Privacy Policy
How Drivepoint processes the personal data of its customers and website visitors.
This English version is a translation for convenience. The Romanian version prevails.
1. Who the controller is
The controller of the personal data processed through drivepoint.ro and in Drivepoint's business is CIUK VERKAUF SRL, VAT RO47527652, Trade Register no. J2023000541236, registered office Str. Biharia 67-77, Building G, 2nd floor, Office 4, District 1, Bucharest.
For any question about personal data or to exercise your rights: office@drivepoint.ro, +40 727 745 195.
2. Categories of personal data
| Category | Examples |
|---|---|
| Identity and contact | first and last name, phone, e-mail, town |
| Requests | your message, the vehicle of interest, the service requested |
| Details of the customer's vehicle | make, model, year, mileage, VIN, registration number, photos, condition and history, insofar as they relate to a person |
| Contracts and invoicing | personal ID number or VAT number, address, ID document series and number, bank details for payments |
| Documents | copies of ID documents, vehicle documents and contracts needed for the transaction |
| Financing | the data the lender asks for to assess the application, passed on only at the customer's request |
| Technical data | IP address, browser and device type, pages visited; analytics data only with consent |
3. Where the data comes from
Mostly directly from you: the website forms, e-mail, phone, WhatsApp, conversations at our office and the documents you give us. We keep it in our internal customer management system (CRM). Some technical data is collected automatically, through the technologies described in the Cookie Policy. Public company data (name, registered office, registration number) may be retrieved from the ANAF register using the VAT number.
4. Purposes and legal bases
We process data only for specific purposes, each with its own legal basis. We do not use consent as a general basis: we ask for it only where the law requires it (for example for analytics and marketing).
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to requests and making offers | steps prior to a contract (Art. 6(1)(b)) |
| Concluding and performing contracts (sale, buy-back, trade-in, sourcing) | performance of a contract (Art. 6(1)(b)) |
| Consignment: valuation, promotion, viewings, sale | performance of the consignment contract (Art. 6(1)(b)) |
| Passing a financing request to the lender | steps prior to a contract, at the customer's request (Art. 6(1)(b)) |
| Invoicing and accounting records | legal obligation (Art. 6(1)(c)) |
| Warranty, after-sales support, complaints | contract and legal obligation (Art. 6(1)(b) and (c)) |
| Website security and abuse prevention | legitimate interest (Art. 6(1)(f)) |
| Defending our rights in a dispute | legitimate interest (Art. 6(1)(f)) |
| Marketing messages | consent (Art. 6(1)(a)) |
5. Who receives the data
We share data only as far as each purpose requires, and only with:
| Recipient | What they receive and why |
|---|---|
| The website and CRM hosting provider (Hetzner Online GmbH, servers in Germany) | all stored data, as a processor |
| The backup provider (Cloudflare, R2 service) | backup copies of the stored data, as a processor |
| The e-mail provider (Hostinger) | the messages and notifications sent and received through Drivepoint e-mail addresses |
| Cloudflare (Turnstile) | technical data to protect the forms against automated submissions |
| Partner financial institutions | the data for a financing application, only at your request |
| Invoicing and accounting (the Oblio invoicing platform) | the data needed for invoicing and legal obligations |
| The warranty issuer (DEFEND Car Protect) | the data needed to issue the extended warranty, if you choose it |
| Public authorities | where the law requires it (for example ANAF, police, courts) |
We do not sell personal data and do not use it for personalised advertising.
6. Data passed to lenders
If you apply for financing, we pass your contact details, the vehicle details and, at the lender's request, the documents you give us for this purpose to the financial institution you choose. The lender becomes an independent controller of the data it receives and processes it under its own policy, including for risk assessment and credit database checks. Drivepoint does not make the approval decision.
7. Vehicle documents
For buy-back, trade-in, consignment and sales we process the vehicle documents (registration certificate, CIV, service records) and the ID documents of owners or their representatives, only as far as needed to verify ownership, for the contract and for the transfer formalities. The documents are kept in our internal system, with access limited to the staff handling the transaction.
The chassis number (VIN) and technical data of vehicles in stock are published in the listings. They do not identify previous owners.
8. How long we keep data
| Category | How long |
|---|---|
| Requests that do not lead to a transaction | 12 months from the last contact |
| Contracts and transaction documents | for the duration of the contract and then the limitation period for possible claims |
| Invoices and accounting documents | the periods set by accounting law |
| Copies of ID documents | as long as the transaction and legal obligations require |
| Your cookie choice | until deleted from the browser or until a new version of the notice |
9. International transfers
Some providers may process data outside the European Economic Area: Google (Analytics, only with consent) and Cloudflare, mainly in the US. These transfers rely on the EU-US Data Privacy Framework adequacy decision, for certified providers, or on standard contractual clauses. The map on the contact page loads from OpenStreetMap (United Kingdom, a country with an adequacy decision), which receives the visitor's IP address.
10. Your rights
- the right of access to your data
- the right to rectification
- the right to erasure, as provided by law
- the right to restriction of processing
- the right to object, including to processing based on legitimate interest
- the right to data portability
- the right to withdraw consent at any time, without affecting earlier processing
- the right to lodge a complaint with the Romanian data protection authority (ANSPDCP): www.dataprotection.ro
To exercise your rights, write to office@drivepoint.ro. We reply within one month of receiving the request, a period that may be extended as provided by the GDPR.
11. Data security
We use appropriate technical and organisational measures: encrypted connections (HTTPS), CRM access only with personal accounts and role-based permissions, documents with financial data visible only to the administrator, protection of the forms against automated submissions, backups. No system is completely secure; if an incident affects your data, we inform you and notify the authority where the law requires.
12. Cookies
The technologies used on the website, their purpose and duration are described in the Cookie Policy. You can change your choice at any time from “Cookie settings” at the bottom of every page.
13. Marketing
We may contact you by phone, WhatsApp or e-mail to answer your request. Messages needed for your request (replies, requested offers, appointments, documents) are not marketing. Marketing messages (news, unsolicited offers) are sent only with your separate consent, which you can withdraw at any time.
14. Updates and contact
We may update this policy when our services, providers or the law change. The version in force is the one on this page, with the date and version shown at the top.
Contact for personal data: office@drivepoint.ro, +40 727 745 195, Str. Biharia 67-77, Building G, 2nd floor, Office 4, District 1, Bucharest.