Privacy Policy

1. Who we are and how to contact us

Car Dealers EU and AI Video Editor are operated by HK-ENTERPRISE, poslovno svetovanje, d.o.o., a limited liability company established in Slovenia. The operator is the controller responsible for the personal data processing described in this policy.

Legal entity name

HK-ENTERPRISE, poslovno svetovanje, d.o.o. (short name: HK-ENTERPRISE d.o.o.)

Postal address

Zaloška cesta 275A, 1000 Ljubljana, Slovenia

Country of establishment

Slovenia

Business registration number

9776931000

VAT identification number

SI83555277

Privacy contact email

carmarkethk@gmail.com

2. What data we collect and why

Email subscriptions and applications

We collect your email address and, where you provide it, your name through our opt-in forms. We use these details for Car Dealers EU newsletters and onboarding emails, with Brevo storing website opt-ins and supporting email delivery. Kit is also used for existing email campaigns.

Legal basis: your consent under Article 6(1)(a) GDPR. Subscribing is voluntary. You can withdraw consent using the unsubscribe link in every email or by contacting us. Withdrawal does not affect processing that was lawful before you withdrew consent.

Some application forms redirect to Skool and may include your email address in the signup link. Submitting an email form does not by itself create a paid membership.

Membership

Car Dealers EU offers a paid community on Skool at $30 per month. Skool handles member accounts and payments under its own privacy policy. We use membership information made available to us to provide and manage access to the community.

Legal basis: performing the membership contract or taking steps you request before entering it, under Article 6(1)(b) GDPR. The account and payment information Skool requires is needed to create and maintain a paid membership.

Website delivery and security

The website is hosted on Vercel. Delivering pages and securing the service involves technical request information, such as IP addresses, requested URLs and browser information. The backoffice also uses an administrator session token and IP-based login-attempt controls.

Legal basis: our legitimate interests in operating a reliable website, preventing unauthorised access and protecting the service, under Article 6(1)(f) GDPR.

Video players and tools

YouTube and Vimeo receive technical connection and playback information when their embedded players load or are used. Some dealer tools save your preferences, checklist progress or listing draft in your own browser. See sections 3 and 4.

[TO CONFIRM: legal basis and consent requirements for embedded video players and optional browser storage under the applicable local rules.]

Google user data handled by AI Video Editor is described separately in section 5.

3. Third-party processors and services

We use the following providers. Their role depends on the service: a provider may process data on our instructions and may also act as a separate controller for its own account, platform or legal purposes.

• Vercel: website hosting, delivery and related technical processing. Vercel Privacy Notice.
• Brevo: storage of website opt-ins and delivery of emails. Brevo Privacy Policy.
• Kit: storage of email subscription details and delivery of newsletters and onboarding emails. Kit Privacy Policy.
• Skool: community accounts, membership and payments. Its own policy covers its handling of this information. Skool Privacy Policy.
• YouTube / Google: embedded videos use youtube-nocookie.com, YouTube’s privacy-enhanced player domain. Privacy-enhanced embedding does not mean that no data is sent to Google when the player is used. Google Privacy Policy.
• Vimeo: the HK Story page contains a Vimeo player that loads automatically, with autoplay enabled. Vimeo privacy information.
• Google: Google Drive and OAuth authorisation for the internal AI Video Editor tool, as described in section 5. Google Privacy Policy.

Providers may process data outside the European Economic Area, depending on the services and account settings used.

[TO CONFIRM: processing locations, applicable processor agreements and subprocessors, and the transfer safeguards actually in place, including any adequacy decision or Standard Contractual Clauses and how to obtain a copy.]

4. Cookies and browser storage

The administrator area uses a strictly necessary cookie: cde_admin_session. It maintains a signed-in administrator’s backoffice session, expires after eight hours and is removed on logout. It is HttpOnly, uses SameSite=Strict and is marked Secure in production. It is not a marketing or analytics cookie.

No analytics cookies are used by the website’s own code. The code review found no configured Google Analytics, Meta Pixel, Microsoft Clarity, Plausible, PostHog or Stripe integration. A Vercel analytics package is present as a hosting-adapter dependency, but analytics is not enabled in the website configuration.

