Privacy Policy
How AutoDeck processes personal data under the GDPR.
Last updated: 25 September 2026
1. Who we are
The operator of the AutoDeck platform is AutoDeck.ro, private individual resident in Romania. Data-protection contact: contact@autodeck.ro. No Data Protection Officer has been appointed.
2. Data of dealerships’ customers
If you are a customer or prospect of a dealership that uses AutoDeck, the dealership is the controller of your data. AutoDeck processes that data only on the dealership’s behalf and instructions, as its processor, under the Data Processing Agreement. For information and to exercise your rights, contact the dealership; if you write to us, we forward the request to the dealership without delay.
3. Data we process as controller
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Subscriber account and the dealership’s user accounts | Name, email, phone, role, company details | Performance of the contract (GDPR Art. 6(1)(b)) | For the term of the contract and after it ends, until the Customer asks for deletion; we delete within 30 days of the request |
| Security: sign-in, access and audit logs, reCAPTCHA check at registration | IP address, browser, date and time, actions in the account | Legitimate interest in protecting the service (GDPR Art. 6(1)(f)) | For the term of the contract and after it ends, until the Customer asks for deletion; we delete within 30 days of the request |
| Support | Contact details and message content | Performance of the contract and legitimate interest (GDPR Art. 6(1)(b) and (f)) | For the term of the contract |
| Inquiries sent through the site’s contact form: we do not store them in the database; we receive them by email in the support mailbox support@autodeck.ro, operated by the operator, and send you a confirmation | Name, email, phone, company, message; the email and company also appear in the application logs | Legitimate interest in answering, and pre-contractual steps taken at your request (GDPR Art. 6(1)(f) and (b)) | Until the inquiry is resolved, then at most 12 months |
| Billing of paid subscriptions | Company and payer details, payments | Performance of the contract and legal obligation (GDPR Art. 6(1)(b) and (c)) | 5 years from 1 July of the year after the financial year (Romanian Accounting Law 82/1991, art. 25); annual financial statements, 10 years |
| Traffic analysis on the public site (Google Analytics) | Cookie identifiers, pages visited | Consent (GDPR Art. 6(1)(a)) | The cookie lifetimes in the cookie policy, until consent is withdrawn |
Account data is needed to conclude the contract; without it we cannot create the account. Encrypted backups are taken daily and expire after 30 days.
4. Recipients and transfers
| Provider | Service | Location | Transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, databases, files and backups for accounts in this region | Germany (EU) | Not applicable |
| Functional Software, Inc. (Sentry) | Error monitoring; email, IP address and user identifier are removed before sending | EU (Sentry’s EU data region) | Standard Contractual Clauses, for access from the US |
| Plus Five Five, Inc. (Resend) | Transactional email | United States | Standard Contractual Clauses |
| Stripe Payments Europe, Limited | Payment of paid subscriptions | Ireland (EU) | Standard Contractual Clauses, for transfers to Stripe, Inc. (US) |
| Google Ireland Limited | reCAPTCHA on the registration form; Google Analytics, only with consent | Ireland (EU) | Standard Contractual Clauses, for transfers to Google LLC (US) |
Standard Contractual Clauses are those adopted by the European Commission (GDPR Art. 46). We disclose data to public authorities only where the law requires it, and billing documents to our accountant. Sub-processors for dealership data and the destinations dealerships choose are listed in Annex 1 of the Data Processing Agreement.
5. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time without affecting earlier processing (GDPR Art. 7(3) and 15–21). Write to contact@autodeck.ro. We reply within one month; for complex or numerous requests the period may be extended by two further months, and we will tell you (GDPR Art. 12(3)).
You may complain to the Romanian supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, postcode 010336, anspdcp@dataprotection.ro, www.dataprotection.ro, and you may go to the competent court (GDPR Art. 79).
6. Security and personal-data breaches
We protect data with the measures in Annex 2 of the Data Processing Agreement. If a breach presents a risk, we notify ANSPDCP within 72 hours of becoming aware of it, and we inform you without undue delay when the risk is high (GDPR Art. 33–34). For data processed on a dealership’s behalf, we notify the dealership without undue delay.
7. Cookies
Cookies and other browser storage are described in the cookie policy.
8. Changes
We announce material changes by email or in the application at least 30 days before they apply.