Privacy Policy
Version: v1.0.0
This Privacy Policy describes how Dream Car Ltd (registered office: Limassol, Cyprus), acting as data controller within the meaning of Regulation (EU) 2016/679 (GDPR) and the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data 125(I)/2018, processes the personal data of Users of the dreamcarcy.com Platform.
1. Data Controller and Contact Details
The data controller is Dream Car Ltd. For questions concerning the processing of personal data, and to exercise the rights set out in this Policy, Users may contact privacy@dreamcarcy.com. Where the volume of special category (biometric) data processing exceeds the thresholds set by law, the Operator will appoint a Data Protection Officer (DPO), whose contact details will be published separately.
2. Data We Collect
Identity data: first and last name, date of birth, nationality, and identity document number/scan (for Verified User status and above);
Biometric data: facial photograph/video for the liveness check (a special category of data);
Contact data: phone number, email address, postal/residential address;
Location data: coordinates captured with vehicle photographs (to confirm the vehicle's presence in Cyprus), and geolocation on QR-code scanning;
Vehicle data and media: VIN, odometer readings, vehicle photographs and videos, paint-thickness gauge data, on-board diagnostics (OBD) codes;
Voice data: audio recordings of Inspector comments, converted to text using speech-recognition tools;
Financial data: records of payments made and Deposit status (full payment card details are not stored by the Operator and are processed solely by the payment provider);
Platform usage data: activity logs, bidding history, IP address, device identifier, cookies and similar technologies;
Transaction-related data: the content of electronic contracts, booking-related correspondence, and the audit trail of bids and agreement signatures.
3. Legal Bases for Processing
performance of a contract with the User, or steps taken at the User's request prior to entering into a contract — Article 6(1)(b) GDPR (registration, booking, auction participation, inspection services);
compliance with the Operator's legal obligations — Article 6(1)(c) GDPR (tax and accounting records, anti-money-laundering legislation, retention of electronic contracts);
the Operator's legitimate interests — Article 6(1)(f) GDPR (Platform security, fraud prevention, improvement of the AI Estimation Engine using anonymised data, establishment and defence of legal claims);
the User's explicit consent — Article 6(1)(a) and Article 9(2)(a) GDPR (processing of biometric data for the liveness check, marketing communications).
4. Special Category Data: Biometrics
Identity verification by way of a liveness check involves the processing of biometric data, a special category of personal data under Article 9 GDPR. Such processing is carried out solely on the basis of the User's explicit, separate consent, obtained prior to the check, which may be withdrawn at any time (with a corresponding restriction of access to functions requiring Verified User status or above).
5. Purposes of Processing
Data is processed for the following purposes: registering and verifying Users; organising vehicle bookings and inspections; generating Inspection Reports and calculating estimation indicators (Dream Car Verified Score, Auction Estimate); running auctions and recording binding bids; supporting the Protected Transaction and generating the electronic contract; processing payments and calculating commissions; maintaining Platform security and preventing fraud; complying with the Operator's legal obligations; and sending service notifications and, where consented to, marketing communications.
6. Automated Processing and Profiling
The AI Estimation Engine performs automated calculation of market value, the anticipated auction closing price (Auction Estimate), a liquidity indicator (Liquidity Score), and repair cost estimates based on inspection data entered. These outputs are advisory in nature and do not constitute a decision producing legal effects concerning a User based solely on automated processing within the meaning of Article 22 GDPR: pricing and transaction decisions remain with the Users.
7. Recipients of Data and Processors
To provide the Platform's services, the Operator engages the following categories of processors, acting under agreements meeting the requirements of Article 28 GDPR: cloud-based image and text recognition providers (in particular for VIN, odometer and OBD-code recognition); a speech-to-text provider; an identity verification and liveness-check (KYC) provider; an SMS verification provider; the PayPal payment provider; an advanced electronic signature provider (where used); cloud photo storage and backup providers; and an AI model provider used for processing text search queries and generating report content.
Dealers, Service Stations and Pickers receive access to User data to the extent necessary to perform their respective function (booking an inspection, carrying out an inspection) and are contractually bound to the Operator to maintain the confidentiality of such data.
8. International Data Transfers
Where any processor referred to in Section 7 is located outside the European Economic Area, the transfer of data is carried out subject to appropriate safeguards under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses, or on the basis of an applicable adequacy decision.
9. Data Retention
9.1. Personal data is retained for as long as necessary to achieve the purposes for which it is processed, after which it is deleted or anonymised, save as provided in Section 9.2 below.
