.

6. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (Art. 15–22 GDPR), and the right to withdraw consent. Write to us and we will answer within 30 days at the latest. If you are not satisfied, you may complain to the Romanian data protection authority (ANSPDCP), Bd. G-ral. Gheorghe Magheru 28-30, Bucharest.

7. Cookies

We use cookies that are necessary for the site to work (session, authentication, language preference) and, with your consent, analytics cookies. You can delete or block them in your browser; without the necessary ones the platform does not work properly.

8. Security

Passwords are stored as hashes, traffic is encrypted, and internal access to data is limited to what is needed. Documents uploaded by companies (authorisations, certificates) are kept apart from public files.

9. Children

The platform is intended for people over 18. We do not knowingly collect data about minors.

10. Changes

If we change this policy, we publish the new version here and, where the change is significant, tell you in your account or by e-mail.

11. Signing in with Google or Facebook

If you choose to sign in with your Google or Facebook account, we receive from them only the e-mail address, the display name on that account, and a unique identifier for your account with that provider — never your password there, which we never have access to. We use this data solely to create your account on the platform or to link it to an existing one that shares the same e-mail address, exactly as with a password registration. We do not publish or send anything back to Google or Facebook about your activity on the platform. You can set a password for our account at any time afterwards and keep using it without signing in through them again.