GDPR compliance

1. Introduction

At Auto Power Search we protect your personal data under the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). This page explains in plain words which data we collect, who we share it with, where and for how long we store it, and what rights you have.

2. Data controller

The controller responsible for processing your data is:

EVO Creations GmbH
Ettenbergstrasse 30
8907 Wettswil am Albis
Switzerland

Email: [email protected]

3. Which data we collect

We only collect the data a feature needs:

• •Account and profile data: Salutation, first and last name, email address and password. Optional: phone number, address, profile picture and language.
• •Search and preference data: Searches, saved searches, favourites, likes, hidden cars, price alerts and recently viewed cars.
• •Messages: Your messages and attachments to dealers and sellers.
• •Purchase data: Price offers, delivery address, payment method, payment receipts and contracts.
• •Leasing and financing requests: Date of birth, marital status, nationality, residence status, employer, income, housing costs, copy of your ID, payslips and debt enforcement register extract. We only collect this data when you request financing.
• •Reviews: Your rating of a dealer and your comment.
• •Contact and support requests: Name, email address, phone number and your message.
• •Dealer data: Company name, UID number, address, contact persons, staff and bank details.
• •Technical data: Usage statistics through Google Analytics and, if you agree, the data needed for push notifications.

4. Legal bases

We process your data on these legal bases:

• •Contract (Art. 6(1)(b) GDPR): For your account, messages to dealers, buying a car and financing requests.
• •Consent (Art. 6(1)(a) GDPR): For analytics cookies, functional cookies, marketing emails, push notifications and sharing data with insurance partners.
• •Legitimate interest (Art. 6(1)(f) GDPR): For the security of the platform, protection against abuse and anonymous statistics.
• •Legal obligation (Art. 6(1)(c) GDPR): For invoices and accounting.

5. Who we share data with

We do not sell your data. We only share it with these recipients and only for the purpose stated:

• •Dealers: When you contact a dealer, the dealer receives your name, email address and phone number. The dealer can transfer this data into its own sales system. For a purchase or a financing request, the dealer also receives the purchase and financing data.
• •Insurance partners: Only when you request a quote and explicitly agree. The partner receives your name, your email address and the vehicle data.
• •Payrexx (Switzerland): For payments. We do not store credit card data. Payrexx privacy policy
• •Google Analytics (USA): For usage statistics. Without your consent, Google sets no analytics cookies. Google privacy policy
• •AI services: For the AI search and for reading vehicle details. The AI services receive vehicle data only: your search criteria and the vehicle descriptions and photos of sellers. We send no details about you, such as your name, email address, phone number or account. Please do not enter personal data into the search.
• •Hosting and storage: Our database is located in Zurich, Switzerland. We store files with Cloudflare in Western Europe. Cloudflare also protects our forms against spam.
• •Other services: OpenStreetMap for maps and driving ranges, YouTube for embedded videos and your browser's push services (Google, Mozilla or Apple) for notifications.

6. Where and how long we store data

This is where your data is stored:

• •Database in Zurich, Switzerland: Account and profile data, search and preference data, messages, purchase and financing details, reviews, contact and support requests, dealer data and your consents.
• •Cloudflare storage in Western Europe: All files. Only vehicle photos, dealer logos and images in articles are public. Profile pictures, message attachments, contracts, payment receipts, ID copies, payslips, debt enforcement register extracts, invoices and support attachments stay private. Private files can only be opened through links that expire after a few minutes.
• •Your browser: Your cookie choice, your language, your market and your login session.
• •Google Analytics: The usage statistics.

This is how long we keep your data:

• •Account, preferences and messages: Until you delete your account.
• •Purchase and financing data, contracts and invoices: 10 years, because of the statutory retention obligation (Swiss Code of Obligations, art. 958f).
• •Deleted listings: We remove the listing and its photos 40 days after deletion.
• •Sold cars: We archive them 7 days after the sale.
• •Completed price alerts: We delete them after 6 months.
• •Consents: We keep proof of your consent, also after you withdraw it. This lets us show what you allowed and when.
• •Cookie choice: Only in your browser, until you change or delete it.

7. Your rights

• •Access: You can request a copy of the data we store about you.
• •Rectification: You can have incorrect data corrected. You can change most details yourself in the account settings.
• •Erasure: You can delete your account yourself in the account settings. Data with a statutory retention obligation is deleted when that period ends.
• •Restriction: You can ask us to restrict the processing.
• •Data portability: You can request your data in a machine-readable format.
• •Objection: You can object to processing based on our legitimate interest.
• •Withdrawal of consent: You can withdraw a consent at any time, for example through the cookie settings in the footer or the unsubscribe link in every email.

To exercise your rights, write to us at [email protected]. We reply within 30 days.

You can also lodge a complaint with a data protection authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). In Austria it is the Austrian Data Protection Authority (Datenschutzbehörde, DSB). In the EU it is the authority in your country of residence.

8. Security measures

We protect your data with these measures:

• •Encrypted transfer (HTTPS) for every connection.
• •Login with a password and a confirmation code sent by email.
• •Access rules in the database: each person only sees the data that belongs to them.
• •Private documents can only be opened through links that expire after a few minutes.
• •Your contact details in messages stay hidden until you share them with the dealer.

9. Data breaches

If a data breach happens despite these measures, we immediately assess the risk to you. Where required, we report the breach to the competent data protection authority within 72 hours. If the risk to you is high, we inform you directly and without delay.

10. Transfers abroad

We store your data in Switzerland and in Western Europe. The EU recognises Switzerland as providing an adequate level of data protection.

One exception is Google Analytics: Google may process the usage statistics in the USA. For this, Google is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. Google only sets analytics cookies with your consent.

When you play an embedded video or allow push notifications, your browser connects directly to that provider. The provider may be based outside Europe.

11. Contact

If you have questions about this page or about your data, you can reach us here:

• •Email: [email protected]
• •Post: EVO Creations GmbH, Ettenbergstrasse 30, 8907 Wettswil am Albis, Switzerland