Privacy Policy

1.Who we are

The data controller for personal data collected through this website is Forge Digital EOOD, with registered office at Stadspark, 2018 Antwerpen, België, company number 0789456123, VAT BE0789456123, trading as Canary. You can contact us by email at info@forgedigital.io, by phone at +32 3 216 58 40, or through the contact form on this website.

2.1.Data you give us through a form

When you send us a message through the contact form, ask us a question about a specific vehicle, or ask a question about financing, we process the information you enter yourself: your name, email address, telephone number, the content of your message, and the language in which you chose to write. That message is forwarded directly to our own email inbox. It is not stored in this website's database, and there is no screen in our management system where visitor messages are collected. Your message therefore reaches us in the same way as an email you would have written to us yourself.

2.2."Offer your car"

The "offer your car" form works differently. We do store the information you submit through it in this website's database, because we follow up on your offer over a period of days or weeks: your name, email address, telephone number, the content of your message, the details and any photographs of the car you are offering, and a salted hash of your IP address (meaning your IP can no longer be reconstructed from what we hold) for abuse prevention. How long we keep this data is set out in Section 7.

2.3.Technical and usage data

To keep this website secure and running smoothly, and to understand how it is used, we collect certain technical data: information about your browser and device, and which pages you viewed. This is done using a privacy-friendly, cookieless analytics tool that does not track individual visitors and does not build personal profiles.

2.4.Contact by email or phone

If you email or call us directly, we process the information you share with us in order to respond to your query.

2.5.Special categories

We do not knowingly collect special categories of personal data (such as data concerning health, ethnic origin, religious beliefs, or trade union membership). Please do not send us such data through our forms or emails.

3.Why we process your data, and on what legal basis

We process your personal data for the following purposes, each on a specific legal basis under the GDPR:

• To respond to your query and take steps prior to a sale that you request (for example, arranging a test drive or reserving a vehicle), under Article 6(1)(b) GDPR (steps taken at your request prior to a contract).
• To manage our vehicle offering and customer relationship, to prevent spam and misuse of our forms, and to compile simple aggregated statistics on the use of our website, under Article 6(1)(f) GDPR (legitimate interest). We have weighed this interest against your rights and freedoms and consider that minimal, proportionate processing is justified.
• To comply with our legal obligations, for example for accounting or tax purposes, under Article 6(1)(c) GDPR.
• Where we ask for your explicit consent for a particular purpose, the processing is based on Article 6(1)(a) GDPR. You may withdraw this consent at any time.

4.Cookies and analytics

This website uses only strictly necessary and functional cookies (for example, to remember your language preference and to protect our forms against abuse). No consent is required for these cookies. We do not use any advertising, tracking, or profiling cookies. Our web analytics is cookieless. Because we set no non-essential cookies, this website displays no cookie banner. If we ever introduce non-essential cookies in the future, we will update this policy and first ask for your explicit consent through a cookie banner. For details on the specific cookies used, see our separate Cookie Policy.

5.Who receives your personal data

We do not share your personal data with third parties for their own commercial purposes, and we never sell your data. To operate this website and our services, we rely on carefully selected service providers who act as our processors within the meaning of the GDPR. They process your data solely on our instructions, and are contractually bound to do so through a data processing agreement that imposes appropriate security and confidentiality measures.

5.1.Providers of the website and its infrastructure

Our website is built and hosted on the Cars by Forge Digital platform, operated by Forge Digital EOOD (Bulgaria). Forge Digital hosts the underlying platform, the database and file storage (in the European Union, at data centres in Frankfurt, Germany), delivers our outbound transactional emails, provides bot protection on our forms and operates authoritative DNS. We have a written data processing agreement with Forge Digital and, through it, with each of its sub-processors. Forge Digital keeps a current list of those sub-processors, which is available on request from support@forgedigital.io, and notifies us in advance of any intended addition or replacement so that we may object.

5.2.Third parties whose services appear on our pages

The following categories of third party receive limited personal data as a result of specific features integrated in our website. We identify them here by the function they perform; the full list of the applications used, naming each provider, is available on request from support@forgedigital.io, together with the transfer mechanism relied upon for any specific recipient.

• Mapping service (established in the European Union): the map in the footer of every page of this website is embedded from a third-party mapping provider. When your browser loads the map, that provider receives your IP address and, in some cases, additional device data, governed by its own privacy policy. It is a separate controller in respect of that data, not our processor. We rely on this embed under our legitimate interest in showing our physical location to visitors.
• Automatic translation service (established in the United States): we use it to translate the text we write about our vehicles into the other public languages of this website. Where our text incidentally contains personal data (for example, a description referring to a previous owner), that personal data reaches the provider. Transfer to the United States is safeguarded by the EU-US Data Privacy Framework, the provider being certified under it, supplemented by Standard Contractual Clauses.
• Image processing service (established in the United States): we optionally use it to replace the background of a vehicle photograph or to generate decorative homepage imagery. Where a photograph incidentally contains personal data (for example, a face or a licence plate visible in the background), that personal data reaches the provider. Transfer to the United States is safeguarded by Standard Contractual Clauses supplemented by appropriate technical measures. The provider does not use our data to train its models.
• Vehicle data look-up service (established in the European Union): we use it to look up a vehicle's technical specifications from its chassis number. This look-up concerns vehicle data, not visitor personal data.
• Weather service (established in the European Union): if we have switched on the weather effect for our homepage, your browser asks a weather provider what the weather is in your area, so that the photograph can reflect it. That provider receives your IP address and an approximate position. The position is derived from your device's time zone, not from a location look-up, and is accurate only to the level of a region. It is a separate controller in respect of that data, not our processor. We rely on our legitimate interest in presenting an appealing homepage; you can switch the effect off from the homepage itself, and it is not used at all when it is switched off.

