1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

Race Retro Autos Ltd is the controller of personal data processed for the operation of its website and services, except where another organisation is independently responsible for its own processing.

Company: Race Retro Autos Ltd
Company number: 2631459-3
Website: www.raceretroautos.com
Contact: Please use the contact details published on our website for privacy enquiries.

If a Data Protection Officer is appointed, their contact details will be published here and on the website.

2. WHAT PERSONAL DATA DO WE COLLECT?

Depending on how you use Race Retro Autos, we may process:

Account and identity information: name, username, account details, date of birth or age confirmation, company name, job title and information needed to verify identity or authority to act for a business.

Contact information: email address, telephone number, postal address and other contact details.

Classified listing information: vehicle details, photographs, videos, registration-related information, vehicle identification information, service/history information, location information supplied for a Listing and other information included in an advertisement.

Auction information: bids, bidding history, winning bids, Auction participation, Lot information, account activity and transaction records.

Transaction information: invoices, purchase and sale information, payment status, fees, premiums, commissions and banking information where necessary for a transaction.

Payment-card information: payment details may be processed by our payment provider. We do not intend to store full payment-card details ourselves where a third-party payment provider processes the payment.

Communications: messages, enquiries, customer-service communications and correspondence with Race Retro Autos.

Technical and usage information: IP address, browser and device information, log information, approximate location derived from technical information where applicable, cookie identifiers and information about how the website is used.

Marketing preferences: records of subscriptions, preferences and whether marketing communications have been opened or interacted with, where applicable.

Fraud and security information: information reasonably necessary to identify suspicious activity, prevent misuse of accounts, protect the Auction process and investigate suspected fraud or other unlawful activity.

3. HOW DO WE USE PERSONAL DATA?

We use personal data for the following purposes:

To create and administer user accounts.

To publish and manage Classified Listings and allow users to communicate about Listings.

To administer Auctions, including registration, bidding, bid records, winning bids and auction-related communications.

To facilitate transactions, issue invoices, collect fees and commissions, process payments and provide transaction-related support.

To provide optional services such as vehicle inspection, transport coordination or other services requested by a user.

To communicate with users about Listings, Auctions, purchases, sales, account activity, service changes, security issues and customer support.

To prevent fraud, account abuse, bid manipulation, payment fraud, money laundering and other unlawful or harmful activity.

To maintain, secure and improve the website and services.

To comply with legal, tax, accounting, regulatory and law-enforcement obligations.

To send marketing communications where we have a lawful basis to do so and, where required, the user’s consent.

4. LEGAL BASES FOR PROCESSING

We process personal data only where a lawful basis under the GDPR and applicable law exists. The applicable basis depends on the purpose of the processing.

Contract – where processing is necessary to provide an account, operate a Classified Listing or Auction, administer a transaction, provide a requested service or perform obligations under an agreement with you.

Legal obligation – where processing is necessary to comply with tax, accounting, anti-fraud, financial, regulatory, court or other legal obligations.

Legitimate interests – where processing is necessary for legitimate business interests such as operating and securing the marketplace, preventing fraud and abuse, maintaining records, improving services, handling disputes and protecting users and our business, provided those interests are not overridden by your rights and freedoms.

Consent – where we ask for consent for a particular purpose, such as certain non-essential cookies or marketing activities where consent is required. Consent is voluntary and can be withdrawn at any time.

Vital interests or public interest – where applicable and only where the relevant legal conditions are met.

We do not rely on consent as a blanket basis for processing all customer or business information. Different processing activities may have different legal bases.

5. CLASSIFIED MARKETPLACE

When you create a Classified Listing, information you choose to publish may be visible to website visitors and prospective Buyers.

A Listing may contain personal data if you include your name, telephone number, email address, location, photographs or documents containing identifying information.

Users should avoid publishing unnecessary personal information in a Listing. Do not upload identity documents, payment-card details or other sensitive personal information unless Race Retro Autos specifically requests it through a secure process.

Race Retro Autos may retain Listing information after a Listing has ended where reasonably necessary for legal, accounting, fraud-prevention, dispute-resolution or record-keeping purposes.

6. AUCTIONS

When you register or participate in an Auction, we process information needed to verify your account, administer bidding and determine the outcome of the Auction.

Information about bids and winning bids may need to be retained as evidence of the Auction process and for contractual, accounting, fraud-prevention or legal purposes.

We may use account and bidding information to detect suspicious bidding patterns, account misuse, attempted fraud, collusion or other conduct that could compromise the integrity of an Auction.

Where automated tools are used for security or fraud detection, they are intended to identify activity requiring review or protective action. We will not make a decision based solely on automated processing that produces legal or similarly significant effects unless the requirements of applicable data-protection law are satisfied.

7. PAYMENTS

Payments may be processed through third-party payment providers such as Stripe or other providers selected by Race Retro Autos.

Payment providers may collect and process payment-card and transaction information under their own privacy notices and terms.

Race Retro Autos may receive information such as payment status, transaction reference, amount, currency, payer information and other information necessary to reconcile the transaction, without receiving or storing full card details where the payment provider handles those details.

We retain transaction and accounting records for as long as necessary to fulfil contractual obligations and comply with tax, accounting and other legal requirements.

8. THIRD-PARTY SERVICE PROVIDERS

We may use third-party providers to operate the website and services. Depending on the services actually enabled on the website, these may include:

Payment processors and payment-service providers.

Website hosting, infrastructure, security, analytics and technical-support providers.

Email, SMS and communications providers.

Transport, freight-forwarding and logistics providers where a user requests or requires such services.

Vehicle inspection or verification providers where such a service is offered.

Professional advisers, insurers, auditors and legal advisers where necessary.

Authorities, courts, regulators or law-enforcement bodies where disclosure is required or permitted by law.

