Privacy Policy
Last updated: 1 January 2025
1. Who we are
Karozza.com ("Karozza", "we", "us", "our") is an online vehicle marketplace operated from Malta. We are the data controller for personal data collected through our website. For data protection enquiries, contact us at privacy@karozza.com.
2. What data we collect
Account data
When you register, we collect your name, email address, phone number (optional), and password (hashed). For dealers, we also collect business name, address, and website.
Listing data
Vehicle details, photos, videos, price, and location you provide when creating a listing.
Usage data
Pages visited, search queries, listing views, and interaction data collected through standard server logs and analytics.
Communications
Messages you send via our enquiry forms and contact page.
Payment data
We do not store payment card details. Payments are processed by Stripe, who are the data controller for payment information.
3. How we use your data
- To provide and improve the Karozza service
- To process your listings and facilitate buyer–seller contact
- To send transactional emails (enquiry notifications, booking confirmations)
- To process payments for listing upgrades and subscriptions
- To comply with legal obligations under Maltese and EU law
- To detect and prevent fraud and abuse
Legal basis: Processing is based on contract performance (to provide the service you requested), legitimate interests (security, fraud prevention, service improvement), and — where required — your explicit consent.
4. Data sharing
We do not sell your personal data. We may share data with:
- Stripe — payment processing
- Resend — transactional email delivery
- Cloudflare — hosting, CDN, and infrastructure
- Anthropic — AI image analysis (no personal data is sent)
- Law enforcement or regulatory bodies when required by law
5. Data retention
Account data is retained for as long as your account is active, plus 3 years after closure for legal compliance purposes. Listing data is retained for 5 years after the listing expires or is deleted. You may request earlier deletion (see Section 7).
6. Cookies
We use cookies for session management (essential), analytics, and advertising preferences. See our Cookie Policy for full details.
7. Your rights under GDPR
As an EU/EEA data subject, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure ("right to be forgotten")
- Object to or restrict processing
- Data portability (receive your data in a machine-readable format)
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, email privacy@karozza.com. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.
8. Security
We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but take all reasonable steps to protect your data.
9. Changes to this policy
We may update this policy from time to time. We will notify registered users of significant changes by email. The "last updated" date at the top of this page will always reflect the most recent version.