Privacy Policy

MotorDeal ("we", "us", "our") operates the vehicle marketplace at www.motordeal.gr. For the purposes of the EU General Data Protection Regulation (GDPR), MotorDeal is the data controller for personal data collected through this platform.

Contact for data matters: privacy@motordeal.gr

2.1 Data you provide directly

• Account registration: name, email address, password (hashed — we never store plain-text passwords).
• Profile information: phone number, location.
• Listing content: vehicle or parts descriptions, photographs, pricing, location.
• Dealer registration: business name, business address, VAT number (if provided), contact details.
• Payment information: processed and stored by Stripe. We never see or store full card details.
• Communications: messages you send to other users through the platform, support requests.
• Referral codes: generated and used codes, referral relationships.

2.2 Data collected automatically

• Device and browser information: browser type, operating system, device type.
• IP address and approximate location.
• Usage data: pages visited, search queries, listing views, time on site, click behaviour.
• Cookies and similar tracking technologies (see Section 7).

2.3 Data from third parties

• Google OAuth: if you sign in with Google, we receive your name, email address, and profile picture from Google.
• Stripe: payment confirmation, subscription status, and anonymised billing data.
• Supabase: our database and authentication provider. Data is stored on Supabase infrastructure within the EU.

We use your personal data for the following purposes:

• To operate the platform: creating and managing your account, displaying listings, enabling messaging between users.
• To process payments: handling dealer subscription payments and credit purchases through Stripe.
• To improve the platform: analysing usage patterns to fix bugs and improve user experience.
• To communicate with you: sending transactional emails and, where you have consented, marketing communications.
• To enforce our Terms: detecting and preventing fraud, abuse, and violations of our Terms and Conditions.
• To comply with legal obligations: responding to lawful requests from law enforcement or regulatory bodies.
• To operate the referral programme: tracking referral codes and awarding credits.

We process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)): Processing necessary to operate your account, display your listings, and provide the services you have requested.
• Legitimate interests (Article 6(1)(f)): Fraud prevention, platform security, analytics, and improving our services.
• Legal obligation (Article 6(1)(c)): Where we are required by law to process your data.
• Consent (Article 6(1)(a)): For marketing communications and non-essential cookies. You may withdraw consent at any time.

We do not sell your personal data. We share it only in the following circumstances:

With other users: Your listing content, username, and general location are visible to other platform users. Your email and phone number are not publicly visible — they are only shared with another user when you explicitly choose to share them through the messaging system.

With service providers:

• Supabase (database and authentication) — EU data storage.
• Stripe (payment processing) — subject to Stripe's own Privacy Policy.
• Google (authentication) — if you use Google sign-in.
• Email service providers — for transactional and marketing emails.

With law enforcement: We will disclose personal data to competent authorities if required by law, court order, or to protect the safety of our users or the public.

In a business transfer: If MotorDeal is acquired, merged, or its assets are transferred, user data may be transferred as part of that transaction. We will notify affected users before any such transfer.

• Account data: Retained for as long as your account is active, plus 12 months after account deletion to resolve any disputes.
• Listing data: Retained for 24 months after a listing is removed or marked as sold.
• Payment records: Retained for 7 years to comply with Greek tax and accounting obligations.
• Messages: Retained for 24 months after the conversation ends.
• Analytics data: Anonymised and retained indefinitely.

You may request deletion of your data at any time (see Section 8). Note that some data may be retained beyond your request period where we have a legal obligation to do so.

We use the following types of cookies:

Strictly necessary cookies: Required for the platform to function. Cannot be disabled.

Analytics cookies: We use anonymised analytics to understand how users navigate the platform. No personally identifiable data is shared with analytics providers.

Preference cookies: Remember your settings and preferences (e.g. language, filter settings).

Marketing cookies: Only set with your explicit consent. Used to show relevant advertising on third-party platforms.

You can manage your cookie preferences at any time through our cookie banner or by adjusting your browser settings. Note that disabling certain cookies may affect platform functionality.

As a resident of the EU/EEA, you have the following rights:

• Right of access: You can request a copy of all personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): You can request deletion of your data where we no longer have a lawful basis to retain it.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to lodge a complaint: You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr or any EU supervisory authority.

To exercise any of these rights, email privacy@motordeal.gr. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data, including:

• All data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
• Passwords are hashed using industry-standard algorithms — we never store plain-text passwords.
• Access to personal data is restricted to authorised personnel on a need-to-know basis.
• Our infrastructure provider (Supabase) maintains ISO 27001 certification and stores data within EU data centres.

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Hellenic Data Protection Authority within 72 hours as required by GDPR.

Your data is stored within the European Union. If we ever transfer data outside the EU/EEA, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses) in compliance with GDPR.

MotorDeal is not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with their data, please contact privacy@motordeal.gr and we will delete it promptly.

The platform may contain links to third-party websites (e.g. vehicle history check services). We are not responsible for the privacy practices of any third-party site. We recommend reviewing the privacy policy of any external site you visit.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by prominent notice on the platform. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after changes take effect constitutes acceptance of the updated Policy.

For any privacy-related queries, data subject requests, or concerns:

Email: privacy@motordeal.gr
MotorDeal, Athens, Greece

For complaints, you may also contact the Hellenic Data Protection Authority:

www.dpa.gr | +30 210 6475 600