Privacy policy

Manstory Cars takes the careful handling of your personal data seriously. This privacy policy explains which data we collect, why we do so, and how long we keep it. It has been drafted in line with the EU General Data Protection Regulation (GDPR).

1. Data controller

Manstory Cars, registered at Keurmeesterstraat 37, 1187 ZX Amstelveen (the Netherlands), is the controller responsible for the processing of your personal data via our website and our services. For privacy queries, please reach us at Manstorygroup@gmail.com or by phone on +31 20 213 00 01.

2. What data do we process?

Depending on your interaction with us, we process:

• Contact details - name, email address, phone number and the subject of your message (via the contact form or WhatsApp/email)
• Vehicle and transaction data - details of your search brief, preferred specifications, and - for purchase, import or consignment - number plate, mileage, name and address, identity verification where legally required
• Financial details - only where relevant for a purchase, consignment or import (IBAN, payment reference). We do not store payment data on the website.
• Website data - pages visited, anonymised IP address, browser type. We do not use tracking cookies.

3. Purposes and legal bases

We process your data for the following purposes:

• Responding to your enquiry and performing any resulting agreement (basis: performance of contract and pre-contractual measures)
• Handling a purchase, import or consignment including RDW and BPM procedures (basis: performance of contract and legal obligation)
• Meeting tax and administrative retention obligations (basis: legal obligation)
• Improving our service and website (basis: legitimate interest)

4. Retention periods

We do not retain your data longer than necessary. Specifically:

• Contact enquiries without follow-up: up to 12 months
• Customer files (after purchase, import or consignment): 7 years, in line with the Dutch fiscal retention obligation
• Identity data from the mandatory AML check: 5 years after the relationship ends, in line with the Dutch Wwft

5. Sharing with third parties

We only share your data with parties necessary for the performance of our service: the Dutch RDW and tax authority (mandatory registration and BPM filing), transport partners (only the name/address data needed for delivery), our hosting partner, and - only at your explicit request - financing or insurance partners. We have a data processing agreement in place with each of these parties where applicable. We never sell your data.

6. Cookies

Our website does not use tracking or advertising cookies. We only set functional cookies needed for the website to operate (for example, remembering your language preference). Functional cookies do not require consent.

7. Your rights

Under the GDPR you have the right to:

• Inspect the data we hold about you
• Have incorrect data corrected
• Have data erased (insofar as we do not have a legal retention obligation)
• Restrict processing or object to processing
• Receive a copy in a structured and commonly used format (right to data portability)
• Withdraw consent at any time, without affecting the legality of earlier processing

You can exercise these rights via Manstorygroup@gmail.com. We respond within one month. If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

8. Security

We take appropriate technical and organisational measures to protect your data against loss, unauthorised access or misuse. Our website is served over HTTPS, and access to customer files is limited to staff who need it for their role.

9. Changes

We may amend this privacy policy from time to time, for example when legislation changes. The current version is always available on this page. We communicate substantial changes proactively to existing customers.