This policy explains what personal data RallyCarsMarket collects, why we need it, how long we keep it and what you can do about it. It applies to this website and to the accounts, listings and messages created through it.
Last updated: 2026-10-04
1. Who is the data controller
RallyCarsMarket (company details to be completed: legal name, company code, registered address).
Questions about personal data, as well as requests to access, correct or delete it: [email protected]. General enquiries: [email protected].
2. What data we collect
2.1. Data you give us
- Account data: name, email address, password (stored only as a cryptographic hash), account type (private seller or dealer/team), and optionally company name, VAT code, phone number, country, city, website and description.
- Listing data: the text, technical specifications, price, location and photographs you publish, together with the contact details you choose to show.
- Messages: enquiries you send to sellers, messages to our administration and reports about listings.
- Preferences: saved listings, whether your phone number is shown, marketing consent, language.
2.2. Data created automatically
- Usage statistics: how many times a listing was shown, viewed, saved, and how many times its contact details were revealed. For sellers these are aggregated counts, not a profile of the individual visitor.
- Technical data: IP address, browser type and the time of the request in server logs; the IP address of the sender is stored with listing enquiries and registrations as evidence against abuse.
- Security data: login time and IP address of the last login, number of failed attempts (rate limiting), consent records.
- Cookies: see the Cookie policy.
2.3. Data we do not collect
We do not ask for special categories of data (health, political views and similar) and we do not knowingly collect data about children under 16. We do not currently process payment card data; when paid promotions are introduced, payments will be handled by a licensed payment service provider and we will only receive the status of the transaction.
3. Why we use the data and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and maintaining your account, authentication | Account data | Art. 6(1)(b) – performance of a contract (our terms of use) |
| Publishing listings and making them searchable | Listing data, contact details | Art. 6(1)(b) – performance of a contract |
| Delivering enquiries between buyer and seller | Message content, sender's name, email, phone | Art. 6(1)(b) and Art. 6(1)(f) – legitimate interest in operating a marketplace |
| Listing statistics for the seller | Aggregated impressions, views, contacts | Art. 6(1)(f) – legitimate interest (a useful service for sellers) |
| Moderation, fraud and spam prevention, security | Technical data, IP addresses, logs | Art. 6(1)(f) – legitimate interest in a safe platform |
| Service emails (activation, password reset, listing status) | Email address, name | Art. 6(1)(b) – performance of a contract |
| Newsletters and marketing messages | Email address, name | Art. 6(1)(a) – your consent, withdrawable at any time |
| Analytics and advertising cookies | See the cookie policy | Art. 6(1)(a) – your consent given in the cookie banner |
| Accounting for paid services (future) | Order and invoice data | Art. 6(1)(c) – legal obligation |
4. What is public
An active listing is public: its description, photographs, price, city and country, the seller's display name (or company name) and the account type are visible to everyone, including search engines. The phone number is shown only when you enable it, and only after the visitor presses "Show phone number". Your email address is never displayed – enquiries are forwarded by our system.
5. Who we share data with
- Hosting provider – the servers on which the site and the database run (within the EU).
- Cloudflare, Inc. – content delivery network and security filter in front of the site; it processes IP addresses and request metadata.
- Email delivery – the outgoing mail service used to send service messages.
- Payment service providers – only when paid services are activated and only for the data needed for the payment.
- Analytics or advertising providers – only if you consent to those cookies; the providers in use are always listed in the Cookie policy.
- Public authorities – when we are legally obliged to disclose data, or to defend legal claims.
Data processors act on our documented instructions under data processing agreements. Where a provider is outside the European Economic Area, transfers are based on the European Commission's standard contractual clauses or an adequacy decision.
6. How long we keep data
| Data | Retention period |
|---|---|
| Account and profile | Until you delete the account; an inactive account with no listings may be deleted after 3 years' notice |
| Listings and photographs | Until you delete them; deletion is immediate and permanent |
| Listing enquiries | 12 months |
| Support conversations | 3 years after the conversation is closed |
| Server and security logs | 12 months |
| Consent records (cookies, marketing) | 3 years after the consent is withdrawn or replaced |
| Accounting documents for paid services | 10 years (statutory period) |
7. Your rights
Under the GDPR you have the right to: access your data; have inaccurate data corrected; have data erased ("right to be forgotten"); restrict or object to processing; receive your data in a machine-readable format (portability); and withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
7.1. What you can do yourself, immediately
- See and correct your data – My account → Profile & settings.
- Delete a listing and its photographs – My listings → the listing's menu → "Delete permanently".
- Delete your account with all listings, photographs and messages – Profile & settings → Delete account. The deletion is permanent and cannot be undone.
- Withdraw marketing consent – the checkbox in your profile or the unsubscribe link in the email.
- Change cookie choices – the "Cookie settings" link in the footer.
7.2. By email
You may also exercise any of these rights by writing to [email protected]. Write from the email address of your account, or be ready to confirm your identity in another way – this protects your data from being disclosed to someone else. We reply within one month; if the request is complex we may extend this by two further months and will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.
In the request please state what you want: a copy of your data, correction, erasure, restriction, portability, or an objection to processing.
7.3. Complaints
If you believe your data is handled unlawfully, please contact us first – most issues are resolved quickly. You also have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt) or with the supervisory authority of your country of residence.
8. Security
Passwords are stored only as hashes, the connection is encrypted (HTTPS), access to the administration area is restricted by roles and permissions, forms are protected against cross-site request forgery, uploaded files are re-encoded and cannot be executed, and the number of login attempts is limited. Backups are made regularly. Despite this, no system is completely immune: if a breach is likely to result in a high risk to your rights, we will notify you and the supervisory authority as required by law.
9. Automated decision-making
We do not take decisions producing legal effects about you solely by automated means and we do not build profiles for such decisions. Listing order (for example promoted listings) is based on the products purchased by the seller, not on an assessment of the visitor.
10. Changes to this policy
We may update this policy as the service develops. The current version is always published on this page together with its date. For significant changes we will inform registered users by email or by a notice on the site.