This policy explains what personal data autoland.md processes, for what purpose and on what legal basis, who receives it and what rights you have. We process data in accordance with Law of the Republic of Moldova No. 133 of 8 July 2011 on personal data protection and the acts replacing it, and follow the principles of the EU General Data Protection Regulation (GDPR).
2. Data we process
Account data
- Mobile phone number — for signing in with an SMS code and as the contact in your listings.
- E-mail address — if you sign in by e-mail or add it to your profile (confirmed with a code).
- With Google sign-in — the Google account identifier, name and e-mail that Google shares. We never receive your Google password.
- Profile data you enter yourself: first and last name, name shown on listings, region, language, photo.
Listings and activity
- Listing content: car specifications, VIN, price, description, photos, viewing location.
- Messages between users and photos attached to them, reviews, reports.
- Favourites, saved searches and alert settings; the chat identifier if you connect Telegram.
- Orders of paid services: what was ordered, the amount and payment status. Card details are processed by the payment provider; we do not receive them.
Technical data
- IP address, browser and device type, request times — in server logs and for abuse protection (limits on sign-in attempts, codes and messages).
- For listing view statistics we use a daily hash of the IP address and browser with a secret salt; the IP address itself is not stored in the statistics, and the hash cannot identify you.
- Cookies and browser local storage — see Cookies.
3. Purposes and legal bases
- Running your account and the site (sign-in, listings, messages, favourites, alerts) — performance of our agreement with you (the terms of use).
- Showing a seller's number to buyers — performance of the agreement: the number is not placed in the page code and is shown only when a button is clicked.
- Security, fighting fraud and spam, moderation — our legitimate interest and the protection of users.
- Paid services and accounting — performance of the contract and legal obligations.
- Service e-mails and SMS (sign-in codes, listing-term reminders, message notices) — performance of the agreement. Optional notices can be switched off in your settings.
- Analytics and improving the site — legitimate interest, or your consent where the relevant cookies require it.
4. Who receives data
We do not sell personal data. We share it only as far as needed:
- other users — what you publish: the listing, the name shown on listings, the region, and your phone number when a buyer asks for it;
- the SMS provider — the phone number and the text with the code;
- the e-mail service — the e-mail address and the message;
- Google — when you sign in with Google (at your initiative);
- Telegram — alert messages, if you connected the bot;
- the payment provider (for example Stripe) — order data to process the payment;
- the hosting provider whose servers run the site;
- public authorities — upon a lawful request.
5. Retention
- Account data — as long as the account exists. When an account is deleted, its personal data is anonymised and its listings archived.
- SMS and e-mail confirmation codes are stored only as hashes, only while they are valid and briefly afterwards to enforce limits.
- Listings — during their term and in the archive afterwards; price history — as long as the listing exists.
- Messages — until deleted by the user or as long as the conversation exists.
- Uploaded photos never attached to a listing are deleted automatically.
- Payment records — for the periods required by accounting law.
6. Your rights
You have the right to:
- know what data of yours we process and obtain a copy of it;
- correct inaccurate data (most of it yourself in your account);
- have your data erased or delete your account;
- object to processing based on legitimate interest and restrict processing;
- withdraw consent where processing is based on consent;
- lodge a complaint with the National Center for Personal Data Protection of the Republic of Moldova (datepersonale.md).
7. Security
We use encrypted connections (HTTPS), store sign-in codes only as hashes, limit sign-in attempts, restrict staff access and make regular backups. Sellers' phone numbers are never exposed in page code or through the public API.
8. Children
The site is not intended for people under 18. We do not knowingly collect their data.
9. Changes
We may update this policy. The new version is published on this page with its date; we will announce significant changes on the site or by e-mail.