Draft version 2026-09-06 · legal review incomplete
Privacy notice
This notice explains what CarPacta processes, why it is processed and what choices you have. It is a pre-launch draft, not an approval by a lawyer or data protection officer.
1. Controller identity
UAB IT prekyba, registration number 304025865, Kampo skg. 3, LT-25111 Lentvaris, Trakų r. sav., Lietuva. Privacy contact: privatumas@carpacta.lt.
2. Data, purposes, legal bases and retention
Account and security: name, email, consent history, sessions and security events, used to perform the service and protect accounts. Authentication data is retained only under the approved security schedule.
Vehicle and transaction record: VIN, registration details, mileage, disclosures, photos, videos with sound, documents and party actions, used to perform the requested service and preserve a verifiable record. An active transaction record is kept while the account remains active. An archived record is kept for at least 3 years from archiving; an existing longer package or legal retention term is never shortened. Expiry only starts an administrative review and does not trigger automatic deletion. These periods remain subject to final legal approval.
Buyer access request: the prospective buyer’s name, email, phone number, language, consent timestamp and a hashed IP address are used to pass the request to the seller, invite an approved buyer and prevent abuse. Encrypted contact data for an unapproved request is deleted after 30 days. Once approved, the buyer becomes a transaction participant and the transaction-record retention period applies.
Payments: order, amount, currency, status and provider reference for contract and accounting obligations. CarPacta does not store the full card number.
Support, claims and technical logs: messages, attachments, actions, hashed IP information and device data, retained only as long as justified for support, security, legal claims and mandatory obligations.
3. Sources and recipients
Data comes from you, another authorised case participant, an invited reviewer and, only after a lawful provider agreement, an identified external source. Access is limited to authorised participants, staff with a documented need and contracted infrastructure, email, payment, identity or signing processors.
4. Automation and AI
The support assistant may draft general information. It must not decide legal responsibility, determine a vehicle fault from sound or make a decision producing legal or similarly significant effects. A person can review legally or financially significant matters.
5. Cookies and browser storage
Necessary technologies provide and protect a service you request: account sessions (up to 30 days), temporary Google sign-in state (up to 10 minutes), language choice (up to 12 months), a dismissed region suggestion (up to 30 days), the consent record (up to 6 months), support-chat continuity and recovery of an upload you started. Separate consent is not requested for these uses.
With optional consent, CarPacta may remember a dismissed app-installation prompt for 30 days and use Google Analytics for aggregate page-traffic statistics. We do not send account identity, form contents or URL query parameters, and advertising profiling is disabled. Functional and analytics consent can be controlled separately; “Allow analytics” and “Necessary only” are equally accessible, and the Settings control lets you withdraw or change the choice at any time. Google Analytics may set _ga and _ga_* cookies for up to two years after consent.
6. Your rights
Depending on the legal basis, you may request access, correction, deletion, restriction, portability or object to processing. Consent may be withdrawn where processing relies on it. Records needed for another party’s legal claims or mandatory obligations may not always be erased, but your position can be recorded separately.
7. Security, incidents and international transfers
CarPacta uses access controls, administrator MFA, encryption of sensitive fields, malware scanning, checksums, an audit chain and encrypted backups. No system can promise absolute security. Where required, a personal-data breach is reported to the supervisory authority without undue delay and, where feasible, within 72 hours. EEA infrastructure is preferred; any transfer outside the EEA requires a documented transfer mechanism and supplementary safeguards before activation.
Contact privatumas@carpacta.lt or complain to the Lithuanian State Data Protection Inspectorate. This draft is based on the GDPR. Retention periods, legitimate-interest assessments, processor agreements and the DPIA still require professional approval before commercial launch.