Privacy Policy
Last updated: 9 July 2026
This statement explains, in plain language, what personal data CarTrace processes, why, on what legal basis, how long we keep it, who we share it with, and the rights you have under the GDPR. It applies to our websites (cartrace.eu, cartrace.nl, cartrace.de) and the services offered through them.
1. Who we are (data controller)
CarTrace operates cartrace.eu, cartrace.nl and cartrace.de and is the controller responsible for the personal data described here. For any privacy question, or to exercise a right, contact us at info@cartrace.nl.
You also have the right to lodge a complaint with your national data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.
2. Data we collect
Some vehicle data shown on CarTrace does not come from you but from external data sources, including official vehicle registries. This is factual vehicle data, not information about you.
- Account information: name, email, phone (optional), country, city.
- Vehicle information: make, model, year, colour, licence plate, VIN, photos, theft details.
- Stolen-vehicle reports: theft date/location, police report number, reward amount.
- Sightings and suspicious-vehicle reports you submit (a suspicious-vehicle report can be sent anonymously — you don't need an account).
- Licence plates and VINs you look up with CarCheck, and reports you purchase (a purchased report is kept in your account for 60 days).
- Usage data: search history, IP address (hashed for rate-limiting and security), device info, pages visited.
- Optional data: precise location (only if you enable it), spotter payout details (for rewards), alert subscriptions (email + area).
- Payment data: processed by our payment provider (Stripe) — we do not store card details.
3. How we use your data (purposes & legal basis)
| Purpose | Legal basis |
|---|---|
| Create and manage your account | Contract — Art. 6(1)(b) |
| List and search stolen vehicles | Legitimate interest — Art. 6(1)(f): recovery & fraud prevention |
| Send theft alerts and notifications | Consent — Art. 6(1)(a) |
| Process payments and keep purchased reports available | Contract — Art. 6(1)(b) |
| CarCheck vehicle reports | Legitimate interest — public safety |
| Review suspicious-vehicle reports | Legitimate interest — Art. 6(1)(f): crime prevention |
| Marketing emails | Consent — Art. 6(1)(a), opt-in only |
| Analytics and improvement | Consent for non-essential; legitimate interest for essential |
| Fraud prevention | Legitimate interest — Art. 6(1)(f) |
5. Data transfers
Your data is stored within the EU (Azure West Europe region). Where a provider processes data outside the EEA (for example Stripe, Resend, Google or Meta), the transfer is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.
6. Data retention
| Data type | Retention period |
|---|---|
| Account data | Until you delete, or 24 months after last login |
| Active vehicle listings | Until recovered, expired, or you delete |
| Stolen-vehicle reports | 12 months after resolution, then anonymised |
| Purchased CarCheck reports | 60 days after purchase, then automatically deleted |
| Suspicious-vehicle reports | Up to 12 months for review, then deleted |
| Payment records | 7 years (legal/tax requirement) |
| Sticker delivery addresses | Cleared 90 days after dispatch (the order record itself is kept) |
| Access logs | 12 months (security) |
| Notification history | 12 months, then deleted |
| Support email | 24 months after the last message, then deleted |
| Case messages | 24 months after the last message, then deleted |
| CarCheck search logs | 6 months |
| Marketing email list / alerts | Until you unsubscribe |
7. Your rights
To exercise these rights, use your account settings or email info@cartrace.nl. We respond within one month. We may ask you to confirm your identity first; if you share very little data with us, that can limit our ability to act on a request.
- Access — request a copy of your data (you can export it from your account settings).
- Rectification — correct inaccurate data in account settings.
- Erasure — delete your account and data.
- Restriction — limit how we process your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interest.
- Withdraw consent — for marketing, analytics and other optional features, at any time.
- Complain — lodge a complaint with your national Data Protection Authority.
9. Your content & public listings
Some things you submit are, by design, shown to others: a stolen-vehicle listing and its photos are publicly searchable so the community can help recover the vehicle. Do not include personal data you don't want to be public in free-text fields or photos.
When you ask us to delete your account we remove your personal data, but content that has already been made public or aggregated into anonymised statistics may be retained in a form that no longer identifies you, and we keep what the law requires us to keep (for example payment records).
10. Security & breach notification
We protect your data with TLS encryption in transit, encrypted storage, hashed passwords, access controls and regular security testing.
If a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority without undue delay and, where the risk is high, inform you directly.
11. Children
CarTrace is intended for users aged 18 and over. We do not knowingly collect data from minors.
12. Changes & contact
We may update this statement and will notify you of material changes. For any privacy matter, contact info@cartrace.nl.