Privacy policy
Note: the registry details of the business (legal name, VAT number, GEMI) are still marked [ΣΥΜΠΛΗΡΩΝΕΤΑΙ] and are filled in from the admin panel.
This policy explains what personal data the website x-sportcars.gr collects, why, for how long we keep it and what you can ask us to do with it. It is written under Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
1 · Who processes your data
The controller is the business that runs the yard at Kleisthenous 237, Gerakas 15344, Attica.
- Legal name[ΣΥΜΠΛΗΡΩΝΕΤΑΙ]
- Trading asX-Sportcars.com
- VAT no. / Tax office[ΣΥΜΠΛΗΡΩΝΕΤΑΙ]
- GEMI no.[ΣΥΜΠΛΗΡΩΝΕΤΑΙ]
- AddressKleisthenous 237, Gerakas 15344, Attica
- Phone693 333 3335 · 210 6120340
- Emailx-sportcars@hotmail.com
We have not appointed a Data Protection Officer: none of the cases in Article 37 GDPR applies to a business of this size and activity. For anything to do with your data, email x-sportcars@hotmail.com or call 693 333 3335.
2 · What we collect
2.1 What you type in yourself
The contact, trade-in, finance, parts and per-vehicle forms send us only the fields you fill in:
- Name.
- Phone number.
- Email address, where the form asks for it.
- Your message and, where relevant, details of the vehicle you are asking about or offering (make, model, year, mileage) and the vehicle code from our stock.
Nothing else is required and nothing is pre-filled. If you would rather not leave anything in writing, call us — the phone works the same way.
2.2 What is recorded automatically
The site keeps its own statistics. They run on our server, not on a third-party platform, and they work without cookies. For each page view we store: the page path, the timestamp, a rough device type (mobile, tablet, desktop), the referring domain when you arrive from another site, a random session identifier held only in your browser tab, and your IP address only as an irreversible HMAC-SHA256 hash — we never store or see the address itself.
If your browser sends the Do Not Track signal, nothing at all is recorded. Requests from known bots and crawlers are discarded. There is no advertising pixel, no remarketing tag and no external analytics service on this site.
2.3 Server logs
Like every website, the hosting provider keeps technical access logs (IP, timestamp, request, user agent) for security and troubleshooting. They are held by the provider under its own retention rules and we do not use them for any other purpose.
3 · Why we process it, and on what legal basis
- To answer you. When you send a form or call us about a vehicle, we use your details to reply, to give you a price, to arrange a viewing or to value your trade-in. Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to a contract — and, where no contract is in view, Article 6(1)(f), our legitimate interest in answering an enquiry.
- To know which vehicles get looked at. Aggregate, cookie-free statistics so we know which listings work and which pages are broken. Legal basis: Article 6(1)(f) GDPR — legitimate interest in running the site. No profiling, no automated decision-making, no advertising use.
- To keep the forms safe. CSRF token, hidden-field and timing traps against bots, and a rate limit per sender. Legal basis: Article 6(1)(f) GDPR — legitimate interest in the security of the service.
- To meet our own legal duties. Where a sale follows, tax and accounting law requires us to keep the relevant records. Legal basis: Article 6(1)(c) GDPR.
4 · How long we keep it
- Enquiries from the forms: for as long as the conversation is live and at most 24 months from our last contact, then deleted.
- Statistics: at most 12 months, and they contain no directly identifying data to begin with.
- Records of an actual sale: for the period required by tax and accounting legislation.
- Server logs: for the period set by the hosting provider.
5 · Who else sees it
Your data stays with us. The only third parties involved are the ones that make the site work:
- The hosting provider that runs the server, as a processor.
- The email provider through which the form messages reach our inbox.
- Where a sale follows, our accountant and the tax authority, to the extent the law requires.
We do not sell, rent or trade personal data. There is no advertising network, no data broker and no third-party tracking service on this site. We do not transfer your data outside the European Economic Area for any purpose of our own.
6 · Your rights
Under Articles 15 to 22 GDPR you may ask us at any time for:
- Access — a copy of what we hold about you.
- Rectification — correction of anything wrong or incomplete.
- Erasure — deletion, where there is no overriding legal reason to keep it.
- Restriction of processing.
- Portability — your data in a structured, machine-readable format.
- Objection to processing based on legitimate interest.
- Withdrawal of consent, where processing rests on consent, without affecting what was lawful before.
Write to x-sportcars@hotmail.com or call 693 333 3335. We answer within one month, as Article 12(3) GDPR requires.
If you believe we are handling your data badly, you can lodge a complaint with the Hellenic Data Protection Authority: Kifisias 1-3, 115 23 Athens, www.dpa.gr.
7 · Security
The site runs over HTTPS with HSTS. Forms are protected by a CSRF token, a honeypot field, a time trap and a rate limit. Enquiries land in a file that is not reachable from the web, and the admin panel is behind a password with its own session. IP addresses in the statistics are hashed with HMAC-SHA256 before they are written. No method is perfect, but we do not keep anything we do not need.
8 · Children
The site is not aimed at children and we do not knowingly collect data from anyone under 16. If such data has reached us, tell us and we will delete it.
9 · Changes to this policy
If the way we handle data changes, this page changes with it and the date at the top is updated. Substantive changes take effect from publication.
10 · Contact
Kleisthenous 237, Gerakas 15344, Attica · 693 333 3335 · 210 6120340 · x-sportcars@hotmail.com