9.2. Data connected with a completed sale transaction, Auction participation, or an electronic contract, together with the audit trail of bids, signatures and payments, is retained by the Operator for the periods set out below irrespective of any subsequent request to delete the User's account:
at least six (6) years, pursuant to the accounting and tax legislation of the Republic of Cyprus (including VAT legislation), which requires retention of financial records relating to transactions concluded through the Platform;
for the limitation period set out in the Cyprus Limitation of Actions Law (Cap. 15) — generally six (6) years from the date the contract was concluded or the cause of action arose — in order to establish, exercise or defend legal claims arising from warranty obligations or disputes as to the vehicle's condition or the content of the Inspection Report;
for five (5) years following the end of the business relationship, in respect of identification data collected in the course of customer due diligence procedures, pursuant to the anti-money-laundering and counter-terrorist-financing legislation of the Republic of Cyprus.
9.3. Such retention is carried out on the basis of Articles 17(3)(b) and 17(3)(e) GDPR, which expressly provide that the right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation of the controller, or for the establishment, exercise or defence of legal claims. During the periods indicated, access to the retained data is restricted to the purposes listed in this Section (restriction of processing under Article 18 GDPR), and such data is not used for any other purpose, including marketing.
10. Data Subject Rights
Users have the right to: obtain access to their personal data and a copy thereof; request rectification of inaccurate data; request erasure of data (the "right to be forgotten"), subject to the limitations set out in Section 9.2 above; request restriction of processing; receive their data in a structured, machine-readable format (the right to data portability) in respect of data processed on the basis of a contract or consent; object to processing carried out on the basis of the Operator's legitimate interest; and withdraw previously given consent, without affecting the lawfulness of processing carried out prior to withdrawal.
Requests are dealt with by the Operator within one (1) month of receipt, extendable by a further two months in cases of complexity, with notice to the User of the reasons for any extension.
11. Right to Lodge a Complaint
Users may lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or with the supervisory authority of their habitual residence or of the place of the alleged infringement.
12. Cookies and Similar Technologies
The Platform uses strictly necessary cookies to enable the operation of the PWA and Service Worker (offline mode, caching) and, subject to the User's consent, analytical and functional cookies. Further details on the categories of cookies used and how to manage them are available in a separate Cookie Notice on the Platform.
13. Data Security
The Operator applies technical and organisational measures appropriate to the risk of processing, including encryption of data at rest and in transit, role-based access control, audit logging of actions taken on sensitive data, and regular backups.
14. Children's Data
The Platform is not intended for persons under the age of 18 and does not knowingly collect data from such persons. Where the Operator becomes aware that a minor has registered, it will promptly delete the relevant account and data, except where retention is required to protect the legitimate interests of the Operator or third parties.
15. Changes to this Policy
The Operator may amend this Policy by publishing a revised version on the Platform at least 14 days before it takes effect. The date of the last update is indicated at the beginning of this document.
16. Contact
For all matters relating to the processing of personal data: Dream Car Ltd, Limassol, Cyprus, email: privacy@dreamcarcy.com.
1. Data Controller and Contact Details
The data controller is Dream Car Ltd. For questions concerning the processing of personal data, and to exercise the rights set out in this Policy, Users may contact privacy@dreamcarcy.com. Where the volume of special category (biometric) data processing exceeds the thresholds set by law, the Operator will appoint a Data Protection Officer (DPO), whose contact details will be published separately.
2. Data We Collect
Identity data: first and last name, date of birth, nationality, and identity document number/scan (for Verified User status and above);
Biometric data: facial photograph/video for the liveness check (a special category of data);
Contact data: phone number, email address, postal/residential address;
Location data: coordinates captured with vehicle photographs (to confirm the vehicle's presence in Cyprus), and geolocation on QR-code scanning;
Vehicle data and media: VIN, odometer readings, vehicle photographs and videos, paint-thickness gauge data, on-board diagnostics (OBD) codes;
Voice data: audio recordings of Inspector comments, converted to text using speech-recognition tools;
Financial data: records of payments made and Deposit status (full payment card details are not stored by the Operator and are processed solely by the payment provider);
Platform usage data: activity logs, bidding history, IP address, device identifier, cookies and similar technologies;
Transaction-related data: the content of electronic contracts, booking-related correspondence, and the audit trail of bids and agreement signatures.
3. Legal Bases for Processing
performance of a contract with the User, or steps taken at the User's request prior to entering into a contract — Article 6(1)(b) GDPR (registration, booking, auction participation, inspection services);
compliance with the Operator's legal obligations — Article 6(1)(c) GDPR (tax and accounting records, anti-money-laundering legislation, retention of electronic contracts);
the Operator's legitimate interests — Article 6(1)(f) GDPR (Platform security, fraud prevention, improvement of the AI Estimation Engine using anonymised data, establishment and defence of legal claims);
the User's explicit consent — Article 6(1)(a) and Article 9(2)(a) GDPR (processing of biometric data for the liveness check, marketing communications).
4. Special Category Data: Biometrics
Identity verification by way of a liveness check involves the processing of biometric data, a special category of personal data under Article 9 GDPR. Such processing is carried out solely on the basis of the User's explicit, separate consent, obtained prior to the check, which may be withdrawn at any time (with a corresponding restriction of access to functions requiring Verified User status or above).
