Privacy policy
This policy explains how CarDesk processes personal data under the EU General Data Protection Regulation 2016/679 ("GDPR") and Greek Law 4624/2019.
1. Who we are
The CarDesk service (app.getcardesk.com and getcardesk.com) is provided by: [Legal name, company form, VAT no., GEMI no., registered address], Athens, Greece. Data protection contact: hello@getcardesk.com.
2. Our two roles: controller and processor
We are the controller for: dealer user accounts (name, email, password stored as a hash), billing details, contact-form messages and website visitor data.
We are a processor for the customer/lead data each dealership enters or imports (name, phone, email, vehicle of interest, messages, consents). The dealership is the controller of that data and we only process it on its documented instructions under the Data Processing Agreement (DPA). If you are a dealership’s customer, please contact the dealership first to exercise your rights; we will help it respond.
3. What data, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| User account (name, email, role, hashed password) | Providing the service, login, security | Contract (6(1)(b)) |
| Billing details (company name, VAT no., address, payment history) | Charging, invoicing, tax obligations | Contract (6(1)(b)), legal obligation (6(1)(c)) |
| Contact form (name, email, dealership, message) | Answering your request | Pre-contractual steps (6(1)(b)) / legitimate interest (6(1)(f)) |
| Security logs (IP, time, action) | Abuse prevention, rate limiting, security | Legitimate interest (6(1)(f)) |
| Visit statistics (anonymous) | Improving the website | Consent (6(1)(a)), only if you give it |
| Dealers’ lead data | The dealership’s communication with its customers | Determined by the dealership as controller; we act as processor |
4. AI and automated messages
CarDesk uses a language model to draft messages to leads on behalf of the dealership. Only the data needed is sent to the model (e.g. first name, vehicle of interest, conversation history). No decisions with legal or similarly significant effects are taken solely by automated means (GDPR Art. 22).
Every send passes automatic checks: opt-out, per-channel consent/lawful basis, quiet hours and sending limits. Any recipient can stop messages by replying STOP or ΣΤΟΠ.
5. Recipients and subprocessors
We do not sell personal data. We share it only with the providers below, under data processing agreements, and with public authorities where the law requires.
| Subprocessor | Purpose | Location / transfers |
|---|---|---|
| Hostinger International Ltd (Cyprus) | Server hosting (VPS), database, backups | Data centre in France (EU) |
| Twilio Ireland Ltd / Twilio Inc. | Sending and receiving SMS and WhatsApp messages | EU and US; EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) |
| Sendinblue SAS (Brevo), France | Sending and receiving email (transactional email, customer replies) | EU (France/Germany) |
| AI (language model) provider, e.g. OpenAI Ireland Ltd | Drafting message suggestions; data is not used to train models | EU/US depending on provider; SCCs / Data Privacy Framework |
| Stripe Payments Europe Ltd (Ireland) | Subscription billing and invoicing (dealer account data only) | EU and US; SCCs / Data Privacy Framework |
| Plausible Insights OÜ or Umami (optional) | Anonymous visit statistics, only with consent | EU |
6. Transfers outside the EEA
The database is hosted in the EU. Where a provider processes data outside the EEA (e.g. the US), the transfer relies on the EU-US Data Privacy Framework adequacy decision or the European Commission’s Standard Contractual Clauses, with supplementary measures where needed.
7. Retention
- Account: for the duration of the subscription and up to 30 days after it ends, unless earlier deletion is requested.
- Lead data: as set by the dealership; deleted immediately with the “GDPR erase” action or when the contract ends.
- Invoices: as long as tax law requires (normally 5 years, or longer where provided).
- Contact-form messages: up to 24 months.
- Backups: automatically deleted after 14 days.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time without affecting the lawfulness of prior processing. Email us at hello@getcardesk.com. We reply within one month.
You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, 1-3 Kifisias Ave, 115 23 Athens) or your local supervisory authority.
9. Security
Encryption in transit (HTTPS/TLS), passwords hashed with bcrypt, isolated containers and a private network for the database and queues, firewall, login rate limiting, an audit trail with personal data redacted, and nightly backups. In case of a breach we notify the authority and, where required, affected people under GDPR Arts. 33–34.
11. Changes
We will publish any change on this page and notify customers of material changes.