GDPR & your rights

1. When GDPR applies

The General Data Protection Regulation may apply depending on the people, organizations, and processing involved. This page explains the request process and relevant rights; it is not a certification that every legal and operational requirement has been satisfied.

2. Rights you may exercise

Rights depend on the legal basis and circumstances. They are not all absolute.

• Access: ask whether your data is processed and request a copy.
• Rectification: ask for inaccurate information to be corrected.
• Erasure or restriction: request deletion or limits on processing where the conditions apply.
• Portability: receive eligible data in a usable format.
• Objection: object to direct marketing or certain other processing.
• Consent: withdraw consent without affecting the lawfulness of earlier processing.
• Automated decisions: seek applicable protections for decisions with legal or similarly significant effects.

3. Make a request

Use the privacy contact below and describe the right you wish to exercise, the account or dealership involved, and enough context to locate the relevant information. Do not send passwords or unnecessary identity documents.

If the data was submitted by a dealership, the dealership may be the controller responsible for the request. The service operator should identify the responsible party and assist within its role. Proportionate identity verification may be necessary before information is disclosed or changed.

4. Response timing

Where GDPR applies, a request must generally be answered without undue delay and within one month. For complex or numerous requests, a permitted extension of up to two further months may apply; the requester must be told within the first month and given the reason.

If a request cannot be fulfilled, the response should explain why and describe applicable complaint or remedy options.

5. Complaints and further information

You may lodge a complaint with a competent data protection authority. You do not have to resolve a complaint with the service operator first. Official guidance linked below explains the rights in more detail.

6. Dealership processing

A dealership uploading personal data should establish its lawful basis, provide necessary notices, minimize the information supplied, and agree appropriate data-processing terms with its providers. Provider locations, retention, and transfer arrangements are described in the privacy policy once verified.