01Who is responsible
The controller is NESTMETRICS MARKETING MANAGEMENT - FZCO, the publisher of Carmin (details in the legal notice). For any question about your data: contact@carmin.app.
As the publisher is established outside the European Union, it has appointed a representative in the EU (Article 27 of the GDPR): ANNA ENGINEERING, SAS, 66 avenue des Champs-Élysées, 75008 Paris, France. It has not appointed a data protection officer.
02Who this policy is for
- Our customers: the dealerships subscribed to Carmin, and the people who use their account;
- visitors to carmin.app;
- the professionals we contact to introduce Carmin to them;
- the dealerships' customers who use the Carmin tools (messaging, reviews, valuation, showroom). For those people, it is the dealership that is the controller; Carmin acts on its behalf, as a processor.
03The data, why, on what basis
| Data | Why | Legal basis |
|---|---|---|
| Account: dealership name, name, e-mail, telephone, address, password (encrypted) | Create and run your account | Contract |
| Billing: company, billing address, VAT number, subscription status. Never your card details: they stay with the payment provider | Bill the subscription | Contract, accounting obligations |
| Your stock: vehicles, photos, prices; your settings; publications and their statistics; the connections to your social networks and to your Google Business Profile | Provide the service | Contract |
| Connection log: a fingerprint of the IP address (never the address itself), browser, device type, approximate city and country provided by our website delivery provider | Keep accounts secure, detect abuse | Legitimate interest |
| Audience measurement of the carmin.app site: page viewed, site you came from, language, mobile or computer, and a daily fingerprint computed from the IP address and browser (never the address itself; it changes every day and cannot recognise you from one day to the next) | Knowing which pages are read and where our visitors come from | Legitimate interest |
| Professionals contacted: dealership name, address, telephone, public e-mail and website, public reviews, our e-mail exchanges | Introduce Carmin to motor trade professionals | Legitimate interest; you may object at any time |
| On behalf of dealerships: messages received on Messenger and Instagram (text, public name and profile photo), Google reviews (text, author's name), valuation requests (vehicle details, without contact details), showroom visit statistics (page views, clicks, browser) | Run the dealership's agents and showroom | Decided by the dealership, as controller |
Some of the texts, voices and agent replies are produced by artificial intelligence tools, from this data. No decision producing legal effects concerning you is taken on a fully automated basis.
04Who receives your data
Your data is processed by the publisher's team and by technical providers acting on our instructions, with the following safeguards:
| Provider's role | Country | Safeguard |
|---|---|---|
| Data hosting | France | European Union |
| Publishing to social networks | Germany | European Union |
| Importing vehicle data | Lithuania | European Union |
| Payment | United States, Ireland | EU–US Data Privacy Framework, standard contractual clauses |
| Sending e-mails | United States | Standard contractual clauses |
| Text generation by artificial intelligence | United States | EU–US Data Privacy Framework, standard contractual clauses |
| Voice-overs for videos | United States | EU–US Data Privacy Framework, standard contractual clauses |
| Website delivery and security | United States | EU–US Data Privacy Framework, standard contractual clauses |
The content you publish with Carmin is, by its nature, sent to the social networks and to Google that you have connected, under their own terms.
05Transfers outside the European Union
The data is hosted in France. Some providers are located in the United States; those transfers are covered by the safeguards set out above. The publisher, established in the United Arab Emirates, accesses the data in order to provide the service; it remains subject to the GDPR for people located in the European Union.
06How long
| Data | Retention period |
|---|---|
| Account and content | For the duration of the subscription, then deleted 30 days after it ends; a sign-up that was never paid is deleted 30 days after it was created |
| Billing | The period required by the applicable accounting law |
| Photos of a sold vehicle | 30 days after the sale |
| Visuals produced | 3 days after they are published |
| Videos produced | 15 days, or as soon as the vehicle is sold |
| Connection log | 90 days |
| Site audience measurement | 13 months |
| Showroom visit statistics | 90 days |
| Valuation requests received for a dealership | 12 months after they are received |
| Messaging agent conversations | 12 months after the last message |
| Google reviews received for a dealership | 12 months after they are posted |
| Account activity feed | 12 months |
| Technical error log | 90 days |
| Technical notifications from social networks | 30 days |
| Prospecting data | 3 years after the last exchange, or as soon as you object; we then keep only the garage's name, its email address and the date of the objection, so that we never write to it again |
Data received on behalf of a dealership is in any case deleted with its account, no later than 30 days after its subscription ends.
07Security
The data is hosted in France, transmitted in encrypted form (HTTPS), and passwords are stored in encrypted form. Access to the data is limited to the people who need it in order to provide the service.
08Your rights
You may request access to your data, its rectification, its erasure, the restriction of its processing and its portability, and you may object to its processing, in particular to prospecting, at any time. Write to contact@carmin.app; we reply within one month.
If you are the customer of a dealership that uses Carmin, contact that dealership first; we will help it reply to you.
You may also lodge a complaint with the data protection authority in your country (for example the APD in Belgium or the CNIL in France).
09Cookies and browser storage
On carmin.app, there is no advertising. We measure the site's audience ourselves, without cookies and without storing anything in your browser (see “The data, why, on what basis”); if your browser asks not to be tracked, nothing is measured. Only items necessary for the site to work are used: a session cookie that remembers your language and, in the app, the login session and a draft of the sign-up kept in your browser. They do not require consent.
On a dealership's website, the showroom stores nothing, and its fonts are served by Carmin: no third-party service is called. The valuation agent keeps the current conversation in the browser, erased when it is sent or after 7 days, and a note that its welcome message was seen, forgotten after 30 days.
10Changes
We may update this policy. The date of the last update appears at the top of the page; if there is a significant change, our customers are notified by e-mail.