5.3.Legal disclosures

We may additionally disclose personal data where we are required to do so by law, by a competent authority, by a court order, or where necessary to protect our rights, our property or the safety of others.

6.International data transfers

Your personal data is primarily processed within the European Union / European Economic Area (EU/EEA). Where a service provider processes your data outside the EEA (in particular the translation and image processing services noted in Section 5.2), we ensure that appropriate safeguards apply: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework where the recipient is a certified US organisation), the European Commission's Standard Contractual Clauses, or another appropriate safeguard recognised under the GDPR. We can provide you with a copy of the transfer mechanism relied upon for any specific recipient on request.

Messages sent through the contact form, a vehicle inquiry or a financing question

These messages are not stored by us. We forward them by email to our own inbox, where they arrive in the same way as an email you would have written to us yourself. From that moment on they are kept and deleted in line with the normal running of our mailbox. We cannot state a fixed deletion date for them, because no automated process on the website governs these messages.

Data you provide to us through the "offer your car" form

This data is stored because we need to assess your car and to contact you over a longer period. As soon as the vehicle is sold, your personal data (name, email address, telephone number, message content and hashed IP address) is deleted automatically. What remains afterwards is only a record of the car itself: one photograph and a summary of its specifications in our public overview of sold vehicles, which contains no personal data. If your offer does not lead to a sale, we keep this data for twenty-four (24) months after our last contact with you, after which it is deleted.

Technical send log

Of every message this website sends, we keep a technical send log permanently, so that we can check afterwards whether a message arrived. That log contains only a reference identifier, the type of inquiry, the vehicle concerned, the recipient's address (our own inbox, never a visitor's) and whether sending succeeded. It does not contain your name, your email address, your telephone number or the content of your message.

Data required by law

Data we are legally required to keep, such as accounting records relating to a sale, is retained for the statutory retention period applicable in our jurisdiction. A longer retention period is also possible where necessary, for example in the context of an ongoing dispute.

8.Automated content on this website (AI transparency)

In accordance with Article 50 of Regulation (EU) 2024/1689 (the "EU AI Act"), we inform you that certain content on this website is produced or modified by automated (including artificial-intelligence) means:

• the decorative image on our homepage may be computer-generated, and is not a photograph of our physical premises or stock;
• vehicle photographs may have their background replaced through an automated tool, and individual photographs may have been created or modified using artificial intelligence; every such photograph carries a label in the photo gallery of the vehicle concerned;
• text about our vehicles may be produced in one language by us and translated into the other languages of this website by machine translation;
• vehicle specifications shown on a vehicle page may be pre-filled from a VIN look-up service and confirmed by us before publishing.

This information is provided to you so that you can distinguish automated or automated-assisted content from content created without any automation.

9.Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: you can request to know what data we hold about you.
• Right to rectification: you can have inaccurate or incomplete data corrected.
• Right to erasure ("right to be forgotten"): you can request that we delete your data, within the limits of our legal obligations.
• Right to restriction of processing: you can request that we temporarily limit the processing of your data.
• Right to data portability: you can request to receive the data you provided to us in a structured, commonly used format.
• Right to object: you can object to processing based on our legitimate interest.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at info@forgedigital.io. We will respond within the legally required timeframe.

10.Right to lodge a complaint

If you are not satisfied with how we process your data, you may always lodge a complaint with the competent supervisory authority in your country. In België the competent authority is Gegevensbeschermingsautoriteit / Autorité de protection des données (GBA/APD), Drukpersstraat 35, 1000 Brussels, website www.gegevensbeschermingsautoriteit.be.

11.Security of your data

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration or destruction. These include: encryption of data in transit (via HTTPS/TLS), access controls on our systems, storing IP addresses only in hashed form, hosting data within the EU, and entering into data processing agreements with all of our service providers.

12.Changes to this policy

We may update this Privacy Policy from time to time, for example following changes to our operations or to applicable law. The date at the top of this page indicates when the policy was last updated. We encourage you to review this policy periodically.

13.Contact

If you have any questions about this Privacy Policy or about how we process your personal data, you can always contact us: Forge Digital EOOD, trading as Canary, Stadspark, 2018 Antwerpen, België. Email: info@forgedigital.io, phone: +32 3 216 58 40, website: canary.dealership.biz.