Privacy Policy CarNet & CarNinja

PRIVACY POLICY — CarNet & CarNinja, ENGLISH

Hebel & Margo BV — Last update: 01/12/2025

1. Who are we and how can you contact us?

Data controller: Hebel & Margo BV

Kapellekensweg 32, 3391 Meensel-Kiezegem, Belgium

Company number: BE 0794.199.079

General: info@carnet.be Privacy & GDPR:

info@carnet.be We respond within 1 month (exceptionally 3 months for complex requests, with motivation, in accordance with GDPR Art. 12).

2. Scope

This privacy policy applies to:

• Carnet.be

• CarNinja

• All subdomains, apps, APIs and integrations

By using our services, you agree to this policy.

3. What data do we process and why?

3.1 Overview

In the context of facilitating personalized vehicle offers, we may share your personal data (such as name, email, and search preferences) with verified professional sellers (garages) if we detect that you are interested in a specific vehicle model and the garage has it in stock. This is done based on our legitimate interest to optimize the marketplace or with your explicit consent. Conversely, we may share garage details (such as contact info) with you as a private individual if we believe the garage best matches the vehicle you are seeking. Garages are always pre-verified through our KYBC process. You have the right to object to this processing via [opt-out link or email], and we conduct a DPIA for high-risk processing. Data is retained no longer than necessary and used solely for this purpose, in compliance with GDPR Art. 6 and 13-14.

3.2 An offer for your car and the Carnet auction (added on 14 October 2026)

When you ask for an offer for your car through Carnet, we process the details of your car (brand, model, year, mileage, photos, condition, options and, if given, your expected price and note) and your contact details (phone number, e-mail address and municipality). Legal basis: performing your request (Art. 6(1)(b) GDPR).

• We show your car anonymously to dealers and buyers, through a personal link and, after our review, also on the Carnet auction. The auction is only open to professional car dealers we check beforehand. They see the car's details and photos and the region, never your name, phone number, e-mail address or address. A number plate or name visible on a photo does remain visible.

• We only pass on your name and contact details once you agree to a price.

• If you do not (or no longer) want to be on the auction, e-mail info@carnet.be and we will take your car off.

• If you later change the brand, model or year, we send anyone who already made an offer an e-mail with the old and new details of the car, without your personal data.

• Anyone who makes an offer gives us a name (or garage name) and a phone number or e-mail address. We use these to handle the offer and keep the bidder informed. The seller is only shown the amount. Legal basis: performing the request and legitimate interest.

• Your request, with its photos and offers, is deleted 6 months after it was sent.

3.3 Messages between buyers and sellers (added on 28 October 2026)

Through the chat on Carnet you ask a seller a question about a car, with or without an account. Legal basis: carrying out your request, as a step before a possible purchase (art. 6.1.b GDPR).

• Without an account we ask for your first name and your e-mail address. The seller sees your first name and your message, never your e-mail address or phone number. With an account, the seller sees your username.

• We send e-mails about your conversations: to the seller a copy of your question, to you a confirmation and a message as soon as the seller answers. If the seller is a garage, that message contains the garage's contact details, which are also on its Carnet page. We never pass on the contact details of a private seller. You read the answer itself on Carnet. These e-mails are sent through our e-mail service Resend (processor).

• Against abuse, for a question without an account we keep an encrypted fingerprint of your IP address (never the IP address itself) and we limit the number of questions per hour and per day (legitimate interest, art. 6.1.f GDPR).

• With "Report abuse" you report a conversation to Carnet. Only then does someone at Carnet read the conversation. Every step goes into a file, without the content of the messages. That file is kept for 2 years after the last step. Carnet can then exclude someone from the chat; that person gets an e-mail with the reason and can object via info@carnet.be. Whoever reported is told once the report has been reviewed (legitimate interest: a safe marketplace, art. 6.1.f GDPR).

• Conversations are deleted automatically 6 months after the last message, and immediately when you delete your account. The data of a question without an account disappear together with the conversation. If you make an account later, your conversations move into that account.

4. AI & Profiling (CarNinja)

4.1 No binding automated decisions Our AI provides advice based on vehicle data, no binding or legal decisions. You always retain full control. No profiling with personal data is performed, but EXIF metadata may potentially contain personal data and is anonymized to minimize risks.

4.2 Rights regarding AI You can: • Request human intervention • Obtain an explanation of the logic • Contest the results

Via info@carnet.be.

4.3 Storage of photos & metadata

• Photos: max. 160 days

• EXIF metadata (potentially personal data): max. 120 days, anonymized after processing

• Model training: only anonymized (no personal data)

We conduct DPIAs and mitigate biases through regular audits.

5. Retention Periods

After expiry, data is deleted or anonymized.

6. Sharing with Third Parties

We never sell personal data.

7. International Transfers

Data outside the EU is protected via:

• EU Standard Contractual Clauses (2021)

• Transfer Impact Assessments

• Additional technical & organizational measures

We monitor GDPR case law (Schrems II/III).

8. Your GDPR Rights

You have the right to:

• Access

• Rectification

• Deletion

• Restriction • Objection (incl. to marketing & model training)

• Data portability • Withdrawal of consent • Complaint to the DPA

Email info@carnet.be.

9. Account Deletion

Email: info@carnet.be Subject: “Account deletion” Within 30 days:

• Account deleted

• Personal data removed

• Remaining data anonymized

10. Cookies & Tracking

We use:

• Functional cookies

• Analytical cookies

• Marketing cookies (opt-in)

• Retargeting via Meta/Google Ads

11. Security

We apply, among others:

• TLS 1.3 • AES-256 encryption

• bcrypt/Argon2 hashing

• Least-privilege access control

• Regular penetration tests

• DPIA for CarNinja

• Data breach notification obligation (72 hours)

12. Minors

Our services are not aimed at persons under 18 years. Detected data is immediately deleted.

13. Changes

Important changes are announced via the website and/or email. The current version is always available at carnet.be/privacy.

14. Applicable Law

Belgian law. Competent court: arrondissement Leuven.

Last update: 01/12/2025 Questions? info@carnet.be