.gif)
Last updated: [date]
Background
This Privacy & cookie policy (the "Policy") explains how MB „Autou", company code 307461736, registered office Kontininkų g. 3B K8, LT-00171 Palanga, Republic of Lithuania ("we", "us", "AutoUniverse"), the owner and operator of autouniverse.eu (the "Website"), collects and uses personal data of visitors and registered users of the Website, and which cookies the Website uses. We are the data controller of this data. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.
Contact for privacy matters: infoautouniverseeu@gmail.com.
1. What data we collect
We collect only the data needed to operate the Website:
- Account data – e-mail address, password (stored only as a one-way hash), name or company name, seller type (private / trade), telephone number(s), country, and – for trade sellers – company address, city, website, logo, categories and stock description.
- Advert data – everything you enter in an advert: description, price, technical attributes, photographs, YouTube video link, country and the contact telephone number / e-mail shown in the advert.
- Payment data – the plan purchased, amount, date, payment status and the transaction reference given by our payment provider. We never receive or store your card number; card payments are handled entirely by Revolut.
- Technical data – IP address, browser type, date and time of visits, pages viewed, and the advert(s) you reported or added to a comparison. Server logs are kept for security and are deleted automatically.
- Correspondence – e-mails you send us and reports you submit about adverts.
We do not ask for and do not knowingly collect data of persons under 18 years of age or any special categories of personal data.
2. Why and on what legal basis we use the data
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Creating and managing your account, verifying your e-mail, publishing and managing your adverts, showing your contact details to buyers | Performance of a contract (art. 6(1)(b)) |
| Processing payments for plans, issuing payment confirmations, keeping accounting records | Performance of a contract and legal obligation (art. 6(1)(b), (c)) |
| Sending service e-mails: verification links, password resets, payment confirmations, advert expiry notices | Performance of a contract (art. 6(1)(b)) |
| Preventing fraud, spam and abuse, handling reported adverts, keeping security logs | Legitimate interest (art. 6(1)(f)) in a safe and lawful marketplace |
| Displaying advertisements (Google AdSense) and measuring their performance | Your consent given in the cookie banner (art. 6(1)(a)) |
| Answering your enquiries | Legitimate interest (art. 6(1)(f)) |
We do not use your data for automated decision-making or profiling, and we do not send marketing newsletters unless you have expressly subscribed to them.
3. Who sees your data
- Visitors of the Website see the content of your adverts including the contact telephone number / e-mail you chose to display, your seller type and country. Trade sellers' company profiles are also listed in the public dealers directory.
- Service providers (processors) who process data on our behalf and under our instructions: our web hosting provider, our e-mail delivery provider, and Revolut (payment processing). We only choose providers established in the EU/EEA or offering adequate safeguards required by GDPR.
- Third parties acting as independent controllers: Google (AdSense advertising, YouTube video embeds) – see section 6.
- Authorities, when we are legally obliged to disclose data (e.g. to police or courts in case of fraud or stolen goods).
We never sell personal data.
4. How long we keep the data
- Unverified accounts are deleted automatically 5 hours after registration.
- Account and advert data are kept while your account exists. Expired adverts remain in your account so that you can prolong them; deleted adverts are removed from the Website immediately and from our backups within 30 days.
- Payment and invoicing records are kept for 10 years as required by Lithuanian accounting law.
- Server logs are kept for up to 90 days.
- When you close your account we delete or anonymise your data, except records we must keep by law.
5. Your rights
Under GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data – most account data can be edited directly in your account;
- erase your data ("right to be forgotten") – you can delete your adverts yourself and ask us to close your account;
- restrict or object to processing based on our legitimate interest;
- data portability – receive the data you provided in a machine-readable format;
- withdraw consent at any time (e.g. change your cookie choices), without affecting processing carried out before withdrawal;
- lodge a complaint with a supervisory authority – in Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or the authority of the EU country where you live.
To exercise your rights write to infoautouniverseeu@gmail.com from the e-mail address registered in your account. We answer within one month.
6. Cookies
Cookies are small text files stored in your browser. The Website uses the following cookies and similar technologies:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| Session cookie (autouniverse_session), XSRF-TOKEN | Necessary | Keeps you logged in, remembers your advert comparison list and protects forms against forgery | Session / 2 hours |
| remember_web… | Necessary | Keeps you logged in when you tick "Remember me" | Up to 5 years |
| Cookie consent (cookie-script.com / au_cookie_ok) | Necessary | Remembers your cookie choices so that the banner is not shown again | Up to 1 year |
| Google AdSense (e.g. _gcl, IDE, NID and other cookies set by google.com / doubleclick.net) | Advertising | Shows advertisements and measures their performance; may be used by Google to personalise ads across websites | Up to 2 years |
| YouTube (embedded videos in adverts) | Third party | Set by YouTube when you play a video embedded in an advert | Set by YouTube |
Necessary cookies are always active because the Website cannot work without them. Advertising and third-party cookies are set only after you accept them in the cookie banner shown on your first visit. You can change or withdraw your choice at any time in the cookie banner settings, or by deleting cookies in your browser settings (the banner will then be shown again). Information on how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites; you can opt out of personalised advertising at adssettings.google.com.
7. Security
All traffic between your browser and the Website is encrypted (HTTPS). Passwords are stored only as salted hashes. Access to personal data is limited to persons who need it to operate the Website. No method of transmission or storage is completely secure, so please keep your password secret and contact us immediately if you suspect misuse of your account.
8. Links to other websites
Adverts and advertisements may link to other websites. This Policy does not apply to them; please read their own privacy policies.
9. Changes to this Policy
We may update this Policy from time to time. The current version is always published on this page with the date of the last update. Significant changes will be announced on the Website or by e-mail to registered users.
