Privacy policy

1. When we are controller and when processor

We are the controller for the data of our customers (dealers) and people interested in the service: account, billing, communication and custom solution requests.

For the data of visitors to dealers' websites (for example inquiries from the form on a dealer's site) the dealer is the controller, and NodeCar processes that data only on the dealer's behalf as a processor (see section 9).

2. What data we process

Account: email, password (stored only as a secure hash), language, date the email was confirmed.

Billing: name or company name, address, country, VAT ID and the result of its check in the EU VIES system (date and consultation number), subscription and invoice details. Card details are processed by Stripe; we do not have them.

Site content and integrations: texts, photos, vehicle details, dealership contacts; for ABManager an encrypted login; for Google reviews the business's Google identifier.

Custom solution requests: name, email, phone, company, website and message.

Technical data: we use the IP address briefly to protect against abuse (limiting the number of requests); a session cookie keeps you signed in (see the cookie policy).

3. Purposes and legal bases

Providing the service and managing the account – performance of a contract (Art. 6(1)(b) GDPR).

Invoicing, accounting and VAT ID checks – legal obligation (Art. 6(1)(c) GDPR).

Answering a request and preparing an offer – steps prior to a contract (Art. 6(1)(b) GDPR).

Security of the service and protection against abuse – legitimate interest (Art. 6(1)(f) GDPR).

Service emails (for example trial ending, failed payment, domain status) are sent as part of the contract. We do not send marketing emails.

4. Who receives data

Hetzner Online GmbH – hosting and backups (data centres in the EU).

Stripe – payment processing, invoices and VAT calculation (Stripe Tax).

Mailjet – sending emails.

Google – Places API to find the business and load reviews; photos of review authors on dealers' sites load directly from Google's servers in the visitor's browser.

European Commission (VIES system) – VAT ID checks.

ABManager – on the dealer's instruction we sign in and read their offers.

Public authorities where the law requires it.

5. Transfers outside the EU

Some providers (Stripe, Google) may also process data outside the EU, in particular in the USA. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.

6. How long we keep data

Account and site data for as long as the contract lasts. We keep the data of a switched-off site for 12 months after it is switched off; we send a warning by email 30 days before deletion and then permanently delete the site, its database and files.

Invoices and accounting records are kept for the period required by the Slovak Accounting Act (10 years). Records of VAT ID checks are kept for the same period as evidence for invoicing.

Custom solution requests are kept as long as needed to handle them and for the follow-up business communication.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. Send your request to info@nodecar.eu.

You have the right to lodge a complaint with the supervisory authority – the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

8. Security

Communication is encrypted (https). Passwords are stored only as hashes and ABManager logins encrypted. Each dealer's data is in a separate database, and only authorised NodeCar staff have access to it.

9. Processing on behalf of dealers (data processing agreement)

Subject and duration: NodeCar processes personal data of visitors to the dealer's site for as long as the contract lasts, in order to run the site. Categories of data: name, email, phone and message from the site's form, details of the vehicle the inquiry is about; possibly personal data in content the dealer adds to the site. Data subjects: visitors and people interested in vehicles.

Inquiries from the site's form are not stored in a database – they are only delivered to the dealer by email (via Mailjet).

NodeCar processes the data only on the dealer's documented instructions (these terms and the site settings), binds the people with access to confidentiality, and takes appropriate technical and organisational measures (section 8).

The dealer gives general authorisation to engage the further processors listed in section 4; we inform the dealer of changes in advance by email, and the dealer may object.

NodeCar assists the dealer with data subject requests and with obligations under Articles 32 to 36 GDPR, informs the dealer of a personal data breach without undue delay, and on request provides the information needed to demonstrate compliance, including allowing audits.

After the contract ends we delete the data within the period in section 6 unless the law requires it to be kept.

10. Changes

We may update this policy; we will tell you about significant changes by email or in the app.