English Deutsch Este texto legal está disponible en inglés y en alemán.
1. Controller
FINCORP GESTION SA, Avenida Europa 24PARQUE EMPRESARIAL LA MORALEJA. 28023, Madrid, phone 0741234567, email contact@fincorp-gestion.com (“we”). Represented by [managing director(s)].
[If a data protection officer has been appointed: name and contact details.]
2. Visiting the website
When you open our pages, the server automatically processes technical data (IP address, date and time, page requested, browser and operating system) to deliver the website and keep it secure. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a secure, working website). Server log files are deleted after [7–14 days, according to the hosting provider].
The website is hosted by [hosting provider, address, server location], which processes data on our behalf under a data processing agreement (Art. 28 GDPR). [If servers are outside the EU: transfer safeguard, e.g. EU–US Data Privacy Framework or standard contractual clauses.]
We only use strictly necessary cookies (see our cookie policy). Fonts are stored on our own server. We do not use analytics or advertising tools.
3. Customer account, bids and purchases
To register you give us your name, email address, password (stored only in encrypted form), country and optionally mobile number, address and — for business buyers — company name and VAT ID. We use this data to manage your account, process bids, Buy It Now purchases and offers, issue invoices, arrange delivery or collection and contact you about your purchases. We also store your bids, watchlist, saved searches and the language you use on the site (so emails reach you in that language). Legal basis: Art. 6 (1) (b) GDPR (contract and pre-contractual steps).
Other bidders only see a masked bidder name, never your real name, email or location.
4. VAT ID check (VIES)
If you enter a VAT ID as a business buyer, we check it automatically in the European Commission’s VAT Information Exchange System (VIES), which queries the tax authority of your country. We store the result and the company name returned. Legal basis: Art. 6 (1) (c) GDPR (our obligations under VAT law for intra-Community supplies) and Art. 6 (1) (b) GDPR.
5. Payments
For bank transfers we receive the details your bank sends with the transfer (name, IBAN, amount, reference). For card payments and card holds you enter your card details on the secure page of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We never see your full card number; Stripe tells us whether the payment or hold succeeded. Stripe may process data in the USA; Stripe uses the EU–US Data Privacy Framework and standard contractual clauses. Legal basis: Art. 6 (1) (b) GDPR; for fraud prevention also Art. 6 (1) (f) GDPR.
6. Emails and notifications
We send emails that are part of the service (account confirmation, outbid alerts, auction results, invoices, payment and delivery information) — Art. 6 (1) (b) GDPR. Reminders for cars you watch and saved-search alerts can be switched off in your account settings. News and offers are only sent if you have agreed (Art. 6 (1) (a) GDPR); you can withdraw your consent at any time in your account or via the link in every such email.
7. Contact form and withdrawal function
If you contact us, we process your name, email, optional phone number and your message to answer you (Art. 6 (1) (b) or (f) GDPR). If you use our online withdrawal function, we process your name, the contract details you give, your email address and the date and time of receipt to handle the withdrawal and send you the confirmation of receipt we are required to send (Art. 6 (1) (c) GDPR). We keep this record as proof for up to 3 years after the end of the year of the withdrawal.
8. Recipients
We only share data where necessary: with the carrier delivering your car (name, address, phone), our hosting and email provider, our payment provider, tax advisers and authorities where the law requires it. We do not sell personal data.
9. How long we keep data
Account data is kept while your account exists. When you close your account we delete it, except where we must keep data by law: invoices and accounting records are kept for the periods required by German commercial and tax law (generally 6, 8 or 10 years depending on the type of document). Data needed to defend legal claims is kept until the limitation period ends.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future. To use your rights, contact contact@fincorp-gestion.com.
You also have the right to lodge a complaint with a data protection supervisory authority, for example in the member state where you live or the authority responsible for us: [e.g. for Saxony: Sächsische Datenschutz- und Transparenzbeauftragte, Devrientstraße 5, 01067 Dresden].
11. Security and automated decisions
The website uses encrypted connections (HTTPS). Passwords are stored only in encrypted (hashed) form. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.