Privacy policy — carsexport.us
1. Who is responsible
LynBro ApS, CVR no. 46321499, Rødovre Parkvej 276, 2610 Rødovre, Denmark ("we") is the controller of the personal data we process about you when you visit carsexport.us, create an account in carsexport.us or contact us. You can always write to us about data protection at info@lynbro.dk.
2. What data we process and why
| What | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account and users | Name, email, phone, company and CVR, role, language, sign-in data | To create and run your account and provide the service | Contract (GDPR Art. 6(1), point b); for contact persons at business customers our legitimate interest in managing the customer relationship (point f) |
| Contract records | Which version of terms and policies you accepted and when, choices and consents | To document the agreement and your choices | Legal obligation and legitimate interest in establishing and defending legal claims (points c and f) |
| Support and communication | Enquiries, emails, messages and replies | To help you and improve our answers | Contract and legitimate interest (points b and f) |
| Security and quality | IP address, browser and device, pages and actions in the service, time and result of requests, sign-in events, signals of automated activity | To protect the service and users against abuse, fraud and attacks and keep the service stable | Legitimate interest in network and information security (point f) and the duty to secure processing (Art. 32) |
| Statistics and product development | Pseudonymised events about use of the service, errors and response times | To understand how the service is used and improve it | Legitimate interest (point f) |
| News and marketing | Email and your choices | To send news about carsexport.us and our other services | Your consent (point a) or, for existing customers, the Danish Marketing Practices Act rules on our own similar products, with an opt-out every time |
| Enquiries and waiting list | Name, email, phone, message and which page you came from | To answer your enquiry and notify you when the service opens | Your consent and your request (points a and b) |
The data comes from you, from your users and from how you use the service. If providing certain data is required to enter into the agreement, we say so; without it we cannot provide the service.
3. Security and quality
To protect the service and users against abuse and to improve the product, we process technical data about each request: IP address, browser and device type, pages and actions in the service, time and result of the request, sign-in events and signals of automated activity. The legal basis is our legitimate interest in network and information security, fraud prevention and a stable service (GDPR Art. 6(1), point f) and the duty to secure processing (Art. 32). This data is not sold, shared for advertising or published; only people who need it have access, and it is deleted according to the table in section 6. This processing happens on our servers and does not depend on your choice in the cookie banner; the banner only controls what is stored on your device (see the cookie policy).
4. Recipients and sub-processors
We use suppliers (processors) that process data on our behalf and under our instructions, e.g. for hosting, email, backups. Some recipients are independent controllers, e.g. payment providers for their own fraud and anti-money-laundering checks. The current list with name, purpose, location and transfer basis is on the sub-processors and recipients page. The list is updated continuously when we change or add suppliers, without this policy being reissued.
We may also disclose data to public authorities when the law requires it, to our advisers (e.g. auditor and lawyer) under a duty of confidentiality, and to a buyer or new operator if the service or part of the business is transferred; in that case you are notified in advance under the terms. We do not sell personal data.
5. Transfers outside the EU/EEA
Our servers are in the EU. Some suppliers process data in countries outside the EU/EEA, e.g. the USA. We only transfer data when there is a valid basis under GDPR Chapter V, typically the European Commission's decision on the EU-US Data Privacy Framework or EU standard contractual clauses. The basis for each supplier is shown in the list of sub-processors. You can get a copy of the safeguards by writing to us.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and users | While the account is active; then deleted no later than 90 days after termination, except as stated below |
| Contract records and consents | While the agreement or consent applies and then up to 5 years to document legal claims |
| Support and communication | Up to 3 years after the case is closed |
| Security logs with full IP address | Up to 90 days; then only in shortened or hashed form or as aggregate figures for up to 13 months |
| Sign-in and security events, abuse signals | Up to 12 months |
| Log of administrative actions | Up to 3 years |
| Statistics and product development | Pseudonymised for up to 25 months; then only as aggregate figures without personal data |
| News and marketing | Until you unsubscribe; proof of consent then up to 5 years |
| Waiting list | Up to 12 months, or until you unsubscribe |
| Backups | Deleted data disappears from backups with the normal backup cycle and no later than 90 days after |
We may keep data longer if necessary to establish, exercise or defend legal claims, or if the law requires it; in that case only the necessary data and only for as long as necessary.
7. Your rights
You have the right to access the data we process about you, to have incorrect data rectified, to have data erased, to have processing restricted, to receive data you have provided to us in a structured format (data portability), and to object to processing based on our legitimate interest — and always to direct marketing. If you have given consent, you can withdraw it at any time; this does not affect the lawfulness of processing before you withdrew it.
Write to info@lynbro.dk. We reply within one month and may ask you to confirm your identity. Some rights have exceptions, e.g. when we must keep accounting records or when security logs are needed to investigate abuse; we will explain if so.
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk, but we would like the chance to resolve the matter with you first.
8. Changes to this policy
We may change this policy, e.g. when the service, the law or our suppliers change. We notify customers of material changes by email or in the service before they take effect. Each version has a version number and a date, and previous versions are on the change log page. Changes to the list of sub-processors follow section 4 and, for customers with a data processing agreement, its notice rules.
9. Contact
LynBro ApS · CVR no. 46321499 · Rødovre Parkvej 276, 2610 Rødovre, Denmark · info@lynbro.dk