Effective date: [EFFECTIVE_DATE]
Last updated: [LAST_UPDATED]
1. Introduction
This Privacy Policy explains how FAFO ("FAFO", "we", "us", "our") collects, uses, shares and protects personal data when you use fafo-trust.com and related services (the "Platform").
We are committed to handling personal data lawfully, fairly and transparently. This policy is written to be understood by people who are not lawyers, while meeting the requirements of the EU General Data Protection Regulation (GDPR) and equivalent data protection laws.
Who is responsible for your data
The data controller for the processing described here is:
FAFO
Registered name: [COMPANY_LEGAL_NAME]
Registration number: [REGISTRATION_NUMBER]
Registered address: [REGISTERED_ADDRESS]
Data protection contact: privacy@fafo-trust.com
Data Protection Officer / EU representative, where appointed: [DPO_OR_EU_REPRESENTATIVE]
An important note about other Users
When you publish a Listing or send a message, the personal data you choose to include becomes visible to other Users. In respect of what a Seller or Buyer then does with your data outside the Platform, that person acts as an independent controller and we are not responsible for their conduct. Please share only what is necessary.
2. Information We Collect
We collect only what we need to operate the Platform. The tables below describe each category.
2.1 Account Information
Provided by you when you register and maintain your profile.
| Data | Notes |
|---|---|
| Full name | First and last name |
| Email address | Used as your login identifier and for service messages |
| Password | Stored only as a salted cryptographic hash — never in readable form |
| Telephone number | Optional; shown to Buyers only if you choose to publish it |
| City or location | Optional |
| Profile photograph | Optional |
| Account type | Private Seller, Dealership or administrator |
| Verification and status flags | Whether your email is confirmed, and whether the Account is suspended |
| Dealership details | Company name, address, telephone, website, logo and description, where you register a Dealership |
2.2 Vehicle Listing Information
Provided by you when you publish or edit a Listing.
- Make, model, generation, year, mileage, price and currency;
- Body type, fuel type, transmission, drivetrain, colour, doors, seats, engine size and power;
- Equipment and features;
- Free-text description;
- Location of the vehicle;
- Photographs and video links;
- Vehicle identification number (VIN), where you choose to provide one.
Please note: a Listing is public. Photographs may contain number plates, faces, house frontages or documents. Please remove or obscure anything you do not wish to publish, including the VIN if you would rather share it privately.
2.3 Communications and Support Requests
- Enquiry messages sent to a Seller, and replies in the same conversation;
- The email address and telephone number supplied with an enquiry;
- The follow-up status a Seller assigns to an enquiry;
- Reports you submit about a Listing or a User, including your description of the problem;
- Correspondence with our support, legal or privacy contacts.
2.4 Saved Preferences
- Vehicles you save to your favourites;
- Saved searches and whether you have enabled alerts for them;
- Notifications generated for you by the Platform.
2.5 Technical and Usage Data
| Data | Purpose |
|---|---|
| IP address | Recorded with security-relevant events; used for security and fraud prevention |
| Browser and device information (user agent) | Recorded with security-relevant events; used for compatibility and fraud prevention |
| Login records, including the date and time of your last sign-in | Account security and support |
| Session and refresh tokens | Keeping you signed in |
| Audit records of significant actions | An append-only record of actions such as registration, publication, moderation decisions and account suspensions, used for security and accountability |
| Search terms entered on the Platform | Held only as aggregate counters — for example "how many searches mentioned a given make" — and not linked to you |
| Listing view counts | Held only as a daily total per Listing. We do not record which person viewed which vehicle |
2.6 Information stored on your device, not sent to us
Your recently viewed vehicles are stored locally in your browser so you can return to them. This list stays on your device and is never transmitted to our servers. Clearing your browser storage removes it.
2.7 Data we do not collect
We do not collect payment card details, because payments between Buyers and Sellers do not take place on the Platform. We do not deliberately collect special categories of data (such as data revealing health, religion, political opinions or biometric data). Please do not include such data in a Listing or a message.
3. How We Use Information
We use personal data for the following purposes:
- Providing the Platform — creating and maintaining your Account, publishing your Listings, delivering enquiries, and showing search results.
