Privacy notice

A & D Euroservice Limited (“Euroservice”, “we”), company no. HE 124733, Sisyfou 10, 3075 Limassol, Cyprus, is the controller of the personal data described in this notice.

For questions and requests about your data, write to enquiries@euroservicecy.com or to the address above. We have not appointed a data protection officer.

When you send an enquiry (the contact form, Find My Car, an enquiry about a vehicle, or a call, WhatsApp message or e-mail), we use what you give us: your name, your phone number, your e-mail address if you add one, your message and, for a sourcing request, the car you want, your budget, when you need it, where to search, your delivery preference and any advert link. The form also records the page it was sent from, the language you used and the time.

We use this to answer you, to find and quote a vehicle, and to arrange a viewing, a workshop visit or a delivery. Legal basis: the steps you ask us to take before a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries and keeping an orderly record of them (Article 6(1)(f) GDPR).

An enquiry does not place an order and does not sign you up to anything. We do not send marketing e-mails or messages, and this website does not ask for marketing permission. If we ever want to send you marketing, we will ask you first, and you can say no.

If you go on to buy a vehicle, we process the data needed for the quotation, the order agreement, the invoice, the import, customs clearance and registration: your identity and address details, the vehicle’s details and the payment records. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legal obligations under tax, accounting, customs and vehicle-registration law (Article 6(1)(c) GDPR). These steps take place under the written quotation and order agreement, not on this website.

Servicing and repairs are provided by the associated family workshops. If we pass your request to a workshop, we share your name, your contact details and what your vehicle needs.

To keep the forms working for real customers, we limit how many messages one connection can send and we check for automated software:

• Each saved enquiry carries a keyed code derived from your connection address (an IPv4 address or an IPv6 network). It is used only to count messages per connection and is deleted after 24 hours.
• The forms use Vercel BotID, an invisible check provided by our hosting provider, Vercel, with its partner Kasada. When you send a form, your browser runs a short script that reads technical characteristics of the browser and device and sends them with your message, so that Vercel and Kasada can judge whether a person or automated software sent it; we receive only the result. The providers also use these signals to improve their detection service. The check sets no cookie and stores nothing in your browser.
• A message that looks automated (a hidden field that people never see has been filled in, or the check reports automated software) is held for a person to review, not lost. A message sent unusually fast, or repeating contact details sent shortly before, is delivered to us but marked for a second look. More than five messages from one connection in an hour are held; only extreme volumes are refused, and a refused visitor keeps their text and is shown our e-mail address.
• Our hosting provider records each request to the website (IP address, time, page and browser type) in server logs for security and troubleshooting, for a short period.

Legal basis: our legitimate interest in the security and proper operation of the website (Article 6(1)(f) GDPR).

We show photographs of delivered vehicles and customer testimonials only with the customer’s written permission, which can be withdrawn at any time by contacting us. On withdrawal the photographs are taken down and deleted from storage. What we keep afterwards is a minimal record of the permission and of its withdrawal: who gave it, when, for what, where the signed form is kept, and when it was withdrawn. Legal basis: consent (Article 6(1)(a) GDPR).

We use service providers that process data on our instructions:

• Vercel Inc. (USA) hosts the website: its server functions run in Frankfurt, Germany, and static pages and images are delivered from Vercel’s network worldwide. Vercel keeps the server logs, provides the BotID check and stores uploaded photographs.
• Neon Inc. (USA) hosts the database in Frankfurt, Germany, where enquiries and the website’s other records are kept.
• Resend Inc. (USA) sends each enquiry to our mailbox as an e-mail from its Ireland region, on Amazon Web Services, and keeps a delivery log.
• SiteGround hosts our e-mail mailbox and filters incoming mail for spam.
• If you message us on WhatsApp, WhatsApp (Meta Platforms Ireland Limited) processes that conversation under its own terms and privacy policy.

When you buy a vehicle, we also share what is necessary with the seller or supplier of the vehicle, shipping and customs agents, the vehicle-registration authorities, our accountant and, where needed, our legal advisers; and with the associated workshops for servicing. We do not sell personal data and we do not share it with advertisers.

We choose European regions where our providers offer them: Frankfurt for the server functions and the database, Ireland for e-mail. Some of our providers are companies based in the United States and may process some technical or support data outside the European Economic Area. Such transfers rely on the European Commission’s Standard Contractual Clauses or on an adequacy decision, as set out in each provider’s data processing terms.

• Enquiries that do not lead to a purchase, including quotations that are not taken up: deleted no later than 12 months after our last contact with you.
• Messages held as likely automated: reviewed and deleted within 3 months.
• Accepted quotations, order agreements, invoices and the documents of a purchase, import and registration are accounting records: we keep them for at least six years, counted as Cyprus tax law requires from the later of the due date and the filing date of the tax return (or revised return) for that year, and, if a tax audit begins in the final year of that period, until the audit is completed or one year from its start, whichever is earlier.
• The minimal record of a photograph or testimonial permission and of its withdrawal: for as long as the material is shown and for no longer than six years after it was taken down, so that we can show that the permission existed.
• Connection codes used to count messages: 24 hours. Server logs: a short period set by the hosting provider.

We delete enquiries and their e-mail copies by hand, in a monthly review, not automatically. A record is kept beyond these periods only where a transaction, a dispute or a legal obligation requires it, and the reason is noted.

You can ask for access to your data, for correction, erasure or restriction, and for a copy in a portable format, and you can object to processing based on our legitimate interests. Where processing rests on consent (photographs and testimonials), you can withdraw it at any time; this does not affect what was done before. Write to enquiries@euroservicecy.com; we answer within one month. You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).

The website is served over HTTPS. The administration area is restricted to staff with a login. Customer photographs are kept in private storage and are served by the website only while permission stands.

This website is not aimed at children, and we do not knowingly collect data from anyone under 18.

We will post any change to this notice on this page, with a new date.