Privacy Policy

Section 01Who we are

Fleetbrains OÜ ("Carbirds", "we", "us") is a private limited company registered in Estonia (reg. no. 17013248, VAT EE102838808), with its registered seat at Valukoja tn 8/2, 11415 Tallinn, Estonia. We operate the carbirds.com website, the dealer storefront platform, and the regulated cross-border vehicle trade entity that supports our partner dealers.

For the purposes of EU General Data Protection Regulation (GDPR) and applicable national data-protection laws, Carbirds is the data controller for personal data processed via this website, the dealer dashboard, and any storefront we operate on a partner's behalf.

Section 02Data we collect

We collect only the data needed to operate the platform, fulfil our contracts, and meet our regulatory obligations. Concretely:

• Account & application data. Name, country, business name, business registration number, contact email, phone number, dealership name, the markets you serve, and a short note about why you want to join.
• Identity & compliance data. Beneficial-owner ID document, sanction-list screening results, proof of address. Required for KYC/AML on every approved dealer.
• Buyer data (via dealer storefronts). Buyer name, delivery address, contact details, and order data, processed strictly to deliver the vehicle and the related paperwork. Buyers transact with the dealer; Carbirds processes their data as a joint controller for fulfilment.
• Transactional data. Reservations, contracts, payouts, invoices, VAT records.
• Technical data. IP address, device and browser type, pages visited, referrer URL. Used for security, debugging, and aggregate analytics.
• Communications. Emails, calls, and chat messages exchanged with our team — retained for service quality and to defend our legal interests.

Section 03How we use your data

We process personal data only for clearly defined purposes:

• To assess your dealer application and operate your storefront.
• To match buyers with vehicles, deliver those vehicles, and issue the related paperwork.
• To meet KYC, AML, sanctions, tax, and consumer-protection obligations.
• To calculate your flat €500-per-car earnings and remit payouts.
• To respond to enquiries, send service notifications, and provide support.
• To improve the platform, prevent fraud, and secure our infrastructure.
• To send marketing emails to dealers — only with your consent, and you can unsubscribe at any time.

We do not sell personal data, and we do not use it for automated decisions that produce legal effects on you. Your dealer application is reviewed by a human.

Section 04Legal basis for processing

Under GDPR Article 6, we rely on the following lawful bases depending on the context:

• Contract (Art. 6(1)(b)). Processing necessary to enter or perform the Dealer Agreement, fulfil a vehicle order, or pay you out.
• Legal obligation (Art. 6(1)(c)). KYC, AML, sanctions screening, tax reporting, accounting record-keeping (typically 7 years).
• Legitimate interest (Art. 6(1)(f)). Security, fraud prevention, aggregate analytics, defence of legal claims, internal administration. We document the balancing test for each use and you can object at any time.
• Consent (Art. 6(1)(a)). Marketing emails, non-essential cookies. Withdraw consent at any time without affecting prior processing.

Section 05Sharing & processors

We share personal data only when necessary, and only with parties under written processing agreements. The categories of recipient are:

• Infrastructure providers. Hosting, email delivery, error monitoring, customer support tools — all EU-based or covered by EU adequacy / SCCs.
• Logistics & inspection partners. The transporters, inspectors, and registration agents who physically deliver each vehicle.
• Financial institutions. Our banking partners and payment processors, for buyer payments and dealer payouts.
• Public authorities. Tax authorities, vehicle-registration authorities, and law-enforcement bodies — only on a lawful basis (court order, statutory request, regulatory audit).
• Professional advisers. Auditors, lawyers, accountants under duty of confidentiality.

A full list of our sub-processors is available on request at privacy@carbirds.com.

Section 06International transfers

Carbirds operates from Estonia and primarily processes personal data within the EU/EEA. Where a sub-processor stores or accesses data outside the EU/EEA (for example, a US-based monitoring service operating under the EU-US Data Privacy Framework), we rely on appropriate safeguards under GDPR Chapter V — Standard Contractual Clauses (SCCs), adequacy decisions, or your explicit consent for the specific transfer.

Section 07Retention

We keep personal data only as long as we need it:

• Active dealer accounts: for the duration of the Dealer Agreement plus 3 years.
• Buyer order data: 7 years (statutory accounting and warranty period).
• KYC documents: 5 years after the relationship ends (AML Act).
• Marketing data: until you withdraw consent.
• Technical logs: 90 days, anonymised thereafter.

Section 08Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase data we no longer need to keep ("right to be forgotten").
• Restrict or object to certain processing (e.g. marketing, profiling).
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority in your country of residence.

To exercise any of these rights, email privacy@carbirds.com. We respond within one month, free of charge.

Section 09Cookies & similar technologies

The Carbirds website uses three categories of cookies and similar technologies:

• Strictly necessary — session, CSRF, load-balancer cookies. No consent required.
• Functional — language preference, dashboard layout. Consent-based.
• Analytics — aggregate, IP-truncated usage statistics through a self-hosted EU-based analytics service. Consent-based.

We do not use advertising cookies, cross-site tracking, or third-party social-media pixels. Manage your preferences any time via the cookie banner.

Section 10Security

We protect personal data with industry-standard organisational and technical measures: encryption in transit (TLS 1.2+) and at rest (AES-256), strict access controls, audit logging, mandatory MFA for staff, annual penetration tests, and a documented incident-response plan. We notify affected individuals and the supervisory authority within 72 hours of a confirmed data breach where required by law.

Section 11Changes to this policy

We update this Privacy Policy when our processing changes or when the law requires. Material changes are notified to active dealers by email at least 14 days before they take effect. The "Effective" date at the top of this page always reflects the current version. Earlier versions are kept in our policy archive on request.

Section 12Contact & DPO

For any privacy-related question, request, or complaint, write to our Data Protection Officer:

Fleetbrains OÜ — Data Protection Officer
Valukoja tn 8/2, 11415 Tallinn, Estonia
privacy@carbirds.com

If you prefer to lodge a complaint with the supervisory authority, contact the Estonian Data Protection Inspectorate at www.aki.ee.