Optional dealer tools use browser storage: saved marketplace favourites, import-checklist progress and your Car Inspection checklist and notes stay on the device you use. The inspection checklist has no account and does not upload your observations. Records from the earlier inspection tool, if present, remain in the browser’s IndexedDB database. You can remove browser-stored information through the tool or your browser’s site-data controls. This storage is not used for cross-site tracking.

Wanted Cars stores the vehicle brief, reference photo, name, email and optional messaging contact you submit on the server. The direct-link tool currently has no membership login. A signed, essential ownership cookie recognises requests created in your browser for up to one year; other visitors cannot browse your requests through the tool. Clearing that cookie removes your ability to manage those requests from that browser. You can delete your own requests, or contact us if you lose access. Submitting a car search records your request for Car Dealers EU to review; it does not automatically publish it to social media, newsletters or a public website. The service uses short-lived request limits to reduce repeated submissions.

Embedded YouTube and Vimeo players are third-party services and may use their own cookies or other storage. The statement about our own analytics cookies does not describe those providers’ practices.

[TO CONFIRM: production-only tracking or hosting injections, the cookies and storage used by embedded video providers, and any consent controls required for the deployed configuration.]

5. Google user data: AI Video Editor

AI Video Editor is an internal tool used only by the operator’s own team. It uses Google authorisation to read, create, move and delete video files in the operator’s own Google Drive folder named “AI Video Editor Workspace”. The purpose is to organise and manage the team’s video-editing workflow.

The Google user data involved is the video-file content and related file information needed to carry out those operations. The tool is not offered to website visitors and does not connect to their Google Drive accounts.

• Google user data is not sold or shared with third parties.
• It is not used for advertising.
• It is not used to train AI models or sent to external AI services for model training.
• Data stored by the tool is stored only on the operator’s own editing computer. The source video files remain in the operator’s Google Drive unless moved or deleted as part of the authorised workflow.

AI Video Editor’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Team members can revoke the app’s access at any time through Google Account permissions. Revoking access prevents further authorised API access; it does not automatically delete files or local copies already stored. For deletion requests, contact the controller using the details in section 1.

[TO CONFIRM: the GDPR legal basis for team-member data, the exact OAuth scopes requested and whether technical permissions are restricted to the workspace folder.]

[TO CONFIRM: access controls and protection of the editing computer, storage and protection of OAuth credentials, and the procedure for deleting local Google user data and credentials on request or when access ends.]

6. How long we keep data

Retention depends on the purpose of the processing and any applicable legal requirements. The following operational periods and remaining details apply:

• Email subscriptions: you can unsubscribe at any time to stop marketing emails. [TO CONFIRM: contact-deletion schedule in Brevo and Kit and retention of consent records or any minimal unsubscribe-suppression record.]
• Membership: Skool applies its own retention policy to accounts and payments. [TO CONFIRM: which membership records the operator separately retains and their retention periods, including any required accounting records.]
• Security information: the admin cookie lasts up to eight hours; login-attempt rate limiting uses a 15-minute assessment window. [TO CONFIRM: actual deletion periods for login-attempt records and Vercel request or security logs.]
• Google user data: [TO CONFIRM: retention periods or deletion criteria for local video files, file information, credentials and any backups on the editing computer.]
• Browser-stored tool data: saved information persists until you remove it through the tool or your browser’s site-data controls.

7. Your GDPR rights

Depending on the circumstances and the legal basis for processing, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, or a portable copy of data you provided. You may object to processing based on legitimate interests, and you may object to direct marketing at any time. Where processing relies on consent, you may withdraw it at any time.

You also have rights concerning decisions based solely on automated processing that have legal or similarly significant effects. The website functions described here do not make such decisions.

To exercise your rights, use the privacy contact in section 1. We may need information to verify your identity. We will normally respond within one month; where the GDPR permits an extension, we will explain it.

You may complain to a data-protection supervisory authority, including in the country where you live or work or where an alleged infringement occurred. In Slovenia, the supervisory authority is the Information Commissioner of the Republic of Slovenia.

8. Changes to this policy

We will update this page when our data practices change and revise the date at the top. If Google user data would be used for a new purpose, we will provide notice and obtain any consent required before that new use begins.