- Authentication and security — signing you in, keeping sessions valid, detecting suspicious access, and protecting Accounts.
- Moderation and trust — reviewing Listings, assessing risk signals such as duplicate advertisements or prices far below the market, investigating reports, and enforcing our Terms.
- Fraud prevention — identifying, investigating and preventing fraudulent or unlawful activity.
- Communication — sending service messages such as email confirmation, password reset, moderation outcomes, enquiry notifications, and saved-search alerts you have enabled.
- Support — answering your questions and resolving problems.
- Improving the Platform — understanding, in aggregate, which features and vehicle categories are used, so we can improve them.
- Legal compliance — meeting our legal obligations and responding to lawful requests from competent authorities.
Automated decision-making
We use automated signals to help prioritise Listings for human review — for example flagging a duplicate advertisement or an unusually low price. These signals assist our moderators; they do not by themselves produce a legal or similarly significant effect on you, and a person decides the outcome. If a decision affects you and you disagree with it, contact privacy@fafo-trust.com.
Marketing
We send marketing messages only where you have asked to receive them, or where the law otherwise permits it. You can withdraw consent at any time, and every marketing message contains an unsubscribe link. Service messages necessary to operate your Account are not marketing and cannot be switched off while your Account is open.
4. Legal Basis for Processing
Under the GDPR we must have a legal basis for each processing activity.
| Processing | Legal basis |
|---|---|
| Creating and operating your Account; publishing your Listings; delivering enquiries | Performance of a contract (Art. 6(1)(b)) |
| Authentication, session management and account security | Performance of a contract and legitimate interests (Art. 6(1)(b) and (f)) |
| Moderation, risk scoring, fraud prevention, abuse investigation, audit records | Legitimate interests (Art. 6(1)(f)) — keeping the marketplace safe and trustworthy for all Users |
| Aggregate usage and search statistics | Legitimate interests (Art. 6(1)(f)) — improving the Platform |
| Saved-search alerts and optional marketing | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Retaining records required by law, and responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms. You may object to that processing — see section 9.
5. Data Retention
We keep personal data only for as long as it is needed, and then delete or anonymise it.
| Data | Retention |
|---|---|
| Account data | While the Account is open, and up to [ACCOUNT_GRACE_PERIOD, e.g. 30 days] after a deletion request, to allow recovery from error or abuse |
| Published Listings | While published; expired or archived Listings are removed from public view and deleted after [LISTING_RETENTION_PERIOD] |
| Listing photographs | Deleted from object storage together with the Listing |
| Enquiries and messages | [MESSAGE_RETENTION_PERIOD] after the conversation ends, so both parties keep a record of what was agreed |
| Reports of fraud or abuse, and related correspondence | [ABUSE_RETENTION_PERIOD], or longer where an investigation or legal claim requires it |
| Audit records (including IP address and user agent) | [AUDIT_RETENTION_PERIOD], for security and accountability |
| Session and refresh tokens | Until expiry, sign-out, or password change |
| Aggregate statistics and view counts | Retained indefinitely in a form that does not identify any person |
| Records required by accounting, tax or other law | For the period required by the applicable law |
6. Data Sharing and Service Providers
We do not sell personal data.
We share personal data only as follows:
6.1 With other Users
The data you choose to publish in a Listing or profile, and the content of enquiries you send, is shared with the Users concerned. This is the core purpose of the Platform.
6.2 With service providers (processors)
We use third parties to run the Platform. They act on our documented instructions under a written data processing agreement, and may not use the data for their own purposes.
| Category | Purpose |
|---|---|
| Hosting and infrastructure | Running the servers and databases |
| Object storage | Storing Listing photographs |
| Email delivery | Sending service and notification emails |
| Error monitoring and logging | Diagnosing faults and detecting abuse |
| Analytics | Understanding aggregate use of the Platform |
A current list of processors is available on request from privacy@fafo-trust.com.
6.3 With authorities and advisers
We may disclose data where we are required to do so by law, or where disclosure is necessary to establish, exercise or defend legal claims, to prevent fraud, or to protect the rights, safety or property of any person. We assess each request and disclose only what is necessary.
