Privacy Policy

This policy explains what personal data Rosso Registry collects, why, and what rights you have under the GDPR. Rosso Registry is the data controller for the marketplace.

What we collect. Account data (name, email, password hash, language), activity you create (favourites, saved searches, enquiries, listings for dealer accounts), business data for dealer accounts (company name, registration number, address, contact details), and technical data (IP address, device and browser, pages viewed, listing views and contact clicks).

Why, and on what basis. To provide the service and your account (contract). To pass your enquiry to the selling dealer, who then becomes an independent controller of that message (contract). To keep the marketplace safe, prevent fraud and produce aggregated statistics for dealers about their own listings (legitimate interest). To measure how the site is used beyond what is strictly necessary (consent — see the cookie policy). To meet accounting and legal obligations (legal obligation).

Who sees it. The dealer you contact, and the processors that run the platform for us: hosting and database, email delivery and, when paid plans start, the payment provider. Processors act on our instructions only. We never sell personal data.

How long. Account data for as long as the account exists and then up to 12 months. Enquiries for up to 24 months so both sides can document the contact. Invoicing data for 7 years where accounting law requires it. Aggregated statistics that cannot identify you are kept without limit.

Transfers. Data is stored inside the EU/EEA. Where a processor needs access from outside, it is covered by the European Commission's standard contractual clauses.

Your rights. Access, correction, deletion, restriction, objection, portability, and withdrawal of consent at any time. Much of this you can do yourself in account settings; otherwise write to support@rossoregistry.com and we answer within 30 days. You may also complain to your national data protection authority.