Privacy notice · Mobility1 Europe

Who is responsible

The data controller for this website is the company that runs Mobility1: Abitech Worldwide Management Holding B.V., Burgemeester Baumannlaan 87A, 3043 AG Rotterdam, KvK number 42080974, VAT ID applied for. Write to info@mobility1-europe.com about anything in this notice.

What we keep

When you visit the site

Our server records each visit: your internet address, the page, the time and your browser. These records are deleted after 14 days. The site's technical log is kept only up to a fixed size, then overwritten.
The public pages set no cookies. Signing in sets a session cookie, pages with a form set a security cookie against forged forms, and a short-lived cookie carries messages such as “Your offer is sent”. We use no advertising or analytics cookies, and the site loads no tracking scripts. The language of a page is in its address, not in a cookie.

When you open a business account

Your company's name, KvK number and VAT ID.
The contact person's name, phone number and work e-mail.
Your password, stored only as a one-way hash: nobody at Mobility1 can read it.
Proof that you accepted the terms: which version, in which language, when, from which internet address and with which browser.
The language you last used the site in, Dutch or English, so our e-mails reach you in it.
Our business check: your code, the name and the last four characters of the account your cent came from, when the bank booked it, and who checked it.

When you make an offer, reserve or pay

Your offers and our answers, your reservations, and the steps of each sale, such as the reference of the RDW transfer.
Your payments and refunds: the payment reference, amount and method; the bank's or Stripe's reference; the account or card the money came from, partly hidden; and, for iDEAL, the account holder's name as your bank gives it.
We never see your card number or your bank login: you pay on the page of Stripe, our payment provider.

When you sell as a dealer

Your application: the company details above, your town, the director or contact person, your KvK extract and any VAT letter, and our notes on how we checked them.
Your payout account: the account holder, the IBAN and BIC, the bank, the bank statement or letter you upload, and our notes on how we checked it.
Your vehicles: number plate, kind, make, model, year, mileage, chassis number and yard; what the RDW's public register says about each vehicle; whether it is sold under the margin scheme or with VAT; your asking price and your private lowest price; price changes you ask for; the inspection reports and photos.
The tax records of each sale: the number of our commission invoice and when you paid it.

When you report a vehicle

Your name if you give it, your e-mail address, what you report and the language of the page you reported it on; then our decision, its reasons and who took it. The dealer hears the decision and its reasons, never your name or e-mail address.

When you e-mail us

Your e-mail address and what you write.

We do not ask for copies of passports or ID cards, or for their numbers. Vehicle photos are taken by our inspector; the site removes location and camera details from them, and the photo of the chassis plate is seen only by our team.

Why we use it

What for	Why we may
Open and run your account, and check that you are a registered business	To provide the service you ask for, and to prevent fraud
Answer offers, reserve vehicles and complete sales, and tell the other side of a sale what it needs	To perform our agreement with you
Take, confirm and refund payments	To perform our agreement with you
Send you e-mails about your account, offers, reservations, payments and sales	To perform our agreement with you
Keep tax records: our invoices and VAT	Tax law requires it
Check dealers and payout accounts with two different people, and keep records of offers, payments and changes that cannot be altered	Our legitimate interest in preventing fraud and settling disputes
Keep proof of which terms you accepted	Our legitimate interest in proving the agreement
Keep server records and limit sign-in tries	Our legitimate interest in keeping the site safe

We send no newsletters or adverts, and we do not sell personal data.

What you must give us

To open an account you must give your company's name, KvK number and VAT ID, a contact person, a phone number and an e-mail address. Without them we cannot check your business, so you cannot make offers or reserve. Dealers must also give a KvK extract and a business payout account; a dealer's VAT ID also goes on the tax invoices we issue to it. You can look at every vehicle without an account.

Where it comes from

From you, when you fill in a form or e-mail us.
From the registers we check: the KvK business register, the EU's VIES for VAT IDs, and the RDW for a vehicle's registration.
From your bank or Stripe, our payment provider, when they confirm a payment.
From our inspector, for vehicle reports and photos.

