In the framework of its activities, Car-Pass a.s.b.l. / v.z.w. ("Car-Pass", "we", "us", "our") may from time to time process your personal data.
Protecting your privacy and personal data is very important to us and we are committed to conduct our activities in accordance with the applicable data protection laws and regulations, including in particular Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the "GDPR") and the Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
This privacy policy (the "Policy") applies to you in your capacity as (i) an owner of a vehicle (or a person who may dispose of a vehicle in another legal capacity than owner), or (ii) a user of our website www.car-pass.be, or (iii) a contact person of a company operating in the automotive sector and legally subject to a reporting obligation to Car-Pass. The purpose of this Policy is to inform you about the way in which we process your personal data in the framework of our legal mission and about the rights you have with respect to such processing operations.
The definitions in the GDPR apply to this Policy, which we invite you to read carefully.
Who are we?
Car-Pass ASBL/VZW
Boulevard de la Woluwe 46 box 2, 1200 Brussels
C.B.E.: 0880.498.395
RPM Brussels
Telephone: 02.773.50.56
E-mail : info@car-pass.be
Website : www.car-pass.be
What is our legal mission?
Car-Pass is a not-for-profit association (“association sans but lucratif”, “vereniging zonder winstoogmerk”), founded on the initiative of professionals in the automotive sector, which, in collaboration among others with companies active in the import, distribution and car repair and maintenance sectors and with approved technical inspection bodies, has as its mission, under the supervision of the competent public authorities and in compliance with the Act of 11 June 2004 on information to be provided in the framework of the sale of second-hand vehicles (the "Car-Pass Act") and its implementing decrees, to collect, record, manage and make available the information referred to in the Car-Pass Act, some of which may constitute personal data. Car-Pass is approved for this purpose by the Royal Decree of 4 May 2006.
Car-Pass is the data controller responsible for the personal data it is required to process as part of its legal mission.
Why do we process your personal data and on what legal basis? How long do we retain it?
We process your personal data only to the extent necessary to achieve our legitimate purposes. Depending on the purpose at stake, the legal basis for processing may differ.
We do not keep your personal data in a form which permits your identification for any longer than is necessary for the purposes for which it was collected or otherwise processed.
The purposes for which your data is processed, the legal basis for processing, and the retention period of your data are detailed below:
Purpose | What data? | How did we obtain this data? | Legal basis for processing | How long do we keep this data in a form that permits your identification?
|
Compliance with our legal obligation to communicate to sellers of second-hand vehicles the data referred to in Article 6, §2 of the Car-Pass Act in order to enable these sellers to comply with their obligation under Article 4, §3 of the Car-Pass Act to provide the buyer, when selling a second-hand vehicle, with the Car-Pass document containing this information | Vehicle chassis number (VIN), vehicle number plate and the following technical data concerning the vehicle:
| In accordance with Article 6, §3 of the Car-Pass Act and the provisions of the Royal Decree of 26 August 2006 regulating cooperation with the association responsible for registering vehicle mileage, this data is sent to us by :
You will find here a schematic overview of incoming and outgoing data streams for this purpose. | Processing is necessary for compliance with our legal obligations enshrined in the Car-Pass Act and its implementing decrees (Article 6(1)(c) GDPR). | In accordance with Article 6, §5 of the Car-Pass Act, until the end of the second year following the year in which a certificate of destruction was issued for the vehicle to which this data relates. Once this legal retention period has expired, we anonymise the chassis number (VIN) and the number plate of the vehicle concerned in our database, in such a way that the other technical data concerning the vehicle is no longer associated with information that permits your identification and is therefore no longer itself indirectly likely to be used to identify you. |
Organisation of consultation by the professional of the data referred to in Article 6, §2 of the Car-Pass Act in order to enable him/her to comply with his/her obligation under Article 3/1 of the Car-Pass Act to indicate such data when offering a second-hand vehicle for sale. | Vehicle chassis number (VIN), vehicle number plate and the following technical data concerning the vehicle:
| In accordance with Article 6, §3 of the Car-Pass Act and the provisions of the Royal Decree of 26 August 2006 regulating cooperation with the association responsible for registering vehicle mileage, this data is sent to us by :
You will find here a schematic overview of incoming and outgoing data streams for this purpose. | Processing is necessary for compliance with our legal obligations enshrined in the Car-Pass Act and its implementing decrees (Article 6(1)(c) GDPR). | In accordance with Article 6, §5 of the Car-Pass Act, until the end of the second year following the year in which a certificate of destruction was issued for the vehicle to which this data relates. Once this legal retention period has expired, we anonymise the chassis number (VIN) and the number plate of the vehicle concerned in our database, in such a way that the other technical data concerning the vehicle is no longer associated with information that permits your identification and is therefore no longer itself indirectly likely to be used to identify you. |
