Privacy policy

1. Who is responsible

Inkooptrader Nederland is responsible for processing personal data for its website and platform service. Our business and contact details are shown above. Email us with privacy questions or requests.

2. Data and sources

For sellers, we process details including name, email address, telephone number, address, language preference, vehicle information, registration number if supplied, photographs, descriptions, submission status and recorded confirmations. We receive these details from you or someone submitting a vehicle on your behalf.

For dealers, we process business and contact details, Chamber of Commerce and VAT information, account and registration data, preferences, bids, agreements and notification settings. We may also receive business contact details from supplied business lists, public business websites and business registers. The source is recorded where available.

A supplied registration number may be checked against RDW Open Data for vehicle information. For address completion, the postcode, house number and any suffix are sent to PDOK/BAG. These lookups pass through our server. You can correct inaccurate information and enter your address manually.

For security and technical operation, we process data including session information, technical request data and audit records of important actions. Passwords are stored as secure hashes; we do not store readable account passwords.

3. Purposes and legal bases

We assess submissions, list vehicles, process bids, record acceptance and send necessary messages to provide the service you request or take steps towards an agreement at your request. This also covers account administration and questions about an ongoing submission.

We may have a legitimate interest in security, fraud prevention, an auditable bidding process and processing business contact details. We consider necessity and your privacy interests. You may object to this processing. Public availability of contact details does not itself constitute consent to unsolicited advertising.

We process data that we must retain or disclose by law on the basis of that legal obligation. Where consent is required, we request it separately for a clear purpose. You may withdraw consent without affecting the lawfulness of processing before withdrawal.

Operational messages about your submission, account security, offer and purchase confirmation form part of the service. Dealers can change auction notification preferences or unsubscribe using the link in those messages. This does not disable necessary transaction or security messages.

4. Who receives data

Approved dealers receive the information needed to assess the vehicle and bid. In the normal dealer portal, your seller-profile name, email address, telephone number and address are not shown to dealers before acceptance. Information you include in photographs or free text may nevertheless be visible.

After acceptance, the buyer and seller receive the identification, contact, vehicle and transaction information needed to perform their purchase agreement. The buyer processes received information for the transaction and statutory records and also has its own privacy responsibilities.

We use hosting, technical administration and email providers that may process data for those tasks. Authorised staff and contracted administrators receive access for their work only. Data may also be disclosed to an adviser or competent authority where necessary and lawful. We do not sell personal data to advertising companies.

Processing by a provider outside the European Economic Area requires the safeguards prescribed by the GDPR, such as a valid adequacy decision or applicable standard contractual clauses with additional measures where needed. You may request information about the recipients and safeguards from us.

5. Retention

We do not retain personal data longer than necessary for its purpose. For submissions that do not result in a purchase, necessity is assessed against completion of the submission, ongoing correspondence and a specific dispute or need for evidence. Unnecessary photographs and contact details should then be deleted or anonymised.

Account details are needed while the account and any outstanding obligations remain active. For inactive business contacts, we consider whether there is still a current business relationship. After unsubscribing, a minimal suppression record may be retained to respect your choice.

Bids, accepted agreements and relevant correspondence may remain necessary for completion, establishing rights or an ongoing dispute. Basic tax records are generally subject to a statutory retention period of 7 years; this does not justify routinely retaining every photograph, rejected submission or contact detail for that period.

Logs and backups are retained only as needed for security, recovery and accountability. Deletion requests are also taken into account when restoring a backup. You may ask which retention period or assessment applies to your data.

6. Cookies and language preference

The renewed platform uses functional storage for login and your language choice. The gns_session cookie supports a logged-in session and lasts 15 minutes, which may restart when the session is renewed. The itn_language cookie remembers your language choice for up to one year. The same preference may be stored in your account.

These functions are not used to track you across other websites for advertising. You can delete or block cookies in your browser; login and language preferences may then work less effectively. Any future non-essential tracking will require prior consent where applicable.

7. Your rights

You may request access, a copy, correction, deletion or restriction of your personal data. Where the law provides, you may request data portability, object to processing or withdraw consent. Not every right applies in every situation; for example, a statutory retention obligation may limit deletion.

Email your request with enough information to locate your data. We may ask for a proportionate identity check, but do not routinely request a complete copy of your identity document. We normally respond within one month. If a lawful extension is necessary, we explain the reasons and duration within that month.

If you are dissatisfied with the processing of your personal data, you may complain to us and may also contact the Dutch Data Protection Authority directly.

8. Automation, security and changes

Auction notification matching and bid processing are partly automated using vehicle data, preferences and bid amounts. Submission is not an automatic sale: the seller decides whether to accept. You can request human review if you have questions about an outcome.

We use measures including an encrypted connection, access controls and hashed passwords. No system can guarantee absolute security. Report suspected misuse promptly and do not send passwords by email.

We update this policy when the service or processing changes. The version date is shown above. Material changes are communicated separately where necessary. This policy is not a request for blanket consent to every processing activity.