Privacy policy
What personal data Garaz.gr processes, why, who we share it with, how long we keep it and what rights you have.
Last updated:
1. Data controller
The controller for the data described here is the operator of Garaz.gr. For any data protection matter, write to info@garaz.gr.
This policy covers the Garaz.gr website and services and is written in accordance with the General Data Protection Regulation (EU) 2016/679 and Greek Law 4624/2019.
2. What data we process
- Account details: email address, first and last name, display name, profile picture where it comes from Google or Apple.
- Contact details: up to two phone numbers and your declaration of whether they answer on Viber or WhatsApp, and your postcode.
- Content you upload: photos, text and technical specifications of adverts, vehicle location, parts adverts.
- Communications: messages between users, price offers, reports and support requests.
- Activity: vehicles saved to your Garage, comparisons, reactions, searches and adverts viewed.
- Dealer details, where applicable: business name, showroom address, opening hours, logo, social links, reviews.
- Payment records: what you bought, when and for how much. Card details are handled exclusively by the payment provider and never reach us.
- Technical data: IP address, device and browser type, language, server logs, and security data such as rate limits.
We do not ask for and do not want special categories of data (health, political opinions and so on). Please do not put them in adverts or messages.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, signing in | Performance of a contract (art. 6(1)(b)) |
| Publishing adverts and showing them to buyers | Performance of a contract |
| Messages and offers between users | Performance of a contract |
| Payments, invoicing, accounting records | Contract and legal obligation |
| Preventing fraud and abuse, system security | Legitimate interest (art. 6(1)(f)) |
| Usage statistics and improving the service | Legitimate interest, or consent where required |
| Newsletters about new services | Consent, withdrawable at any time |
4. Processing with AI
When you use the advert-drafting assistance, the photos and notes you upload are sent to an AI model provider (Anthropic) so that specifications, a price and a description can be suggested. The advert content is sent; your account details are not.
- Data is sent only when you request the assistance or publish an advert with photos.
- No decision with legal effect for you is taken by automated means alone. Suggestions are always editable by you.
- You can complete an advert entirely by hand and never use the feature.
7. How long we keep it
- Account details: for as long as the account is active.
- Adverts and photos: while published, and for a reasonable period after withdrawal so you can restore them.
- Messages: for as long as the account exists, as a record of the exchange.
- Payment records: for as long as tax law requires.
- Logs and security data: for a limited period, usually a few months.
After account deletion we delete or anonymise your data, except what we are required to keep by law or need in order to establish or defend legal claims.
8. Your rights
- Access: to learn what data we process about you and receive a copy.
- Rectification: to correct inaccurate details — most of them you can change yourself in your account.
- Erasure: to ask for deletion, where no legal obligation requires otherwise.
- Restriction and objection: to processing based on legitimate interest.
- Portability: to receive your data in a structured, commonly used format.
- Withdrawal of consent at any time, without retroactive effect — for example via the unsubscribe link in every newsletter.
Send your request to info@garaz.gr from your account's email address. We respond within one month. If you believe we are in breach, you may complain to the Hellenic Data Protection Authority (www.dpa.gr).
9. Security
- Traffic to the site is encrypted (HTTPS).
- We store no passwords: sign-in uses a single-use link or an identity provider.
- Access to data is limited to those who need it to run the service.
- Rate limits and checks are in place to constrain automated abuse.
10. Children
The service is intended for adults. We do not knowingly collect data from minors. If we become aware of such a case, we delete the account.
11. Changes to this policy
When the way we process data changes, we update this page and the date at the top of it. For material changes we also notify you inside the platform.