Privacy policy

This policy describes how BilPorten (bilporten.dk) processes personal data. We comply with the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

1. Data controller

BilPorten, 6270 Tønder, Denmark. E-mail: kontakt@bilporten.dk. [CVR number to be added once the company is registered.]

2. What data we process, and why

• Account: name, e-mail, phone (optional), password (hashed). Purpose: to deliver the service. Basis: contract (GDPR art. 6(1)(b)).
• Listings: details about the car, photos, postcode/town and region. The licence plate and VIN are used only for lookups and are never shown publicly. Basis: contract.
• Dealers: company name, CVR number, address, contact details, logo and banner — shown publicly on the dealer page. On sign-up we look the CVR number up in the public Danish company register (via cvrapi.dk) to confirm the company exists and is active. Basis: contract and legitimate interest (transparency and buyer confidence).
• Contacting a seller (buyer enquiries): when you use the contact form on a listing, we store your name, e-mail, any phone number, your message and — if you fill it in yourself — details about your trade-in car (make, model, year, mileage, any registration number). The information is passed on to the seller of that car (private seller or dealer) so they can contact you. The seller is an independent data controller for their own further processing. Basis: your consent (the tick box in the form), GDPR art. 6(1)(a). We delete the enquiry no later than 12 months after it is created; the seller may delete it sooner.
• Saved searches: if you create a saved search, we store your e-mail, the search's filters, how often you want e-mails, and when we last sent you one. We use it solely to notify you of new cars that match — never for any other marketing — and we do not pass the address on to anyone. If you are not logged in, we send nothing until you have confirmed via a link in an e-mail (double opt-in); if you do not confirm within 7 days, we automatically delete the sign-up. Every e-mail contains an unsubscribe link that deletes the saved search immediately. Basis: your consent, GDPR art. 6(1)(a).
• Compare cars: the cars you put up for comparison are stored only in your own browser (localStorage). They are never sent to us.
• Customer service chat: when you open the chat in the corner, we store the name, e-mail and phone number you provide yourself, the whole conversation, which page you wrote from, and any files you send along. The purpose is to be able to help you — including if the conversation is interrupted, or we need to get back to you outside opening hours. Files from the chat are not publicly accessible and can only be read by you and by BilPorten's administrators. The chat sets one technically necessary cookie (bp_support), which links you to your own conversation and nothing else. The conversation, files and all, is deleted no later than 90 days after it ends. Basis: legitimate interest / contract.
• Enquiries to us: when you write to us through a form, we store your name, e-mail, any phone/company details, the topic you chose and your message, so we can reply. If you attach files, they are sent to our own mailbox with the enquiry; the files themselves are not stored on the website. Deleted no later than 12 months after the case is closed. Basis: legitimate interest / contract.
• E-mails from us: we send service e-mails only (e-mail confirmation, password reset, notice of new enquiries on your listings). Newsletters require your active consent.
• Messages: the content of conversations between buyers and sellers. Basis: contract.
• Technical data: IP address and timestamps in server logs (deleted after 30 days) for security and abuse prevention. Basis: legitimate interest (art. 6(1)(f)).
• Marketing: only if you have actively opted in. Basis: consent (art. 6(1)(a)) — can be withdrawn at any time.

3. Cookies

We use necessary cookies only, unless you consent to statistics. We use no advertising cookies and no third-party tracking. Partner banners are served as ordinary images from our own server; we count impressions and clicks in aggregate only (with no personal data). See the cookie policy.

4. Who we share data with

We never sell your information. Data is stored on servers in the EU (one.com, Denmark) under a data processing agreement; e-mails are sent via one.com's mail servers. When verifying dealers, only the CVR number (not personal data) is sent to the CVR lookup service. Only what is necessary for the listing is shown publicly: the car's details, photos, town/region, and your first name (private sellers) or company details (dealers). Your phone number is shown only if you have provided one, and only once a user actively clicks “Show phone number”.

5. Retention

• Account: for as long as it is active. Deleted on request or after 3 years of inactivity.
• Listings: anonymised 12 months after they are removed or sold (for statistics).
• Customer service chat: deleted 90 days after the conversation ends. Conversations where nothing was ever written are deleted after 7 days.
• Messages: 24 months after the last message.
• Accounting records (dealers): 5 years under the Danish Bookkeeping Act.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. Write to kontakt@bilporten.dk — we reply within 30 days. You can complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk.

7. Security

All traffic is encrypted (HTTPS). Passwords are stored hashed (bcrypt). We strip EXIF data (including GPS) from uploaded photos. Backups are taken daily.

8. Changes

Changes are published here with a new date. Material changes are notified by e-mail to registered users.