5. Purposes of Processing
Data is processed for the following purposes: registering and verifying Users; organising vehicle bookings and inspections; generating Inspection Reports and calculating estimation indicators (Dream Car Verified Score, Auction Estimate); running auctions and recording binding bids; supporting the Protected Transaction and generating the electronic contract; processing payments and calculating commissions; maintaining Platform security and preventing fraud; complying with the Operator's legal obligations; and sending service notifications and, where consented to, marketing communications.
6. Automated Processing and Profiling
The AI Estimation Engine performs automated calculation of market value, the anticipated auction closing price (Auction Estimate), a liquidity indicator (Liquidity Score), and repair cost estimates based on inspection data entered. These outputs are advisory in nature and do not constitute a decision producing legal effects concerning a User based solely on automated processing within the meaning of Article 22 GDPR: pricing and transaction decisions remain with the Users.
7. Recipients of Data and Processors
To provide the Platform's services, the Operator engages the following categories of processors, acting under agreements meeting the requirements of Article 28 GDPR: cloud-based image and text recognition providers (in particular for VIN, odometer and OBD-code recognition); a speech-to-text provider; an identity verification and liveness-check (KYC) provider; an SMS verification provider; the PayPal payment provider; an advanced electronic signature provider (where used); cloud photo storage and backup providers; and an AI model provider used for processing text search queries and generating report content.
Dealers, Service Stations and Pickers receive access to User data to the extent necessary to perform their respective function (booking an inspection, carrying out an inspection) and are contractually bound to the Operator to maintain the confidentiality of such data.
8. International Data Transfers
Where any processor referred to in Section 7 is located outside the European Economic Area, the transfer of data is carried out subject to appropriate safeguards under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses, or on the basis of an applicable adequacy decision.
9. Data Retention
9.1. Personal data is retained for as long as necessary to achieve the purposes for which it is processed, after which it is deleted or anonymised, save as provided in Section 9.2 below.
9.2. Data connected with a completed sale transaction, Auction participation, or an electronic contract, together with the audit trail of bids, signatures and payments, is retained by the Operator for the periods set out below irrespective of any subsequent request to delete the User's account:
at least six (6) years, pursuant to the accounting and tax legislation of the Republic of Cyprus (including VAT legislation), which requires retention of financial records relating to transactions concluded through the Platform;
for the limitation period set out in the Cyprus Limitation of Actions Law (Cap. 15) — generally six (6) years from the date the contract was concluded or the cause of action arose — in order to establish, exercise or defend legal claims arising from warranty obligations or disputes as to the vehicle's condition or the content of the Inspection Report;
for five (5) years following the end of the business relationship, in respect of identification data collected in the course of customer due diligence procedures, pursuant to the anti-money-laundering and counter-terrorist-financing legislation of the Republic of Cyprus.
9.3. Such retention is carried out on the basis of Articles 17(3)(b) and 17(3)(e) GDPR, which expressly provide that the right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation of the controller, or for the establishment, exercise or defence of legal claims. During the periods indicated, access to the retained data is restricted to the purposes listed in this Section (restriction of processing under Article 18 GDPR), and such data is not used for any other purpose, including marketing.
10. Data Subject Rights
Users have the right to: obtain access to their personal data and a copy thereof; request rectification of inaccurate data; request erasure of data (the "right to be forgotten"), subject to the limitations set out in Section 9.2 above; request restriction of processing; receive their data in a structured, machine-readable format (the right to data portability) in respect of data processed on the basis of a contract or consent; object to processing carried out on the basis of the Operator's legitimate interest; and withdraw previously given consent, without affecting the lawfulness of processing carried out prior to withdrawal.
Requests are dealt with by the Operator within one (1) month of receipt, extendable by a further two months in cases of complexity, with notice to the User of the reasons for any extension.
11. Right to Lodge a Complaint
Users may lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or with the supervisory authority of their habitual residence or of the place of the alleged infringement.
12. Cookies and Similar Technologies
The Platform uses strictly necessary cookies to enable the operation of the PWA and Service Worker (offline mode, caching) and, subject to the User's consent, analytical and functional cookies. Further details on the categories of cookies used and how to manage them are available in a separate Cookie Notice on the Platform.
13. Data Security
The Operator applies technical and organisational measures appropriate to the risk of processing, including encryption of data at rest and in transit, role-based access control, audit logging of actions taken on sensitive data, and regular backups.
14. Children's Data
The Platform is not intended for persons under the age of 18 and does not knowingly collect data from such persons. Where the Operator becomes aware that a minor has registered, it will promptly delete the relevant account and data, except where retention is required to protect the legitimate interests of the Operator or third parties.
15. Changes to this Policy
The Operator may amend this Policy by publishing a revised version on the Platform at least 14 days before it takes effect. The date of the last update is indicated at the beginning of this document.
16. Contact
For all matters relating to the processing of personal data: Dream Car Ltd, Limassol, Cyprus, email: privacy@dreamcarcy.com.