Privacy policy
Last updated: 20 September 2026
Data controller
CarPlay Auto SRL, Rue Van Soust 33 bis, 1070 Anderlecht (Brussels), company number 1038.463.885, is the controller of your personal data.
Contact for any question about your data: contact@carplayauto.be
Data we collect
| Category | Data concerned | Source |
|---|---|---|
| Identity and contact | Surname, first name, postal address, email, phone | You |
| Vehicle | Make, model, year, trim level, photo of the interior | You |
| Orders | Purchase history, amounts, invoices | Website / workshop |
| Appointments | Date, service booked, history | Booking tool |
| Payment | Amount, method, transaction status | Payment provider |
| Technical | IP address, device type, browser, pages viewed | Automatic |
| Communications | WhatsApp messages, emails, contact forms | You |
We never collect your full bank card numbers: they are processed directly by our payment provider.
Why we process them, and on what basis
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Processing your order and delivering it | Performance of the contract — art. 6.1.b | Duration of the relationship + legal periods |
| Managing your installation appointment | Performance of the contract — art. 6.1.b | Duration of the relationship + legal periods |
| Checking your vehicle's compatibility | Performance of the contract — art. 6.1.b | Duration of the warranty |
| Providing after-sales service and the warranty | Performance of the contract and legal obligation | At least 2 years after the sale |
| Issuing and keeping invoices | Legal obligation — art. 6.1.c | 10 years (tax obligation; 7 years under accounting law) |
| Preventing fraud, securing the website | Legitimate interest — art. 6.1.f | 12 months |
| Sending our newsletter | Consent — art. 6.1.a | Until consent is withdrawn |
| Audience measurement and targeted advertising | Consent — art. 6.1.a | See the cookie policy |
Who has access to your data
Your data is never sold. It's shared only with the providers needed for our business, who act as processors and are bound by confidentiality:
- Shopify — hosting the shop and processing orders
- Shopify Payments — processing card, wallet and Bancontact payments
- Carrier — DPD, via the Sendcloud shipping platform
- Booking tool — Trafft, for managing appointments
- WhatsApp (Meta) — when you write to us through this channel
- Measurement and advertising tools — only after your consent, see the cookie policy
- Accountant and advisers — only to the extent needed for our legal obligations
We may also be required to disclose data to the authorities when the law requires it.
Transfers outside the European Union
Some of our providers, including Shopify and Meta (WhatsApp), may process data outside the European Economic Area. These transfers are governed by the mechanisms provided for by the GDPR: standard contractual clauses of the European Commission, or an adequacy decision where the destination country benefits from one.
Your rights
You have the following rights at any time:
- Access — obtain a copy of the data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion, within the limits of our legal obligations
- Restriction — request that a disputed processing be put on hold
- Objection — object to processing based on our legitimate interest
- Portability — receive your data in a structured, machine-readable format
- Withdrawal of consent — at any time, without affecting the lawfulness of prior processing
To exercise these rights, write to us at contact@carplayauto.be. We reply within one month, which may be extended by two months if the request is complex. Proof of identity may be requested if there is reasonable doubt about your identity; it is destroyed immediately after verification.
Complaints
If you believe your rights are not being respected, you can lodge a complaint with the Data Protection Authority:
- Rue de la Presse 35, 1000 Brussels
- Phone: +32 2 274 48 00
- Email: contact@apd-gba.be
- Website: dataprotectionauthority.be
Security
We implement appropriate technical and organisational measures to protect your data: encrypted connection (HTTPS), access restricted to authorised people, providers selected for their level of security. As no system is infallible, we will inform you and notify the Data Protection Authority in the event of a breach posing a risk to your rights, in accordance with the GDPR.
Updates
This policy may be amended. The applicable version is the one published on this page. Last updated: 28 September 2026