Privacy Policy

1. Data controller

The controller for personal data collected via garageforall.be is:

• Osmonov Muratbek, personne physique
• 1457 Walhain, Belgique
• Contact: support@garageforall.be

For the publisher's status and the service's legal status, see the Legal Notice.

2. Categories of data collected

• Account identifiers: email address, name, password (hashed), optional phone number.
• Vehicle data: make, model, year, plate, VIN, mileage, roadworthiness inspection and circulation tax dates, photos and documents you upload.
• Maintenance history: events (services, inspections, invoices, insurance premiums), parts installed, intervention reports.
• Transaction data: bookings, quotes, invoices issued by partner garages via the platform, payment methods (no card data — not stored by the service).
• Technical data: session cookies (authentication), IP address at the time a quote is approved (retained for evidentiary purposes), user agent.

3. Purposes and legal bases (Art. 6 GDPR)

4. "Ledger" model — data attached to the vehicle

A vehicle's technical information (maintenance events, documents, ownership history, approved quotes) is attached to the vehicle itself, not to your personal account. This means:

• The history persists across ownership changes: when a vehicle is resold, the history stays attached to the vehicle and remains viewable by the new owner.
• Recorded events and approved quotes are append-only: once recorded, they can be neither deleted nor modified. Corrections are made by adding a corrective event.
• When you delete your account, the vehicle's technical history remains in place, but the link to your personal identity is severed (anonymisation).

This architecture answers a legitimate need — a vehicle can lose its resale value if its service book disappears at every change of owner. Approved quotes also carry quasi-contractual value under Belgian law.

5. Retention period

6. Recipients

Your data is processed by:

• The service publisher (Osmonov Muratbek) for platform administration.
• Vercel Inc. (United States) — application hosting.
• Neon Inc. — database, servers located in the European Union (Frankfurt).
• Partner garages — only for their own customers (garages see the vehicles for which a booking was created with them, or for which you have explicitly granted them access).
• Where applicable: email and SMS delivery providers to notify reminders and confirmations (processors).
• Sentry (Functional Software, Inc.) — technical error monitoring, to detect and fix malfunctions of the Service. The data sent (error message, technical trace, URL, IP address, browser) is stored on servers located in the European Union. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

No data is sold, rented, or shared for advertising or third-party profiling purposes.

7. Transfers outside the EU

Application hosting is provided by Vercel Inc. in the United States. The transfer is governed by the European Commission's Standard Contractual Clauses (SCCs) (decision 2021/914) and by the terms of the Data Processing Addendum published by Vercel.

The database, by contrast, is hosted in the European Union (Frankfurt, via Neon) — no transfer outside the EU for persistent content.

8. Your rights (Art. 15-22 GDPR)

You have the following rights:

• Access to data concerning you (Art. 15).
• Rectification of inaccurate data (Art. 16).
• Erasure (Art. 17) — see the "Account deletion" paragraph below.
• Restriction of processing (Art. 18).
• Objection to processing based on legitimate interest (Art. 21).
• Portability (Art. 20) — on request at support@garageforall.be (manual JSON export at this stage).

Account deletion (Art. 17)

You can delete your account directly from /me/settings, "Sensitive zone" section. For security reasons, deletion requires email confirmation (link valid for 24 hours).

Concretely, upon deletion:

• Your personal identifiers (email, name, phone, password) are anonymised immediately and irreversibly.
• Your active sessions on the device used to confirm are closed. Active sessions on other devices expire within a maximum of 30 days (token lifetime).
• Your active ownership links on vehicles are closed as of the deletion date; prior ownership history remains attached to the vehicle in anonymised form.
• The vehicle's technical history (events, documents, quotes, bookings) remains in place to preserve the value of the service book and to comply with accounting obligations (VAT Code — see §5).
• Invoices and approved quotes retain their content (numbers, dates, amounts, line items) for 7 years, without your name appearing.
• The original email address is released and may be reused to create a new, separate account.

Restriction: if you are the sole active owner of a partner garage, deletion is blocked until the garage is transferred or deactivated. Contact support for the manual transfer.

9. Cookies

The service uses only strictly necessary cookies: session cookie (authentication), CSRF cookie, acceptance preference cookie. No advertising cookie, no browser fingerprinting.

In addition, analytics tools (Vercel Analytics, Microsoft Clarity) are loaded only after your explicit acceptance via the consent banner. Declining leaves the service fully functional.

You can change or withdraw your choice at any time:

10. Changes to this policy

Any substantial change is published on this page with a new update date. Changes affecting your rights are communicated by email to users with an active account at the time of the change.

11. Complaint

If you believe your rights are not being respected, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA), rue de la Presse 35, 1000 Brussels — autoriteprotectiondonnees.be.