Drawing up an annual report on our activities, in accordance with Article 2, §2 of the Royal Decree of 21 February 2005 on the approval and supervision of the association responsible for recording vehicle mileage, and making this report available to the public. | Vehicle chassis number (VIN), vehicle number plate and the following technical data concerning the vehicle:
| In accordance with Article 6, §3 of the Car-Pass Act and the provisions of the Royal Decree of 26 August 2006 regulating cooperation with the association responsible for registering vehicle mileage, this data is sent to us by :
You will find here a schematic overview of incoming and outgoing data streams for this purpose. | Processing is necessary for compliance with our legal obligations enshrined in the Car-Pass Act and its implementing decrees (Article 6(1)(c) GDPR). | In accordance with Article 6, §5 of the Car-Pass Act, until the end of the second year following the year in which a certificate of destruction was issued for the vehicle to which this data relates. Once this legal retention period has expired, we anonymise the chassis number (VIN) and the number plate of the vehicle concerned in our database, in such a way that the other technical data concerning the vehicle is no longer associated with information that permits your identification and is therefore no longer itself indirectly likely to be used to identify you. |
Archiving in the public interest, carrying out or participating in studies for historical, scientific or statistical purposes, and communicating the results to third parties. | Vehicle chassis number (VIN), vehicle number plate and the following technical data concerning the vehicle:
| In accordance with Article 6, §3 of the Car-Pass Act and the provisions of the Royal Decree of 26 August 2006 regulating cooperation with the association responsible for registering vehicle mileage, this data is sent to us by :
You will find here a schematic overview of incoming and outgoing data streams for this purpose. | Processing is necessary for the performance of the public interest task entrusted to us (Art. 6(1)(e) RGPD) | In accordance with Article 6, §5 of the Car-Pass Act, until the end of the second year following the year in which a certificate of destruction was issued for the vehicle to which this data relates. Once this legal retention period has expired, we anonymise the chassis number (VIN) and the number plate of the vehicle concerned in our database, in such a way that the other technical data concerning the vehicle is no longer associated with information that permits your identification and is therefore no longer itself indirectly likely to be used to identify you. |
Transmission of data to third parties for archiving in the public interest or for carrying out studies for historical, scientific or statistical purposes. | Vehicle chassis number (VIN), vehicle number plate and the following technical data concerning the vehicle:
| In accordance with Article 6, §3 of the Car-Pass Act and the provisions of the Royal Decree of 26 August 2006 regulating cooperation with the association responsible for registering vehicle mileage, this data is sent to us by :
You will find here a schematic overview of incoming and outgoing data streams for this purpose. | Processing is necessary for the performance of the public interest task entrusted to us (Art. 6(1)(e) RGPD) | In accordance with Article 6, §5 of the Car-Pass Act, until the end of the second year following the year in which a certificate of destruction was issued for the vehicle to which this data relates. Once this legal retention period has expired, we anonymise the chassis number (VIN) and the number plate of the vehicle concerned in our database, in such a way that the other technical data concerning the vehicle is no longer associated with information that permits your identification and is therefore no longer itself indirectly likely to be used to identify you. |
Management of declarations made by companies in the automotive sector that are legally subject to a reporting obligation to Car-Pass by virtue of Article 6, §3 of the Car-Pass Act and the provisions of the Royal Decree of 26 August 2006 regulating cooperation with the association responsible for registering vehicle mileage. | Details of companies operating in the automotive sector and legally subject to a reporting obligation to Car-Pass, including the following personal data:
| Directly from the contact person at the automotive company concerned | Processing is necessary for compliance with our legal obligations enshrined in the Car-Pass Act and its implementing decrees (Article 6(1)(c) GDPR). | Until Car-Pass has been informed that the contact persons concerned are no longer employed by the company in the automotive sector concerned. |
Website management | IP addresses and other data of the users of our website collected via cookies You can find more information on this subject in our Cookie Policy. | You can find more information on this subject in our Cookie Policy. | Processing is based, as far as the security and proper operation of our website is concerned, on our legitimate interest (Article 6(1)(f) GDPR) and, as far as the analysis of the use of our website is concerned, on your consent (Article 6(1)(a) GDPR). Except for necessary cookies, we always ask for your consent.