Where a provider processes personal data on our behalf, we will take appropriate steps to require processing in accordance with applicable data-protection law and the relevant contractual requirements.

9. COMMUNICATIONS

We may send service communications necessary to operate your account or complete a transaction, including account notices, Auction notifications, bid results, invoices, payment notices, Listing-related communications, security alerts and customer-service responses.

These operational communications are not the same as optional marketing communications.

Where permitted by law, we may send information about Race Retro Autos services that may be relevant to you. Where consent is required, we will ask for it.

You can unsubscribe from marketing communications at any time using the unsubscribe mechanism provided or by contacting us.

10. COOKIES AND SIMILAR TECHNOLOGIES

Race Retro Autos may use cookies and similar technologies to operate the website, remember preferences, maintain account sessions, secure the service, understand website usage and, where applicable, support marketing or analytics.

Cookies may include:

Strictly necessary cookies – required for functions such as account login, security, session management, shopping/transaction functions and cookie preferences. These generally do not require consent where they are technically necessary.

Preference cookies – used to remember choices such as language or interface preferences.

Analytics cookies – used to understand how visitors use the website and improve performance. Where consent is legally required, these cookies will only be activated after consent.

Marketing or advertising cookies – used, where applicable, to support advertising, campaign measurement or personalised marketing. Where consent is legally required, these cookies will only be activated after consent.

Where non-essential cookies require consent, our cookie controls should allow users to accept or refuse them and to change their preferences later. Refusing non-essential cookies should not prevent access to core services unless a particular cookie is genuinely necessary for that service.

The exact cookies and retention periods depend on the technology actually installed on www.raceretroautos.com. Before publication, the website operator should complete a cookie audit and insert the actual cookie names, providers, purposes and durations into the cookie settings/policy.

11. IMAGES AND LOCATION DATA

Users may upload photographs and other media to Classified Listings and Auctions. Photographs can contain embedded metadata such as GPS location information (EXIF). Users should remove unnecessary location metadata before uploading images.

Information contained in a published photograph may be visible to website visitors. Users should ensure that they have the right to upload and publish the image and that it does not unnecessarily disclose another person’s personal information.

12. DATA RETENTION

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, contractual, accounting, tax, security and dispute-resolution requirements.

Account information – generally while the account remains active and for a reasonable period afterwards where necessary for legal, security or dispute purposes.

Classified Listings – while the Listing is active and, where necessary, afterwards for transaction records, fraud prevention, disputes, legal obligations or service administration.

Auction and bid records – for as long as reasonably necessary to evidence the Auction and transactions, prevent fraud, resolve disputes and comply with legal obligations.

Transaction, invoice and accounting records – for the period required by applicable tax and accounting laws.

Customer-service and dispute records – for as long as reasonably necessary to investigate and resolve the matter and protect legal rights.

Marketing records – until you unsubscribe or withdraw consent, unless another lawful reason requires limited retention of suppression or compliance records.

Cookie data – according to the duration of the relevant cookie and our cookie settings.

Specific retention periods should be documented internally and applied consistently. Where a fixed statutory retention period applies, the applicable law will determine the minimum retention period.

13. DATA SECURITY

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, unlawful processing, accidental loss, destruction or damage.

Users are responsible for protecting their own account credentials and should not share passwords. No internet-based service can guarantee absolute security.

14. INTERNATIONAL TRANSFERS

Some third-party providers may process personal data outside Finland or the European Economic Area. Where personal data is transferred outside the EEA, Race Retro Autos will use an appropriate legal mechanism and safeguards where required by GDPR, such as an adequacy decision or appropriate contractual safeguards.

The actual countries and safeguards depend on the third-party providers used by the website.

15. YOUR GDPR RIGHTS

Subject to the conditions and limitations in applicable law, you may have the following rights:

Right to be informed about how your personal data is processed.

Right of access to personal data we hold about you.

Right to rectification of inaccurate or incomplete personal data.

Right to erasure where the legal conditions are met.

Right to restriction of processing in certain circumstances.

Right to data portability where the legal conditions apply.

Right to object to processing based on legitimate interests and to direct marketing, subject to applicable law.

Right to withdraw consent where processing is based on consent. Withdrawal does not affect processing that was lawful before withdrawal.

Rights concerning solely automated decision-making and profiling where applicable.

Some rights are not absolute and may be limited where, for example, we are required to retain information to comply with a legal obligation or to establish, exercise or defend legal claims.

16. HOW TO EXERCISE YOUR RIGHTS

To exercise a data-protection right or ask a privacy question, contact Race Retro Autos using the privacy contact details published on www.raceretroautos.com.

We may need to verify your identity before responding to a request. We will handle requests within the time limits required by applicable data-protection law.

If you believe that your personal data has been processed unlawfully, you also have the right to lodge a complaint with the relevant supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

17. THIRD-PARTY WEBSITES

The website may contain links to third-party websites or services. This Privacy Policy does not govern the privacy practices of those third parties. You should review their privacy notices before providing personal data to them.

Where a third-party service is embedded into the Race Retro Autos website, the provider may process information according to its own privacy terms as well as the arrangements between that provider and Race Retro Autos.

18. CHILDREN

Race Retro Autos services are intended for users aged 18 or over. We do not knowingly invite children under 18 to register or participate in Classified Listings or Auctions. If we learn that we have collected personal data from a child contrary to applicable law, we will take appropriate steps.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy when our services, technology, providers or legal requirements change. The latest version will be published on www.raceretroautos.com with the applicable update date.

20. CONTACT

For privacy questions, data-protection requests or complaints about our handling of personal data, please contact Race Retro Autos Ltd using the contact details published on www.raceretroautos.com.

Race Retro Autos Ltd
Company number: 2631459-3
Website: www.raceretroautos.com