← Back to home

Privacy Policy

Last updated on May 30, 2026

Preamble

The purpose of this policy is to explain transparently to data subjects how their personal data is processed when they use the Carvoh waitlist website (hereinafter the "Site"), and to inform them about the measures taken to preserve its confidentiality and security.

Carvoh is a vehicle marketplace project currently in pre-launch. This policy applies to the waitlist and any related communication services accessible via the Site.

We inform you that this policy may be modified at any time to reflect legislative, regulatory, or operational changes. We therefore invite you to consult it regularly.

1. Data controller

The data controller for the personal data collected and processed via the Site is Carvoh, hereinafter referred to as "we", "our", or "us".

Registered office: Rue de la Station 8, 6040 Jumet (Belgium).

Crossroads Bank for Enterprises (BCE) registration number: 1018 823 563.

For any questions regarding the processing of your personal data or to exercise your rights, you can contact us at contact@carvoh.com.

As the data controller, we must comply with several obligations under Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and the Belgian Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data, including ensuring your rights, notifying you of certain security breaches where required, and maintaining appropriate records.

2. What data do we process?

Only adequate, relevant, and limited data to the purpose of the processing can be processed. The methods of collection and the data processed vary depending on your use of the Site.

Waitlist registration and email verification

  • Email address.
  • How you heard about Carvoh (discovery source).
  • Account type (individual or professional).
  • Company name and professional category, where applicable.
  • Preferred language and registration date.
  • Technical referrer and UTM campaign parameters, where present in the URL.

Security, anti-spam, and abuse prevention

  • Hashed IP address (we do not store the raw IP).
  • Hashed device identifier via the wl_device cookie.
  • User agent and HTTP referrer at the time of registration.
  • Email address and reason in case of a blocked registration attempt.
  • Anti-bot signals (honeypot field, minimum form completion time).

Language preferences and cookies

  • Selected language stored in the CARVOH_LOCALE cookie.
  • Strictly necessary technical cookies described in our Cookie Policy.

Administration area (restricted access)

  • Authentication data (email, session identifiers, security tokens) for authorised administrators only.
  • Connection and security logs required to protect the service.

3. Legal bases for processing

Any processing of personal data must be based on a legal basis determined by the GDPR.

  • Managing your waitlist registration, sending verification emails, and keeping you informed about the Carvoh launch: performance of pre-contractual steps at your request and, where applicable, performance of the relationship with you (Articles 6.1.b GDPR).
  • Sending commercial communications or updates when you have expressly consented: your consent (Article 6.1.a GDPR), which you may withdraw at any time.
  • Securing the Site, limiting spam, and detecting abusive use of forms: our legitimate interest in protecting the Site, our services, and our users (Article 6.1.f GDPR).
  • Remembering your language preference and operating strictly necessary cookies: our legitimate interest for functional cookies and, where applicable, your consent for any optional storage (Articles 6.1.f and 6.1.a GDPR).
  • Admin authentication and security of the administration area: our legitimate interest in securing our systems (Article 6.1.f GDPR) and, where applicable, performance of the contract with authorised staff (Article 6.1.b GDPR).
  • Compliance with legal, accounting, or tax obligations: legal obligation (Article 6.1.c GDPR).

4. Retention periods

Personal data cannot be retained longer than necessary for the purposes for which it is processed.

  • Waitlist data (pending or verified registration): for the duration of the pre-launch phase and until the launch of Carvoh or deletion at your request, unless a longer period is required to manage a claim or comply with a legal obligation.
  • Blocked registration attempts and security logs: limited to what is necessary for abuse analysis; deleted regularly once no longer needed.
  • Accounting, tax, and contractual documents: for the duration of the relationship, then for the applicable legal retention periods under Belgian law.
  • CARVOH_LOCALE language cookie: up to 12 months.
  • wl_device cookie: up to 12 months.
  • Administration session cookies: duration of the browsing session or according to the security policy in force.

5. Recipients and data sharing

We share your data within the scope of our activities with our staff or with our duly authorised suppliers and subcontractors, subject to appropriate contractual safeguards.

For example, we may share your data with our hosting provider, email service provider (Resend), technical providers required for the Site to operate, and our accountant where necessary.

We share data with supervisory authorities, courts, and government agencies when a legal obligation, regulation, or judicial process requires us to do so.

We may also transmit data in good faith when we consider that this action is required to comply with applicable regulations or to protect and defend our rights or those of other users.

In all circumstances, we ensure the protection of your data through confidentiality agreements. A list of our main subprocessors is available upon request at contact@carvoh.com.

6. Transfers outside the European Union

Some of your data may be processed within the European Union, where personal data benefits from the same level of protection as in Belgium.

Some technical providers, in particular email or online service providers, may involve access or transfers outside the European Union depending on their own organisation. In that case, such transfers rely on an adequacy decision of the European Commission or appropriate safeguards provided by the GDPR, such as the Commission's Standard Contractual Clauses, approved binding corporate rules, or another mechanism recognised by law.

If we transfer data outside the Union or grant access to a subcontractor located outside the Union, this is only authorised where an adequate level of protection is ensured in accordance with Chapter V of the GDPR.

7. Your rights as a data subject

Under the GDPR and applicable Belgian law, you have the following rights, subject to the conditions and limitations provided by law:

  • Right of access: know whether we process your data and obtain a copy.
  • Right to rectification: correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten"): request deletion when data is no longer necessary or when you withdraw consent, where applicable.
  • Right to restriction of processing in the cases provided by Article 18 GDPR.
  • Right to data portability: receive your data in a structured, commonly used format where the processing is based on consent or contract and carried out by automated means.
  • Right to object: object to processing based on our legitimate interest, on grounds relating to your particular situation.
  • Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

How to exercise your rights

To exercise these rights, contact us at contact@carvoh.com or by post to Rue de la Station 8, 6040 Jumet (Belgium).

We will respond as soon as possible and, at the latest, within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension within one month.

These rights are not absolute. If a legal obligation prevents us from complying, we will inform you accordingly. We may also refuse manifestly unfounded or excessive requests.

8. Filing a complaint

If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données):

Website: https://www.autoriteprotectiondonnees.be — Address: Rue de la Presse 35, 1000 Brussels — Tel.: +32 (0)2 274 48 00 — Email: contact@apd-gba.be

More information on complaints: https://www.autoriteprotectiondonnees.be/introduire-une-plainte

You may also bring proceedings before the competent court of your place of residence.

9. Data security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful alteration, loss, or unauthorised use, disclosure, or access.

We apply privacy by design and privacy by default principles, including hashing of sensitive identifiers (IP address, device identifier), access controls for the administration area, and encryption in transit (HTTPS).

A detailed description of security measures may be provided upon request at contact@carvoh.com.

10. Cookies

We use cookies and similar technologies to manage language preferences, secure waitlist registration, and operate the Site. For more information, please consult our Cookie Policy.

11. Applicable law and jurisdiction

This policy is governed by Belgian law.

Any dispute relating to the interpretation or execution of this policy will be subject to the exclusive jurisdiction of the courts of the judicial district of Charleroi, without prejudice to mandatory provisions granting jurisdiction to the courts of your place of residence as a consumer.

12. Updates

We reserve the right to modify this privacy policy to reflect legislative or regulatory changes or to adapt it to our practices. The date of the last update is indicated at the top of this page.