You can find more information on this subject in our Cookie Policy.
| You can find more information on this subject in our Cookie Policy. |
Processing of requests sent to Car-Pass via the contact form on our website | Surname, first name, e-mail address, country of origin and telephone number of the person who filled in the contact form | Directly from the data subject | Processing is based on your consent (Article 6(1)(a) GDPR). | Until 31 December of the third year following the year in which the contact form was filled in. |
Handling of data subjects requests to exercise their rights in relation to processing carried out by Car-Pass | With regard to requests from data subjects exercising their data protection rights relating to the data referred to in Article 6, §2 of the Car-Pass Act:
With regard to requests from data subjects exercising their data protection rights relating to other data we process:
| Directly from the data subject | Processing is necessary for compliance with our legal obligations enshrined in the GDPR in our capacity as data controller (Article 6(1)(c) GDPR). | With regard to data processed in connection with requests from individuals exercising their data protection rights relating to the data referred to in Article 6, §2 of the Car-Pass Act:
With regard to data processed in connection with requests from individuals exercising their data protection rights relating to other data we process:
|
With whom do we share your personal data?
With the sole aim of achieving the purposes described above, we may share your personal data with:
- Car-Pass employees;
- Professionals subject to the legal obligation set out in Article 3/1 of the Car-Pass Act to indicate the data referred to in Article 6, §2 of the Car-Pass Act when offering a second-hand vehicle for sale;
- Third parties subject to the legal obligation set out in article 4, §3 of the Car-Pass Act to provide the buyer, at the time of selling a second-hand vehicle, with the Car-Pass document containing the information referred to in article 6, §2 of the Car-Pass Act (i.e. sellers of second-hand vehicles, where applicable through the intermediary of approved technical inspection bodies);
- The institutions, bodies and agencies of the European Union, the federal public services or public interest bodies subject to the authority, control or administrative supervision of the Belgian Federal State, the ministerial departments of the Communities and Regions and the public interest bodies subject to the authority, control or administrative supervision of the Communities and Regions, the French Community Commission, the Flemish Community Commission and the Joint Community Commission, as well as legal entities wishing to archive data or carry out studies, in the general interest or for scientific, historical or statistical purposes, to whom we may transmit the data referred to in article 6, §2 of the Car-Pass Act with a view to archiving them in the general interest or carrying out studies for historical, scientific or statistical purposes;
- The authorised personnel of the service providers we are working with to ensure the proper operation of our IT systems, such as in particular our hosting and cloud storage service providers. These service providers qualify as "processors" within the meaning of the GDPR and are bound to Car-Pass by a data processing agreement, under which they undertake in particular to take all necessary technical and organisational measures to protect the computer equipment against accidental or malicious damage, any loss or modification of the data recorded and any unauthorised access thereto.
- National and foreign supervisory, judicial and governmental authorities: where we are required to do so in order to comply with applicable regulations; and/or where such authorities lawfully require us to do so;
- Our lawyers or advisers to the extent necessary to comply with our obligations or to defend your or our rights;
- Third parties who may place cookies on your terminals with your consent. For more details on this subject, please consult our Cookie Policy.
We are not responsible for the processing of your personal data carried out by third parties, with the exception of the processing carried out by our own processors. For information on the processing of your personal data by other data controllers, please refer to the privacy policy of the data controller concerned.
Transfer of personal data outside the EEA
We normally process your personal data within the European Economic Area ("EEA") and do not transfer it outside the EEA.
In particular, we ensure that your data is stored on servers in external data centres located in Belgium.
In exceptional cases where your data needs to be shared with persons or organisations located outside the EEA, we ensure that such a transfer only takes place if:
- The European Commission has issued an adequacy decision establishing that the State concerned ensures an adequate level of protection of personal data, i.e. equivalent to that conferred by European legislation; or if
- The transfer may be carried out with appropriate safeguards offering a level of data protection equivalent to that conferred by European legislation, such as the European Commission's standard contractual clauses (which are available here), as the case may be in combination with additional data protection measures.
Data security
Ensuring the security of your personal data is particularly important to Car-Pass. We have therefore put in place technical and organisational measures (such as firewalls, anti-virus scanners, back-up and access control systems) for the data recorded and the computer equipment held on our own premises, which are appropriate to the degree of sensitivity of the data we process, with a view to ensuring its integrity and confidentiality and protecting it against any malicious intrusion, loss, alteration or disclosure to unauthorised third parties.
What rights do you have with regard to the processing of your personal data and how can you exercise them?
As a data subject, you have several rights with respect to the personal data processed by Car-Pass, which vary depending on the legal basis for the processing concerned:
Right of access | Article 15 of the RGPD | You have the right to obtain confirmation as to whether or not your personal data is being processed by Car-Pass and, if so, to obtain a copy of your data as well as various information concerning the processing thereof (purpose of the processing; categories of data concerned ; recipients or categories of recipients and, where appropriate, international organisations to which the data has been or will be communicated, in particular when they are established outside the EEA; retention periods of the data or at least the criteria used to determine this period; information relating to the source of the data when it is not collected directly from you; etc.)