Who receives it

The other side of a sale, only once a vehicle is reserved. The buyer then sees the dealer's company name, phone, e-mail and yard, and the full chassis number; the dealer sees the buyer's company name, contact person, phone and e-mail. Before that, neither sees the other. The screen our team uses to answer offers shows a code name for the buyer, different on every vehicle.
Mobility1's team: the staff who check businesses, vehicles, payout accounts and payments, our inspectors, and the owner, each for their own task.
Our service providers:
- Hetzner Online, which runs our server and its backups in Nuremberg, Germany;
- Cloudflare, which carries all traffic to the site, protects it, and forwards e-mails sent to info@mobility1-europe.com;
- Google, whose Gmail receives the e-mails Cloudflare forwards;
- Brevo, which sends the site's e-mails;
- Stripe Payments Europe (Ireland), our payment provider, and our bank, for payments and refunds;
- our own bookkeeping system, which we keep with the help of Claude, the AI assistant of Anthropic, for our invoices. Claude also helps us run the site.
The tax authority, through our invoices and tax returns, as the law requires, and other authorities only where the law obliges us.

Data sent outside the EU

Our server and its backups are in Germany, with Hetzner. Brevo, which sends our e-mails, is a French company. Cloudflare, a US company, handles traffic to the site in its data centres around the world, so some of your data is processed outside the European Union, by Cloudflare and only for the purposes in this notice.

How long we keep it

Server records of visits: 14 days.
Backups of the database and files: 14 days.
Your account details: as long as your account is open.
Records of offers, reservations, payments, refunds and sales: the site cannot change or delete them, because they are our evidence and our books.
Tax records, such as our invoices: as long as Dutch tax law requires.
Reports about a vehicle, with our decision: two years after the decision.
A link to choose a new password works for 2 hours.

How we protect it

The site works only over an encrypted connection (HTTPS).
Passwords are stored as one-way hashes and need at least 10 characters. The sign-in, sign-up and password forms limit how often one visitor can try.
Company documents are stored without a public link and open only for signed-in Mobility1 staff. Vehicle photos show only while the vehicle is on the site.
Public vehicle pages show only the town and the last four characters of the chassis number. The yard and the full number appear only to the reserving buyer, the seller and our team.
Pages with your personal details are never stored in shared caches.
Two different people check every dealer and every payout account, and a second person records every refund.
Records of offers, payments and changes cannot be edited or deleted.
The server accepts no password logins, and its backups can be read only by its administrator.

Your rights

Under the GDPR, the European Union's data protection law, you may:

be told how your data is used: this notice;
get a copy of your data;
have wrong or incomplete data corrected;
have data deleted that we no longer need, or that we keep without a good reason;
object to our use of your data where we rely on our legitimate interest;
ask us to restrict its use, for example while we check a correction;
receive your data in a common, machine-readable format, or have it sent to another company;
withdraw your consent wherever we rely on it;
not be subject to a decision based only on automated processing;
refuse the use of your data for direct marketing, which we do not do.

To use a right, e-mail info@mobility1-europe.com from the address on your account, or tell us how we can check that it is you. It is free, and we answer within the time the law sets. Where the law makes us keep a record, such as a tax invoice, we keep it for the time required and tell you so.

Decisions made by rules

A person on Mobility1's team answers every offer; we never accept an offer automatically. Some steps follow fixed rules that are the same for everyone: the first payment to arrive reserves a vehicle; an offer or counter-offer that is not answered within 24 hours closes; and a reservation ends if the dealer has not confirmed the price by the end of the working day after its 72 hours. We do not profile you.

Children

Accounts are for registered businesses. We do not knowingly keep data about children.

Complaints

Please tell us first: info@mobility1-europe.com. You may also complain to a data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.

Changes to this notice

When this notice changes, we publish the new version here, with its date. The notice is in Dutch and in English; the Dutch text prevails.