6.4 On a change of business
If the business is reorganised, merged or sold, personal data may be transferred as part of that transaction. We will inform you, and the recipient will remain bound by this policy or by a policy offering equivalent protection.
7. Security Measures
We take appropriate technical and organisational measures to protect personal data, including:
- Encryption of traffic in transit using TLS;
- Storage of passwords only as salted cryptographic hashes;
- Signed, expiring access tokens, with separate refresh tokens that can be revoked;
- Role-based access control, so staff access only what their role requires;
- An append-only audit trail of significant administrative actions;
- Rate limiting and abuse detection on sensitive endpoints;
- Isolation of internal services, which are not exposed to the public internet;
- Regular application of security updates.
No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and will inform affected Users without undue delay where the law requires it.
8. International Data Transfers
The Platform serves Users in several countries, and some of our service providers operate outside the country in which you live. Personal data may therefore be transferred to, stored in, or accessed from a country other than your own — including countries outside the European Economic Area.
Where we transfer personal data out of the EEA, we rely on one of the following safeguards:
- An adequacy decision of the European Commission covering the destination country; or
- The European Commission's Standard Contractual Clauses, together with any supplementary technical and organisational measures needed after assessing the destination; or
- Another lawful transfer mechanism recognised under applicable law.
You may request a copy of the relevant safeguard by writing to privacy@fafo-trust.com.
9. Your Rights
Subject to the conditions and exemptions in applicable law, you have the following rights over your personal data.
| Right | What it means |
|---|---|
| Access | To be told whether we process your data and to receive a copy of it |
| Rectification (correction) | To have inaccurate data corrected and incomplete data completed |
| Erasure ("right to be forgotten") | To have your data deleted where there is no overriding reason to keep it |
| Restriction of processing | To have processing paused, for example while accuracy is being checked |
| Data portability | To receive the data you provided in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible |
| Objection to processing | To object to processing based on our legitimate interests, and to object at any time — absolutely — to direct marketing |
| Withdrawal of consent | To withdraw consent at any time, where processing is based on consent. This does not affect processing carried out before withdrawal |
| Human review | To ask for human involvement in, and to contest, a decision that affects you |
How to exercise your rights
Write to privacy@fafo-trust.com. Some rights can also be exercised directly: you can edit most profile and Listing data in your Account settings, and you can request deletion of your Account as described on our Delete My Account page.
We will respond within one month. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months and will explain why within the first month.
We may ask you to verify your identity before we act, so that we do not disclose your data to someone else. Requests are free of charge, unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, explaining our reasons.
Complaints
If you believe we have not handled your data properly, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority — in the EEA, the authority in the country where you live, where you work, or where the alleged infringement occurred. Our lead supervisory authority, where applicable, is [LEAD_SUPERVISORY_AUTHORITY].
10. Cookies and Similar Technologies
We use a small number of technologies that store information on your device:
- Strictly necessary storage, such as your authentication tokens and session data, without which the Platform cannot function. These do not require consent.
- Functional storage, such as your recently viewed vehicles and your vehicle comparison list, which stay on your device.
- Analytics, where used, which we deploy only on the basis of your consent where consent is required.
You can clear this storage through your browser settings. Doing so will sign you out and clear your locally stored preferences. Further detail is available in our [COOKIE_POLICY_LINK] where published.
11. Children's Privacy
The Platform is intended for adults. You must be at least 18 years old to create an Account.
We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@fafo-trust.com and we will delete it without undue delay.
12. Changes to this Policy
We may update this Privacy Policy to reflect changes in the Platform, in our practices, or in the law. The "Last updated" date at the top of this page shows when it was last revised.
Where a change materially affects how we use your personal data, we will give notice before it takes effect — by publishing the revised policy and, where appropriate, by contacting registered Users directly. Where the law requires your consent to a change, we will ask for it.
13. Contact Information
For any question about this policy, or to exercise any of your rights:
| Purpose | |
|---|---|
| Privacy and data protection | privacy@fafo-trust.com |
| Legal, abuse and fraud reports | legal@fafo-trust.com |
| General support | support@fafo-trust.com |
FAFO
[COMPANY_LEGAL_NAME]
[REGISTERED_ADDRESS]
Website: fafo-trust.com