|
Right to rectification | Article 16 of the RGPD
| You have the right to have your data corrected and/or completed if it is inaccurate and/or incomplete. |
Right to erasure | Article 17 of the RGPD | You have the right to obtain the erasure of your personal data held by us where one of the grounds set out in the GDPR applies (essentially, a) where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; b) you have withdrawn your consent on which the processing was based and there is no other legal basis for the processing; c) you have objected to the processing and there is no overriding legitimate grounds for the processing; d) your personal data has been processed unlawfully; e) your personal data must be erased by virtue of a legal obligation to which Car-Pass is subject). Please note, however, that such a right is not granted to you in particular where the processing of your personal data: is necessary to comply with a legal obligation to which Car-Pass is subject; is necessary for the performance of a task carried out in the public interest with which Car-Pass is entrusted; is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, insofar as erasure would be likely to render impossible or seriously impair the achievement of the objectives of the said processing; or is necessary for the establishment, exercise or defence of our legal rights.
|
Right to restriction of processing | Article 18 of the RGPD | You have the right to ask us to restrict the processing of your personal data where one of the grounds set out in the GDPR applies (for example, while we verify the accuracy of the personal data you dispute).
|
Right to object | Article 21 of the RGPD | You have the right to ask us, on grounds relating to your particular situation, to stop processing your personal data where, in particular, the processing is based on our legitimate interests or the data is processed for scientific or historical research or statistical purposes. We will comply with such a request, in the first case unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is justified for the establishment, exercise or defence of our legal claims, or in the second case unless the processing is necessary for the performance of a task carried out for reasons of public interest.
|
Right to withdraw your consent | Article 7 of the RGPD | Where the processing of your personal data is based on your consent, you are free to withdraw that consent at any time. Car-Pass will then cease to process this personal data for the future, without the previous operations to which you had consented being called into question.
|
To exercise any of the rights listed above, simply send us a reasoned e-mail to the following address privacy@car-pass.be or by post to Boulevard de la Woluwe 46 box 2, 1200 Brussels. Always make sure to clearly state therein the data protection right you wish to exercise and, if applicable, the way in which you wish to receive information (by e-mail, post, etc.). Please bear in mind that in some cases we will need further information before we can respond to your request.
If you contact us to exercise your data protection rights, we will reply within one month. This period may exceptionally be extended (up to a maximum of three months), in which case we will give you the reason of this extension within one month.
Any request to exercise data protection rights relating to the processing of the data listed in Article 6, §2 of the Car-Pass Act must, in accordance with Article 6, §2/1 of the Car-Pass Act, be accompanied by the relevant evidence enabling you to demonstrate that the vehicle to which the data concerned by your request relates does in fact belong to you (or that you at least enjoy the right to dispose of it on another legal basis than that of owner). As Car-Pass does not have access to the vehicle registration register of the Vehicle Registration Department (FPS Mobility and Transport; “DIV”), it is not in a position to establish a link between the VIN or plate number of a given vehicle and the natural person who owns that vehicle.
Therefore, if you wish to access data held by Car-Pass relating to your own vehicle or to exercise any other of your rights as a data subject in respect of such data, you will need to demonstrate that you are the owner or holder (the person in whose name the vehicle is registered with the DIV) by presenting a number of documents such as the registration certificate, the insurance green card, the purchase invoice, recent repair and maintenance invoices, or any other piece of evidence. If, on the basis of the documents submitted, the applicant is unable to demonstrate that he or she is the current owner or holder of the vehicle in question, or if there is at least one legitimate doubt, Car-Pass reserves the right to refuse the data protection right request. In any event, Car-Pass will only reply to your requests to exercise data protection rights in respect of data relating to the period during which you were the owner or holder of the vehicle concerned.
If you believe that an error has been made in one or more mileage records or in one or more descriptions of work performed on the vehicle, you can submit a request for rectification. You will find the form to fill in on our website. If it appears that the sender of the disputed mileage record or work description has indeed made a mistake, we will correct it and inform you accordingly. If your request for rectification is well-founded and if your Car-Pass document was still valid at the time you submitted your request for rectification, we will send you a rectified Car-Pass document by post, free of charge.
How can you contact us?
If you have any questions, comments or concerns about this Policy or the way in which we process your personal data, or should your information change at any time, please contact us by e-mail at privacy@car-pass.be or by post at Boulevard de la Woluwe 46 box 2, 1200 Brussels.
You are legally free to lodge a complaint with the Belgian Data Protection Authority:
Autorité de protection des données / Gegevensbescherming Autoriteit
Rue de la Presse 35, 1000 Brussels
+32 (0)2 274 48 00
+32 (0)2 274 48 35
contact@apd-gba.be
Modification of this Policy
Car-Pass reserves the right to modify this Policy at any time, in particular in order to adapt it to any changes in the applicable law. We therefore encourage you to consult it regularly.
This Policy was last updated in 15 november 2024.